Personal Data Protection Policy

NextNest's Commitment to Your Privacy

Last updated: 12 December 2025

Introduction

This Personal Data Protection Policy ("Policy") explains how NextNest Pte. Ltd. ("NextNest", "we", "us", "our") collects, uses, discloses and protects personal data in the course of our business in Singapore.

We are committed to handling your personal data in accordance with the Singapore Personal Data Protection Act 2012 ("PDPA").

This Policy applies to personal data in our possession or under our control, including personal data held by organisations engaged by us to perform services on our behalf.

What this Policy Covers

This Policy explains, in particular:

  • What kinds of personal data we collect
  • How we collect personal data
  • The purposes for which we collect, use and disclose personal data
  • Use of anonymised data and scenario intelligence
  • Referrals to and from third parties (including banks and real estate agents)
  • How we obtain consent and how you may withdraw it
  • How we keep personal data accurate and up to date
  • How we protect and retain personal data
  • How you may access and correct your personal data
  • How to contact our Data Protection Officer

Where appropriate, this Policy should be read together with any consent forms, notices, or terms and conditions that apply to your relationship with us.

What Personal Data We Collect

"Personal data" means data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access.

Depending on your relationship with us, the personal data we may collect includes, but is not limited to:

Identification details

Name, NRIC/FIN/passport number, date of birth, nationality, gender, marital status

Contact details

Mobile number, residential address, email address, preferred contact channel

Financial and employment information

Employment status, employer name, job title, income, bonuses, variable pay
Bank statements, payslips, tax statements (e.g. IRAS Notice of Assessment), CPF contribution history
Existing loan information (e.g. property loans, other borrowings), credit facilities

Property and mortgage-related information

Property address, type of property, ownership details, purchase price, loan amount, tenure
Information on existing mortgages, refinancing details, repricing decisions
Intended purchase, sale or refinancing scenarios

Supporting documentation

Copies of identity documents, proof of address, legal/completion documents, option-to-purchase, tenancy agreements and other documents relevant to assessing or implementing your loan or property-related plans

Technical and usage data (website/digital channels)

IP address, browser type, device identifiers, pages viewed, time spent on pages, cookies and similar technologies where enabled

We generally do not collect sensitive personal data such as medical records or religion for our core services. If such data is provided to us incidentally (e.g. appear in documents you supply), we will treat it with the same care and only process it where reasonably necessary for the purposes described in this Policy or as required by law.

How We Collect Personal Data

We collect personal data in various ways, including:

  • When you engage us to provide loan review, comparison, advisory or application support
  • When you fill in our forms, whether online or in hard copy (including our client consent forms)
  • When you provide documents or information to us directly via messaging apps, email, portals, or in person
  • When you communicate with us by phone, WhatsApp, SMS, email or other channels
  • When you use our websites, tools or digital services
  • From banks, financial institutions, property agents or other partners, where you have authorised such sharing
  • From public sources, where permitted (e.g. public registers, property portals, government data made publicly available)

Important: Where you provide personal data of another individual to us (for example, a spouse, co-borrower, guarantor or family member), you are responsible for ensuring that the individual has been informed of this Policy and that you have obtained their consent to the collection, use and disclosure of their personal data for the purposes described.

Purposes for Collection, Use and Disclosure

We collect, use and disclose personal data primarily to support property financing and related services, including:

A. Core mortgage and loan-related purposes

  • Assessing your mortgage eligibility, options and requirements, including affordability, financing structure and scenario planning
  • Reviewing your existing loans and intended transactions for refinancing, repricing, equity term loans or new purchases
  • Comparing options and scenarios across different banks or lenders
  • Preparing, submitting and administering applications with banks, lenders and related service providers
  • Communicating with you on requirements, documentation, timelines, indicative terms, approvals, rejections, conditions and next steps
  • Coordinating with your professional advisers, such as lawyers, property agents and other relevant parties, where appropriate and authorised by you

B. Legal, regulatory, audit and risk management

  • Meeting or supporting compliance with legal, regulatory, audit and risk-management requirements, including anti-money laundering / countering the financing of terrorism (AML/CFT), know-your-customer (KYC) checks, sanctions screening and other due diligence, where applicable
  • Responding to lawful requests by public agencies, regulators or law enforcement authorities

C. Service quality and operations

  • Managing our relationship with you, including record-keeping, billing (if applicable), responding to queries and handling feedback
  • Improving our internal processes, workflows and tools, including training, quality assurance and service development

D. Marketing and communications (optional, where consented)

Informing you of relevant updates, market commentary, tools or events that may be of interest to you, where you have given your consent to receive such communications. You may opt out at any time (see Section 7 and 9).

Use of Anonymised Data and Scenario Intelligence

Over time, NextNest may analyse patterns across different client cases to improve the clarity and quality of our advisory tools and scenario planning.

Where we do so, we use data in anonymised or aggregated form, such that individuals are not identifiable.

Examples include:

  • Analysing common refinancing patterns by property type and loan profile
  • Studying loan structuring decisions across demographics and income bands (without identifying individuals)
  • Testing and refining internal calculators, comparison tools and scenario engines

Commitment: We do not use anonymised patterns with the intention or effect of re-identifying individuals. Any use of data for such scenario intelligence remains subject to the PDPA's requirements on purpose limitation and protection.

Referrals, Third Parties and Real Estate Agents

In the course of assisting with your mortgage and property-related plans, it may be helpful for us to work with third parties, including banks, financial institutions, law firms and property agents.

A. Banks and lenders

We may disclose your personal data to banks, financial institutions or lenders where necessary to:

  • assess eligibility
  • obtain indicative terms
  • submit or manage applications
  • coordinate approvals, conditions and drawdown

This is done only with your knowledge and for the purpose of your financing needs.

B. Real estate agents and other partners

Where helpful, and with your knowledge, we may introduce you to partner real estate agents or other service providers to ensure your property and financing plans stay aligned (for example, in relation to sale and purchase timelines, completion structures and loan conditions). Such introductions are optional, and you are free to decline or work with your own chosen representatives.

NextNest may receive a referral fee for such connections. This does not affect the terms offered to you by the partner, and we will continue to act with the aim of supporting a coherent, well-coordinated property-and-financing journey.

C. Service providers and vendors

We may also share personal data with third-party service providers (e.g. IT vendors, document storage providers, CRM and communication tools) who perform services for us. Such parties are generally subject to confidentiality obligations and may only use personal data for the purposes for which it is disclosed.

We do not sell your personal data to third parties.

Consent, Withdrawal of Consent and Consequences

By engaging NextNest, providing personal data to us, or continuing to interact with us, you are generally deemed to consent to our collection, use and disclosure of your personal data for the purposes described in this Policy and in any applicable consent forms.

Withdrawing Your Consent

You may withdraw your consent for our continued use or disclosure of your personal data by writing to our Data Protection Officer (see Section 10). Please indicate clearly:

  • your full name and identification details
  • the specific purpose(s) for which you wish to withdraw consent

Consequences of Withdrawal

After we receive your request, we will inform you of any likely consequences, which may include:

  • our ability to continue advising you or processing your applications may be limited or prevented
  • banks or partners may not be able to proceed with your applications
  • certain services, scenarios or recommendations may no longer be available

We will process your request within a reasonable time and will cease (or cause our data intermediaries to cease) collecting, using or disclosing your personal data for the stated purpose(s), except where retention is required or permitted by law, or where necessary to fulfil our ongoing obligations to you (for example, record-keeping for completed transactions).

Accuracy and Updating of Personal Data

We rely on you to provide complete, accurate and up-to-date information so that we can provide meaningful and appropriate scenarios and recommendations.

By providing personal data to us, you represent that the information is true, accurate and complete to the best of your knowledge, and you understand that inaccurate or incomplete information may affect your application outcome or the suitability of scenarios considered.

If your personal data changes (for example, change of contact number, income, employment, marital status or property plan), please notify us as soon as reasonably practicable so that we can update our records and, where necessary, refine our advice or assessments.

Protection, Retention, Access and Correction

A. Protection

We take reasonable technical, administrative and physical measures to safeguard personal data in our possession or control against loss, misuse, unauthorised access, disclosure, alteration or destruction. These measures may include:

  • access controls and authentication
  • encryption or secure storage of sensitive documents where appropriate
  • limiting access to personal data to staff and service providers on a "need-to-know" basis
  • staff training and awareness on data protection responsibilities

Important: No method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect personal data, we cannot guarantee absolute security.

B. Retention

We retain personal data for as long as is reasonably necessary to fulfil the purposes for which it was collected, and to satisfy legal, regulatory, accounting or business requirements.

The precise retention period may vary depending on:

  • the nature of the data
  • the type of matter or transaction
  • applicable regulatory obligations (for example, record-keeping periods under financial or tax regulations)

When personal data is no longer required, we will take reasonable steps to dispose of or anonymise it in a secure manner.

C. Access and Correction

You may request:

  • access to personal data that we hold about you, and/or
  • correction of any inaccurate or incomplete personal data

by contacting our Data Protection Officer (see Section 10).

To protect your privacy and security, we may need to verify your identity before processing such requests. We may charge a reasonable fee to cover the administrative costs of processing an access request, and will inform you of the fee before proceeding.

There are circumstances under the PDPA where we may be permitted or required to refuse access or correction (for example, where providing access would reveal personal data about another individual or confidential business information). If we are unable to fulfil your request in full, we will generally explain the reasons, to the extent we are permitted to do so.

Use of Cookies and Website Technologies

Our websites and digital services may use cookies and similar technologies to:

  • remember your preferences
  • understand how our sites and tools are used
  • improve user experience and content relevance

You may choose to disable cookies in your browser settings. However, doing so may affect the availability or functionality of certain features.

Where cookies or other technologies collect data that can identify you, we will treat such data as personal data and handle it in accordance with this Policy.

Third-party Sites and Services

Our websites or communications may contain links to third-party websites or services. We are not responsible for the privacy practices or content of such third parties.

If you visit those websites or use those services, you should review their privacy policies to understand how they process your personal data.

Data Protection Officer and Contact Details

If you:

  • have any questions about this Policy
  • wish to make a request to access or correct your personal data, or
  • wish to withdraw consent

you may contact our Data Protection Officer (DPO) at:

Phone
+65 8334 1445
Address
7 Temasek Boulevard, #12-07, Suntec Tower One, Singapore 038987

Please include your full name and sufficient details of your query or request. We will aim to respond within a reasonable time.

Updates to This Policy

We may update or amend this Policy from time to time to reflect:

  • changes in our practices
  • changes in legal or regulatory requirements, or
  • improvements in how we communicate our data protection approach

Any updates will be posted on our website with a revised "Last updated" date. Where required by law, we will notify you of material changes and, where necessary, obtain your further consent.

Your continued use of our services, website or continued provision of personal data after such changes are made will constitute your acknowledgement and acceptance of the updated Policy.