← Back to Co-Erasmus

Privacy Policy

Last updated: 2 August 2026

This Privacy Policy explains how Co-Erasmus processes personal data when you visit the website, create an account, use the platform, or contact us.

Co-Erasmus is a peer-to-peer platform that helps mobility students find and coordinate short-term housing arrangements (for example rent, sublet, or room swap).

1. Controller

The controller responsible for the processing of personal data is:

Mootez Boughattas
Email: hello@co-erasmus.eu

If Co-Erasmus is later operated through a registered company, this section will be updated accordingly.

2. What personal data we collect

Depending on how you use Co-Erasmus, we may process the following categories of personal data:

  • Account data — identity and login details needed to create and manage your account (including Google sign-in data if you choose that option)
  • Profile data — information you provide about yourself, your mobility, and your organisation or university
  • Photos and documents — profile or room photos you upload, and student verification documents where requested
  • Housing / listing data — information about rooms you list, including location details
  • Mutual commitment data — personal details needed to generate an agreement when both parties confirm an arrangement (including contact details and exact addresses shared for that purpose)
  • Contact and inquiry data — information you submit through contact or partnership forms
  • Moderation data — reports and related records needed to review content and enforce our Terms
  • Technical data — such as IP address, browser and device information, and server logs

Exact private addresses are not shown publicly while browsing. Only an approximate location may be displayed. Exact addresses may be shared later when needed for a mutual commitment between the relevant users.

3. Purposes and legal bases of processing

a) Operating and securing the website

To make the website available, keep it secure, prevent misuse, and diagnose technical issues.

Legal basis: Article 6(1)(f) GDPR

b) Accounts, profiles, listings, and commitments

To register and authenticate you, manage your profile and room listings, support housing coordination, and generate mutual commitment agreements when both parties confirm an arrangement. If you use Google sign-in, we process the account information Google provides for authentication. Passwords for email accounts are stored in hashed form.

Legal basis: Article 6(1)(b) GDPR

c) Student verification

To verify student or mobility status, reduce fraud, and protect the integrity of the marketplace. Verification documents are reviewed by authorised Co-Erasmus administrators.

Legal basis: Article 6(1)(b) GDPR and, where applicable, Article 6(1)(f) GDPR

d) Inquiries and partnerships

To respond to contact forms and requests about pilots, partnerships, or institutional cooperation.

Legal basis: Article 6(1)(b) GDPR where the request relates to pre-contractual steps, otherwise Article 6(1)(f) GDPR

e) Moderation and safety

To review reports, enforce our Terms, prevent fraud or misuse, and protect users and the platform.

Legal basis: Article 6(1)(f) GDPR

f) Interactive maps

If you enable Maps, Mapbox processes technical data needed to provide map features. Maps are loaded only after you accept them in our cookie notice or a later maps prompt.

Legal basis: Article 6(1)(a) GDPR (consent), together with applicable ePrivacy rules

g) Legal obligations and claims

Where necessary to comply with the law or to establish, exercise, or defend legal claims.

Legal basis: Article 6(1)(c) GDPR and, where applicable, Article 6(1)(f) GDPR

4. Student verification and agreements

Student verification documents may contain identity-related information. Access is limited to authorised administrators. Please upload only what is needed for verification.

When both users mutually confirm an arrangement, Co-Erasmus may generate an agreement PDF with the personal details needed to document that commitment. The agreement is provided to the users concerned.

5. Recipients

We use service providers to operate Co-Erasmus. These may include hosting and database providers, Cloudinary (uploaded images and verification documents), Google (sign-in, where you choose that option), Mapbox (maps, when accepted), and email delivery providers.

Information you choose to show on your profile or listing may be visible to other users as part of the service. We may also disclose personal data if required by law or needed for legal claims.

6. Storage period

We keep personal data only as long as needed for the purposes described in this Privacy Policy, unless a longer period is required by law.

  • account, profile, and listing data — while your account or listing is active, and for a limited period afterwards if needed
  • student verification documents — for review and a limited period afterwards, then deleted when no longer needed
  • mutual commitment records — for as long as needed for the service and for a reasonable period for disputes or legal defense
  • contact inquiries and server logs — only as long as needed to handle the request or secure the service

If you ask us to delete your account, we will erase or anonymise data that is no longer needed, except where retention is required for legal, security, or dispute-related reasons.

7. Cookies and similar technologies

Details on cookies, local storage, and Mapbox are set out in our Cookies Policy.

8. International data transfers

Some providers may process data outside the EEA, including in the United States (for example Google, Cloudinary, and Mapbox when the relevant features are used). Where transfers occur, we rely on safeguards required by applicable law, such as an adequacy decision or standard contractual clauses.

9. Your rights

Under the GDPR, you have the following rights, subject to applicable conditions:

  • access
  • rectification
  • erasure
  • restriction of processing
  • data portability
  • objection
  • withdrawal of consent at any time where processing is based on consent (for example Maps), without affecting earlier lawful processing

To exercise your rights, contact us at hello@co-erasmus.eu.

10. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

11. Requirement to provide data

You can browse the website without creating an account. Certain data are required to use account features (for example profiling, listing, verification, or mutual commitment). Without that information, we may not be able to provide the relevant part of the service.

12. Automated decision-making

We do not use automated decision-making within the meaning of Article 22 GDPR that produces legal or similarly significant effects on you.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The version published on this website is the current version. The “Last updated” date shows when it was last revised.