CORPORATENP

Business & Corporate Advisory Services | Nepal

PRIVACY POLICY

Effective Date: March 21, 2026

Last Reviewed: March 21, 2026

Next Scheduled Review: March 21, 2027

1. Introduction and Scope

CorporateNP (referred to in this document as "we," "us," or "our") is a professional business advisory and corporate consulting firm based in Kathmandu, Nepal. We operate through our website at www.corporatenp.com and provide services including Foreign Direct Investment (FDI) advisory, business incorporation, foreign branch office registration, aircraft lease and registration, construction licensing advisory, and related financial and legal consulting services.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit our website, communicate with us, or engage our advisory services. It applies to all users of our website — including prospective clients, existing clients, visitors, and business representatives from any jurisdiction worldwide.

Because we serve clients from multiple countries — including Nepal, India, the Arab world, and further afield — this policy is designed to comply with applicable data protection frameworks including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the Individual Privacy Act 2018 of Nepal, and other major international privacy standards.

By using our website or contacting us through any channel listed on this site, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with these practices, please discontinue use of our website.

2. Data Controller and Contact Details

The data controller responsible for your personal information is:

CorporateNP

Business & Corporate Advisory Services

World Trade Center, Kathmandu, Nepal

(Also accessible at: Putalisadak, Kathmandu)

Email: info@corporatenp.com

Phone: +977 9768717747

WhatsApp: +977 9768717747

For all privacy-related inquiries, requests, or complaints, please contact us at the email address above, referencing "Privacy Policy" in the subject line.

3. Information We Collect

We collect personal information through several distinct channels on our website. The categories below reflect the actual data practices we have identified:

3.1 Information You Provide Directly

a) Contact Form

Our website features a contact/inquiry form ("Feel free to write / Send Message") on the Contact page and on the homepage. When you submit this form, we collect:

• Full name

• Email address

• Phone number (if provided)

• The content of your inquiry or message

• Any attachments or supplementary documents you choose to submit

b) Newsletter Subscription

Our website includes a newsletter subscription feature in the site footer, through which visitors can subscribe to receive updates, news, and articles about business, taxation, FDI, and corporate law in Nepal. When you subscribe, we collect:

• Email address

• Subscription date and timestamp

c) Direct Communications

When you contact us via telephone, WhatsApp, or email directly, we may collect:

• Your name and contact details

• The content of your communications

• Voice recordings or chat logs (where applicable and where you have been informed)

d) Client Engagement and Advisory Processes

If you engage our services as a client, we will collect additional information necessary to deliver those services. This may include:

• Business registration documents and corporate information

• Passport or government-issued identification (required for FDI and company registration processes in Nepal)

• Financial information relevant to investment assessments or advisory mandates

• Details of proposed business activities, investment plans, or corporate structures

• Legal entity documents, directorship information, and shareholding structures

This information is collected under a separate client services agreement and is subject to professional confidentiality obligations in addition to this Privacy Policy.

3.2 Information Collected Automatically

When you visit our website, our web server and any analytics or session tools automatically collect certain technical data, including:

• IP address

• Browser type and version

• Operating system

• Referring URLs (pages that linked you to our site)

• Pages visited and time spent on each page

• Date and time of your visit

• Language preference (English, Arabic, or Hindi as selected on the site)

This data is used for security monitoring, performance optimization, and basic traffic analysis. We do not currently operate a formally named analytics platform (such as Google Analytics); however, standard web server access logs are maintained.

3.3 Cookies and Tracking Technologies

Our website uses cookies and similar technologies. Please see Section 9 (Cookie Policy) for full details.

4. How We Use Your Information

We use your personal information only for the purposes described below. We will not use your data in ways that are incompatible with these stated purposes without your prior consent.

4.1 Service Delivery and Client Advisory

• To respond to your inquiries submitted through our contact form, email, or phone

• To assess your advisory needs and prepare service proposals or quotations

• To provide FDI advisory, business incorporation, branch office registration, and other consulting services you have engaged

• To communicate updates about your engagement, including regulatory developments that may affect your matter

4.2 Marketing and Communications

• To send our newsletter to subscribers who have opted in

• To share relevant news, blog articles, regulatory updates, and service announcements

• To conduct follow-up communications after initial inquiries

You may opt out of marketing communications at any time (see Section 7 on your rights).

4.3 Website Operation and Security

• To maintain and improve the functionality and performance of our website

• To detect, prevent, and respond to security threats, fraud, or unauthorized access

• To comply with our legal obligations regarding record-keeping and cybersecurity

4.4 Legal and Regulatory Compliance

• To comply with Nepalese law, including the Foreign Investment and Technology Transfer Act (FITTA 2019), Company Act 2006, and related regulations

• To respond to lawful requests from government agencies, courts, or regulatory authorities

• To enforce our Terms of Use and protect our legal rights

4.5 Business Analytics and Improvement

• To understand how users interact with our website in order to improve usability and content

• To measure the effectiveness of our blog, service pages, and contact features

5. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), the United Kingdom, or other jurisdictions with consent-based data protection laws, we process your personal data on the following legal bases:

5.1 Legitimate Interests

We process contact form submissions, email inquiries, server log data, and basic analytics under our legitimate interest in operating a business advisory website, responding to prospective clients, and ensuring the security and performance of our platform. We have balanced these interests against your rights and concluded our processing is proportionate and not prejudicial to your fundamental rights.

5.2 Contractual Necessity

Where you engage our advisory services, we process the personal and business information necessary to perform our contractual obligations to you, including client due diligence, regulatory filings, and advisory deliverables.

5.3 Consent

We process your email address for newsletter distribution on the basis of your freely given, specific, and informed consent obtained at the time of subscription. You may withdraw this consent at any time by unsubscribing.

5.4 Legal Obligation

We may process your data where required to comply with applicable Nepalese law, international tax reporting obligations, anti-money laundering (AML) regulations, or court orders.

6. Data Sharing and Third Parties

We do not sell, rent, or trade your personal information to any third party for commercial or marketing purposes. We may share your data only in the circumstances described below:

6.1 Service Providers and Technology Partners

We use limited third-party services to operate our website and deliver our advisory services. These may include:

• Web Hosting Provider: Our website and its associated data (including form submissions and server logs) are hosted on our web server infrastructure. The hosting provider may process data on our behalf as a data processor.

• WhatsApp (Meta Platforms): Our website includes a WhatsApp contact button that redirects you to the WhatsApp messaging platform. If you initiate contact via WhatsApp, your communications are subject to Meta's own Privacy Policy and Terms of Service, in addition to this policy. We do not control Meta's data practices.

• Email Service: We send and receive emails through our domain (info@corporatenp.com). Our email service provider may process message metadata in the course of delivery.

• Newsletter Distribution: If a third-party newsletter or email marketing platform is used to distribute our newsletter, it will process subscriber email addresses as a data processor on our behalf, under a data processing agreement.

6.2 Professional and Legal Partners

We collaborate with corporate law firms in Nepal and other professional advisors to deliver comprehensive services to our clients. Where necessary, and with your knowledge, we may share relevant client information with these partners strictly for the purpose of delivering your engagement. All such partners are bound by professional confidentiality obligations.

6.3 Regulatory and Government Bodies

In the course of providing company registration, FDI approval, or licensing services, we may be required to submit your information (or your company's information) to Nepalese government bodies, including:

• Office of the Company Registrar (OCR)

• Department of Industry (DOI)

• Investment Board Nepal (IBN)

• Civil Aviation Authority of Nepal (CAAN) (for aircraft-related registrations)

• Department of Revenue Investigation and Inland Revenue Department (IRD)

This is done with your instruction and as required by applicable Nepalese law.

6.4 Legal Disclosure

We may disclose personal information if required to do so by law, or in the good-faith belief that such disclosure is necessary to comply with a legal obligation, protect our rights, prevent fraud, or protect the safety of our users or the public.

6.5 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or part of our business, personal data held by us may be transferred to the acquiring entity. We will notify affected individuals in advance of any such transfer and inform them of their choices under applicable law.

7. Your Rights and Choices

Depending on your country of residence, you may have the following rights with respect to your personal data. We honour these rights in good faith regardless of your jurisdiction.

7.1 Right of Access

You have the right to request a copy of the personal data we hold about you, along with information about how it is being used and with whom it has been shared.

7.2 Right to Rectification

If any personal data we hold is inaccurate or incomplete, you have the right to request that we correct or update it.

7.3 Right to Erasure ('Right to be Forgotten')

You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing and we have no overriding legitimate grounds.

Note: Certain data may be subject to mandatory retention obligations under Nepalese law (e.g., accounting records, regulatory filings), which may prevent full erasure.

7.4 Right to Restrict Processing

You may ask us to restrict the processing of your data in certain circumstances, such as while a query about its accuracy is being resolved.

7.5 Right to Data Portability

Where processing is based on consent or contract and is carried out by automated means, you may request a structured, machine-readable copy of your personal data to transfer to another provider.

7.6 Right to Object

You may object at any time to processing of your personal data for direct marketing purposes. You may also object to processing based on our legitimate interests, and we will cease processing unless we can demonstrate compelling legitimate grounds.

7.7 Right to Withdraw Consent

Where processing is based on your consent (e.g., newsletter subscriptions), you may withdraw that consent at any time without affecting the lawfulness of prior processing. To unsubscribe from our newsletter, click the unsubscribe link in any newsletter email or contact us at info@corporatenp.com.

7.8 CCPA Rights (California Residents)

If you are a California resident, you have additional rights under the CCPA, including:

• The right to know what personal information is collected, disclosed, or sold

• The right to request deletion of your personal information

• The right to opt out of the sale of your personal information (note: we do not sell personal data)

• The right to non-discrimination for exercising your CCPA rights

To exercise your CCPA rights, please contact us at info@corporatenp.com with the subject line "CCPA Rights Request."

7.9 How to Exercise Your Rights

To exercise any of the rights above, please contact us at info@corporatenp.com. We will respond within 30 days (or within 72 hours for urgent requests) and may need to verify your identity before processing your request.

8. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this policy, or as required by applicable law. The following retention periods generally apply:

Contact Form Inquiries: We retain contact form submissions for up to 2 years from the date of submission, or until the matter is fully resolved, to ensure continuity in client communications.

Client Engagement Records: Records relating to completed advisory engagements are retained for a minimum of 7 years in accordance with Nepalese accounting and legal retention requirements (Company Act 2006 and tax regulations).

Newsletter Subscriber Data: Email addresses of newsletter subscribers are retained for as long as you remain subscribed. Upon unsubscription, your email address is removed from the active list within 30 days. Suppression records may be retained to honour opt-out preferences.

Server and Access Logs: Technical access logs and IP address data are retained for up to 90 days for security purposes, after which they are deleted or anonymized.

Cookie Data: See Section 9 for cookie-specific retention periods.

When personal data is no longer required, we delete it securely or anonymize it such that it can no longer be linked to any identifiable individual.

9. Cookie Policy

9.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites function correctly, improve efficiency, and provide information to site owners. Our website may use both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device for a set period).

9.2 Cookies We Use

Essential / Functional Cookies

These cookies are strictly necessary for the website to function. They enable core features such as:

• Maintaining your session as you navigate between pages

• Remembering your language preference (English, Arabic, or Hindi)

• Enabling contact form functionality and anti-spam measures

These cookies cannot be disabled without affecting site functionality.

Analytics and Performance Cookies

Our web server may collect basic traffic data (page views, referral sources, session duration) through server-side logging or lightweight analytics. This data is used in aggregated, anonymized form to improve site content and performance.

Third-Party Cookies

Our website includes links to WhatsApp (Meta Platforms). If you click the WhatsApp button or interact with any embedded third-party element, that third party may set its own cookies subject to its own privacy policy. We do not control these cookies.

9.3 Cookie Retention

• Session cookies: Deleted automatically when you close your browser

• Language preference cookies: Retained for up to 12 months

• Server log data tied to sessions: Retained for up to 90 days

9.4 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can typically:

• Block all cookies

• Delete existing cookies

• Set preferences for specific websites

Please note that blocking essential cookies may affect the functionality of our website. For guidance on managing cookies in popular browsers, visit your browser's help section or www.allaboutcookies.org.

10. International Data Transfers

CorporateNP is based in Nepal and primarily serves international clients, including individuals and businesses in EU/EEA countries, India, the Gulf Cooperation Council (GCC), and elsewhere. As a result, your personal data may be transferred to, stored in, or processed in Nepal.

Nepal is not currently recognized as a country with an adequacy decision by the European Commission. When we receive personal data from individuals in the EU/EEA, we rely on appropriate safeguards to ensure your data is protected to standards equivalent to those in the EU. These safeguards may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission

• Your explicit consent to the transfer where no other safeguard applies

• The necessity of the transfer to perform a contract you have entered into with us

If you would like further information about the safeguards applicable to international transfers of your data, please contact us at info@corporatenp.com.

11. Security Measures

We take the security of your personal data seriously and have implemented a range of technical and organizational measures to protect it from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Secure HTTPS encryption for all data transmitted between your browser and our website

• Access controls limiting internal access to personal data on a need-to-know basis

• Regular review of our website's security posture

• Use of professional, business-grade email infrastructure for client communications

• Physical security at our offices in Kathmandu

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. If you believe your data has been compromised, please contact us immediately at info@corporatenp.com.

We also note for transparency that our existing Privacy Policy page was found to contain malformed content at the time of this policy's preparation. This has been addressed and we are committed to ongoing website security hygiene.

12. Children's Privacy

Our website and services are directed exclusively at business professionals, corporate clients, investors, and adults seeking business advisory services. We do not knowingly collect personal data from children under the age of 18.

If you believe that a child has provided us with personal data without appropriate parental consent, please contact us at info@corporatenp.com and we will take prompt steps to delete such information.

13. Links to Third-Party Websites

Our website may contain links to external websites, partner law firms, government portals, or other resources. This Privacy Policy applies only to www.corporatenp.com. We are not responsible for the privacy practices of third-party websites and encourage you to review their respective privacy policies before submitting any personal information to those sites.

In particular, the WhatsApp button on our site links to Meta's WhatsApp platform. Use of WhatsApp is subject to Meta's Privacy Policy, not this policy.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Effective Date" at the top of this document and, where appropriate, notify you by email (if you are a subscriber or registered client) or by a prominent notice on our website.

We encourage you to review this Privacy Policy periodically. Your continued use of our website after any changes constitutes your acceptance of the updated policy.

15. Complaints and Supervisory Authority

If you have a complaint about how we handle your personal data and are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority:

• Nepal: The National Information Commission of Nepal or any applicable data protection authority established under Nepalese law

• EU/EEA residents: The data protection supervisory authority in your EU Member State of residence

• UK residents: The Information Commissioner's Office (ICO) — www.ico.org.uk

• Other jurisdictions: The relevant data protection authority in your country

We would always encourage you to contact us first at info@corporatenp.com so we have the opportunity to resolve your concern directly.

16. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact:

Privacy Officer, CorporateNP

World Trade Center, Kathmandu, Nepal

Email: info@corporatenp.com

Phone: +977 9768717747

WhatsApp: +977 9768717747

Website: www.corporatenp.com

We are committed to resolving all privacy-related inquiries promptly and transparently.