Privacy policy

01.Controller

NDR Labs acts as controller for the Wimmio service.

• Trade name: NDR Labs
• Contact: info@wimmio.be
• TVA/BTW/VAT: BE1036.269.509

02.Data processed

We process only data useful for the service, security, support and legal obligations.

• Account: email, optional name, language, verification status and security settings.
• Search: budget, municipalities, property type, surface, bedrooms, criteria, selected agencies and alerts.
• Daily life: saved places, categories such as work or school, times and route preferences if the feature is enabled.
• Usage: favourites, hidden listings, tracking status, private notes, notifications, export and account deletion.
• Technical: essential cookies, IP, access logs, product events with consent, errors and performance.
• Payment: Stripe identifiers, subscription status and billing data.
• Public sources: public property listings technically indexed and normalized to create matching signals.

03.Purposes and legal bases

Each processing activity has a defined purpose.

• Contract performance: account, profiles, matching, alerts, favourites, notes, support and subscription.
• Legitimate interest: security, abuse prevention, technical logs, service improvement and monitoring of public sources.
• Consent: non-essential cookies, analytics, optional monitoring and non-essential third-party services.
• Legal obligation: billing, accounting, authority requests and necessary evidence.

04.Recipients and processors

Data may be processed by service providers needed for Wimmio.

• Hostinger: hosting, storage and infrastructure.
• Stripe: payment, subscription, billing and customer portal.
• Sentry: technical errors and performance, with session replay off by default.
• Google Sign-In: Google login only when the user chooses it.
• Geoapify or Google Maps: geocoding, nearby places and route calculations for geographic features.
• CARTO and OpenStreetMap: map tiles.
• SMTP email provider: verification, support, alerts and notifications.

05.Retention

Data is kept for limited periods proportionate to its purpose.

• Account and profiles: while the account is active, then deletion or anonymization.
• Unverified users: 7 days.
• Notifications: 90 days.
• Analytics events: up to 180 days.
• Health logs: 30 days; technical collection metrics: 14 days by default.
• Route caches: until technical expiry.
• Stripe and billing: according to applicable legal obligations.
• Backups: limited retention under the operations policy.

06.Rights

You may exercise access, correction, deletion, restriction, objection and portability rights.

• Contact: info@wimmio.be
• Data export and account deletion are available in settings.
• You may lodge a complaint with the Belgian Data Protection Authority (APD/GBA).

07.Cookies and trackers

Essential cookies are required. Analytics, monitoring and third-party services stay off until you accept them.

08.Automated assessment

Wimmio ranks listings according to your criteria. This ranking has no automatic legal effect and you remain responsible for the final decision.

09.Transfers outside the EEA

Some providers may involve transfers outside the EEA. Where needed, we rely on appropriate safeguards such as standard contractual clauses or recognized frameworks.