Privacy policy

The data controller for this website and for the Erasmus+ projects it advertises is:

Controller

Dreaming Awake, an informal group of young people (Erasmus+), represented by its legal representative

Data protection contact

info@dreamingawake.eu

We collect data in two stages, on purpose, so that nobody hands over sensitive information just to apply.

Stage 1, when you apply. Name, email, phone, date of birth (to check that you are eligible and whether you are under 18 and, if you are selected, for the participant list we report to the Erasmus+ programme), gender (you can choose «non-binary» or «I prefer not to say»; we use it to organise shared rooms, for anonymous statistics and, if you are selected, in that participant list), nationality, country and city of residence, the city you would travel from, your motivation, any previous experience you choose to tell us about and your answers to the questions of that call, if it has its own. If you apply on one of our Google Forms, we also keep your answers to its questions that our website does not ask, as part of your application and for as long as we keep it, except what this policy says we never keep from a form. No CV, no documents and no ID number. Our website does not ask for health data. If one of our Google Forms asks for something sensitive, we keep that answer encrypted and only our administrators can see it. A health answer, or one about another special category of data, is kept only if you give your explicit consent on that same form, the form recorded the email address of your Google account and you are 14 or older (today and on the day the activity starts); we remove it 30 days after the project ends, or earlier if you withdraw your consent. Answering those questions is never a condition for applying. Two boxes are optional and unticked: keeping your application for future calls and staying in touch; we assess your application the same way whether you tick them or not, and we do not show them to people under 14 (today or on the day the activity starts), nor keep them if they arrive ticked.

Rooms. Shared rooms are by gender. If your gender is missing (for example, a question left empty on one of our Google Forms), we deduce it from your first name (and, for names that vary by country, your nationality and country of residence), only to organise the rooms, mark it as deduced and confirm it with you; a deduced gender is used for nothing else. If you chose «non-binary» or «I prefer not to say», we deduce nothing: we talk with you and choose your room together. What you declared is never replaced, not in our statistics or in the participant list either.

Stage 2, only if you are selected or on the reserve list. Through a separate private link we ask for what the programme needs to run the project and justify the grant: ID document type, number, expiry date and place of birth (never an image of it), postal address, an emergency contact, dietary, health and accessibility needs (only if you have any: you can answer «I have nothing to declare»), insurance details, the bank account for your travel reimbursement, the languages you speak, your T-shirt size and how you plan to travel and, if you are under 18, your parent's or guardian's name, contact details and consent. In the same form you can choose whether we may publish photos and videos in which you can be recognised, on our website and reports and, separately, on our social networks (two optional boxes; see the table below), and you can tick «I want to stay in touch with DreamingAwake».

Staying in touch, if you want. When you apply, and again in the stage 2 form, you can tick «I want to stay in touch with DreamingAwake». We then keep your name, email, country, languages, year of birth, the projects you took part in and your application to them after your project's file has ended, to tell you about future projects and calls. It is your choice and does not affect your selection. When you tick it on the application form or answer yes on one of our Google Forms, or when you ask us and we send you an invitation, you confirm it from your email (you tick the box on that page and press the button), and we keep both: that you ticked the box and that you confirmed it. If you have not answered when your project ends, the email in which we ask you to save your certificate also invites you once; nothing changes unless you confirm. Until you confirm, our emails say that it has not been confirmed and carry a link to cancel it. You can leave at any time with the link in any of our emails or by writing to us.

Keeping your application for future calls, if you want. If you are not selected, we keep your application for 12 months after the decision and then anonymise it. If you tick «Keep my application for future calls», we keep it for 3 years after the decision, so we can offer you other projects. If you applied on one of our Google Forms, a «yes» to this box is only recorded if the form recorded the email address of your Google account (so that nobody can answer with your email). You can withdraw this at any time; we then keep your application only for the 12 months after the decision.

Learning diary, if you want. With the same private link you can write down what you learn before, during and after the activity, to describe it later in your Youthpass. Writing in it is voluntary (your consent). You and the team that helps you with Youthpass can read it, and every reading by the team is recorded. It is stored encrypted and has no deletion date: while your link is open you can delete a note by emptying it, and at any time you can withdraw your consent and ask us to delete the whole diary. We delete all its notes and record that we did, without their text; if your link is still open, the page tells you the day, and anything you write afterwards is a new diary. We stop sending you diary reminders unless you start writing again.

After a project. The team writes a short internal evaluation of how the exchange went for each participant (a score, whether we would invite you again and a comment), to plan future projects. Only the team sees it, a person always decides, and you can ask to see it. It has no fixed deletion date, because it helps us plan future projects; you can object to it and ask us to delete it. We then delete every evaluation of you in that project, record that we did (without the scores or comments) and write no new one. The anonymous average of the project, which we only keep when three or more people were evaluated, stays as it was if we had already taken it; if not, the one we take when the project closes will not count them.

What our team writes about you. While we select people and run a project, the team keeps short internal notes: the reasons for a selection decision, notes on your file and tags such as «Fewer opportunities» (when you face obstacles the Erasmus+ programme asks us to support and count; it can reveal a social or health situation, so we only use it to plan support and to report anonymous inclusion figures), «Leader» (you could lead a group) and «Green travel». When two files turn out to be the same person, we merge them and record that we did. Only the team sees all this (legitimate interest, Art. 6.1.f), a person always decides, and you can ask to see it, correct it or object to it.

When you write to us. Your name, email, optional organisation, subject and message.

What we keep for our history. When a project's file ends, we keep only anonymous numbers: how many people took part, by country, age range and gender, the results and the average of our evaluations. Groups of fewer than three people are merged so that nobody can be recognised.

Sometimes we collect these answers with a Google Form instead of our website. That form belongs to the association's Google account; we copy the answers into this platform, where the sensitive ones are encrypted, and then delete them from the form. Health answers are only kept if you give the same explicit consent as on the website and the form recorded the email address of your Google account (so that nobody can answer with your email); the same goes for your consents in the stage 2 form (publishing your image, the code of conduct). Under 14, the health consent is given by your parent or guardian in your stage 2 link, never on a form.

If the email address of your file changes. If we change it (for example, because you ask us to correct it), the private links to your forms and to your application page that we sent to the old address stop working (the link to leave our community always works) and, when you still need them, we send you new ones at the new address (a new link to your stage 2 form, if the change is made by the last day of your project and your link is still open, and it stays open for as long as the old one would have; after that day we do not send it: write to us to withdraw a permission to publish your image, to delete your learning diary or for anything else you would have done with that link); the old address gets a notice of the change, without any private link. The old address loses access to your Drive folder as soon as we process the change, and the new one gets access only after our team has checked the files in it, because what was uploaded through the old address may not be yours; until then, your link does not give you the folder, and nothing in it is deleted. What was given, written or answered through the old address stays in your file for our team (your health answers only until you answer again: your new answers replace them), but your new link does not show it and it does not count until you give it again there (your ID document, address and insurance also count if you send them again on one of our Google Forms that records the email address of your Google account, answered after the change): you write your ID document, address, insurance, your parent's or guardian's details, your emergency contact, your bank account and your health answers again, each in its step (our finance team can also check the bank account with you, and we pay no reimbursement to it until then), and your parent's or guardian's consent, the code of conduct, the permissions to publish your image and staying in touch count again only when you tick them again. Your T-shirt size, your languages and how you plan to travel are not shown in your new link either: until you write them again there, our team still sees them and uses them to organise the project, marked as not written again with your new link. The notes of your learning diary written through the old address stay with our team: your new link does not show them, and we do not use them for your Youthpass without talking to you. Until you answer the health questions again, our lists and the sheets for the place where you stay say that your diet and allergies are not known. We keep the old address in your file, with the notice we sent to it.

To process your travel reimbursement, we review the documents you upload to your Google Drive folder (invoices, tickets and boarding passes). An automated system reads them to check that they are complete, prepare your travel plan, verify dates, routes and amounts, and detect possible errors or inconsistencies.

You confirm your travel plan in a Google Sheet in your folder. If your plan counts as green travel, you also declare there, on your honour, that you travel by the sustainable means it shows; without that declaration, we propose the standard travel grant instead of the green one. We record the date of your declaration, and it goes into what we report to the National Agency. If you have no sheet (your folder is not shared with you), a team member goes through your plan with you, row by row and with its amount, and records that you confirmed it in person, when, the amount and a note saying who did it with you, where and when; your green travel declaration can be made the same way.

We may check your booking with the company that issued it (airline, train or bus), using the booking reference and your surname, and compare its invoice with the one you upload.

We do this because you ask for the reimbursement and because we must justify the Erasmus+ grant (Art. 6.1.b and 6.1.c GDPR). The checks for manipulated documents, including the check with the company, rely on our legitimate interest in making sure European public funds are used correctly (Art. 6.1.f). On the same basis, we check which Google account confirmed your travel plan sheet: we keep only whether it was yours, never the account itself.

You can object to these checks, on grounds relating to your particular situation, by writing to us (Art. 21). We weigh your objection against the reasons for the checks and tell you our decision and why. Travel refunds are public EU funds, and every participant's documents are checked in the same way to prevent fraud, so we normally keep the checks: those are compelling legitimate grounds.

If your particular situation outweighs them, we accept your objection and stop those automatic checks with you, in this and future projects: they are no longer calculated on your documents, and what they had already produced about them is deleted unless another participant's identical document still needs it; your documents are not compared with the company's originals or, to look for manipulation, with other people's; and we do not look at which account confirmed your sheet. We still see whether the same document is also in another participant's folder, so that it is not paid twice. A person on the team reviews each of your travel documents by hand before your reimbursement is proposed. We still read your documents automatically to take the dates, routes and amounts needed to calculate your reimbursement (Art. 6.1.b and 6.1.c GDPR). We keep a record of your objection and our decision with your participant file; if you withdraw it, the checks start again.

No decision is made automatically: a team member always reviews the result, and you can correct your travel plan. The result of these checks, and any warning about a document, is only for our team: it is not in what we report to the National Agency. Your documents stay in your Google Drive folder, and the association keeps its own copy of them for the retention period, so that the grant can still be justified if a file is deleted. We only keep the data needed for your reimbursement and for reporting on the Erasmus+ grant.

Some projects accept minors. If you will be under 18 on the first day of the project, we cannot confirm your place until a parent or legal guardian has given consent. Health data of minors is handled with the same separate, explicit consent and removed 30 days after the project ends, like everyone else's; if you are under 14 (today or on the day the activity starts), that consent is given by your parent or legal guardian, after giving their own consent for you to take part. The contact details of your parent or guardian are removed then too; their name and the date of their consent stay in your participant file as proof. If your parent or guardian withdraws their consent (by writing to us), we record how and when they asked, the permissions to publish your image end with it and, as we cannot keep your place without it, we talk with you both about it. The two permissions to publish your image are optional. If you are under 14, your parent or guardian decides; from 14 to 17, you decide together with your parent or guardian. We never publish on social networks photos in which a child under 14 can be recognised, even with that permission. If you are under 14 (today or on the day the activity starts), we do not offer you the boxes to keep your application or to stay in touch, and if they arrive ticked we do not keep them.

We do not sell or rent personal data, and we do not use it for advertising.

Within the programme. The Spanish National Agency (INJUVE) and the European Commission receive participant data in our reports on the grant (the Beneficiary Module): for each participant, the name, email, gender (as you declared it), date of birth, whether you were under 18, nationality, country of residence, the city you travel from (and why, if it is not the usual one), your role, your sending organisation, the activity dates, the distance and the distance band, whether you travelled green, the date of your declaration and the travel grant. Never the result of our checks of your documents. They may receive more when they audit the grant. They process the participant data they receive under their own privacy statement: ec.europa.eu/erasmus-esc-personal-data. Partner and hosting organisations of your project receive only what they need to host you and look after you: your name and national group and, if you are selected, your room, when and where you arrive and leave (with your flight or train), and the diet and allergies they must cater for (only if you gave your health consent). The group leaders who look after the group during the activity get an emergency list (a partner's leaders, only for their own group), and the hosting organisation's team gets the emergency list of the whole group: your name (and whether you are under 18), room, phone, emergency contact, insurance and, if you gave your health consent, your allergies and medical notes. The place where you stay and eat, when it is not the hosting organisation itself, gets the rooming and kitchen sheet: your name, national group and room and, if you gave your health consent, your diet and allergies, to give you a bed and safe meals. Your stage 2 form names the organisations of your project. We ask each partner to sign a mandate with us before we give it any list: in it, the partner is responsible for these data as a separate controller, may use them only to host and look after the group, keeps them safe, does not pass them on and deletes them 30 days after the project ends; at that time we also ask partners and group leaders to delete the lists we gave them.

Partners outside the European Economic Area. Some partners are in countries outside the EEA. If the European Commission has decided that the country protects personal data adequately (for example, Switzerland, the United Kingdom or Brazil), the lists go to the partner on that basis. If it has not (for example, Serbia or Türkiye), the partner's mandate incorporates the EU standard contractual clauses for transfers between controllers (Commission Implementing Decision (EU) 2021/914, Module One). If the place where you stay is outside the EEA, it gets the rooming and kitchen sheet because it is necessary for the stay we arrange for you (Article 49(1)(c) GDPR). You can ask us for a copy of these safeguards at the email in «Who is responsible».

To pay you and give you your certificate. When we pay your travel reimbursement, our bank receives the name of the account holder (who may be someone other than you), the bank account, the amount and the payment reference «Erasmus+ travel reimbursement» with the project and your name. If you want a Youthpass certificate, we add your name, your email and the activity details on youthpass.eu, the European Commission's Youthpass platform.

Other participants of your project. You get access to the project's shared «Photos & videos» folder, together with the other participants of your project, whether or not you let us publish your image (if you are under 18, once your parent or guardian has given their consent): they see the photos and videos uploaded there and the Google accounts that have access. If you do not want to appear in it, tell us and we will remove the photos in which you can be recognised. Please do not publish other people's photos from this folder without their permission. When you stop taking part, you lose that access. Your travel documents are in a folder only you and our team see; in some projects, where the groups get lost with one link per person, we share instead, for the whole project, one folder per country (or one for everyone), and then the other participants of that folder, the group leaders included, see the travel documents in it (tickets, boarding passes, invoices and bank statements) and also each person's travel plan sheet (their home city, journeys, amounts, what is missing and the proposed refund) and attendance certificate, which we put in their folder too. We tell the group before we do it, record why, and the leaders of a partner may use them only to accompany the group and justify its travel. If you join your project's WhatsApp group (we send you the invitation link), its other members see your name and phone number, and WhatsApp (Meta) processes them under its own terms.

Service providers acting on our instructions. Hosting and database (Oracle Cloud Infrastructure, in Marseille, France (European Union)); DNS, network security, the browser check on our public forms and email routing (Cloudflare); transactional email delivery (Mailjet, part of Sinch). Oracle and Cloudflare work under the data processing terms that are part of their standard agreements, and Mailjet under Sinch's data processing agreement. Our team mailbox, the forms of a call or a project and, when we use them, the travel-receipt folders are in the association's own Google account (Gmail, Google Forms and Google Drive; in the EEA, provided by Google Ireland Limited): it is a standard Google account, under Google's terms, without a separate data processing agreement, until the association moves to Google Workspace. When we back up our database (once a day), the backups are kept in that same Google account (Google Drive): they are encrypted on our server before they leave it, with a key that only we hold, so Google stores them but cannot read them. Google may store data in its data centres outside the European Economic Area; for the United States, the transfer relies on the EU-US Data Privacy Framework (an adequacy decision). For our other providers, where they process data outside the EEA, the transfer relies on the safeguards of Chapter V GDPR, such as an adequacy decision or standard contractual clauses.

The browser check on our forms. When you open the application form or the contact form, Cloudflare Turnstile checks in your browser that you are a person and not an automated bot: to do this Cloudflare processes your IP address and technical signals from your browser, it does not use cookies to track you or for advertising, and we only receive whether the check passed.

Our emails. Mailjet (part of Sinch), which delivers our emails, keeps a record of each email it delivers (the address, when it was sent and whether it was delivered or bounced) on servers in the European Union, in Germany and Belgium; some of Sinch's providers for support and billing are in the United States, with the safeguards described above. We have switched off its tracking, in our account and in every email: our emails carry no invisible image to record whether you opened them, and their links go straight to us, without passing through Mailjet. We only use what Mailjet records about our emails to see whether an email arrived and to decide whether we remove your address from Mailjet or keep it there (see «How we remove data» above): for that, we read from Mailjet whether our emails to your address bounced or were blocked, whether you reported one of them as spam, and when your address was added to Mailjet or last had activity there. We never use it to build a profile of you or to decide anything else about you. To protect its network against spam and fraud, Sinch also uses the delivery data as a controller in its own right, under its own privacy notice.

If you are the contact person of a partner organisation, we keep your name and work email, given to us by you or by your organisation, and your role in each project, to work with your organisation on the project: the mandate, the places, the lists we send you and the transfers of the grant (legitimate interest, Art. 6.1.f). We keep the contact on your organisation's file while we work together and, after that, as long as the file of the latest project we did together; the contact in a project's mandate, as long as that project's file. A team member removes them then. You have the same rights as everyone else (see «Your rights»).

If you are a member of our team, we keep your name, email, role and the security data of your account, and a record of what you did and viewed in the back office, to give you access, keep it secure and show who decided on the grant money (Art. 6.1.b, 6.1.c and 6.1.f). The security data are your password hash, the secret of your two-step verification (encrypted), your recovery codes (only as a one-way hash), the one-time code and links we email you (the code to set up two-step verification, the link to reset your password and the «This wasn't me» link; we keep them only as a one-way hash, except inside the email itself while it waits to be sent, until 30 days after it finally fails to be sent), the code the reset page gives you to lift a hold on your account (also only as a one-way hash), your last sign-in, the IP address of failed sign-in attempts that paused sign-in to your account (from one connection or entirely), the IP address in the security notices we send you (your password changed or reset, two-step verification turned on, a sign-in with a recovery code, your codes paused or switched off after too many wrong ones) and, in the email with the code to set up two-step verification, a keyed hash of the connection that asked for it (never its IP address). The entries of our security logs that show these IP addresses, and our copies of those notices, are kept for 24 months, like the rest of the security logs. When your account is deactivated, your access data are removed 24 months after your last activity; your name stays while a project file in its retention period names you as the person who approved, reviewed or paid something, and then becomes «Former staff member».

• Health and diet data, and sensitive answers given on our Google Forms, are encrypted at column level, separately from the rest of the database.
• Your private status link is stored only as a one-way hash: even our own database cannot show it.
• The secret of each team member's two-step verification is encrypted, and their recovery codes are stored only as a one-way hash.
• We do not store the IP address of visitors, applicants or participants; for fraud prevention we may keep a salted, one-way hash of it. The only exceptions are in the back office, and only for our team: when repeated failed attempts pause sign-in to a team account (from one connection or entirely), we record the IP address they came from, with the security logs; and the security notices about a team account (password changed or reset, two-step verification turned on, a sign-in with a recovery code, codes paused or switched off after too many wrong ones) keep the IP address the action came from.
• Access to the back office is restricted by role. Only the selection team and the administrators can read applications.

You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format (the rights of access, rectification, erasure, restriction of processing, objection and data portability, Articles 15 to 21 GDPR). Where we rely on your consent (health data, publishing your image, the learning diary, keeping your application, staying in touch) you can withdraw it at any time by writing to info@dreamingawake.eu; this does not affect what was done before. For health data and the permissions to publish your image you can also untick the box in your stage 2 link while it is open, and you can leave the community with the link in any of our emails. You can also ask us to delete a particular photo or video in which you can be recognised. If you withdraw your consent for health data, we remove your health, diet and accessibility answers at once, and from then on we cannot take your allergies or medical needs into account. By writing to us, you can also withdraw your consent for the health or other special-category answers you gave on a Google Form when you applied: we then remove those answers at once, and the rest of your application stays as it is.

Write to info@dreamingawake.eu or use the contact form. We answer within one month. We may ask you to confirm your identity first.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or to the data protection supervisory authority of the EU country where you live.

Each version is dated. When you apply, we record which version you accepted (if you applied on one of our Google Forms and we could not confirm that it showed our text, we record the version published on the day you sent it, marked as not confirmed). If a change affects data you already gave us, we will tell you by email before it takes effect.