This Privacy Policy explains how personal data is handled by NEXTGTM CONSULTING SINGAPORE PTE. LTD., a consulting firm registered in Singapore and operating from 133 CECIL STREET, #15-02 KECK SENG TOWER, 069535, Singapore (SG). The policy is written and maintained by the developer known as NextGTM, which designs and operates the website and the internal launch board tooling described here.
The firm advises teams that build computer integrated systems on how to map markets, gate pipelines and decide when to launch. That work requires careful handling of commercial information and contact details, and this policy sets out the standard we hold ourselves to.
This document describes the principles, practices and operational rules that govern personal data at NEXTGTM CONSULTING SINGAPORE PTE. LTD. It applies to the public website at nextgtm.mom, to messages sent to our published contact address, to calls made to our published telephone number, and to the consulting engagements we deliver from the Cecil Street office.
The firm is the organisation that decides why and how personal data is processed for its own consulting work. Where the firm processes data on behalf of a client, the client remains the organisation responsible for that data, and our handling is set by the written engagement terms agreed with that client.
NextGTM is the developer name used by the team that built this website and maintains its technical operation. References to the developer within this policy refer to that same group of people, working for NEXTGTM CONSULTING SINGAPORE PTE. LTD. under the address given above.
The policy covers personal data collected through this website, through business correspondence, through the launch board sessions we run, and through the internal systems we use to prepare and deliver advisory work. It does not cover the practices of our clients, partners or any third party site that a visitor reaches through a link from our pages.
Where a client engagement requires us to process data under different rules, for example because the client operates in a regulated sector, the more protective of the two standards applies. We record that decision in the engagement file so that the expectation is visible to both sides.
The policy does not create obligations for parties who merely browse the public pages without submitting any information. It becomes relevant as soon as a person sends a message, requests a call, signs an engagement or participates in a board session.
Personal data means any information that identifies a person, or that could reasonably be used to identify a person when combined with other information held by the firm. This includes a name, a business email address, a telephone number, a job title, an employer name and the content of correspondence.
Processing means any operation performed on personal data, including collection, recording, organisation, storage, use, disclosure, restriction, erasure and destruction.
The firm means NEXTGTM CONSULTING SINGAPORE PTE. LTD. The desk means the office and correspondence function of the firm at the Cecil Street address. A board session means a facilitated working meeting in which a launch plan, a market map or a pipeline review is discussed with a client team. A service provider means a third party that processes data on behalf of the firm under a written contract.
The website means the pages published under the nextgtm.mom domain. The engagement file means the organised record of a consulting engagement, including notes, board artefacts and correspondence.
We collect only the categories of data that a specific purpose requires. In practice the categories fall into four groups: identification and contact details, business context, correspondence content and technical data.
This includes a person name, a company name, a job title, a business email address, a telephone number and, where relevant, a postal address for documents that require one. We do not ask for identity document numbers, financial account details or health information, and we ask people not to send such material through the contact form.
This includes the market a client intends to enter, the launch date under consideration, the routes to market under review, the size of the relevant team and any commercial constraints the client chooses to share. Much of this information belongs to the client as a business, and not every item is personal data. It becomes personal data when it identifies an individual, for example when a note names the owner of a channel or the person who blocked a gate.
This includes the text of messages sent to the desk, notes taken during calls and board sessions, and material shared with us for review. We keep such material only for as long as the engagement or the business relationship requires.
This includes the internet protocol address that reaches our hosting provider, the browser type, the pages viewed and the time of a request. Technical data is used in aggregate to keep the site available and to understand which pages serve visitors well.
Most data arrives directly from the person concerned. A visitor sends a message through the contact form, writes to our published email address, calls our published telephone number or requests a meeting. In each case the person chooses what to share, and we encourage a short, purposeful message over a long submission.
Data also arrives from client teams during an engagement. A sponsor may introduce us to colleagues by email, share a list of account owners, or forward a board note that contains names. We treat such introductions as part of the engagement file and do not add those people to any marketing list without a separate basis.
On some occasions data arrives from public business sources, such as a company website, a conference programme or a professional directory. We use such material only to understand the market and to prepare a relevant conversation, and we limit it to business contact details and professional context.
We do not buy contact lists for marketing purposes, and we do not receive personal data from data brokers.
We process personal data for a small number of clearly stated purposes. Each purpose is tied to a practical need and is assessed before any new collection begins.
We do not use personal data to make automated decisions that produce legal effects for an individual. We do not sell personal data to any party, and we do not trade it for access to other lists.
Where the law requires a basis for processing, we rely on one of the following grounds. The first is the performance of a contract or the steps needed before a contract, which covers most engagement work and correspondence with client teams.
The second is a legitimate business interest, assessed against the rights of the individual. This covers answering a business enquiry, securing the website and keeping ordinary company records. We document the assessment for any new activity that relies on this ground.
The third is a legal obligation, which covers tax records, accounting entries and responses to a lawful request from a competent authority. The fourth is consent, which we use for optional marketing messages and for any activity not covered by the grounds above. Where consent is the basis, it can be withdrawn at any time.
A person who sends a message through the contact form is asking us to reply, and that request is the basis for the response. It does not automatically become consent to receive a newsletter or periodic updates. We ask separately before adding anyone to a mailing list.
Consent can be withdrawn by writing to contact@nextgtm.mom with a clear request. We action withdrawal within a short period and confirm it by email. Withdrawal does not affect processing that happened before the request, and it does not affect processing that rests on another legal basis, such as keeping a tax record.
Where a person has consented to a particular use, we record the date and the scope of the consent so that a later withdrawal can be applied accurately.
The website keeps server logs that record a request, a timestamp, a browser type and an approximate region. These logs help us find broken links, detect abusive traffic and confirm that the pages load correctly for visitors in different places.
Log data is reviewed in aggregate. We do not attempt to identify an individual visitor from log data, and we do not combine log data with contact records to profile a person.
If we introduce a privacy respecting measurement tool in the future, it will be configured to avoid cross site tracking, to avoid storing raw addresses and to keep reports aggregated. The change will be described here before it goes live.
The firm is based in Singapore, and its primary systems are operated from Singapore and from the regions used by our hosting provider. Some service providers process data in other countries, including the United States and member states of the European Union.
Where data leaves Singapore, we rely on a contractual mechanism that requires the recipient to protect the data to a comparable standard. We assess the legal environment of the destination and apply additional measures such as encryption and access restriction where the assessment calls for them.
A client or an individual may ask for more detail about the location of processing for a specific engagement, and we will answer in writing where the request is reasonable and does not compromise the security of the systems involved.
We keep personal data only for as long as a stated purpose requires. An enquiry that does not become an engagement is removed within twelve months of the last exchange. Correspondence that becomes an engagement file is kept for the duration of the relationship and then for a further period of up to seven years to meet accounting and contractual record duties.
Board artefacts, such as market maps and retrospective cards, are kept for the duration of the engagement plus the review period agreed with the client. Where a client asks for earlier deletion and no legal duty prevents it, we delete the material and confirm the action in writing.
Server logs are rotated on a short cycle and are not kept beyond the period needed for fault diagnosis and abuse prevention. Backup copies are overwritten on a rolling schedule that follows the same logic.
Personal data is protected by administrative, technical and physical controls. Access is limited to the people who need the data to do their work, and access is granted per role rather than to everyone by default. Accounts use strong authentication, and shared accounts are not permitted.
Data in transit is protected by encryption, and data at rest is encrypted on the systems that hold engagement files. Workspace devices use full disk encryption and automatic screen locking. Paper board artefacts are kept in a locked drawer at the desk and are destroyed when the engagement file is closed.
Staff and contractors receive a short briefing on these rules when they join and whenever the rules change in a material way. We test the backup and restore process each year, and we review the access list each quarter so that access is removed promptly when a person leaves a project.
No system can be perfectly secure. We accept that risk and manage it by limiting the data we hold, by keeping the systems small and by reviewing incidents promptly rather than hoping they do not happen.
Subject to applicable law, a person may ask for a copy of the personal data the firm holds about them, ask for a correction of inaccurate data, ask for deletion of data that is no longer needed, ask for a restriction of processing, or object to processing that relies on a legitimate interest.
A request should be sent to contact@nextgtm.mom with enough detail for us to locate the relevant records. We may ask a small number of questions to confirm identity, because we do not want to disclose data to the wrong person. We answer within thirty days, and if a request is complex we will explain the reason for any extension in writing.
If a request cannot be met, for example because a legal retention duty applies, we explain the reason and the period for which the data must remain. A person who is not satisfied with our response may raise the matter with the relevant data protection authority in their jurisdiction.
Exercising a right is free of charge unless a request is clearly unfounded or repetitive, in which case we may explain the position and ask the person to narrow the request.
The services of the firm are offered to businesses and are not directed at children. We do not knowingly collect personal data from anyone under the age of eighteen through this website or through our consulting work.
If a parent or guardian believes that a child has sent personal data to the firm, they should write to contact@nextgtm.mom. We will confirm what was received, delete it promptly where no legal duty requires retention, and reply to the person who raised the matter.
The firm sends occasional notes about launch board methods, upcoming clinics and practical lessons from completed engagements. These notes are sent only to people who have asked for them or who have an active business relationship with the firm and would reasonably expect relevant updates.
Every such message includes a way to stop receiving it. A request to stop is actioned promptly and recorded so that the person is not contacted again for that purpose. A person who stops receiving marketing messages will still receive replies to direct enquiries and messages about an active engagement.
The website may link to the pages of partners, host organisations or public resources that are relevant to a market map. Those pages are controlled by other parties, and this policy does not apply to them. A visitor who follows a link should read the privacy notice of the destination site.
We take care to link only to pages we consider useful and trustworthy, but we do not control their content, their security or their data practices. A link is not an endorsement of those practices.
Our team uses ordinary productivity software, including document editing and scheduling tools, to deliver consulting work. Some of those tools include automated features. When a tool that relies on a generative model is used on client material, we check the provider settings first, limit the material to what the task requires and avoid entering sensitive personal data.
We do not use client material to train a model that belongs to the firm or to a third party. Where a client prefers that a specific piece of work be completed without any automated assistance, the client may say so and we will record the instruction in the engagement file.
Automated tools do not make employment or legal decisions about individuals, and they do not replace the judgement of a consultant on a launch board.
If we become aware of an incident that may have affected personal data, we contain the incident first, then assess what data was involved and who may be affected. The assessment considers the sensitivity of the data, the size of the affected group and the likely harm.
Where the law requires notification, we inform the relevant authority within the required period and describe the nature of the incident, the data involved and the steps taken. We also inform affected individuals where the incident is likely to result in significant harm, and we give practical guidance on what they can do.
After an incident we write a short internal review that names the cause and the change required. The review is shared with the people responsible for the affected systems, and the change is tracked until it is complete.
This policy is reviewed at least once a year and whenever a material change occurs in our methods, our systems or the law that applies to us. The date at the top of the page records the most recent revision.
Where a change affects how we use data already collected, we will take reasonable steps to inform the people concerned before the change takes effect. Where the change requires consent, we will ask for it rather than assume it.
Earlier versions of the policy are kept with the engagement records so that the standard that applied at a given time can be confirmed.
Questions about this policy, requests to exercise a right and reports of a possible incident should be sent to the desk. Please use a clear subject line and state the nature of the request so that it can be routed quickly.
NEXTGTM CONSULTING SINGAPORE PTE. LTD.
133 CECIL STREET
#15-02 KECK SENG TOWER
069535, Singapore (SG)
Email: contact@nextgtm.mom
Phone: +17748472819
The desk is staffed Monday to Friday between 09:00 and 18:00 Singapore time. A message that arrives after hours is reviewed on the next working morning.
This policy applies from 1 October 2026 and replaces all earlier privacy notices published on this website.