Privacy and about us

Erasmus Student Network (ESN) is a non-profit international student organisation. Our mission is to represent international students, thus provide opportunities for cultural understanding and self-development under the principle of Students Helping Students.

This site sets no analytics or tracking cookies. The only cookies are the login session used by board members and officers in the content admin.

The controller of the personal data on this site is ESN FINT ry (Erasmus Student Network Finns and Internationals in Tampere ry), a registered association in Tampere. We collect only what each feature below needs, use it only for that, and never sell or share it for marketing.

The gallery shows photos from our events. They come from the association's Google Drive, are watermarked, and have their camera data (location, device) removed. A photo in which people can be recognised stays hidden from the public until the people in it have agreed to it being published; until then only signed-in board members can see it. The board records who confirmed consent and when. The legal basis is your consent.

If you are in a photo and want it taken down, email us with a link to it. We delete it from the site and from our Drive, normally within a few days and at the latest within one month. You can withdraw consent at any time; it does not affect what was published before.

Quotes from students and the names and photos of board members and officers appear only after the person has agreed, and are removed when they ask.

Board members and officers sign in to the admin with their esnfint.org Google account. We store the name, email address and profile picture link from that account, Google's account id, the time of the last sign-in, and the groups an admin has put the person in. When someone signs in for the first time, the admins are told by email (with the address) and by notification (with the name only). Nothing from the account is shared further. The legal basis is the association's legitimate interest in running its website.

The admin has a shift calendar for the clubroom. Who has signed up for which shift is visible to everyone who can sign in, and only to them; it never appears on the public site. A shift and the names on it are deleted 30 days after the shift.

A signed-in person can turn on notifications for their shifts. The browser then gives us an address to send them to, which we store with the person's account until they turn notifications off on the same page, the browser cancels it, or the account is deleted. Notifications are sent through the browser's own push service (Apple, Google or Mozilla, depending on the browser); they carry the shift's date and time and first names, nothing more.

A signed-in person can also ask for the same shift news by email, and turn it off again on the same page; the choice is stored with their account. The messages go to the esnfint.org address they signed in with, through the association's own mail server, and carry the shift's date and time and first names, nothing more. Nothing is sent to anyone who has not asked for it.

Shifts nobody has taken and last-minute drop-outs are also posted to the board's own Telegram group, with first names. That group is run by the board under Telegram's terms.

The site and the admin can be added to a phone's home screen. Installing them stores nothing beyond what the browser already keeps, and a small offline page.

These companies store or carry data on our behalf, each only for the part listed:

• Vercel: hosts the site and the admin (servers in Frankfurt) and keeps short-lived technical logs.
• Neon: the database with accounts, shifts, consent records and site content.
• Cloudflare R2: storage for the photos and documents shown on the site.
• Google Workspace: sign-in, our email, the Drive the photos come from, and the officer application form.
• Telegram: the board's group, where open shifts and drop-outs are posted with first names.
• Apple, Google and Mozilla push services: deliver notifications to browsers that asked for them.

Shifts are deleted 30 days after they take place. An account that signed in but was never let in is deleted after 30 days. An account is deleted when the person leaves the board or asks, and its notification addresses and shift sign-ups go with it. Photos stay until someone asks for removal or the album is taken down.

You can ask what data we hold about you, have it corrected, have it deleted, object to its use, and withdraw any consent you gave. Email us and we answer within one month.

Questions about this site or your data: contact@esnfint.org

If you think we handle your data wrongly, you can also complain to the Data Protection Ombudsman: tietosuoja.fi

Clubroom C07b · Kalevantie 4 · 33014 Tampere University · students helping students