Privacy policy

1. Who we are

Pando is a product of NextdoorSEC BV, a private limited company (besloten vennootschap) under Belgian law with its registered office at Brusselstraat 38, 2018 Antwerpen, Belgium. Our company and VAT number is BE0798.791.337 (RPR Antwerpen, Antwerpen division).

For any question about this privacy policy or about the processing of your data, you can reach us at info@pando.immo.

2. Controller and processor

Depending on the data, we act as controller or as processor. This distinction matters for your rights and for who you should contact.

For the data of website visitors and of account holders (the agents and agencies that register - their name, e-mail address, login, agency details, billing and usage data), NextdoorSEC BV is the controller. We decide ourselves why and how that data is processed.

For the personal data an agency itself enters into the CRM about its own clients (sellers, buyers, tenants, landlords, and the related contacts, properties and mandates), the agency is the controller and Pando/NextdoorSEC BV acts as processor, on behalf of and following the instructions of that agency, under a data processing agreement. As an end client of an agency, you address your requests about that data directly to the agency you work with.

3. Which data we process

Depending on your situation, we process the following categories of data:

• Account and contact data: name, e-mail address, phone number, language preference, agency details and login data of account holders.
• Billing and subscription data: chosen plan, number of users, billing details and payment status.
• Usage and log data: technical data about your use of the application, such as sign-in times, actions performed, IP address and device or browser information.
• Device location: only when you tap “Use my location” do we read your device's location once. We store the coordinates as the location of the property and send them to Geopunt (Digitaal Vlaanderen) to look up the address. Pando never tracks your location in the background.
• CRM content (as processor): the data an agency enters about its clients and files. We process it solely on behalf of the agency.
• Website visits and analytics: data about your visit to pando.immo, only with your consent to analytics cookies (see our cookie policy).
• Communication: the content of your messages when you contact us, and data from access requests or demo appointments.

4. Purposes and legal bases

We only process your personal data for specific purposes and always on a valid legal basis:

• Performance of the contract: to create and manage your account, deliver the service, provide support and invoice.
• Legitimate interest: to secure the service, prevent abuse, improve how it works and inform you about relevant changes.
• Legal obligation: to comply with our accounting, tax and other legal obligations.
• Consent: for non-essential analytics cookies and for any marketing communication. You can withdraw your consent at any time.

5. Recipients and processors

We never sell your data. We use carefully selected service providers (processors) that act only on our behalf and under a data processing agreement. The main ones are:

• Supabase - database and authentication (EU region).
• Vercel - hosting of the website and application, CDN.
• Resend - sending of transactional and notification e-mails.
• Upstash (QStash) - queue for background jobs.
• Vercel Blob - storage of files and documents.
• Google (Gemini via the Vercel AI SDK) - AI features, such as generating property descriptions and documents, and reading documents an agency uploads to Pando (such as a brokerage mandate, certificates or an identity card, with the data on it, including the national register number). An identity card is only read when the agent asks for it. If an agency uses its own AI key, those documents go to the provider of that key. Pando uses the paid Gemini API: Google does not use what we send and what comes back to improve its products and processes it as a processor (Gemini API Additional Terms, "Paid Services"). This keeps it a closed AI system within the meaning of art. 41 of the BIV code of ethics.
• Google Analytics 4 - website analytics, only with your consent.
• Google Ads - if you reach our website through a Google ad and have accepted cookies, we share Google's click ID (gclid) with Google to measure which ads lead to a trial request.
• Meta Platforms Ireland (Facebook/Instagram) - only if you accept cookies: the Meta Pixel on our public website and the request page, and the Conversions API when you submit a trial request. This is how we measure which ads on Facebook and Instagram lead to a trial request. With a request, we send your e-mail address, phone number and name only in hashed form (SHA-256), together with your IP address, browser and Meta's click ID (fbclid, cookies _fbc and _fbp). Meta acts as joint controller for this; without consent we send nothing to Meta.
• PostHog (EU cloud, eu.posthog.com) - product analytics, only with your consent.
• Microsoft Clarity (Microsoft) - session recordings and heatmaps of how visitors use the public website and the demo, only with your consent; typed text is masked, never in an agency's CRM.
• Sentry - error tracking and monitoring.
• Hostinger - backup mail server (info@pando.immo), only when Resend cannot send an e-mail.
• Odoo - accounting and invoicing of subscriptions (data of the agency as a customer, not the CRM content).
• Apple (Apple Push Notification service) - only if you turn on notifications in the iPhone app: we store a push token per device and send, via Apple, a notification with the title and a short text (for example the name and town of a new request). The app contains no analytics and no tracking.

We may also share data with competent authorities or advisers when this is required by law or necessary to protect our rights.

Sales figures from the CRM are never shared in a traceable way. To improve valuations for all agencies, we convert real sale prices into anonymous, aggregated figures per postcode, property type, surface band and quarter. Such an aggregate only appears when it is based on at least 5 properties from at least 2 different agencies; addresses and individual properties are never shared with other agencies.

6. International transfers

We prefer to process your data within the European Economic Area (EEA). When a service provider processes data outside the EEA, we put appropriate safeguards in place, such as the European Commission's Standard Contractual Clauses or an adequacy decision, so that your data enjoys an equivalent level of protection.

7. Retention period

We do not keep your personal data longer than necessary for the purposes for which it was collected.

We keep account and file data for the duration of the contract and afterwards for as long as necessary to meet our legal retention obligations (including accounting and tax periods). We keep analytics data for a limited period. We keep CRM content on behalf of the agency; after the subscription ends, the agency can still request an export for 30 days, and we erase that content no later than 90 days after the end. A signed subscription agreement (with the name, signature, time and IP address of the signer) and the invoices are kept for 10 years after the end, as evidence and for accounting, even if the account is deleted.

8. Security

We take appropriate technical and organisational measures to protect your data. Each agency is strictly separated from the others at database level (tenant isolation via Row Level Security), data is encrypted in transit and sensitive data also at rest, and access is limited to authorised persons on the basis of roles. We review our security on a regular basis.

9. Your rights

Under the GDPR you have the following rights regarding your personal data:

• Right of access to the data we process about you.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure (the right to be forgotten).
• Right to restriction of processing.
• Right to data portability.
• Right to object to certain processing.
• Right to withdraw consent at any time, without affecting the lawfulness of earlier processing.

You can exercise your rights by contacting us at info@pando.immo. If you are an end client of an agency, address your request about the CRM data to that agency, which is responsible for it.

If you believe we do not process your data correctly, you have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be.

10. Having your account deleted

You can have your Pando account and the related data deleted at any time, also if you use the Android or iPhone app. This is how:

• Send an e-mail to info@pando.immo from the e-mail address you sign in with, with the subject "Account verwijderen" (delete account).
• Mention the name of your agency. If you are the owner of the agency, also say whether the whole agency must be deleted or only your own account.
• We confirm your request and carry it out within one month, as the GDPR requires.

What we delete: your account data (name, e-mail address, phone number, language preference and login data) and the usage and log data linked to your account.

What we keep: invoices and billing data, for as long as the legal accounting and tax retention periods require. CRM content (clients, properties and files) belongs to the agency: we delete it at the request of the agency's owner, after an export if requested.

11. Connecting AI assistants

If you use an AI assistant with your clients' data, choose a business or paid version in which the provider does not use your data to train its models, or turn training off in that assistant's settings (for example ChatGPT, Claude, Gemini, Microsoft Copilot or Mistral Le Chat). A free consumer version that uses conversations for training is not suitable for your clients' data. Pando's built-in AI uses Google's paid Gemini API, under which Google does not use the data to train models.

You can connect an AI assistant (such as Claude or ChatGPT) to your Pando account: you sign in to Pando from the assistant and choose yourself whether the assistant may only read or may also write. The assistant never sees more than what you may see in Pando, and the connection never passes on commission and billing data, identity cards or national register numbers.

What the assistant reads through the connection (including contact and lead data of your agency's clients) is sent to the AI provider that you or your agency chose, such as Anthropic or OpenAI. That provider is not a processor of NextdoorSEC BV: processing there falls under your or your agency's own agreement with that provider. The agency remains the controller for that CRM data. These providers are often located outside the European Economic Area, for example in the United States. Whether data goes there and with which safeguards (such as the European Commission's Standard Contractual Clauses) is set out in the agency's agreement with that provider; section 6 only covers our own processors. Whether the provider keeps conversations or uses them to train models depends on the subscription and settings that you or your agency choose with that provider. A data subject who wants to exercise their rights over data in the CRM should contact the agency (see section 2).

Of a connection we only keep what is needed to make it work and to secure it: which assistant it is, which rights you granted, when the connection was made and last used, and a fingerprint (hash) of the keys, never the keys themselves. We do not keep conversations. An access key is valid for 1 hour; the connection stays valid for 60 days and is extended when used. We erase expired keys after 7 days. What the assistant creates or changes in Pando goes into the agency's normal data and activity log.

You can disconnect your connections at any time in Pando under "AI-assistent". The agency owner can disconnect every connection of the agency and switch AI assistants off for the whole agency.

12. Cookies

Our website uses cookies. Essential cookies are always active; we only place analytics cookies with your consent. You can find more information in our cookie policy.

13. Changes

We may update this privacy policy from time to time, for example for new features or changed legislation. The current version is always on this page, with the date of the last update.

14. Contact

If you have questions about this privacy policy or about the processing of your data, you can always reach us at info@pando.immo or by post at the address of our registered office.