This is a placeholder draft, not a lawyer-reviewed GDPR-compliant privacy notice or Data Processing Agreement. It exists so the link from the login page resolves to real content instead of a 404. Erasmus+, ESC, and OFAJ mobility projects frequently involve participants who are minors — a real DPA and privacy policy, reviewed by counsel, is required before this notice can be relied on and before any organization's live participant data should be treated as covered by it.
Account data (name, email) for staff who sign in; organization, project, and budget records entered by your organization; participant records (name, and grant-relevant attributes such as distance band, fewer-opportunities status, and green-travel status) entered by your organization for mobility grant calculation and National Agency reporting; and receipts/documents uploaded as expense evidence.
Where a participant is a minor, your organization is responsible for obtaining any required parental/guardian consent before entering their data into the Service. OpsNGO acts as a data processor for organization-entered participant records — your organization remains the data controller for that data.
Each organization's data is isolated at the database level (row-level security) — staff at one organization cannot read another organization's projects, expenses, or participants.
Records are retained for the lifetime of your organization's account, reflecting the multi-year retention periods EU grant audits typically require. A formal retention schedule and deletion process will be documented following legal review.
Under GDPR, individuals whose data is held in the Service have rights of access, rectification, and erasure. Requests should be directed to the organization that entered your data, as they are the data controller; OpsNGO will assist that organization in fulfilling verified requests.
Questions about this policy, or a request for the Data Processing Agreement, can be directed to your OpsNGO point of contact.