Privacy Policy

This site is run by me, Nirajan, a web engineer working from Kathmandu, Nepal. This policy explains what personal information I collect when you use nbk.com.np, why I collect it, how long I keep it, and what you can ask me to do with it.

I have written it in plain language on purpose. If anything here is unclear, email me and I will explain it.

1. Who is responsible

I am the data controller for information collected through this site.

• Site: https://nbk.com.np
• General contact: [email protected]
• Work and freelance enquiries: [email protected]
• Location: Kathmandu, Nepal

This policy covers nbk.com.np only. It does not cover the websites of clients and employers whose work is shown here, even where I link to them. Those sites have their own policies and their own owners.

2. What I collect

Information you give me

When you send a message through the contact form, I collect your name, your email address, and whatever you write in the message. The form is one I built, and it runs on my own server rather than through a third party form service.

You choose what goes in that message, so please do not include anything sensitive that I do not need in order to reply.

If you email me directly at either address, I receive your email address, your name if your mail client sends it, and the contents of your message. Both addresses are handled the same way under this policy.

Information collected automatically

• Server logs. My hosting provider records your IP address, browser and device type, the pages you requested, and when you requested them. This happens on every website and is necessary for the site to run and stay secure.
• Spam protection. The contact form uses Google reCAPTCHA v3 and a hidden trap field. reCAPTCHA looks at how the page was used in order to score how likely the submission is to be automated. This runs on the contact form only.
• Analytics, only if you agree. Google Analytics 4, loaded through Google Tag Manager, records which pages are read, how people arrived, and basic device information. Nothing loads unless you accept analytics cookies.
• Session recording, only if you agree. Microsoft Clarity produces aggregated heatmaps and anonymized session recordings so I can see where the interface confuses people. Text you type into form fields is masked before it leaves your browser. Nothing loads unless you accept.
• Google Fonts. Some typefaces are served from Google’s font servers rather than mine. When your browser requests a font file, your IP address and basic browser information reach Google so the file can be delivered. This happens as the page loads.

I do not collect payment details through this site. I do not knowingly collect information from anyone under 16.

3. Why I collect it, and on what basis

Where the basis is consent, you can withdraw it at any time using the cookie settings link in the footer. Withdrawing it does not undo anything that happened before you withdrew it.

I do not sell your information. I do not share it with advertisers. I do not run advertising or retargeting on this site. I do not build a profile of you, and I do not make automated decisions about you.

4. How I use it

• To reply to enquiries about projects, freelance work and consulting
• To send you an automatic acknowledgment confirming your message arrived
• To keep a record of enquiries in a private, password protected area of this site that only I can reach
• To find and fix rendering, speed and compatibility problems

5. Who else is involved

I have no staff, so nobody at my end sees your information except me. But some services necessarily process data on my behalf, or receive it as a consequence of how the web works:

• My hosting provider, who run the servers and store the logs
• Google, through Google Analytics 4, Google Tag Manager, reCAPTCHA and Google Fonts
• Microsoft, through Clarity
• My email provider, who deliver and store messages sent to [email protected] and [email protected]

This site is also verified with Google Search Console and Bing Webmaster Tools. Those are reporting tools. They read pages and the sitemap that are already public. Neither receives anything you submit to me, and neither stores anything on your device.

Each of these companies has its own privacy policy. I chose them, I am responsible for that choice, and I only use providers that commit to handling data properly.

I will also disclose information where I am legally required to, for example under a court order.

6. How long I keep it

• Enquiries that do not lead to work: 24 months from the last message, then deleted.
• Enquiries that lead to work: for the length of the engagement, then for as long as I need to keep records of it. In practice up to seven years, because tax and accounting records have to be retained.
• Server logs: typically 14 to 90 days depending on the log, after which they are overwritten.
• Google Analytics: retention is set to 14 months. After that, user level and event level data is deleted and only aggregate reporting remains.
• Microsoft Clarity: recordings and heatmap data expire on Clarity’s own schedule, currently around 30 days.
• Your cookie choice: stored in your own browser until you clear it or change it.

If you ask me to delete something sooner, I will, unless I have a legal reason to keep it.

7. Where your information goes

I work from Nepal. The providers listed above may store or process data on servers in the United States, the European Union, the United Kingdom or elsewhere. Information you send me may therefore leave the country you are in.

If you are in the United Kingdom or the European Economic Area, transfers outside that area are covered by the contractual safeguards those providers put in place, usually Standard Contractual Clauses or an equivalent mechanism. Google and Microsoft each publish their own arrangements. If you want to know where a particular piece of your data sits, ask me and I will tell you.

8. Your rights

If you are in the United Kingdom or the European Economic Area, the UK GDPR and the GDPR give you the right to:

• ask what information I hold about you and get a copy of it
• have anything inaccurate corrected
• have your information deleted
• ask me to stop or limit what I do with it
• receive it in a structured, machine readable format
• object to processing based on legitimate interest
• withdraw consent at any time
• complain to a data protection regulator. In the United Kingdom that is the Information Commissioner’s Office at ico.org.uk. In the EEA it is the authority for your country

If you are in Nepal, the Individual Privacy Act, 2075 (2018) gives you the right to have your personal information kept confidential, the right to be told why it is being collected, and the right to have it used only for the purpose you agreed to. Nepal does not currently have a dedicated data protection regulator, so complaints are made through the District Court.

Wherever you are, the route is the same. Email [email protected] and I will deal with it. I respond within 30 days, and usually much sooner, because there is only one of me and the volume is small.

You can also opt out of Google Analytics across every site you visit by installing Google’s opt-out browser add-on.

9. Security

What I actually do:

• The whole site runs over HTTPS
• Form submissions are checked with a one-time token and the contents are validated and sanitized before anything is stored or sent
• The form is rate limited and protected by reCAPTCHA and a hidden trap field
• Stored enquiries sit behind administrator-only access, protected by a strong password and two factor authentication
• WordPress core, the theme and any plugins are kept up to date

I will be straight with you: no website is perfectly secure, and anyone who tells you otherwise is selling something. If something goes wrong and your information is affected, I will tell you, and I will notify the relevant regulator where I am required to.

10. Links to other sites

This site links out to the live websites of clients and employers whose work is shown here, and to code repositories. Once you follow one of those links you are on someone else’s site under someone else’s policy. I have no control over what they collect.

11. Children

This site is not aimed at anyone under 16 and I do not knowingly collect their information. If you think a child has sent me something through the form, email [email protected] and I will delete it.

12. Changes to this policy

If I change how I handle data, I will update this page and change the date at the top. Material changes will be flagged on the page for a reasonable period.

13. Contact

Questions, requests or complaints about anything above: [email protected]