Privacy Policy & Data Protection Standards

Effective Date: October 2026 | Document Version: 3.2 | Compliance: Individual Privacy Act 2075 (Nepal)

Lavam Tech Private Limited ("LavamTech", "we", "us", or "our") is dedicated to upholding the highest standards of data protection, customer confidentiality, and operational transparency. This Privacy Policy governs the collection, processing, storage, and security of information obtained through our official website (lavamtech.com.np), our proprietary multi-tenant SaaS platforms (including Schoolaya and Restrilia), our API endpoints, and our recruitment channels.

This policy is engineered in strict accordance with the Individual Privacy Act, 2075 (2018) of Nepal, the Electronic Transactions Act, 2063 (2006), and international data protection standards governing tenant isolation and personal information handling.

Our Data Guarantee: LavamTech never sells, monetizes, or rents personal or institutional data. We do not inspect or aggregate customer data across tenants for external AI model training or commercial profiling.

1. Scope & Identification of Data Roles

Depending on the nature of your interaction with LavamTech, our legal responsibilities under data protection laws are defined as follows:

LavamTech as Data Controller: When you browse our website, submit an enterprise inquiry form, subscribe to our technical newsletter, or apply to our Talent Pool, LavamTech acts as the Data Controller responsible for determining the purpose and means of processing your personal details.
LavamTech as Data Processor: For all data uploaded, processed, or managed within our multi-tenant SaaS products (such as student academic records, parental contact details, teacher logs, and financial transaction histories within Schoolaya; or customer orders and billings within Restrilia), LavamTech acts strictly as a Data Processor. The subscribing institution (school, college, enterprise) remains the sole Data Controller and legal owner of all uploaded records.

2. Categories of Information We Collect

We collect only the minimum necessary information required to provide our enterprise software services, maintain network security, and satisfy statutory obligations in Nepal:

A. Information You Voluntarily Provide

Commercial Consultation Inquiries: Full name, organizational email address, contact telephone number, institution or company name, project specifications, and any correspondence submitted through our contact forms.
Job Applications & Talent Pool Submissions: Full name, email address, phone number, residential city/country, current and target professional title, primary engineering discipline, years of experience, educational degrees, GPA/grades, graduation year, curriculum vitae (CV/resume files in PDF or DOCX format), portfolio URLs, LinkedIn profile links, GitHub profile links, salary expectations, and notice periods.
SaaS User Credentials: Full name, verified mobile phone number, email address, encrypted authentication hashes, and role-based access tokens required to access authorized institution dashboards.

B. Automated System Telemetry & Logs

Network Telemetry: Anonymized IP addresses, browser engine details, operating system types, HTTP referring URLs, and request latency timings collected to diagnose performance bottlenecks.
Security Audit Trails: Timestamped authentication attempts, role-switching events, export downloads, and system authorization failures captured by our security middleware for intrusion detection and incident investigation.

3. Multi-Tenant SaaS Data Isolation Guarantee

Tenant isolation is our paramount architectural principle. Every institutional customer subscribing to a LavamTech platform operates within a logically isolated environment:

Immutable Row-Level Filtering: Every single database query executed against tenant-scoped tables enforces a strict WHERE tenant_id = ? constraint. This rule is applied programmatically at the middleware layer before queries reach the database driver.
Cross-Tenant Segregation: User accounts from Institution A can never access, query, view, or deduce the records of Institution B under any circumstance. Automated security test suites (including tests/security/crossTenantIsolation.test.js) run continuously to verify zero cross-tenant leakage.
Sovereign Data Portability: All institutional data remains the absolute property of the customer. Upon termination of service, subscribing institutions are entitled to export all institutional records in standard, non-proprietary formats (CSV, JSON, SQL) within thirty (30) days.

4. Lawful Grounds for Data Processing

We process personal and organizational information only when we possess an established lawful basis under Nepalese law:

Performance of Contract: To deliver licensed software functionality, process legitimate transactions, provide technical support, and fulfill our contractual Service Level Agreements.
Statutory Compliance: To satisfy corporate auditing, tax reporting (Inland Revenue Department of Nepal), and lawful judicial requests.
Legitimate Technical Interests: To detect distributed denial-of-service (DDoS) attacks, mitigate unauthorized penetration attempts, and optimize server response times.
Explicit Consent: To send technical updates, newsletters, or talent matching opportunities where individuals have affirmatively opted in.

5. Trusted Sub-Processors & Infrastructure Partners

LavamTech engages a curated roster of trusted technical infrastructure partners to deliver our digital services. Every sub-processor is vetted for rigorous data protection standards and bound by non-disclosure and security covenants:

Infrastructure Partner Operational Function Data Location / Scope
| Tier-IV Enterprise Cloud Data Centers | High-availability cloud computing clusters, enterprise database hosting, and automated encrypted offsite backups. | Secure Enterprise Cloud Infrastructure with 24/7 monitoring and DDoS mitigation
| Authorized Payment Gateways & Interbank Networks | Secure payment gateway routing and transaction settlement for SaaS billing. | PCI-DSS compliant; LavamTech stores zero raw card or banking PIN numbers.
| Enterprise Telecom SMS Gateways | Carrier transactional SMS dispatch for attendance alerts and two-factor OTPs. | Kathmandu, Nepal (Transactional phone numbers only)

6. Cryptographic Safeguards & System Security

LavamTech implements defense-in-depth technical and organizational measures to safeguard data against accidental destruction, unauthorized alteration, or malicious exfiltration:

Transport Encryption: All public and private web traffic is encrypted using Transport Layer Security (TLS 1.3 / HTTPS) with HTTP Strict Transport Security (HSTS) enforced across all subdomains.
Encryption at Rest: Database snapshots, private CV storage repositories, and sensitive institutional uploads are stored with AES-256 encryption.
Password Protection: User passwords are never stored in plaintext. We utilize adaptive, salted password hashing functions (Argon2id and Bcrypt with high work factors).
Restricted Operator Access: Internal access to production database servers is strictly restricted to senior infrastructure engineers using multi-factor authentication (MFA) and SSH keys with session logging.

7. Data Retention & Destruction Protocols

We maintain operational data only for the duration required to achieve the purpose for which it was gathered:

General Sales Inquiries: Retained for twenty-four (24) months to facilitate commercial discussions, after which they are securely archived or purged.
Talent Pool Profiles & CVs: Retained for thirty-six (36) months for ongoing recruitment evaluation. Candidates may request immediate, permanent deletion of their profile at any time by emailing [email protected].
Institutional SaaS Tenant Data: Retained during the active subscription period. Upon formal contract termination, the customer is granted thirty (30) calendar days to export all data, after which tenant databases are cryptographically sanitized and purged.
Security & Audit Logs: Retained for twelve (12) months to satisfy forensic and cybersecurity audit requirements.

8. Statutory Data Subject Rights

In accordance with the Individual Privacy Act, 2075 of Nepal and modern data privacy frameworks, individuals retain the following statutory rights:

Right of Access: You may request a verified copy of all personal information held about you by LavamTech.
Right to Rectification: You may request the prompt correction of inaccurate, outdated, or incomplete records.
Right to Erasure ("Right to Be Forgotten"): You may request the permanent deletion of your personal records where no statutory or contractual obligation necessitates ongoing retention.
Right to Data Portability: You may request your personal data exported in a structured, commonly used, and machine-readable format (CSV or JSON).
Right to Withdraw Consent: Where processing is predicated on voluntary consent, you may withdraw your consent at any time without retroactive penalty.

9. Cookies & Browser Storage

Our website utilizes strictly necessary session cookies (e.g., XSRF-TOKEN and encrypted session identifiers) essential for security and anti-tampering verification. We do not deploy invasive third-party tracking pixels, behavioral advertising beacons, or cross-site commercial profiling cookies.

10. Contacting Our Data Protection Officer (DPO)

If you have questions, concerns, or formal requests regarding this Privacy Policy or wish to exercise your statutory privacy rights, please direct your communication to our dedicated Data Protection Officer:

Attention: Data Protection Officer (DPO)
Entity: Lavam Tech Private Limited
Address: Kathmandu, Bagmati Province, Nepal
Email: [email protected]
General Inquiries: [email protected]