Privacy Policy

NepalHRM (“NepalHRM,” “we,” “us,” “our”) is the cloud HR + payroll platform operated by Yoddhalab Pvt. Ltd., a private limited company incorporated in Nepal (see Section 17 for full identity details). This Privacy Policy describes how we collect, use, store, disclose, and protect personal data when you visit nepalhrm.com, create an account, or use the NepalHRM platform and mobile applications for Android and iOS.

We process personal data in accordance with the Individual Privacy Act 2075 (2018), the Electronic Transactions Act 2063 (2008), and other applicable laws of Nepal. Where employee data is handled on behalf of an employer, the employer is the “controller” and NepalHRM is the “processor” for the purposes of those laws.

1. Scope

This Policy applies to:

• Visitors to nepalhrm.com
• Prospective customers who contact us
• Authorised users of the NepalHRM web platform and mobile apps
• Employees of our customers whose data is processed via the platform

For employee personal data processed within the platform, the customer (your employer) is the data controller and NepalHRM acts as a data processor, processing data only on the customer's documented instructions, in line with the Privacy Act 2075. A separate Data Processing Addendum is available on request for customers who require formal documentation of the controller-processor relationship.

There is one purpose for which we act as a controller rather than a processor: the aggregated, de-identified statistics described in Section 3.1. Those statistics are derived from platform data but describe groups of employers, never an identifiable organisation or person, and any customer may ask to be left out of them.

2. Information We Collect

2.1 Information you give us

• Contact details - name, work email, phone, company
• Account credentials - username, hashed password (bcrypt + per-user salt)
• Billing information - for paid subscriptions, including VAT / PAN number
• Support interactions - email, chat, and ticket content

2.2 Information our customers upload (about their employees)

• Identity - name, citizenship / passport / PAN number, date of birth
• Contact - address, phone, personal email, emergency contact
• Employment - role, department, reporting line, employment dates
• Financial - salary, bank account, PF (Karmachari Sanchaya Kosh), CIT (Citizen Investment Trust), SSF, tax status
• Attendance, leave, performance, and lifecycle data
• Documents - contracts, certificates, citizenship copy, photo ID, visa

2.3 Biometric data (sensitive - handled separately)

When an employer enables biometric attendance, fingerprint, face, or vein templates may be enrolled on hardware devices (ZKTeco, Hikvision) at the employer's premises. By default, NepalHRM stores only the device user-ID and the timestamped check-in / check-out event - not the underlying biometric template. Where an employer opts into our optional cloud face-template service, templates are stored encrypted, isolated per tenant, and never used to train shared models. We treat biometric data as a sensitive category of personal data under the Privacy Act 2075 and process it only with the employee's consent and the employer's lawful basis under the Labour Act 2074 (2017) for attendance recordkeeping.

2.4 Information we collect automatically

• Device and browser information, IP address
• Usage data - pages viewed, features used, actions taken
• Cookies and similar technologies - see our Cookie Policy

2.5 Information our mobile apps may access

When you use the NepalHRM mobile apps, we may (with your explicit permission) access:

• Camera - to capture selfies for attendance check-in verification
• Location - to GPS-verify check-ins when your employer enables field attendance (precise GPS is captured only at the moment of the action, not continuously)
• Storage - to save payslips and documents you download
• Notifications - to deliver approvals, announcements, and reminders
• Biometric (Face ID / Fingerprint) - only for on-device app unlock; the template never leaves the device and is never transmitted to our servers

You can revoke any of these permissions in your device settings at any time. Some app features may become unavailable if the relevant permission is revoked.

3. How We Use Information

• To provide, operate, and improve the NepalHRM service
• To process payments and manage subscriptions
• To communicate about service changes, billing, and support
• With your consent, to send marketing communications (you can unsubscribe at any time)
• To prevent fraud and protect the security of the service
• To comply with legal, tax, and statutory obligations under Nepali law (Income Tax Act 2058, Companies Act 2063, VAT Act 2052, PF / CIT / SSF schemes)
• To enforce our Terms of Service
• To produce aggregated, de-identified statistics about HR and payroll practice in Nepal, which we may publish (Section 3.1)

We do not use customer-uploaded employee data to train any artificial intelligence model or sell it to third parties.

3.1 Aggregated statistics

Nepal has almost no published data on how its employers actually run payroll and leave. We produce aggregated, de-identified statistics to fill that gap: the share of employers enrolled in SSF, the median monthly gross salary in a sector, how long after a month closes salaries are typically paid. We may publish them.

These statistics are produced under the following limits, which are enforced in the code that generates them rather than left to judgement:

• Every published figure pools at least 5 separate employers and 25 employees. Anything thinner is withheld, not published.
• A figure in which any single employer accounts for more than 40% of the underlying records is withheld, so that a published number can never be one organisation's payroll wearing a sector's name.
• Salary figures are rounded. No figure is published with a company name, an employee name, a job title, or any other identifier, and none is published at a level of detail that would let one be inferred.

This does not narrow the commitment above. We still do not use customer-uploaded employee data to train artificial intelligence models, and we still do not sell it. What we publish are statistics about groups; the underlying records stay in our systems and are never shared.

If you would rather your organisation was not included, email privacy@nepalhrm.com and we will exclude your data from every edition produced after we receive your request. We cannot recall an edition that is already published.

4. Legal Basis for Processing

We process personal data on one or more of the following bases:

• Performance of a contract - our agreement with you or your employer
• Legitimate interests - running, securing, and improving our business, including the aggregated statistics in Section 3.1, in a manner consistent with the Privacy Act 2075 and the reasonable expectations of users
• Consent - for marketing communications and optional features such as cloud biometric storage
• Legal obligation - tax, accounting, and statutory requirements under Nepali law

For employee data, our customers are responsible for establishing and documenting the legal basis for processing (most commonly: the employment contract under the Labour Act 2074).

5. How We Share Information

We do not sell personal data. We share it only:

• With sub-processors who help run the service (hosting, email, payments, analytics). Our current list of sub-processors and their location is available on request at privacy@nepalhrm.com. We provide 30 days' advance notice before adding or replacing a sub-processor that handles customer data
• With professional advisors - lawyers, accountants, auditors - under confidentiality
• With Nepali government authorities or regulators when legally required (see Section 6)
• In the event of a merger or acquisition, with successors under equivalent protections
• With your explicit consent

5.1 Statutory filings (initiated by your employer)

When your employer uses NepalHRM to file statutory returns, the following authorities may receive your employment data through your employer's submission:

• Inland Revenue Department (IRD) - for eTDS, PAN-linked tax returns
• Karmachari Sanchaya Kosh (PF Trust) - for monthly Provident Fund contributions
• Citizen Investment Trust (CIT) - for voluntary tax-efficient contributions
• Social Security Fund (SSF) - for SSF-registered enterprises
• Banks - for salary disbursement files (NIC Asia, Nabil, Global IME, NBL, others)

NepalHRM facilitates these filings on behalf of your employer; the legal disclosure to the authority is performed by the employer as the data controller.

6. Government and Law-Enforcement Requests

We disclose personal data to law enforcement, courts, or regulators only when we receive a legally valid request (court order, search warrant, or written demand validly issued under the laws of Nepal, including the Privacy Act 2075 and the Electronic Transactions Act 2063). Where the law permits, we will:

• Review the request for validity and proportionality
• Disclose only the minimum data the request actually requires
• Notify the affected customer in advance so they can challenge the request - unless the law prohibits notice
• Where lawful and operationally feasible, publish a periodic transparency note summarising the number and category of requests received

7. Data Location and Transfers

Our primary application servers and customer data are hosted in cloud regions located in Asia - chosen for low-latency access from Nepal - with disaster-recovery snapshots in a separate region. Backups are encrypted in transit and at rest. The current data-residency profile (the specific cloud provider, region, and any sub-processor regions) is published on the Security page and is updated when the configuration changes.

We do not transfer customer data to jurisdictions outside our published profile without your prior, documented instruction. Where a cross-border transfer is necessary to deliver the Service (for example, an email-delivery sub-processor with global infrastructure), we rely on contractual safeguards such as Standard Contractual Clauses and on our sub-processor agreements.

8. Data Retention

We retain personal data only for as long as we have a lawful basis for the relevant processing. The table below sets out our default retention windows; customers may configure shorter retention where the platform supports it, and longer retention may apply when required to comply with Nepali law (for example, the record-keeping minimums under the Income Tax Act 2058 and the Companies Act 2063).

• Account and billing data - for the life of the account plus the statutory record-keeping period applicable under Nepali law (typically up to 7 years).
• Customer data in the service - processed per customer instructions; deleted or made available for export within 30 days of account termination, after which it is removed from primary storage on a documented schedule.
• Statutory filings (PF / CIT / SSF / eTDS history) - retained for the period required by the relevant Nepali authority.
• Biometric templates (cloud option) - deleted within a reasonable period of an employee being marked “separated.”
• Audit logs - retained for up to 3 years from the event.
• Marketing lists - until you unsubscribe.
• Support tickets - up to 3 years after closure.
• Web analytics - up to 26 months.

9. Security

We apply administrative, technical, and physical safeguards consistent with the Privacy Act 2075 - encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access, audit logging, regular backups, penetration testing, staff training, and physical security at our hosting partners. See our Data Security page for the current technical detail.

10. Breach Notification

If we become aware of a personal-data breach that is likely to affect a customer's data, we will notify the affected customer (controller) without undue delay, and where feasible within 72 hours of confirming the breach, by email to the primary account contact. The notification will describe (to the extent known at the time) the nature of the breach, the categories and approximate volume of affected records, the likely consequences, and the remedial steps we are taking. Where full information is not yet available, we will provide an initial notice and a follow-up as the investigation progresses. Customers are responsible for downstream notification to their employees and, where required, to the relevant Nepali authority.

11. Your Rights

Subject to applicable law, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Receive your data in a portable format (JSON / CSV / PDF)
• Withdraw consent at any time, where consent is the legal basis
• Ask us to leave your organisation out of the aggregated statistics described in Section 3.1
• Lodge a complaint with the competent authority or the courts of Nepal having jurisdiction over the matter

To exercise these rights, email privacy@nepalhrm.com. We respond to verified requests within 30 days. If you are an employee of one of our customers, please contact your employer first, as they control your record.

To delete your personal account or request deletion of data you created directly with NepalHRM, visit our Account & Data Deletion page.

12. Children and Minors

NepalHRM is a business-to-business service intended for use by adults aged 18 or above (see Section 2 of our Terms of Service for self-service signup). We do not knowingly collect personal data directly from any visitor under 16 through our public website.

A separate situation arises where an employer onboards a minor employee through the Service. The Labour Act 2074 (2017) regulates the employment of minors in Nepal and requires specific safeguards. Where an employer's NepalHRM record includes a minor employee (for example, an apprentice), the employer is solely responsible for verifying age, obtaining any parental or guardian consents required by the Labour Act, and configuring the employee's access so that features inappropriate for the employee's age are restricted.

13. Cookies and Tracking

See our Cookie Policy for details on cookies and similar technologies used on nepalhrm.com.

14. In-App Messaging

Messages exchanged within the NepalHRM platform (channels, direct messages, attachments) are subject to a separate Messaging Privacy Notice which describes how messages are stored, who can read them, and what the employer's visibility is.

15. Third-Party Links

Our website and apps may contain links to third-party sites. We are not responsible for their privacy practices. Please review their policies separately.

16. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via email or in-product notice at least 15 days before they take effect. The “last updated” date at the top reflects the latest change. Continued use after the effective date constitutes acceptance.

17. Who We Are, and Contact

NepalHRM is a product of Yoddhalab Pvt. Ltd. (in Nepali: योद्धा ल्याब प्रा. लि.), a private limited company incorporated in Nepal. Where these legal pages refer to “NepalHRM,” “we,” or “us,” Yoddhalab Pvt. Ltd. is the contracting entity.

• Registered office: Ward No. 7, Chabahil, Kathmandu Metropolitan City, Kathmandu, Nepal
• PAN (Permanent Account Number): 619760380
• Tax registration: Inland Revenue Office, Chabahil
• Registered activity: information technology, computer programming, computer consultancy + service management, data processing, hosting and related activities (per the company's PAN registration)

We maintain a dedicated contact point for privacy and data-protection matters. Queries are routed to the team member responsible for data protection (acting as our Data Protection contact); we will treat that role as a formal Data Protection Officer where and when Nepali law requires the appointment of one.

• Data Protection contact: dpo@nepalhrm.com
• General privacy queries: privacy@nepalhrm.com
• Postal: Yoddhalab Pvt. Ltd. (NepalHRM), Ward No. 7, Chabahil, Kathmandu Metropolitan City, Kathmandu, Nepal