How the Events platform uses information

Who operates the service

ESN Ireland operates this platform for internal ESN event administration. The final organisational contact for data-protection questions is still to be confirmed before live registrations open.

ESN Account sign-in

When ESN Account sign-in is enabled, the platform requests the profile-information scope from ESN Accounts. It uses the stable account subject (sub) to link the sign-in to a local user. It may also use name, preferred username, verified email, profile picture and the minimum organisational roles needed to decide eligibility and access.

The platform does not store the ESN access token after the initial profile request. It does not copy unrelated ESN Account fields such as postal address, date of birth or social profiles.

Information used for an event

An event registration may include contact details, section or organisation, ticket choice, dietary information, accessibility or support requirements, accommodation information and other questions configured by the organiser. Each live event must show its questions and event-specific privacy information before submission.

The development pilot saves the Events account ID, display name, ticket, attendance days, registration reference and status. The pilot has no free-text participant questions and does not collect payment or send email. Access administrators can look up a verified national account by an ID shared with them.

Why information is used

Information is used to authenticate participants, assess eligibility, administer attendance, provide requested event support, communicate registration and payment status, reconcile payments, produce necessary participant lists and maintain an appropriate audit trail. The applicable lawful basis must be confirmed in the final approved notice before real registrations are collected.

Storage and access

The proposed staging service uses AWS resources in the Europe (Ireland) region. OAuth transactions expire after ten minutes and application sessions after eight hours. Access is limited through application roles, with organiser and finance access separated. Exports must be deliberately requested and should include only fields needed for the organiser’s task.

Payments and service providers

If online payment is approved, payment will be completed on a hosted payment-provider page. The Events platform must not store card numbers or security codes. AWS, ESN Accounts, an approved email service and an approved payment provider may process limited information to deliver the service; the final notice will identify the providers actually enabled.

Retention and participant rights

Pilot registrations and the account lookup entry expire after 30 days. Audit entries expire after 90 days and include the actor’s Events account ID, the target, the change and its reason. Expired pilot records are removed asynchronously. AWS backups may retain copies within the configured recovery window.

Event records must be separated by edition. Operational participant information should be deleted or anonymised according to an approved retention schedule, while a minimal financial or audit record may need to be retained for a different period. Final periods, the request route for access, correction or deletion, and any necessary exceptions are pending ESN Ireland approval.