Privacy Policy

1. Who we are

This privacy policy applies to Nexus Mortgage SG ("Nexus", "we", "us", "our"), an independent mortgage brokerage operating in Singapore. Our registered address is 190 Woodlands Industrial Park E5, #03-08, Woodlands Bizhub, Singapore 757516. We act as a "data controller" under the Personal Data Protection Act 2012 ("PDPA") for personal data you provide to us through this website, WhatsApp, email, or in person.

2. Data we collect

We collect personal data that you voluntarily provide when enquiring about a home loan, requesting a Free Refinancing Report, using our calculators, or otherwise contacting us. The categories include:

• Identity data: full name, NRIC / FIN (only when needed for bank submission), date of birth.
• Contact data: email address, mobile number, residential address.
• Financial data: employment status, monthly income, existing loan details, CPF balances, outstanding mortgage information, property details.
• Loan-application data: documents you upload or share for bank-loan submission (payslips, IRAS NOA, CPF statement, bank statements, Letter of Offer, etc.).
• Technical data: IP address, device type, browser, pages viewed, referring URL — captured by analytics tools (see Section 9).

You are not legally obliged to provide personal data, but we may not be able to provide a meaningful loan recommendation without it.

3. How we use your data

We use your personal data to:

• Provide mortgage advisory, including comparing loan packages across our partner banks.
• Submit your loan application to the bank you select, with your consent.
• Generate your Free Refinancing Report or other written analyses.
• Respond to enquiries via WhatsApp, email, or phone.
• Send you rate updates, refinancing notifications, or service-related communications — only if you have opted in.
• Maintain records for our regulatory, audit, and tax obligations.
• Improve our website, content, and tools through aggregated, non-identifying analytics.

4. Disclosure to third parties

We disclose personal data only to the parties needed to provide the service you have engaged us for:

• Partner banks — when submitting a loan application on your behalf, with your written consent. We currently have arrangements with 16 banks operating in Singapore (DBS, OCBC, UOB, SCB, BOC, HSBC, Maybank, CIMB, Citibank, RHB, and others).
• Conveyancing lawyers — when introduced by you for the legal completion of a loan switch, only with your consent.
• Regulators — where required by law (e.g., MAS, IRAS, ACRA, the police).
• Service providers — secure document storage, email delivery, calendar scheduling, and CRM tooling under written confidentiality terms.

We do not sell your personal data, and we do not share it for marketing or profiling by unrelated third parties.

5. Consent & withdrawal

By submitting your details through our website, WhatsApp, or email, you consent to our collection, use, and disclosure of your personal data for the purposes listed above. You may withdraw consent at any time by emailing [email protected]. Withdrawal of consent will not affect anything we lawfully did with your data before withdrawal, but it may end our ability to continue advising on or processing your loan application.

6. Access & correction rights

Under the PDPA, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of any data that is inaccurate or out of date.
• Request information about how your data has been used or disclosed in the past 12 months.

Send any request to [email protected] with the subject line "PDPA request". We will respond within 30 days. A reasonable fee may be charged for very large or repeated access requests.

7. Retention

We retain personal data only as long as it is needed to fulfil the purpose for which it was collected, or to satisfy legal, tax, or audit obligations. Typical retention periods:

• Active loan-application data: retained for the duration of the engagement and up to 7 years after disbursement, in line with bank and MAS record-keeping expectations.
• Refinancing-Report enquiries that did not proceed: retained for up to 24 months, then deleted unless you reactivate the engagement.
• General enquiries via WhatsApp / email: retained for up to 12 months.
• Aggregated analytics: retained indefinitely in non-identifying form.

8. Security

We take reasonable steps to protect your personal data against unauthorised access, modification, disclosure, or loss. These include access controls on document storage, encryption in transit (TLS) for the website and email, two-factor authentication on all administrative accounts, and limited internal access on a need-to-know basis. No internet-based system is perfectly secure, however, and you share data with us at your own risk.

9. Cookies & analytics

This website uses cookies and JavaScript-based analytics to understand site performance, diagnose user-experience issues, and measure the effectiveness of our content. We do not use cookies for advertising profiling, retargeting, or sale of data to third-party advertisers.

9.1 Google Analytics 4 (GA4)

We use Google Analytics 4, a service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), to measure aggregate website traffic. Our GA4 measurement ID is G-7VKFWNBRM6.

• Data collected: page URLs viewed, referring URL, device type, browser, approximate location (country / region — IP address is truncated by Google before storage), session duration, button and link clicks (including WhatsApp, phone, and email clicks), and lead-form submission events. We do not pass your name, NRIC, email, phone number, income, or any other directly identifying personal data to Google.
• Cookies set: _ga, _ga_7VKFWNBRM6 (up to 2 years), and short-lived session cookies.
• Retention: event data is retained for 14 months and then automatically deleted by Google.
• Cross-border transfer: data is processed on Google's infrastructure, which may include servers located outside Singapore (including the United States and the European Union). Google participates in the EU-U.S. Data Privacy Framework.
• Opt-out: install the official Google Analytics Opt-Out Browser Add-On, or block cookies in your browser settings.

9.2 Microsoft Clarity

We use Microsoft Clarity, a behavioural analytics service provided by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052, USA), to view aggregated heatmaps and anonymised session recordings so we can fix usability issues. Our Clarity project ID is wpg9v4xzro.

• Data collected: mouse movement, scroll depth, clicks, page navigation, browser type, device type, and approximate location. Sessions are recorded as anonymised playbacks of pointer activity, not screen video.
• Form-field masking: Clarity is configured in Strict masking mode. All text content and every form input — including names, NRIC fields, email addresses, phone numbers, income figures, and uploaded-document filenames — are masked at the browser level before the recording is sent to Microsoft. We cannot view, and Microsoft does not receive, the actual characters you type into our forms.
• Cookies set: _clck, _clsk, CLID, MUID (lifetime up to 1 year).
• Retention: session recordings are retained for up to 13 months and then automatically deleted by Microsoft.
• Cross-border transfer: data is processed on Microsoft's infrastructure, which includes servers in the United States. Microsoft participates in the EU-U.S. Data Privacy Framework.
• Opt-out: Microsoft honours the Global Privacy Control signal and the Do Not Track browser header. You may also disable third-party cookies, or review Microsoft's Privacy Statement for additional controls.

9.3 Legal basis & PDPA position

Under the PDPA, the collection and use of the technical analytics data above is supported by your deemed consent for the operation of this website, and (where you submit a lead enquiry) the explicit consent you provide via the PDPA acknowledgement checkbox on our forms. The data is used solely for legitimate business interests — improving our service, fixing site bugs, and measuring marketing reach — and is not combined with the directly identifying information you provide in lead forms.

9.4 Your control

You can refuse or disable cookies in your browser settings at any time. You can also use private / incognito browsing mode, which automatically discards cookies when you close the window. Disabling cookies will not prevent you from using the website, although some features (e.g., remembered preferences) may be reduced.

10. Data Protection Officer

Questions, complaints, or PDPA requests can be addressed to:

Dan Ler — Data Protection Officer, Nexus Mortgage SG
Email: [email protected]
WhatsApp: +65 8752 0859
Address: 190 Woodlands Industrial Park E5, #03-08, Woodlands Bizhub, Singapore 757516

If you are not satisfied with our response, you may escalate to the Personal Data Protection Commission of Singapore at pdpc.gov.sg.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be flagged on this page and, where appropriate, communicated by email to clients with active engagements.

See also: Terms of Use.