Porta PE Privacy Policy
Effective date: 2026-03-18 · Last updated: 2026-03-18
Who operates Porta
Porta PE is operated by IseoGroup Ltd., Griva Digeni 78, 2nd floor, Office V1, CY-3101 Limassol, Cyprus (“IseoGroup”, “we”, “us”).
Authorized Representatives / DPO: Joachim Freitag, Director.
What Porta does
Porta is an admissions platform for international schools. Families use Porta to find schools, upload application documents, and submit applications. Porta uses artificial intelligence to extract information from uploaded documents, classify document types, and validate completeness. Porta generates a structured dossier that the school reviews to make its admissions decision.
Porta does not make admissions decisions. The school reviews every dossier and decides independently.
Our role in data protection
Porta has two roles depending on the processing activity:
Porta as data controller. For the following activities, IseoGroup determines the purpose and means of processing: your account and profile, school search and discovery, dossier storage for reuse across applications, collection of the reservation fee, and communication with you about your account.
Porta as data processor. For the following activities, IseoGroup processes data on behalf of the school you apply to: document extraction, classification, and validation using AI, dossier generation, completeness scoring, and delivery of the dossier to the school. The school is the data controller for these activities. The school determines what happens with your application.
What data we collect
Data you provide directly
Account information: name, email address, phone number, country of residence.
Applicant information: child's full name, date of birth, nationality, grade level, curriculum preferences.
Documents you upload: passport or ID, birth certificate, academic transcripts, school reports, language test results (e.g. IELTS, Cambridge), medical or vaccination records, recommendation letters, personal statements, photos.
Payment information: processed by our payment provider [PROVIDER TBD]. We do not store your credit card or bank details. We receive a transaction confirmation and receipt.
Data extracted by AI
When you upload documents, our AI systems extract: full name, date of birth, place of birth, nationality, passport number and expiry date, issuing country, school names and grades, test scores, dates. This extracted data is used solely to generate your application dossier.
Data we collect automatically
When you use Porta: IP address, browser type, device type, pages visited, timestamps. This data is used for security, fraud prevention, and service improvement. It is not linked to your application data.
Why we process your data and on what legal basis
| Purpose | Legal basis (GDPR) | Details |
|---|---|---|
| Account creation and authentication | Art. 6(1)(b) – contract performance | Necessary to provide the service you signed up for. |
| School search and discovery | Art. 6(1)(f) – legitimate interest | Our interest: enabling families to find schools matching their criteria. You can object. |
| Document upload, AI extraction, validation | Art. 6(1)(a) – your consent | You give explicit consent before your first upload (Consent C3). You can withdraw anytime. |
| Dossier delivery to a specific school | Art. 6(1)(a) – your consent | You give consent per school (Consent C4). Each school is a separate consent. |
| Dossier storage for reuse | Art. 6(1)(a) – your consent | Optional. You choose whether to keep your dossier (Consent C5). |
| Reservation fee collection | Art. 6(1)(b) – contract performance | Necessary to process your seat reservation. |
| Application fee collection (on behalf of school) | Art. 6(1)(b) – contract performance | We collect and transfer to the school per our agreement with them. |
| Security and fraud prevention | Art. 6(1)(f) – legitimate interest | Our interest: preventing unauthorized access and fraudulent applications. |
| Legal compliance | Art. 6(1)(c) – legal obligation | Accounting records, tax obligations, regulatory requirements. |
How AI processes your documents
Porta uses artificial intelligence for three tasks:
1. Document classification. AI identifies what type of document you uploaded (passport, transcript, test result, etc.).
2. Data extraction. AI reads the document and extracts key fields: names, dates, scores, school names, nationalities.
3. Validation. AI checks extracted data for completeness and consistency. For example: does the name on the passport match the name on the transcript? Is the passport expired? Are all required documents present?
The output is a structured dossier with a completeness score. The school reviews this dossier and makes its own decision.
What AI does not do: AI does not decide whether your child is admitted. AI does not rank applicants. AI does not compare your child to other applicants. AI does not contact you. The school reviews every dossier.
Your data is not used to train AI models. Documents you upload are processed and the results are delivered. Your data is not fed into any machine learning training pipeline. This applies to all AI components used by Porta.
You can request human review. If you want a person (rather than AI) to review what was extracted from your documents, you can request this through your dashboard. The request is forwarded to the school's admissions team.
Who receives your data
| Recipient | What they receive | Why |
|---|---|---|
| The school you apply to | Your complete application dossier | To review and decide on your application. The school becomes the data controller for this data. |
| AI processing sub-processors | Document content during processing | To perform extraction, classification, validation. See sub-processor register. |
| Payment provider ([PROVIDER TBD]) | Payment amount, transaction reference | To process your reservation fee and application fee. They do not receive your application documents. |
| No one else | – | We do not sell, rent, or share your data with any other party. |
If you apply to a school outside the European Economic Area (EEA), your dossier data is transferred to that school in a country that may not have the same data protection standards. When this applies, you will be informed at the point of application (Consent C4) and asked for your explicit consent to the transfer.
How long we keep your data
| Data category | Retention period | What triggers deletion |
|---|---|---|
| Active application data | Until the school communicates its decision + 30 days | School decision notification. |
| Reusable dossier (if you consent) | 12 months from last activity. Renewable by re-consent. | 12-month expiry. You can delete anytime via your dashboard. |
| Account data | Until you delete your account | Your deletion request. 30-day grace period, then permanent deletion. |
| Payment records | 10 years (Swiss/EU accounting law) | Legal retention period. |
| Audit logs | 3 years | Regulatory retention for AI Act compliance and dispute resolution. |
| Automatically collected data (IP, browser) | 90 days | Rolling deletion. |
When data is deleted: it is immediately made inaccessible (soft-delete) and permanently removed from all systems within 30 days (hard-delete), including backups.
Your rights
You have the following rights under GDPR and the Swiss nFADP:
Access (Art. 15). Request a copy of all personal data we hold about you. We respond within 30 days.
Rectification (Art. 16). If any extracted data is incorrect, request a correction. You can also re-upload documents.
Erasure (Art. 17). Request deletion of your data. We delete within 30 days. Note: if you have an active application, the school may still hold a copy under their own retention policy.
Restriction (Art. 18). Request that we stop processing your data while a dispute is resolved.
Data portability (Art. 20). Download your dossier and extracted data in a structured, machine-readable format (JSON and PDF).
Object (Art. 21). Object to processing based on legitimate interest (school search, security).
Withdraw consent (Art. 7). Withdraw any consent at any time. Withdrawal does not affect processing that already happened. You can withdraw AI processing consent (C3), school-specific sharing consent (C4), or dossier retention consent (C5) independently through your dashboard.
Lodge a complaint. You can file a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch, or your local EU data protection authority.
To exercise any right: use the privacy settings in your Porta dashboard or contact IseoGroup at the address below.
Children’s data
Porta processes personal data of children (the applicants) submitted by their parents or legal guardians. Children do not create Porta accounts or interact with Porta directly.
Account creation is restricted to persons 18 years of age or older. By creating an account, you confirm that you are the parent or legal guardian of the applicant and have the authority to submit their personal data.
Children's data is subject to enhanced protections: strengthened right to erasure (Art. 17(1)(f)), parental consent for all processing, and strict purpose limitation.
Data security
Data encrypted in transit (TLS 1.3) and at rest (AES-256). EU-based infrastructure (Frankfurt, Germany). Role-based access controls. Regular security assessments. Incident response procedures with 72-hour notification to controllers (schools) and affected data subjects.
Cookies
See our Cookie Policy, managed via iubenda.
Changes to this policy
We may update this Privacy Policy. Changes are posted on this page with an updated “Last updated” date. For material changes that affect your rights, we notify you by email.
Contact
For privacy questions, data subject requests, or DPA inquiries:
Joachim Freitag, Director
IseoGroup Ltd.
Griva Digeni 78
2nd floor, Office V1
CY-3101 Limassol