Privacy Policy

1. Who is responsible

The data controller is [Registered company name], Luxembourg (details in the Legal Notice). For any question about your data, write to contact@zemmer.lu.

2. What we collect

We only collect what the service needs:

• Account: username, email address and a password stored in hashed form.
• Housing profile: your financial profile (such as income and savings) and your lifestyle answers, including optional ones such as gender, studies and housemate preferences. We use them to suggest co-buyers and to show how well you would fit in a home. Optional answers can be left empty. We never ask about health, drugs, religion, political views or your relationships.
• Co-buying activity: the properties you apply to, the groups proposed to you and your answers.
• Rooms you list: the home and rooms, commune and postal code (the street is never shown publicly), photos, calendar and your housing-standards declaration. Before a listing goes live we check the landlord’s identity; we keep only the result, the date and how it was checked, not a copy of the document.
• Bookings and requests: the room, the dates, and what happens to them (accepted, cancelled, extended).
• Issues you report and the messages exchanged about them with the landlord and Zemmer.
• The obligations planner of landlords and Zemmer records which checks were done and when. For the lease and the occupants register the law requires (law of 20 December 2019), tenants give their full name, date of birth, current address and ID document number once a stay is confirmed. We never ask for a copy of the document; the number is stored encrypted and only the landlord and Zemmer staff can see it.
• Agencies: the listings you publish and the contact person you name.
• Payments: handled by Stripe. When online payment is live, Stripe also verifies landlords’ identity for payouts (Stripe Connect); we receive the payment and account status, never full card or bank details.
• Technical data: IP address and browser information in server logs, and the cookies described in our Cookies Policy.

3. Why we use it, and on what legal basis

To run your account, publish listings, process bookings and requests, prepare a draft lease, handle reported issues and suggest matches (performance of a contract). To check landlords’ identity, prevent fraud and keep the platform secure (our legitimate interest, and that of tenants not to be scammed). To send service emails about your account, bookings, requests and issues (performance of a contract). To meet accounting duties and the housing rules (legal obligation). We do not sell your data and we do not use it for advertising.

4. Who receives it

When you book a room, the landlord receives your name and email address; once the booking is accepted, you receive the landlord’s. The landlord and Zemmer see the issues you report. For co-buying, the other members of a group proposed to you and the agency selling the property receive what is needed to organise the purchase, and only after you apply.

Service providers process data on our instructions: hosting and email delivery (Hostinger, in the EU) and payments (Stripe). When you look at the map of rooms, your browser loads map images from OpenStreetMap’s servers, which see your IP address. To place a home on the map, we send its postal code and commune (no personal data) to the Luxembourg State geoportal. Internal reports of the team are kept on GitHub and contain no personal data of users.

Where data leaves the European Economic Area, we rely on safeguards such as the European Commission standard contractual clauses. We may disclose data when the law requires it.

5. How long we keep it

We keep your account data while your account is active; when you delete it, it is erased after a 30-day grace period during which you can change your mind. The identity given for the lease and the register is deleted one year after move-out. Bookings, requests and issues are kept for three years after the end of the stay, in case of a dispute, and then deleted or anonymised. Payment and invoice records are kept for ten years, as accounting law requires. Server logs are kept for a short time for security.

6. Security

Connections are encrypted, passwords are hashed and access to the database is restricted. No system is perfectly secure, so we also limit what we collect in the first place.

7. Job applications

If you send us a spontaneous application, we receive the CV and details you choose to share. We use them only to consider you for current or future roles at Zemmer, on the basis of your request to be considered (steps taken at your request before a contract). Only the people involved in hiring see them. We keep applications for up to 12 months and then delete them, or earlier if you ask. Write to contact@zemmer.lu to ask for deletion.

8. Your rights

You can ask to access, correct, delete, restrict or export your data, and object to certain uses. Many of these actions are available directly in your profile. For anything else, write to contact@zemmer.lu; we answer within one month.

If you believe your rights are not respected, you can complain to the Luxembourg data protection authority, the Commission nationale pour la protection des données (CNPD), at cnpd.lu.