Last updated: 2 October 2026
Who this policy covers
This policy explains how Keshab Joshi (“I”, “me”, “my”) handles personal information collected through krjoshi.com.np and in the course of providing SEO, Google Ads, Meta Ads, analytics and marketing automation services.
I operate as an independent consultant based in Kathmandu, Nepal, and work with clients in Nepal, Australia, the United Kingdom, the United States and Europe. For visitors in the United Kingdom and the European Economic Area, I am the data controller for the information described below.
For any privacy question, use the contact page, or write to Kathmandu, Nepal.
What I collect, and why
Information you give me directly
When you complete a contact form, request a free audit, book a call or email me, I collect the details you provide. Depending on the form that is your name, email address, phone or WhatsApp number, company name, website address, the services you are interested in, your approximate monthly ad budget on the two ad-audit forms, a preferred date and time where you are booking a call, and whatever you write in the message field.
I use this only to reply to you, prepare for a call, and deliver anything you asked for such as an audit. If you become a client, the same details form part of the engagement record.
What the form records about how you arrived
Alongside what you type, each enquiry stores how you reached the site, so I can see which marketing brings the right enquiries: the page you submitted from and its title, the page you first landed on, the referring website, the five UTM parameters (source, medium, campaign, term and content) for both that first visit and the visit you submitted on, advertising click identifiers if you arrived from an ad (Google’s gclid, gbraid and wbraid, Meta’s fbclid and Microsoft’s msclkid), your browser’s user-agent string, a coarse device type, and the time of submission.
Your IP address is not stored with your enquiry. To block spam and repeated submissions the site keeps a one-way SHA-256 hash of it, salted with a secret unique to this site. That hash cannot be turned back into an address; it only lets the site recognise that two submissions came from the same place.
Two further records are kept. If more than one enquiry arrives from the same email address or phone number within 24 hours, the later one is marked as related to the earlier one so I do not reply twice to the same person. And when a submission is rejected as spam, by the hidden anti-bot field or by a rate limit, the site logs that a rejection happened, with the hashed IP address and the form involved, but not what was typed.
Information collected automatically
Standard server logs kept by my hosting provider record your IP address, browser type, device, referring page and the time of the request, for security and troubleshooting. These are the host’s logs, not something the site writes.
The site uses Google Analytics, loaded through Google Tag Manager. It counts visits and shows which pages and sources lead to an enquiry. No name, email address or phone number is sent to Google, and Google Analytics 4 uses your IP address to estimate the country or city you are in and then discards it rather than storing it. There is no Google Ads tag, no Meta Pixel, no TikTok pixel, no Microsoft Clarity, no Microsoft Advertising tag and no LinkedIn tag on any page. The Cookie Policy lists every cookie in use.
Newsletter sign-up
If you subscribe to the newsletter, I collect your email address and, if you give one, your first name. The address is stored on this site alongside enquiries and is used only to send that newsletter. It is not passed to an email marketing platform, because this site does not use one, and the emails carry no tracking pixel, so I cannot tell whether you opened one.
Information I handle for clients
When I work on a client’s account, I am given access to their Google Ads, Meta Business Manager, Google Analytics, Search Console, CRM or website. Those systems may contain personal information about that client’s own customers and staff.
In that situation I act as a processor, not a controller. I only use the access for the agreed work, I do not export or copy customer databases unless the engagement specifically requires it and the client instructs it in writing, and access is removed at the end of the engagement or sooner on request. A separate data processing agreement is available for clients who need one.
Information I do not want
Please do not send medical records, financial account credentials, government identification numbers, or personal information about your customers through the contact form. If you need to share something sensitive as part of an engagement, ask and I will arrange a secure route.
Legal bases for processing
For visitors and clients in the United Kingdom and the European Economic Area, the UK GDPR and the EU GDPR require a legal basis for each purpose.
| What I do | Legal basis |
|---|---|
| Reply to your enquiry and prepare a proposal | Steps taken at your request before entering a contract, Article 6(1)(b) |
| Send you the newsletter you signed up for | Your consent, Article 6(1)(a), which you can withdraw at any time by unsubscribing |
| Deliver services and issue invoices under an engagement | Performance of a contract, Article 6(1)(b) |
| Keep records of enquiries and work delivered | Legitimate interests in running and defending a professional practice, Article 6(1)(f) |
| Secure the website, measure how it is used, and attribute an enquiry to the marketing that produced it | Legitimate interests in protecting the service and understanding which marketing works, Article 6(1)(f) You can prevent this entirely by blocking cookies for this site, and nothing else stops working. |
| Keep accounting records | Legal obligation under Nepali tax law, Article 6(1)(c) |
Where processing rests on legitimate interests, I have considered whether it would be unexpected or intrusive, and limited it to what is necessary. You can object to it at any time.
Who else sees your information
I do not sell personal information and I do not share it with data brokers or advertisers for their own purposes. Today the list of recipients is short, because the site sends your data almost nowhere.
| Recipient | Purpose | Where it processes data |
|---|---|---|
| Website hosting provider | Running the site and its database, and keeping server logs | Ask and I will name the provider and the country its servers are in |
| Business email provider | Carrying the notification when you submit an enquiry, and storing our correspondence | Global infrastructure |
| Google (Analytics and Tag Manager) | Counting visits and showing which pages and sources produce enquiries | Global infrastructure |
| WhatsApp (Meta) | Messages you choose to send me | Global infrastructure |
Your enquiry is saved to this site’s own database first, and the notification email is sent afterwards; the enquiry is kept whether or not that email succeeds. There is no CRM, scheduling tool or automation platform connected to the enquiry pipeline. An outgoing webhook that could forward enquiries elsewhere exists in the software but is switched off.
If I add any further analytics or advertising tag, this table and the Cookie Policy are updated to match. I will also disclose information where the law requires it, or where it is necessary to establish or defend a legal claim.
International transfers
I am based in Nepal, which has not been assessed by the UK or the European Commission as providing an adequate level of data protection. If you are in the United Kingdom or the European Economic Area, your information will therefore be accessed from outside those areas.
Where I act as a processor for a UK or EU client, transfers are covered by the standard contractual clauses or the UK international data transfer addendum in the engagement agreement, together with the technical measures described below. For general website enquiries, the transfer is necessary to respond to a request you made, under Article 49(1)(b).
You can ask for a copy of the transfer safeguards that apply to your engagement, or for the named list of providers rather than the categories above, at any time.
How long information is kept
| Category | Retention |
|---|---|
| Enquiries that do not become engagements | Up to 24 months from the last message, then the personal details are erased from the record |
| Client engagement records, contracts and deliverables | Duration of the engagement plus 7 years, for tax and professional records |
| Invoices and accounting records | 7 years, as required by Nepali tax law |
| Server logs | Set by my hosting provider, typically 30 to 90 days |
| Newsletter subscribers | Until you unsubscribe, after which the address is removed from the list |
The krj_attr cookie in your browser | 90 days, or until you clear it |
| Client account access | Removed at the end of the engagement or on request |
When an enquiry reaches the end of its retention period, or when you ask for erasure, the personal fields and the advertising click identifiers are cleared from the record. The campaign columns that describe the visit rather than the person, such as which campaign brought the enquiry, are kept so that historical marketing reporting stays accurate.
How information is protected
The site runs over HTTPS. Enquiry forms carry anti-spam and anti-forgery protection, rate limiting per address, and a timing check. Enquiry data is stored in the site’s own database tables rather than among its posts, so it is not exposed to search, feeds or the public API. Administrative access requires a strong password. Client accounts are accessed through delegated or partner permissions rather than shared passwords, so nothing is stored on my side that a client cannot revoke. Devices are encrypted and kept up to date.
No system is completely secure. If a breach occurs that is likely to affect you, I will tell you and, where the law requires it, the relevant authority, as quickly as I reasonably can.
Your rights
Rights differ by where you live. Whatever your location, I will handle a request within 30 days and will not charge for it or treat you differently for making it.
United Kingdom and European Economic Area
Under the UK GDPR and the EU GDPR you can ask for access to your information, correction of anything inaccurate, deletion, restriction of processing, portability of information you provided, and you can object to processing based on legitimate interests or to direct marketing. Where processing rests on consent, you can withdraw it at any time without affecting what was done beforehand.
If you are not satisfied with my response, you can complain to the Information Commissioner’s Office in the United Kingdom at ico.org.uk, or to the supervisory authority in your EU member state.
Australia
The Australian Privacy Principles under the Privacy Act 1988 (Cth) give you the right to ask what personal information is held about you, to have it corrected, and to complain about how it has been handled. Complaints can be made to the Office of the Australian Information Commissioner at oaic.gov.au.
United States
Depending on your state, you may have the right to know what personal information has been collected, to have it deleted or corrected, and to opt out of its sale or sharing. I do not sell or share personal information as those terms are defined under California law, and I do not use it for cross-context behavioural advertising.
Nepal
The Individual Privacy Act 2075 (2018) and the Individual Privacy Regulation 2077 (2020) give you the right to be informed about the collection of your personal information, to consent to it, and to have inaccurate information corrected. Complaints under the Act are made to the District Court, and a strict limitation period applies, so act promptly.
Making a request
Ask through the contact page, with enough detail for me to find your records. I may ask a question to confirm your identity before acting, particularly for deletion requests. The site is wired into WordPress’s own privacy tools, so an export returns every field held against your email address and an erasure clears the personal fields and the advertising identifiers.
Marketing
I run one email list, the Nepal Marketing Notes newsletter, and it is opt-in: the only way onto it is the form on the newsletter page. Enquiry contacts and clients are never added to it, I do not send unsolicited commercial email, and I do not buy contact lists.
Newsletter addresses are held on this site and used for that newsletter alone. They are not sold, shared or passed to an email marketing service. Every issue says how to stop receiving it: reply with the word unsubscribe and I remove your address from the list. You can also ask by any other route in the contact section below.
Children
The site is aimed at businesses and is not directed at anyone under 16. I do not knowingly collect information from children. If you believe a child has sent me personal information, tell me and I will delete it.
Automated decisions
I do not make decisions about you by automated means that produce legal or similarly significant effects. Enquiries are scored for spam automatically, but a high score only flags a message for my attention; nothing is refused without a person looking at it.
Links to other sites
Pages here link to client websites, tools and platforms I do not control. Their privacy practices are their own, and this policy does not cover them.
Changes to this policy
When this policy changes, the date at the top changes with it. Material changes will be noted on the page for at least 30 days. Continuing to use the site after a change means you accept the current version.