Privacy Notice

1. Controller and contact

Premium Spanish Products BV, Rotterdamsedijk 45, 3112 AA Schiedam, Netherlands, registered with the Dutch Chamber of Commerce under KvK number 91062209 and VAT identification number NL865540160B01, is the controller for the iErasmus service unless a separate notice says otherwise. Contact privacy@ierasmus.app for privacy matters, support@ierasmus.app for service support, or +31 683 915 925 by telephone.

2. Data we process

Account and profile data, such as name, email, authentication provider, language, role, organizer details and profile image.
Event, saved-item, engagement and transaction data, including views, shares, map opens, interests, orders, refunds, ticket status and admissions.
Organizer billing and merchant-onboarding state from Stripe. Card details are handled by Stripe and are not stored as full payment-card data by iErasmus.
Door-team invitations, assignments and access history needed to protect events and validate tickets.
Academic profile details and agreement contributions you choose to provide.
Student-card information and protected images only where that optional feature is enabled and you choose to use it.
Approximate device location when you request nearby map results. The app asks for while-in-use permission, targets roughly 100-metre accuracy, and uses the coordinate to centre the map and calculate proximity.
Mobile telemetry data through Firebase Analytics, Performance, Remote Config and Crashlytics: app and screen opens, searches, filters, event interactions, account type, whether a university or degree is selected, app version, device language, performance traces, remote-configuration requests, crashes and sanitized errors. Crashlytics can receive the authenticated account identifier and active-screen context.
Messages and evidence you send when requesting support, reporting content or exercising rights.

3. Purposes and legal bases

Contract and requested steps: create accounts, publish events, issue and validate tickets, provide organizer plans, fulfil support and keep the service synchronized.
Legitimate interests: secure accounts, prevent fraud and abuse, diagnose failures, improve the service and defend legal claims, balanced against your rights. The final legal basis and any consent controls for Firebase analytics, performance and diagnostic operations must be confirmed before this draft becomes the final notice.
Legal obligations: accounting, tax, payment, consumer, safety and lawful-authority requirements.
Consent: only where a separate optional feature or non-essential storage requires it, such as an enabled student-card flow, optional marketing or non-essential cookies. Refusing optional consent does not block unrelated core service.

We use Supabase for authentication and application data, Cloudflare for hosting and protected file gateways, Stripe for subscriptions, ticket payments and merchant onboarding, Google and Apple for sign-in when selected, and Firebase Analytics, Performance, Remote Config and Crashlytics for the mobile telemetry described above. Organizers receive data needed to fulfil their events, tickets and refunds. Door staff receive only the event access needed for their assignment.

The primary Supabase project is currently configured in the eu-west-1 region. This does not mean every Supabase feature or every other provider processes data only in the EU. Google states that Firebase processing can be global, including the United States, and publishes Data Privacy Framework and DPA/SCC materials. Cloudflare and Supabase publish DPA/SCC materials. The operator still has to document which role, location and transfer safeguard applies to each activity; publication by a provider does not prove that a particular agreement has been accepted for this service.

Providers process data under their own and/or our instructions depending on the service. Data may be processed outside your country. Where GDPR requires safeguards for an international transfer, the responsible party must use an applicable mechanism. We do not describe all processing as EU-only.

5. Retention

We keep data only for a stated period or for as long as needed for the purpose, account, security, dispute or legal obligation. Financial, order, refund and admission records may remain after account or plan closure where required. See the Retention Policy for category-specific criteria.

6. Your rights

Depending on the law and circumstances, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier lawful processing. You may also complain to the Dutch Data Protection Authority or the competent authority where you live or work.

Send a request to privacy@ierasmus.app. We may verify identity and ask for information needed to locate the data. Under GDPR we normally respond within one month; where permitted, we may extend by up to two further months and will tell you within the first month why the extension is needed.

7. Choices and security

You can manage language, theme, profile, plan renewal and account deletion from the available settings. Provider sign-in, optional contributions and optional protected-card features remain separate choices.

We use access controls, per-account and per-event authorization, protected gateways and other technical and organizational safeguards. No internet service can promise absolute security; report suspected misuse promptly.

8. Updates

Material changes receive a new version and effective date. A new notice does not create retroactive consent or acceptance. Where law requires notice or consent, we will request it through an appropriate flow.