Privacy Policy.

This policy applies to 12NexusBPO ("12NexusBPO", "we", "us", "our"), a remote operations and business process outsourcing provider serving clients across the United States and Canada. 12NexusBPO is the trading name of 12Nexus, a sole proprietorship registered with the Federal Board of Revenue of Pakistan (NTN 6273759-3) and the Pakistan Software Export Board (registration no. C05/PSEB/2026/8482), with its registered office at H# 19-C, St. 7, Block E, Soan Gardens, Islamabad, Pakistan, and an office at 5615 Raleigh St, Mississauga, ON L5M 7E4, Canada.

12Nexus is responsible for the personal information collected through this website, including information collected when you pay an invoice online.

It covers this website, any inquiry you send us, and the support work we carry out for clients. It does not cover the CRMs, brokerage platforms, or other sites you reach through links from here, which are governed by their own policies.

Website visitors and prospective clients

Agents, team leaders, and brokerage owners who browse the site or send us a message.

Clients

Real estate professionals who have engaged us for transaction coordination, lead follow-up, marketing, admin support, or any of our other services.

Transaction parties and leads

Buyers, sellers, and leads whose records sit inside a client's CRM, transaction files, or lead platforms, and whose information we touch only while working for that client.

Almost every privacy question about our business has two answers, because we handle two very different kinds of information.

Information we decide what to do with

Everything on the website side: the inquiry you send through our contact form, the emails you exchange with us, the invoices you pay us, and the analytics that tell us how the site is used. We decide why and how that information is used, and this policy governs it.

Information we handle on a client's instructions

Everything inside a client's systems: their contacts, their transaction files, their inbox, their MLS activity. That information belongs to the client and, ultimately, to the people it describes. We act as a service provider, working only on the client's instructions. The client's own privacy policy governs it; this policy describes how we protect it.

Information you send us

Our contact form asks for your name, email address, and a message. It also has optional fields for your phone number, your brokerage or company, and the service you are asking about. Anything else you put in the message is up to you, though we ask that a first inquiry not include client details, transaction documents, or login credentials.

Information collected automatically

Like most websites, ours records basic technical information when you visit: IP address, browser and device type, the page that referred you, which pages you view, and roughly how long you spend on them.

Anti-spam verification

The contact form is protected by Google reCAPTCHA v3, which analyzes how the page is used to tell people apart from bots. Google receives your IP address and interaction data for that purpose, subject to the Google Privacy Policy and Terms of Service.

Payment information

When you pay an invoice online, we collect your name, email address, phone number, billing address, the invoice being paid, the amount and currency, and the payment method you choose. How card and account details are handled is explained in the next section.

This website does not ask for government identification, social security or social insurance numbers, or any other sensitive category of information. There are no user accounts to create.

Clients can pay invoices online by Visa or Mastercard debit or credit card, by bank transfer, or through mobile wallets such as JazzCash, Easypaisa, and Raast. Card and wallet payments are processed by our acquiring bank and its payment gateway, not by us.

Card details never reach us

Your card number, expiry date, and security code (CVV) are entered on the bank's secure, PCI DSS compliant payment page and encrypted in transit. We never see, receive, or store your full card number or CVV.

What we receive back

The gateway tells us whether the payment succeeded, along with the transaction reference, amount, currency, date, card type, and the last four digits of the card. We use this to match the payment to your invoice and to issue a receipt.

Card verification

Your card issuer may ask you to verify the payment with a one-time password or 3-D Secure (Visa Secure, Mastercard Identity Check). That verification happens between you and your bank.

Bank transfers and wallets

For bank transfers and wallet payments, we receive the sender name, account or wallet reference, amount, and transaction ID shown on the transfer, and use them only to confirm and reconcile your payment.

We use payment information only to process payments, issue receipts and refunds, keep accounting and tax records, and prevent fraud. We do not use it for marketing, and we do not store card details to charge you again without your authorization.

We use what you send us to:

• Answer your inquiry and follow up by email or phone, usually within one business day
• Understand which services you are interested in so the first conversation is a useful one
• Prepare a proposal and, if we go ahead, set up your engagement
• Issue invoices, process payments and refunds, and send receipts
• Keep a record of our correspondence with you
• See which pages and services people actually read, so we can improve the site
• Protect the contact form against spam and automated abuse

Where a legal basis is required, it is your consent when you submit the form, our legitimate interest in operating and securing the site, and the steps needed to enter into a contract with you.

We use Google Analytics 4 to see how the site is used in aggregate: which pages get read, which services get clicked, and where visitors arrive from. It sets cookies in your browser and reports on visits as a whole rather than identifying you personally. Google advertising features and audience remarketing are not enabled.

Google reCAPTCHA also sets a cookie, which is what allows it to distinguish a person from a bot without making you solve a puzzle.

When you pay an invoice, the bank's payment page may set its own strictly necessary cookies to keep the payment session secure and to detect fraud. Those cookies are governed by the bank's policies. None of the cookies on our site hold your card details.

You can clear or block cookies in your browser settings, and you can opt out of Google Analytics entirely with Google's browser opt-out add-on. Blocking analytics cookies does not affect your ability to read the site or send us a message.

This is the part of our work that touches the most personal information, and the part we treat most carefully. To do the job you hire us for, we work inside systems you already own:

• CRMs such as KW Command and Lofty, including contact records, notes, and pipeline stages
• Transaction platforms such as DotLoop and SkySlope, including contracts, disclosures, deeds, and tax cards
• MLS systems, for listing activity and buyer agent interactions
• Your email inbox and calendar, where you have asked us to manage them
• Lead platforms such as LandVoice and Zillow Premier Agent, where the subscription remains yours
• Marketing tools, newsletter platforms, and social accounts operated under your brand

In every one of those systems, the information belongs to you and to the people it describes. We access it to carry out the work set out in your service agreement, we follow your instructions, and we do not use it for anything else.

Instruction only

We process client information solely to deliver the services you asked for. If we were ever asked to do something else with it, we would come to you first.

No independent use

We do not copy client databases into our own systems, market to your contacts, or use your transaction data to build lists, products, or models.

Least access necessary

Where a platform lets you choose a permission level, we ask for the narrowest one that still lets the work get done.

Assigned team only

Access is limited to the assistants and supervisors assigned to your account, each bound by a written confidentiality agreement.

Clean exit

When an engagement ends we stop accessing your systems and ask you to revoke our credentials. Working copies of your files are returned or deleted on request.

If you are a buyer, seller, or lead and you want to know what is held about you, the agent or brokerage you have been dealing with is the right place to start, because they control that record. You can also write to us at info@12nexusbpo.com and we will pass your request to them and support their response.

Handling other people's client relationships is the whole job, so the safeguards are not an afterthought:

• This website is served over HTTPS, so everything you send through it is encrypted in transit
• Card payments are handled on the bank's PCI DSS compliant payment page, so card numbers never pass through or rest on our systems
• Only the people who need payment and billing records to do their job, such as billing and client support, can access them
• Credentials you give us are stored in a password manager, never in shared documents, spreadsheets, or chat messages
• Multi-factor authentication is enabled wherever the platform supports it
• Access is granted per person and removed when someone moves off your engagement or leaves the team
• Everyone signs a confidentiality agreement before touching client work
• Work happens inside your platforms rather than on local copies wherever the platform allows it
• Devices used for client work are password protected and kept up to date

No method of storing or transmitting information is completely secure, and we cannot guarantee absolute security. If a breach ever affected your information, we would notify you without undue delay, and notify the relevant privacy regulator where the law requires it.

Our own service providers

The providers that keep our operation running: email and productivity services, our website host, Google Analytics, and Google reCAPTCHA. They may use information only to provide their service to us.

Banks and payment processors

Our acquiring bank, its payment gateway, the card networks (Visa and Mastercard), and wallet providers receive what they need to process, verify, and settle a payment or refund, and to prevent fraud. They handle it under their own privacy policies and banking regulation.

Your platforms and partners

When we act on your behalf, information moves through the systems you have chosen and to the parties a transaction requires, such as lenders, title companies, appraisers, and your outside marketing or video partners, at your direction.

Professional advisers

Our accountants, auditors, insurers, and lawyers, where they need it and are bound to keep it confidential.

Legal requirements

Where we are required by law, court order, or a regulator or tax authority, including the Federal Board of Revenue and the State Bank of Pakistan, or where we need to establish or defend a legal claim.

A change to our business

If our business is ever sold or merged, information may transfer with it. Any buyer would be bound by commitments no weaker than those in this policy.

We do not sell personal information, and we do not share it for anyone else's marketing.

Our business is registered in Islamabad, Pakistan, where most of our team works, and we also have an office in Ontario, Canada. Most of our clients are in the United States. That means information you give us, and information in the client systems we work in, is generally accessed and handled from Pakistan, and may also be handled from Canada or elsewhere, depending on who is assigned to your account.

Wherever it is handled, it stays subject to the same contractual confidentiality and security commitments. It may also be accessible to the courts, law enforcement, and regulators of the country it is handled in, under that country's laws.

If your brokerage requires work to stay within a specific country or region, tell us before the engagement starts and we will confirm in writing whether we can accommodate it.

Inquiries that do not become engagements

Kept for up to 24 months so we recognize you if you come back, then deleted.

Client and payment records

Invoices, receipts, and transaction records are kept for the length of the engagement, and afterwards for as long as tax, accounting, and banking laws in Pakistan and Canada require, generally seven years.

Working copies of client files

Returned or deleted at the end of an engagement, or sooner on request.

Website analytics

Retained in aggregate under Google Analytics' data retention settings, and not used to identify individual visitors.

Backups are overwritten on a rolling basis, so deleted information may persist in a backup for a short period before it is cycled out.

Depending on where you live, you have rights over the personal information we hold about you. We honor all of the following for anyone who asks, regardless of where they live:

• Access — ask what personal information we hold about you and receive a copy
• Correction — ask us to fix information that is wrong or out of date
• Deletion — ask us to delete information we no longer have a reason to keep
• Withdraw consent — tell us to stop using your information for a purpose you previously agreed to
• Opt out of marketing — unsubscribe from anything we send, at any time
• Complain — raise a concern with us, or with a privacy regulator

We handle personal information in line with the laws of Pakistan, where our business is registered. For information we collect through our Canadian office, this policy also follows the Personal Information Protection and Electronic Documents Act (PIPEDA), and you may complain to the Office of the Privacy Commissioner of Canada.

If you are a California resident, you also have the right to know what we collect, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information as California law defines those terms, and we will never discriminate against you for exercising a right. Residents of other US states with comparable privacy laws have equivalent rights.

To make a request, email info@12nexusbpo.com. We will confirm receipt and respond within 30 days, or explain why we need longer. We may need to verify your identity first, particularly for access and deletion requests.

If you ask us a question, we will answer it. That reply is not marketing and there is nothing to unsubscribe from. Anything broader, such as an update or newsletter from us, goes only to people who agreed to receive it, carries our business address, and includes an unsubscribe link that works. This follows Canada's Anti-Spam Legislation (CASL) and the US CAN-SPAM Act.

Newsletters and campaigns we send on behalf of a client are a different matter: they go out under that client's name, from that client's platform, to that client's list. The client is responsible for how the list was built and for the consents behind it.

Our services are sold to businesses, and this website is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, contact us and we will delete it.

This site links to platforms we work in and to Google's policies. We do not control those sites and are not responsible for their content or their privacy practices. Read their policies before giving them information.

We update this policy when our practices, our tools, or the law change. The effective date at the top of the page always reflects the current version. If a change materially affects how we handle your information, we will tell active clients directly rather than relying on you to notice.

Questions about this policy, or a request about your information, can go to:

• Email: info@12nexusbpo.com
• Phone (United States): +1 512 842 0504
• Phone (Pakistan): +92 331 984 9845
• Registered office: 12Nexus, H# 19-C, St. 7, Block E, Soan Gardens, Islamabad, Pakistan
• Canada office: 12NexusBPO, 5615 Raleigh St, Mississauga, ON L5M 7E4, Canada

You can also reach us through our contact page. Our Terms of Service are on the terms page.