Everything your IT department wants to know, on one page

The tour runs on servers in the Netherlands. That’s also where the database and the backups are. Audio and images are also stored in the EU. For translation and voices, we also work with processors outside the EU. European contractual terms apply to them, and visitor data doesn’t go to them.

Yes, with every customer, together with the contract. Your organisation is the controller and Wandrz is the processor. We report a data breach no later than 48 hours after discovering it.

The DPA comes with every quote.

The full list of sub-processors is in the DPA, which comes with every quote. If a processor is added or changed, you’ll hear about it at least 30 days in advance and you can object. If we can’t resolve it together, you can cancel at no cost.

With two-step verification: required for Owners, on by default for everyone and enforceable for your whole team. A session expires after 8 hours of inactivity and after 12 hours at most. There’s no open registration: only people you invite can get in.

You work with unlimited colleagues, in four roles: Owner, Editor, Reviewer and Viewer. Everyone can only do what belongs to their own role. The activity log shows who did what.

Only staff assigned to your organisation, and only what they need for their role. They work in your account when that’s needed for support, maintenance or work you’ve asked us to do, always under their own name. The activity log shows who at Wandrz did what. Everyone at Wandrz is bound by confidentiality.

No. We only use your data to create and run your tour. We don’t sell it and we don’t train AI models with it.

Every type of data has a fixed retention period, and anything that has expired is deleted every day. A few examples: log files 14 days, visitors’ access passes up to 30 days after they expire, the activity log 1 year. We keep your team’s accounts for as long as they exist and for 30 days after that. The full list is in the data processing agreement, which comes with every quote.

Yes, twice a day, encrypted, in a separate data centre in the Netherlands. We keep them for 30 days and check every backup automatically. The files for visitors are stored in two places: if one goes down, the other takes over. In the event of a disaster, we aim to restore everything within one working day.

We aim for 99.5% availability per month, for the tour and for the dashboard. Every minute, a service outside our own servers checks that everything is working. The result is shown live on status.wandrz.eu. As a rule, we put updates live without visitors noticing anything.

If the tour or the dashboard can’t be reached, we start work within an hour during office hours and you get an update every hour. Outside office hours, we pick it up as soon as possible. We answer an ordinary question within two working days; with Pro, you get priority. You can reach us at hello@wandrz.eu and on working days from 9 to 5 on +31 85 004 6611.

The SLA comes with every quote.

The AI Act requires that people know when they’re listening to AI-generated content. This is how Wandrz handles that: by default, every stop shows a label saying the voice was narrated with AI. The audio itself also carries a marker that computers can read. Your own recordings don’t get that label. And you approve every version before it goes live.

We test the visitor app and the dashboard against WCAG 2.2 AA. Visitors can adjust the playback speed, skip back or forward 15 seconds, read along with the text and work at 200% text size. Does your organisation have to publish an accessibility statement? Then you can adopt our statement for the tour. It also says what has already been tested and what is still to come.

Read the accessibility statement

Yes. Up to 90 days after the end of your contract, you can request an export of your texts, translations, own recordings and images. You get a download file that stays available for seven days. The AI voices are only for use in the tour and aren’t included.

Your tour can then no longer be reached, and you can only view your dashboard. After 90 days, we delete your content and the personal data; backups are overwritten within 30 days after that. We only keep what the law requires for longer: invoices for 7 years and the activity log for up to a year after the event.

Yes. Once a year, an independent expert may check whether we comply with the data processing agreement, with at least 30 days’ notice. If you’re carrying out a DPIA for the tour, we’ll help you with it.