Effective date: September 25, 2025
This Privacy Policy describes how National Loan Exchange, Inc. (“NLEX,” “we,” “us,” “our”) collects, uses, discloses, and retains personal information of business representatives who interact with us (e.g., bidder/principal contacts and registered portal users) and visitors to nlex.com (the “Site”).
Scope
This Policy applies to personal information of natural persons acting in a business capacity (B2B). It does not apply to information that is not personal information under applicable law (e.g., de-identified data or publicly available information). Certain rights described below apply only to California residents under the California Consumer Privacy Act (CCPA/CPRA).
Categories of Personal Information We Collect
Identifiers & business contact information: name, business email, business phone, company, role/title, mailing address.
Account information (Sensitive Personal Information): account log-in credentials for registered users.
Commercial/relationship information: registration status, bidding activity (e.g., bids placed), communications and deal history related to loan sales.
Internet or network activity: IP address, device/browser type, pages viewed, timestamps, and download/access logs.
Lookback: 12 months
We do not collect government identifiers (e.g., SSN/driver’s license) or consumers’ bank account numbers from individual representatives.
Sources of Personal Information
Directly from you; your company/employer; our seller clients in connection with a contemplated transaction; and through your use of the Site and our secure data room/transfer services (logs and telemetry).
How We Use Personal Information
We use personal information to:
- register, authenticate, and administer user accounts;
- communicate about available loan sales and operate the bidding process;
- perform and support due diligence, eligibility review, and compliance screening;
- secure, monitor, audit, and troubleshoot our Site and services (including the secure data room/MFT);
- comply with legal, regulatory, and recordkeeping obligations; and
- provide secure access to downloadable files, including delivery of access credentials.
Email Marketing & Opt-Out
We may send you updates about new portfolios, services, or features. You may opt out of marketing emails at any time by using the unsubscribe or Opt-Out link in those messages. Transactional or service communications (e.g., account or download confirmations) may still be sent.
Selling/Sharing
We do not sell personal information and do not share personal information for cross-context behavioral advertising.
Disclosures of Personal Information (12-month lookback)
We disclose the categories listed above for the business purposes described in this Policy to:
- Seller clients (third parties): to evaluate bidder eligibility, perform transaction due diligence/compliance screening, communicate regarding potential sales of assets, and negotiate or complete transactions.
- Service providers/contractors: providers of hosting/infrastructure, secure data room/managed file transfer, CRM, productivity/collaboration, security/fraud/audit, and related support who process personal information on our behalf under written contracts that restrict their use and disclosure.
We do not sell or share personal information for cross-context behavioral advertising, and we do not disclose personal information for purposes unrelated to the transaction/due-diligence or the services described here.
Sensitive Personal Information (SPI)
We may process account log-in credentials for registered users. We do not use or disclose SPI for purposes other than those that are necessary and proportionate to provide our services and ensure security (e.g., authentication and account protection). As a result, the Right to Limit SPI does not apply to our current practices.
Retention
We retain personal information for as long as needed to fulfill the purposes described above and to meet legal, regulatory, fraud-prevention, and recordkeeping obligations, after which we delete or de-identify it. We review retention periodically and may adjust retention periods in accordance with these criteria. Additionally, we may continue to store your personal information contained in our standard back-ups. Following termination or deactivation of any account you may create, we may retain your personal information for a reasonable amount of time for archival purposes. Furthermore, we may retain and continue to indefinitely use your personal information contained in your communications to other users.
Upon your request, we will delete or de-identify your personal information unless we are legally required or allowed to maintain such personal information.
Cookies & Tracking
We use cookies and similar technologies to operate our Site, make it easier for you to use, and analyze traffic. You can manage non-essential cookies through your browser or device settings. If we ever engage in selling or sharing personal information, we will honor user-enabled opt-out preference signals (e.g., Global Privacy Control) in a frictionless manner.
We or our third-party partners may use invisible pixels or beacons on the Site to count how many users access or use certain pages, features or content. This information is collected and reported in the aggregate. We may use this information to improve our current Site offerings, develop new products or services, and target information to you that may be helpful and useful to you based upon your use of the Site.
Log Files
We maintain log files of traffic and downloads to manage system performance, security, and compliance.
Links to other sites and services
Our Site may provide links to third-party websites that we do not control and with which our connection may only consist of a hyperlink (“Linked Sites”). We cannot be held responsible for third parties’ privacy practices or content provided on these websites. If you click on one of these links, please understand that you are leaving our Site and any information you provide will not be covered by this Privacy Notice. All Linked Sites are provided only because they may be of interest to users of the Site or offer a service for your convenience. The fact that we offer such links should not be construed in any way as an endorsement, authorization, or sponsorship of that Linked Site or its content, products, or services. Please read that website’s privacy policy before providing any information.
You acknowledge and agree that HGI has no responsibility for the accuracy or reliability of information provided by or through Linked Sites. HGI does not author, edit, or have any responsibility to monitor these Linked Sites. You should refer to the separate terms of use, privacy policies, and other rules posted on a Linked Site before you use them. You acknowledge that we shall not be responsible or liable for any damage or loss caused or alleged to be caused by, or in connection with, your reliance on any information, any good, any service, or any other material provided through a Linked Site. You bear all risk associated with the use of the Linked Sites, third party services, and your correspondence or business dealings with third parties (including any advertisers) found on or through the Site. We reserve the right to terminate such links at any time.
Your Privacy Rights (California)
Subject to applicable law, you may have the right to Know (access), Delete, and Correct personal information we maintain about you. You also have the right to opt out of sale or sharing (not applicable to our current practices) and the right to non-discrimination for exercising your rights.
How to submit a request:
Verification: We will take steps appropriate to the request type (e.g., match data points you provide to information we maintain). Information collected solely for verification will be deleted after we complete your request. Authorized agents must provide proof of authority; we may also verify the consumer directly.
Timelines: We will confirm receipt within 10 business days and respond within 45 calendar days (we may extend once, by up to 45 days, where permitted and will notify you of the reason and extension period).
If we deny a request: We will explain our reasons and provide information about how to contact the California Privacy Protection Agency and the California Attorney General.
Children
Our services and Site are directed to adult business professionals and are not directed to individuals under 18. We do not knowingly collect personal information from individuals under 18. We do not have actual knowledge that we sell or share the personal information of consumers under 16.
California “Shine the Light”
We do not share personal information with third parties for their own direct marketing purposes. If our practices change, we will update this notice and provide methods to exercise applicable rights.
Other State Specific Rights
Nebraska
Nebraska residents have the following rights:
- Right to access and data portability. The right to confirm whether we are processing your personal information, to access your personal information, and to request that we provide you a digital copy, if available, of your personal information that you previously provided to us.
- Right to correct. The right to request that we correct any inaccurate personal information we maintain about you.
- Right to deletion. The right to request that we delete certain personal information that we have collected from you, subject to our right to maintain your personal information for specific purposes permitted under applicable state law.
- Right to opt-out. The right to opt-out of sales of your personal information, the use of your personal information for targeted advertising, or the use of your personal information for “profiling” in furtherance of decisions that impact a legal or similar right. We do not engage in “profiling” to make decisions about consumers that impact legal or similar rights, so there is no need to opt-out.
- Right to appeal. The right to appeal a denial of a privacy rights-related request.
Texas
Texas residents have the following rights:
- Right to access and data portability. The right to confirm whether we are processing your personal information, to access your personal information, and to request that we provide you a digital copy, if available, of your personal information that you previously provided to us.
- Right to correct. The right to request that we correct any inaccurate personal information we maintain about you.
- Right to deletion. The right to request that we delete certain personal information that we have collected from you, subject to our right to maintain your personal information for specific purposes permitted under applicable state law.
- Right to opt-out. The right to opt-out of sales of your personal information, the use of your personal information for targeted advertising, or the use of your personal information for “profiling” in furtherance of decisions that impact a legal or similar right. We do not engage in “profiling” to make decisions about consumers that impact legal or similar rights, so there is no need to opt-out.
- Right to appeal. The right to appeal a denial of a privacy rights-related request.
Appeals: If we deny your request and your state law gives you the right to appeal, you may submit an appeal by contacting us at (800) 264-3683 or nlex@nlex.com. Please include “Privacy Request Appeal” in your communication.
Security
We implement reasonable security measures designed to reduce the risks of loss, misuse, unauthorized access, disclosure or alteration of your personal information. While we are committed to protecting your personal information, please note that information communicated over the Internet is never 100% secure. Any transmission of personal information is at your own risk. By using our Site, you acknowledge and accept these risks. As a result, we cannot guarantee or warrant the security of any information you disclose or transmit to us or that are otherwise provided to us and we cannot be responsible for the theft, destruction, or inadvertent disclosure of information. Any transmission of information is at your own risk.
Acknowledgement
To the extent that you provide or transmit any information, including, but not limited to, any personal information and any information that identifies any other individual (including without limitation name, email address and/or telephone number), to HGI or our third-party service or data providers, licensors, or distributors (“Representatives”) through the Site, you warrant that (a) you are providing or obtaining only your own information or the information of others which you are authorized to provide to third parties and/or obtain from third parties on their behalf; and (b) the use of such information by HGI and its Representatives will not infringe upon or misappropriate the intellectual property rights or otherwise violate the rights of any third parties.
Governing law and jurisdiction
This privacy notice shall be construed and governed under the laws of the United States and State of Illinois (without regard to rules governing conflicts of laws provisions). You agree that venue for all actions, arising out of or relating in any way to your use of our Site, shall be in federal or state court of competent jurisdiction located in Madison County, Illinois, within one (1) year after the claim arises. Each party waives any objections based on forum non conveniens and waives any objection to venue of any action instituted hereunder to the extent that an action is brought in the courts identified above.
Special notice to non-U.S. users regarding data transfers
We store your personal information in the United States or other locations outside your home country. The privacy protections and the rights of authorities to access your information in these countries may not be the same as in your home country. If you are visiting our Site or using our services from outside of the U.S., please note that you are transferring information about you, including personal information, to a country and jurisdiction that may not have the same data protection laws as your country of residence. Because of the nature of our services, you may not have the same rights regarding your personal information that you would have interacting with a company in your jurisdiction. By providing us with personal information, you consent to the transfer of information about you, including your personal information, to the U.S. and other countries and the use and disclosure of information about you, including your personal information, as described in this Privacy Notice. We may store, access or otherwise process personal information outside of the U.S. as well.
If you are located in a country outside the U.S. and submit personal information to us, you consent to the general use and disclosure of such information as provided in this Privacy Notice and to the transfer and/or storage of that information to the U.S. and other countries outside your home country.
Changes to This Policy
We may update this Policy from time to time. The “Effective date” above indicates the date of the latest revision. If we make material changes, we may also notify registered users by email.
Contact Us
Questions or requests: (800) 264-3683 or nlex@nlex.com
Mailing address: 10 Sunset Hills Professional Centre, Edwardsville, IL 62025.
Your Privacy Choices page
Your Privacy Choices
NLEX does not sell personal information and does not share personal information for cross-context behavioral advertising. If our practices change, we will update this page and provide opt-out methods and honor user-enabled opt-out signals (e.g., Global Privacy Control).
You can manage non-essential cookies through your browser or device settings.
To exercise your privacy rights (Know, Delete, Correct), submit our Privacy Request Form or call (800) 264-3683. For details, see our Privacy Policy.