Privacy policy

What data do we collect?

• Property data: Address, postcode, municipality, asking price, surface area, EPC, property type and other fields you enter or confirm. For processing and retention details, see Transparency.
• Financial input: Income, own funds, loan term and related fields. Only if you enter them yourself for the affordability check.
• Email address: If you want your report by email or price updates for a report.
• Aggregate site statistics: Anonymous, cookieless pageview counts and popular pages via Vercel Web Analytics - always active, no individual profiles. Internal product measurement: form views, funnel steps and technical context (screen size, device type) via our own database (Convex) - first-party, no individual ad profiles, max 90-day retention.

What do we use your data for?

We use your data to build your property analysis and affordability check. For price comparison we rely primarily on Statbel (FPS Finance sale deeds) and secondarily on the Fednot property barometer. We only use your email to send your report and, if you want, an occasional update.

Your full report may contain an exact address and financial fields you enter yourself. For product improvement and internal benchmarks we also use a minimised copy (property characteristics, scores, postcode/municipality) without exact address and without those financial details. That happens only inside Pandwijzer; we do not sell report data to third parties. The only structural exception is the lead-sharing described below: if you explicitly opt in to be contacted by the real-estate agent, renovation partner or mortgage partner for your postcode, we forward on your request your email address (and phone number or report summary if you provide them) to that company.

We use aggregate pageviews to understand traffic and popular pages (cookieless). Internal product measurement helps us improve funnels and product behaviour - first-party, no third party.

Sharing leads with a real-estate, renovation or mortgage partner

When you actively click the send button on a result or report page to be contacted by the active partner for your postcode, you give your explicit consent through a clear, affirmative action (article 6.1.a in conjunction with 4(11) GDPR). Right above that button a short disclosure text states which data (email address, optionally your phone number and - for renovation and mortgage - a short report summary) is shared with which partner and how you can withdraw. On that basis we share your details with the partner. For this sharing, Nakamas BV (Pandwijzer) and the partner are joint controllers (article 26 GDPR): Nakamas BV is the primary contact point for your rights; the partner is responsible for their own follow-up and file. You can withdraw your consent at any time via [email protected]. As consent evidence we keep the exact on-screen disclosure text, its version and the timestamp of the click, for a maximum of 24 months.

Retention periods

• Market and neighbourhood cache: short retention to reuse public aggregates, then cleaned up.
• Security signals: limited retention to reduce abuse and rate-limit issues.
• Market data cache: 7 days, then physically deleted.
• Mobility (transit/green, server): 7 days, then removed on cleanup (see Transparency).
• Minimised benchmark copy: tied to your report; removed when you delete the report.
• Product measurement (first-party): max 90 days; then automatically purged.
• Accounting and invoicing (paying partners): 7 years, as required by article III.86 of the Belgian Code of Economic Law. This covers invoices, payment data and related correspondence; not user report data.

Third-party services (processors)

To run Pandwijzer we rely on a small set of processors. We keep the list deliberately short and up to date:

• Convex - application database and serverless backend (data stored in the EU).
• Vercel - hosting, CDN, edge functions and aggregate web statistics (cookieless pageviews). The connection to your browser always uses TLS 1.2+.
• Stripe (Stripe Payments Europe Ltd., Ireland) - processing of partner payments. Payment details are entered directly with Stripe; we never see them.
• Resend - sending transactional emails (reports, updates, partner and DSR communication).
• Ad platform - conversion measurement for ad campaigns, only after consent via the cookie banner (see Cookies). No selling of personal data.
• OpenStreetMap, Statbel, Fednot, geo.be, iRail and comparable open sources - market and map data (see Transparency).
• Sentry - technical error monitoring to keep the site stable (no marketing, no session recordings).
• Sub-processors - additional technical parties in the chain of the processors above, for hosting, delivery or support only, with appropriate agreements (art. 28 GDPR) where required.

Where a processor nevertheless processes data outside the European Economic Area (for example Stripe or Resend support or sub-processors), we rely on the European Commission Standard Contractual Clauses (SCC) together with supplementary technical and organisational measures. An up-to-date sub-processor list is available on request via [email protected].

Cookies

We measure aggregate pageviews cookielessly via Vercel Web Analytics (always active). Internal product measurement (funnel steps) runs via our own database without cookies or third-party tags. Ad conversion tracking is only enabled after Accept in the cookie banner. If you choose Close, necessary processing, aggregate pageviews, first-party product measurement and your banner preference remain active. Cookie preferences in the footer reopens the banner.

Accept: you allow ad and conversion tracking. Close: you decline marketing tags; only necessary processing, first-party product measurement, cookieless pageviews and your banner preference remain active.

Your rights

You have the right of access, rectification, erasure, restriction, data portability, objection and to withdraw consent previously given. We respond within one month of your request. Contact us via [email protected]. If you cannot resolve a matter with us, you can also lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).

Data breaches

In the event of a data breach we notify the Data Protection Authority within 72 hours as required by article 33 GDPR, and - if you are at high risk - we notify you directly as well (article 34 GDPR). For partner data, Nakamas BV and the partner also apply a mutual 48-hour notification window.