DIRECTPROP PTE. LTD. (UEN 202634762K) ("DirectProp", "we", "us") operates the DirectProp platform, which connects property owners directly with tenants and buyers in Singapore. This Policy explains how we collect, use, disclose and protect personal data in accordance with the Personal Data Protection Act 2012 ("PDPA").
We collect the following categories of personal data. Account data: name, email address, phone number and password credentials when you register. Listing data: property details you publish, including photographs and, where provided, the property address. Transaction data: viewing bookings, messages exchanged on the platform, and tenancy agreement particulars including rent, deposit and lease dates. Identity data: NRIC/FIN numbers of the contracting parties, collected only when a tenancy agreement is created, because a high degree of identity fidelity is required for a legally binding tenancy contract and IRAS e-stamping, consistent with the PDPC's Advisory Guidelines on the collection of NRIC numbers. Usage data: pages viewed, searches performed, listing interactions and device information, used to operate and improve the service.
NRIC/FIN numbers are encrypted at the application layer before storage using keys held in a managed secrets vault. They are displayed throughout the platform only in masked form (for example, ****567A). Full values are accessible solely to the two contracting parties to the relevant tenancy agreement, through an access-controlled and logged function. We do not use NRIC/FIN numbers for marketing, profiling or any purpose other than the tenancy contract and statutory compliance.
We use personal data to: create and administer your account; publish and manage listings; facilitate enquiries, viewings and tenancy agreements between users; verify identity and prevent fraud; provide customer support; comply with legal obligations (including e-stamping facilitation and responses to lawful requests by public agencies); enforce our Terms of Use; and, with your consent where required, send service updates. We do not sell personal data.
Personal data is disclosed only to: the counterparty to your transaction, to the extent needed for that transaction (for example, your name and contact details are shared with the other party to a confirmed viewing or executed agreement); our service providers (cloud hosting and database services, transactional email delivery) under contractual obligations of confidentiality and security; and regulators or law enforcement where required by law.
Our primary database is hosted in the Asia-Pacific region (Tokyo, Japan — AWS ap-northeast-1). Where personal data is transferred outside Singapore, we ensure a comparable standard of protection through contractual safeguards with our hosting providers, in accordance with s26 of the PDPA.
We retain personal data only as long as necessary for the purposes above or as required by law. Indicative schedule for legal review: account data — life of the account plus 1 year; executed tenancy agreements and associated identity data — 6 years after lease expiry (limitation period alignment); messages and viewing records — 2 years; analytics events — 18 months, after which they are aggregated or anonymised. Data is securely deleted or anonymised at the end of the applicable period.
You may access and correct your personal data through account settings or by contacting us, withdraw consent (which may affect our ability to provide the service), and request account deletion. We will respond to access and correction requests within the timelines prescribed by the PDPA. To exercise any right, contact our Data Protection Officer.
We use strictly necessary cookies for authentication and session management, and first-party analytics events to understand product usage. We do not currently use third-party advertising technologies.
We apply industry-standard safeguards: encryption in transit (TLS) and at rest, row-level access controls on all user data, encrypted storage of government identifiers, restricted and logged administrative access, and periodic review of security advisories on our infrastructure.
Our DPO can be contacted at dpo@directprop.asia, or by post at 2 Sembawang Walk, Unit 72 Springhill, Singapore 757616. Complaints may also be directed to the Personal Data Protection Commission (www.pdpc.gov.sg).
We may update this Policy from time to time. Material changes will be notified through the platform or by email, and the "last updated" date below will be revised.
Last updated: 3 August 2026