Last updated: 3 November 2026
Renting a home means sharing personal information: your income, your identity, where you live. This policy explains what Nexo collects, why, who sees it, and how long we keep it — in line with the EU General Data Protection Regulation (GDPR, in Dutch: AVG).
1. Who is responsible
Nexo Housing VOF ("Nexo"), Pieter Calandlaan 554, 1060 TV Amsterdam, KvK 42164696, is the controller of your personal data.
Privacy questions or requests: support@nexohousing.com.
2. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account | name, e-mail address, phone number, username, password (stored only as a one-way hash) | you |
| Tenant profile | photo, date of birth, occupation, employer, income, household, pets, move-in date, guarantor | you |
| Landlord profile | type (private, company, agent), company name, KvK number, address, IBAN for rent payouts | you |
| Identity check | the outcome of the check and when it was done | Didit (see §5) |
| Income check | the figures read from the payslip or employer statement you upload (gross income, employer, period) — not the document itself | you, read by Didit (see §5) |
| Listings | address, photos, description, rent, documents proving you may rent the home | you (landlords) |
| Documents a landlord asks for | after a viewing, the landlord or agent may ask you for proof of identity and income (for example payslips or an employer statement); you choose whether to upload them | you |
| Applications and tenancy | applications, viewings, offers, the rental agreement, inspection reports and their photos, meter readings, rent payments and invoices | you and the other party |
| Signatures | your name, typed or drawn signature, the time, IP address and browser, and a fingerprint of the signed document | recorded when you sign |
| Auto-apply | your filters (places, maximum rent, bedrooms, living area, furnishing), the message sent with each application, and which applications it sent | you |
| Payments for Premium and Auto-apply | amount, status, payment method and Mollie's payment reference; for Auto-apply also Mollie's references for you as a customer, your subscription and the authorisation to collect later months — not your bank or card details | Mollie (see §5) |
| Rent and deposit paid through Nexo | for the landlord: that their Mollie account is connected, its status and Mollie's account references (the access Nexo was given is stored encrypted); for both: amounts, the month paid, status and Mollie's payment reference — not bank or card details | Mollie (see §5) |
| Reviews (NestPass) | ratings and comments you give and receive | you and the other party |
| Technical | log data such as IP address and browser, needed to run and secure the service | your device |
We do not ask for or store your BSN (citizen service number). Identity documents and income documents are checked by Didit; we do not keep copies of either.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Running your account and the platform: listings, applications, viewings, offers | contract (b) |
| Sending applications for you with Auto-apply, when you have switched it on | contract (b) |
| Drawing up, signing and storing rental agreements and inspection reports | contract (b) |
| Verifying identity and income, so landlords can rely on what applicants say | contract (b); legitimate interest (f) in preventing fraud |
| Processing payments for Premium and Auto-apply and keeping financial records | contract (b); legal obligation (c): tax law requires 7 years |
| Security, fraud prevention, handling disputes and complaints | legitimate interest (f) |
| Service messages about your applications, tenancy and payments | contract (b) |
| Newsletters or marketing, if you ask for them | consent (a) — you can withdraw at any time |
4. Who sees your data
Other users — only what the process requires:
- Landlords see the profile and application of tenants who apply to *their* home, including verified income and the *result* of identity checks. They never see the documents from your identity or income check.
- After a viewing, a landlord or agent may ask you for documents. Only they see what you upload, and only once you send it.
- Once a tenancy starts, both parties see the agreement, inspection reports, rent payments and the contact details you chose to share.
- Your public profile shows your username, NestPass ratings and verified badges.
Service providers who process data on our behalf, under a data processing agreement:
| Provider | What for | Location |
|---|---|---|
| Supabase | database, login and file storage | EU (Frankfurt) |
| Vercel | hosting the website | EU and US |
| Didit | identity verification and reading uploaded income documents | EU (Spain) and US |
| Brevo | sending account e-mails (confirmation, password reset) | EU (France) |
Where a provider processes data outside the European Economic Area, the transfer is covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
Mollie, our payment provider (Mollie B.V., Amsterdam), handles payments for Premium and Auto-apply, and rent and deposit paid through Nexo, which Mollie pays out to the landlord's bank account. Mollie is not a service provider working on our instructions: it processes payment data as an independent controller, because the law on payment services obliges it to check payments for fraud and money laundering itself. Mollie's own privacy statement (mollie.com/legal/privacy) applies to what Mollie processes. We share with Mollie only what a payment needs.
Authorities — only where the law obliges us to.
We never sell your personal data.
5. Identity checks, income checks and payments in more detail
- Identity (Didit): you photograph your ID and take a selfie in Didit's secure flow. Didit compares them and tells us the result. We store the outcome and when it happened — not the document or the selfie — and as soon as the check is done we ask Didit to delete its copy of them. Didit's own privacy policy applies to what Didit processes.
- Income (Didit): the document you upload is sent straight to Didit, which reads the income figures and checks the document for tampering. Neither Nexo nor Didit keeps the document; we store only the figures and the outcome. Landlords see the verified figures.
- Payments (Mollie): you pay on Mollie's payment page. Mollie handles your bank or card details, as an independent controller (see §4); we only receive whether and how the payment was made. For Auto-apply, Mollie keeps the card or the bank account you paid from (for a SEPA direct debit) to collect the following months; we receive only references to them, never the card or account number.
6. Sorting applicants
A landlord or agent can sort applicants by verified data and income. This helps them read applications; it does not decide anything. The landlord or agent chooses who to invite and to whom to offer the home. There is no decision about you based solely on automated processing.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and profile | as long as your account exists |
| Rental agreement, inspection reports, signatures | the length of the tenancy plus 2 years (the period for claims about the state of the home), or until both parties have deleted their accounts |
| Invoices and payment records | 7 years (Dutch tax law) |
| Income check figures | 6 months from the check, then deleted |
| Identity check outcome | tenants: 6 months from the check, then deleted; landlords and agents: as long as the account exists |
| Documents a landlord asked for | until the application closes (offer accepted or declined, application withdrawn or rejected), and at most 30 days after the request |
| Logs | up to 30 days |
When you delete your account, we delete your profile, listings, applications, messages, photos and other uploaded files, and ask Didit again to delete any photos of your ID and selfie it still holds. Payment records stay for 7 years, as tax law requires, but no longer name you. Records of moderation decisions stay without your name.
If you rented through Nexo, the tenancy stays available to the other party once your account is gone: the signed agreement, inspection reports and payment history are theirs too, and the signed documents keep the name you signed with. We keep them for claims about the home; once both parties have deleted their accounts, we delete them.
While a tenancy hasn't finished — its end date hasn't passed, or the deposit hasn't been settled — your account can't be deleted straight away, because you both still need its records (GDPR art. 17(3)(e)). You can ask for it to be deleted automatically once the tenancy has finished; until then we withdraw your open applications and pause your listings.
8. Your rights
You have the right to:
- see the personal data we hold about you (access);
- correct it if it's wrong — most of it you can edit in your profile;
- have it deleted — you can delete your account yourself;
- restrict or object to processing based on legitimate interest;
- receive your data in a portable format;
- withdraw consent where processing is based on it.
E-mail support@nexohousing.com. We reply within three business days, and complete your request within one month at the latest. We may ask you to confirm your identity first.
If you're not satisfied, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
9. Cookies
Nexo uses only cookies that are needed for the site to work:
| Cookie | Purpose |
|---|---|
sb-… (Supabase) | keeps you signed in |
NEXT_LOCALE | remembers your language |
active_role | remembers whether you're using Nexo as a tenant, a landlord or an agent |
We don't use advertising or analytics cookies. Because these cookies are strictly necessary, they don't require consent. If we add any other cookies, we'll ask first.
10. Security
Data is encrypted in transit (TLS) and at rest (by our database provider, Supabase), and access is restricted per user: other users can only see what is described in §4, enforced in the database itself. Documents are in private storage and opened through short-lived links. Payments run through Mollie, which is licensed and supervised by De Nederlandsche Bank.
11. Children
Nexo is for people aged 18 and over. We don't knowingly collect data from anyone younger.
12. Changes
We may update this policy. We'll announce material changes by e-mail or in the app before they take effect.