Who we are
Penahak Technology Pvt. Ltd is a company registered in Nepal under the Companies Act, 2063 (2006), with its office at Kuleshwar, Kathmandu, Nepal. In this policy, “we”, “us” and “Penahak” mean that company.
For questions about this policy, or to exercise any of the rights described below, write to info@penahak.com or to us at the address above.
The law this policy follows
Privacy in Nepal is protected by Article 28 of the Constitution of Nepal, 2072 (2015), which recognises privacy of the person, residence, property, documents, data, correspondence and reputation as a fundamental right.
The principal statute is the Individual Privacy Act, 2075 (2018), together with the Individual Privacy Rules, 2077 (2020). We also operate under the Electronic Transactions Act, 2063 (2008), which governs electronic records and creates offences for unauthorised access to data, and the Consumer Protection Act, 2075 (2018).
Where we keep accounting and tax records, we do so as required by the Income Tax Act, 2058 (2002) and the Value Added Tax Act, 2052 (1996).
Two different roles — please read this part
This distinction matters, because it determines who is answerable for what.
| Situation | Our role | What it means |
|---|---|---|
| Information about you — you visit this website, enquire, or hold a Penahak account | We decide how it is used | This policy governs it, and you deal directly with us. |
| Information a customer puts into Penahak — their own customers, guests, employees, suppliers | We process it on that customer’s instructions | The customer decides what is collected and why, and their own privacy notice governs it. We hold it for them, keep it secure, and do not use it for our own purposes. |
If you are a guest at a hotel, a shopper, or an employee whose details are held in a Penahak system, the business you dealt with is responsible for that data. Contact them first. We will support them in answering you, but we cannot give out or change their records on your request alone.
What we collect
When you use this website
- What you type into a form: your name, email address, phone number, business name, and what you tell us about your requirements.
- Technical information your browser sends: IP address, browser and device type, pages viewed, and the page you arrived from. This is used for security and to understand which pages are useful.
When you hold a Penahak account
- Account and contact details for each of your users, including name, email address, phone number and role.
- Business and billing details, including your registered name, address, and PAN or VAT registration number where required for invoicing.
- Records of subscription, invoices and payments.
- Support correspondence, and the activity log of actions taken in your workspace.
What we do not do
- We do not sell personal information, and we do not rent or trade contact lists.
- We do not use the business records inside a customer’s workspace for advertising, resale, or to build products for anyone else.
- We do not ask you to send passwords, card numbers or full bank credentials by email or over the phone, and you should refuse if anyone claiming to be us does.
Why we collect it
| Purpose | Basis |
|---|---|
| Answering an enquiry or arranging a demonstration | Your consent, given when you submit the form |
| Providing the Penahak service under a subscription | Performance of our contract with you |
| Invoicing, collecting payment and keeping accounts | Our contract, and our obligations under Nepali tax law |
| Providing support and investigating faults | Performance of our contract |
| Keeping the service secure and detecting misuse | Our legitimate interest in protecting the service and its users |
| Responding to a lawful order from a competent authority | Legal obligation |
Where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not affect processing already carried out, and it may mean we can no longer provide a service you have asked for.
Cookies and similar technology
This website uses cookies for two things: keeping the site working (for example, remembering that you have dismissed a notice or that you are signed in to the administration area), and understanding which pages are read.
You can block or delete cookies in your browser settings. Essential cookies cannot be switched off without breaking parts of the site; the rest are not required for you to read any page here.
Who we share information with
We share personal information only where it is necessary, and only with parties who are bound to protect it:
- Hosting and infrastructure providers, who store and serve the application and this website.
- Payment providers — where you pay through eSewa, Khalti, Fonepay, a card scheme or a bank, that provider processes the payment under its own terms. We receive confirmation and settlement information; we do not store your full card or wallet credentials.
- SMS and email delivery providers, for notifications you or your business have configured.
- Professional advisers — our auditors and lawyers, under a duty of confidentiality.
- Government authorities, including the Inland Revenue Department, where disclosure is required by Nepali law or by a lawful order.
If our business is transferred or reorganised, information may transfer with it. We will tell affected customers before that happens.
Where information is held
Penahak is a cloud service, and some infrastructure and support tools we rely on operate outside Nepal. Where information is transferred out of the country, we do so only to the extent needed to run the service, and we require the provider to keep it confidential and secure.
If your organisation has a specific requirement about where its data is stored, raise it before you sign. It is a question we would rather answer honestly up front than be asked after go-live.
How long we keep it
- Enquiries that do not become customers — kept while we are in contact and for a reasonable period afterwards, then deleted.
- Customer workspace data — kept for as long as the subscription is active. After it ends, we retain it for an agreed wind-down period so you can export your records, then delete it.
- Accounting and tax records — retained for the periods required by the Income Tax Act, 2058 (2002) and the Value Added Tax Act, 2052 (1996). We cannot delete these earlier on request, because we are required to hold them.
- Activity and audit logs — retained so that a posted document can always be traced to the person who created it. This is a deliberate design decision and applies for the life of the record.
How we protect it
- Role-based access control, so a user sees only what their role permits.
- Optional two-factor authentication, and IP address whitelisting for organisations that want to restrict where the system can be reached from.
- Time-based account start and expiry, so temporary access genuinely expires.
- Encrypted connections between your browser and the service.
- Activity logging of actions taken in the system, which cannot be switched off.
- Automatic and manual backups, with restore procedures.
No system is immune. If a breach affects your personal information and creates a real risk to you, we will tell you and, where required, the relevant authority, and we will tell you what we know rather than waiting until we know everything.
Your rights
Consistent with Article 28 of the Constitution and the Individual Privacy Act, 2075 (2018), you may ask us to:
- tell you what personal information about you we hold, and why;
- correct information that is inaccurate or incomplete;
- stop disclosing your information to others, where that disclosure is not required by law;
- delete information we no longer have a lawful reason to keep;
- withdraw a consent you previously gave.
Write to info@penahak.com. We may need to verify who you are before we act, so that we are not disclosing someone else’s information to you. We will respond within a reasonable period and, if we cannot do what you have asked, we will explain why.
If you are not satisfied with our response, you may complain to the appropriate authority in Nepal, or seek a remedy through the courts. Nothing in this policy limits your rights under the Consumer Protection Act, 2075 (2018).
Children
Penahak is business software. It is not directed at children, and we do not knowingly collect personal information from children through this website. If a customer’s own records include information about a minor, that customer is responsible for the lawful basis on which they hold it.
Changes to this policy
We may update this policy as the service or the law changes. The review date at the top of the page tells you when it last changed. Where a change materially affects how we handle information about customers, we will notify account holders directly rather than relying on this page alone.
See also our privacy policy and terms of service, or get in touch if anything here is unclear.