Privacy policy and GDPR
In accordance with the General Data Protection Regulation (EU 2016/679), here is how Pandem collects, uses and protects your personal data.
16 October 2026
Data controller
Data we collect
Identity
First name, last name, email address, phone number
Billing
Postal address, payment details (via PayPal / Stripe)
Technical
IP address, access logs, server information
Communication and KYC
Messages via tickets or email, and government-issued ID when required
We do not collect any special category data as defined in Article 9 of the GDPR (ethnic origin, political opinions, health data, etc.).
Purposes of processing
Why we process your data
Managing your customer account and access to our services
Processing orders and billing
Providing and maintaining the services you order (VPS, game servers, Discord bots, web hosting, email, DNS)
Technical support and responding to your requests
Sending account-related communications (invoices, alerts)
Compliance with legal obligations (accounting, fraud prevention)
Security of our infrastructure and abuse prevention
Identity verification and KYC compliance
Data retention
How long we keep your data
When you close your account, it is anonymised at once; what the law requires us to keep is held apart, encrypted, used only to answer a legal request from the authorities, and deleted at the end of its period.
Data sharing and transfers
Who has access
Pandem does not sell your personal data to third parties.
Payment providers
PayPal, Stripe, secure transaction processing
Infrastructure providers
Ikoula (France: customer databases, @pandem.fr mail), Oracle Cloud (France: status page, encrypted backups), Akwa (France: network, incoming mail relays), a partner's server near Lyon (France: one copy of the mail service). Details in the legal notice.
Competent authorities
Upon lawful request (law enforcement, courts)
Where data is transferred outside the EU, Pandem ensures appropriate safeguards are in place (standard contractual clauses, adequacy decision, etc.).
Data security
How we protect your data
Encryption
Every connection is encrypted (HTTPS, TLS for mail). Off-site backup copies are encrypted. The disks of our own servers are not encrypted; access to them is restricted to Pandem's administrators.
Two-factor authentication
2FA available on every account
Access control
Data access restricted to authorised personnel
Monitoring
Regular backups and access monitoring
In the event of a data breach likely to pose a risk to your rights and freedoms, you will be notified within the timeframes prescribed by the GDPR.
Your rights
Control over your personal data
Right to rectification
Correct inaccurate or incomplete data
Right to erasure
Request deletion of your data ("right to be forgotten")
Right to portability
Receive your data in a structured, machine-readable format
Right to object
Object to processing based on legitimate interests
To exercise these rights, contact us at contact@pandem.fr. We will respond within one month. You may also lodge a complaint with the supervisory authority in your country of residence.
Cookies
Cookie policy
Pandem uses cookies and your browser's storage only to keep you signed in and to remember your choices (cookie choice, language, theme, plan list). No advertising cookies, no tracking pixels, no analytics. Everything is listed below. You can change your choice at any time with “Cookie preferences” at the bottom of every page.
Categories used
Essential (sign-in, cookie choice, the language you picked; always on, no consent needed) and functional (theme, plan list, your name on the page; only if you accept). No analytics cookies. No advertising cookies.
Recipients
Our cookies and stored preferences are read by Pandem only, on our own servers in France. A few pages use services from other companies: they are listed below.
Retention
The sign-in cookie lasts 7 days, or until you sign out. Your cookie choice is kept 13 months, then we ask again (CNIL). Preferences in your browser stay until you clear them; the functional ones are erased as soon as you decline.
Withdrawal of consent
Change your choice at any time with “Cookie preferences” at the bottom of every page, by clearing your browser data, or by emailing contact@pandem.fr. On Decline, Pandem immediately erases the local-storage preferences tied to that choice.
What we keep in your browser
Only a few small things, so the site works and remembers your choices. Nothing here follows you to other sites.
Always on: the site needs these
Without them you could not sign in. The law does not require us to ask you for these.
- Keeps you signed in7 days, or until you sign out
- Keeps your sign-in safe when you open your dashboard or a panel10 minutes
- Remembers your cookie choice13 months, then we ask again
- Remembers the language you choseUntil you change it
- Remembers the messages you closed and a sign-in you have startedUntil you close the tab
Only if you click “Accept”
Small comforts. If you decline, we erase them from your browser.
- Your light or dark themeUntil you clear your browser
- The list of plans, so pages open fasterUntil you clear your browser
- Your name and picture, so they appear at once when a page opensUntil you sign out (if you decline: until you close the tab)
Technical names
pandem_tokenKeeps you signed in__Host-pandem_ssoKeeps your sign-in safe when you open your dashboard or a panelpandem_cookie_consentRemembers your cookie choicepandem_locale_choiceRemembers the language you chosedismissed_maintenance, pandem_mfa_*, pandem_2fa_suggestionRemembers the messages you closed and a sign-in you have startedpandem-themeYour light or dark themepandem:plans_cacheThe list of plans, so pages open fasterpandem_userYour name and picture, so they appear at once when a page opens
Services from other companies, on some pages
Cloudflare Turnstile
Where: Sign-in, sign-up, password reset, abuse form
Checks that a person, not a bot, is sending the form. Cloudflare, Inc. (United States) receives technical data about your browser, only for that.
Discord
Where: About us
The team's profile pictures load from Discord's servers: Discord, Inc. (United States) sees your IP address.
Base Adresse Nationale
Where: Sign-up and account (billing address)
When you type an address, the text goes to api-adresse.data.gouv.fr (French State) to suggest matching addresses.
Stripe, PayPal
Where: When you pay
You pay on their own pages; they set their own cookies there, under their own policies. None of their scripts run on our pages.
Contact
Questions about this policy?
For any question about this policy or to exercise your rights (access, rectification, erasure, portability, restriction, objection):
This privacy policy may be updated. We will notify you of any significant changes by email or via a notification on our site.