Privacy Policy - WeConnect

Preliminary observations

WeConnect Sàrl-Sis works to promote intergenerational cohabitation. In concrete terms, the owner/tenant with a subletting authorization from the owner, who hopes to rent out at least one room of his property, contacts WeConnect and signs a main lease contract. It is then up to WeConnect to find a subtenant who is a student/young person and who would be interested in renting the said property. The signing of the main lease contract as well as the sublease contract operates via the WeConnect platform: https://weconnect.lu/

It is obvious that the signing of any lease contract necessarily entails the collection of personal data.

Processing of personal data

The purpose and legal basis of the processing

WeConnect enters into a lease agreement with the owner of the property to be rented.

WeConnect then sublets the property previously rented out by itself.

Within the framework of these contractual relationships taken in isolation, personal data will be collected by WeConnect in order to secure the payment of rent and to ensure the proper performance of contractual obligations. This data will also be used in order to be able to usefully answer the questions asked by WeConnect's co-contractor and to keep it informed of the changes to be made to its account. The collection of personal data is also intended to inform WeConnect's contracting parties, who have consented to it, of the new services respectively offers offered by WeConnect, to facilitate the connection between hosts and students, to manage user accounts and the platform, as well as to produce internal statistics, which can be used in aggregated and anonymized form for analysis purposes or communication with partners.

The data collected

The conclusion of the main lease agreement as well as the conclusion of the sublease agreement requires the collection of personal data, including, in particular: surname, first name, date and place of birth, address, e-mail address, indication of the university attended (in the case of the subtenant), profession (in the case of the main landlord), telephone number, bank account details, payment details, information about the use of the WeConnect website, including IP logs, pages visited and actions taken, etc. as fully detailed in the Appendix to this policy.

The data subject explicitly consents to the collection of the aforementioned personal data.

The data subject may, if he or she so wishes, provide certain additional information, including data falling within the special categories of data within the meaning of Article 9 of the General Data Protection Regulation (e.g. data relating to health, political opinions, religious and philosophical beliefs, data concerning the sex life or sexual orientation of a natural person, etc.), when this information is likely to promote or optimize the relationship between the parties. However, the provision of such data remains strictly optional and does not constitute a condition for the conclusion of the lease or sublease contract, or for the use of the services offered by WeConnect.

Recipient of the information transmitted

The information transmitted is received by WeConnect.

The personal data of the subtenant may be transmitted to the main lessor (the owner) and vice versa.

The personal data of the subtenant as well as the main lessor may also be shared with Mailchimp or Brevo for email management, Stripe for payment processing, Microsoft Services for secure data storage, Laravel Nova, WeConnect's fiduciary and insurer, and cleaning services. Personal data will not be passed on to any other third party.

Retention period of transmitted information

Personal data will be kept for up to 5 years following the event marking the end of the contractual relationship.

For persons registered on the WeConnect platform who do not enter into any main lease or sublease agreement through WeConnect, personal data will be kept for a maximum period of 5 years from the date of their registration on the platform or, where applicable, from their last significant activity on it.

Rights and their respect

The data controller in the context of the aforementioned activity is WeConnect.

Personal data is processed in accordance with the General Data Protection Regulation (GDPR), i.e. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of data, which has been applicable since 25 May 2018. In concrete terms, the rights of the data subjects are as follows:

Right of access – The data subject has a right of access to the personal data that WeConnect processes about him/her. Thus, they have the right to contact the data controller so that they can communicate all the data held concerning them.
Right to rectification – If the personal data is inaccurate or incomplete, the data subject has the right to request the data controller to rectify it.
Right to object to processing – In principle, the data subject may object to the use of his or her personal data by the controller, who will then determine whether the processing of the data is unfairly harmful and, if so, put an end to it. However, the data subject may not object to the processing of his or her data if the law obliges the data controller to do so or if the data is necessary for the performance of the obligations arising from the conclusion of the lease agreement and/or the sublease agreement.
Right to restriction of processing – The data subject has the right to request that the controller restrict the use of his or her data under the conditions set out in Article 18 of the GDPR.
Right to be forgotten – The data subject has the right to ask the controller to erase his or her data if its retention is no longer justified by a legitimate reason.
Right to complain – If the data subject has a complaint about the processing of their data or suspects a breach of their data security, they can contact [email protected] and the WeConnect team. The data subject also has the option of lodging a complaint with the National Commission for Data Protection (CNPD), the national supervisory authority in this area (1, avenue du Rock'n'Roll / L-4361 Esch-sur-Alzette; www.cnpd.lu) and, if necessary, to refer the matter to the competent court.
Right to data portability – Data subjects have the right to receive the personal data concerning them that they have provided to a controller, in a structured, commonly used and machine-readable format, and have the right to transmit such data to another controller without hindrance from the controller to whom the personal data have been disclosed.

Data Breach Notification

Any incident resulting in the destruction, loss, alteration, unauthorized disclosure of, or access to personal data is considered a personal data breach.

The data controller shall notify the competent supervisory authority of the personal data breach as soon as possible and, if possible, no later than 72 hours after becoming aware of it, unless the breach in question is not likely to result in a risk to the rights and freedoms of the data subjects.

Where a personal data breach is likely to result in a high risk to the rights and freedoms of the data subject, the data controller shall communicate the breach to the data subject without undue delay, unless such disclosure is not necessary in accordance with Article 34(3) of the GDPR.

Exercising the rights of the data subject

To exercise their rights, the data subject may contact the data controller by letter or email. The Data Controller will make every effort to respond to the request as soon as possible. In some cases, the response time may be up to a month. If the controller needs more time to process the request, it will inform the data subject with the reasons for the delay. In some cases, the controller may refuse to grant the request. Where permitted, the Superintendent will give reasons for the refusal to the individual in a timely manner.

Appendix: Data collected

a. Data collected on the host side (main lessor)

Personal data

Gender (Female / Male / Non-binary)
First and last name
Email address
Phone Number
Primary Address
Date of birth
Nationality
Profile picture
Professional Status (Retired / Active / Other)
Trade / Profession
Languages spoken
Hobbies and hobbies
Free presentation text

Bank details

Account Holder Name
IBAN
BIC / SWIFT

Data about the proposed accommodation

Address of the accommodation
Indication if the host is staying on-site with the student
Indication if the accommodation is shared with a third party
Type of accommodation (room in apartment / room in house / independent studio)
Name given to the chamber
Free description of the accommodation
Room size (m²)
Description of the rooms (type, floor, equipment, private or shared character)
General facilities (Wifi, heating, parking, terrace, balcony, garden, lift, lock, air conditioning)
Soil type
Nearest transport stop
Room availability date
Desired rental period
Monthly rent

Preferences regarding the host student

Student's Preferred Genre
Acceptance of visits
Desired Personality Traits
Free Additional Comments

b. Data collected on the subtenant side (youth)

Personal data

Gender (Female / Male / Non-binary)
First and last name
Email address
Phone Number
Date of birth
Nationality
Profile picture
Presentation video
Status (Student / Intern / Young Worker / Other)
Address of the institution attended (university, school, employer)
Languages spoken
Hobbies and hobbies
Free presentation text

Documents submitted

Identity document (front and back: identity card or passport)
School certificate or employment contract

Housing search data

Cohabitation preference (in a woman / a man / indifferent)
Expectations of cohabitation
Use of the kitchen
Smoking status (smoker/non-smoker/occasional)
Relationship with animals
Presence of allergies

Emergency contact

Emergency contact name and surname
Emergency Contact Email Address
Emergency Contact Phone Number

c. Technical Data (for all users)

Connection logs (IP address)
Pages visited and actions taken on the site
Browsing data (cookies, session ID)
History of exchanges via the platform's internal messaging system