1. Data controller
The controller of personal data collected via the Where Next site is Dreamzup OÜ, headquartered at Tartu mnt 67/1-13b, 10115 Tallinn, Estonie. For any question relating to your personal data, you can write to contact@where-next.me.
2. Data collected
We collect only the data strictly necessary for the service to function:
- Account data: email address, password (encrypted), first and last name if provided. Collected when creating an account.
- Subscription data: status (Free, Monthly Pro, Annual Pro), subscription date, billing data. Collected via our authorised payment service provider.
- Expatriation profile data: declared situation (professional status, family situation, income bracket, target countries). Voluntarily provided to personalise our recommendations.
- Usage data: pages viewed, actions performed, session duration. Collected through third-party audience measurement tools, including Google Analytics 4 on the public website, only after your consent. Processing outside the European Union may occur.
- Newsletter data: email address and subscription/unsubscription status. Collected if you subscribe to our monthly newsletter.
3. Purposes and legal bases
| Purpose | Legal basis | Duration |
|---|---|---|
| User account management | Contract performance | Account duration + 3 years |
| Billing and subscriptions | Contract performance | 10 years (accounting obligation) |
| Content personalisation | Contract performance | Account duration |
| Product analytics | Consent (cookies) | 13 months |
| Newsletter | Consent | Until unsubscribe |
| Customer support | Legitimate interest | 3 years after last contact |
4. Sub-processors and transfers outside EU
To operate, Where Next relies on authorised technical providers. Each is bound by a contract governing data processing and guaranteeing a level of protection compliant with GDPR:
| Recipient category | Purpose | Location |
|---|---|---|
| Prestataire d’hébergement base de données | Stockage des comptes utilisateurs et des abonnements | Union européenne |
| Prestataire d’hébergement applicatif | Diffusion du site et de l’application | États-Unis (transferts encadrés par le Data Privacy Framework) |
| Prestataire de traitement des paiements | Gestion des abonnements et des transactions | États-Unis (transferts encadrés par le Data Privacy Framework) |
| Prestataire d’envoi d’emails | Envoi des emails transactionnels et de la newsletter | États-Unis (transferts encadrés par le Data Privacy Framework) |
Transfers outside the EU (mainly to the United States) are framed by the Data Privacy Framework (DPF) to which our American providers adhere, or by standard contractual clauses adopted by the European Commission. The exhaustive list of our sub-processors, including audience analytics providers, is available on simple request to contact@where-next.me.
5. Your rights
In accordance with GDPR, you have the following rights over your personal data:
- Right of access: obtain a copy of the data concerning you.
- Right to rectification: correct inaccurate or incomplete data.
- Right to erasure: request deletion of your data.
- Right to restriction: temporarily suspend the processing of your data.
- Right to portability: retrieve your data in a structured and reusable format.
- Right to object: object to processing for legitimate reasons.
- Right to withdraw consent: at any time, for processing based on consent.
To exercise these rights, write to contact@where-next.me. We respond within a maximum of 30 days. You may also lodge a complaint with the competent supervisory authority: the Estonian Data Protection Inspectorate (aki.ee) or the CNIL in France (cnil.fr).
6. Security
Your data is stored on secure servers located in the European Union, with encryption in transit (TLS 1.3) and at rest. Passwords are hashed with bcrypt. Access to data by Dreamzup OÜ teams is limited to what is strictly necessary and tracked. In case of a security incident likely to affect you, you will be informed within 72 hours in accordance with article 34 GDPR.
8. Changes
This privacy policy may be updated to reflect legal or technical developments. Any substantial change will be notified to you by email at least 30 days before entry into force. The date of the last update is shown at the bottom of this page.
Last update: 2026-05-14