Privacy Policy

This policy explains how Nemax GCC Limited (Hong Kong, Company No. 77533929), trading as “NEMAX Finance” (“we”, “us”), handles personal data in the NEMAX Finance website, client portal and mobile applications (together, the “Services”).

1. What we collect

Category	Examples
Identity & contact	name, email address, mobile number, borrower type
Application & asset data	requested co-financing amount, property value and location, strategy, term, deadline, comments
Verification documents	passport / Emirates ID, title deed, contracts and other files you upload
Account data	sign-in email, one-time sign-in codes, session information
Device data	push notification token, platform (iOS / Android), app version
Diagnostics	crash and error reports (technical only — configured not to include personal content)
Website analytics	on the application form only: pages viewed, form steps reached, device and browser type, the link or advert that brought you (see section 7)

We do not collect payment card details. The application form uses Google Analytics to measure our website and advertising (section 7); the client portal, staff tools and mobile applications do not.

2. Why we use it, and on what basis

• to assess and respond to your co-financing request (contract / your request);
• to carry out identity, source-of-funds and anti-money-laundering checks (legal obligation);
• to give you access to your application status and documents (contract);
• to notify you when your application status changes (your consent for notifications);
• to keep the Services secure, prevent abuse and diagnose faults (legitimate interests);
• to understand which channels and adverts bring applications and to improve the application form and our advertising (legitimate interests).

3. Who processes it for us

We do not sell personal data. We share it only with providers that operate the Services on our behalf, and with our affiliates, special-purpose vehicles, advisers and funding partners where necessary to assess and perform a transaction:

Provider	Purpose	Location
Supabase (AWS)	database, authentication, encrypted document storage	European Union (Ireland)
Cloudflare	website and portal delivery	Global edge network
Resend	sending sign-in codes and notification emails	European Union
Google Cloud	encrypted off-site backups; email relay	United States
Apple / Google	delivery of push notifications to your device	United States
Sentry	crash and error diagnostics	Germany
Google Analytics	application-form analytics and advertising measurement	United States / European Union

Where data is transferred outside your country, we rely on the provider’s standard contractual clauses and equivalent safeguards.

4. How we protect it

• documents are held in private storage — never on a public link — and are served only through short-lived signed links to you or authorised staff;
• database access is enforced row-by-row, so you can only ever read your own records;
• sign-in is by one-time code to your email; we never ask for a password;
• access by our staff is role-restricted and logged;
• backups are encrypted and retained on a rolling basis.

5. How long we keep it

Application, verification and transaction records are retained for as long as required by applicable anti-money-laundering and financial record-keeping rules, and thereafter for the period needed to establish or defend legal claims. Sign-in and device data are kept only while your account is active. Diagnostic data is kept for a short rolling period.

6. Your choices and rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, object to or restrict certain processing, and request a copy of your data.

Deleting your account. You can delete your account at any time from within the mobile app (profile menu → Delete account), or by emailing us. This permanently removes your sign-in access, your profile and your notification tokens. Applications, uploaded documents and status history that you have already submitted are retained as regulatory records, de-linked from your account, because anti-money-laundering rules require us to keep them; they are not used to contact you again.

Notifications. You can turn push notifications off at any time in your device settings.

7. Cookies and analytics

The application form at apply.nemax-finance.com uses Google Analytics 4 (Google) to measure which channels — our website, advertising, emails — bring applications and at which step of the form visitors leave. We use these measurements, in aggregate, to evaluate and improve our advertising on Google.

• Cookies: Google Analytics sets cookies on nemax-finance.com (_ga, _ga_<id>) holding a random identifier, kept for up to 2 years. They do not contain your name or contact details.
• What is sent: pages viewed; that the form was opened, started, submitted or did not meet the minimum amount; device, browser and approximate location; the link or advert that brought you (UTM tags). We do not send what you type into the form — no names, emails, phone numbers, amounts or documents — and personal invitation links are removed before anything is sent.
• Where it is not used: the client portal, staff tools and mobile applications.
• How to opt out: block or delete cookies in your browser, or install the Google Analytics opt-out add-on. The form works the same without them.

8. Children

The Services are intended for adults. We do not knowingly collect data from anyone under 18.

9. Changes

We may update this policy. The current version is always the one published on this page, with the date shown above.

10. Contact

Questions or requests: Nemax GCC Limited (trading as NEMAX Finance) · info@nemax-finance.com · nemax-finance.com