Privacy, Safeguarding & Confidentiality Policy
Nepal Education Consultancy Pvt. Ltd. (NEC)
Version 2.0 | Effective Date: Shrawan 1, 2083 (17 July 2026) | Next Review: Shrawan 1, 2084 (17 July 2027)
Approved By: Board of Directors — Nepal Education Consultancy Pvt. Ltd.
1. Introduction
Nepal Education Consultancy Pvt. Ltd. (NEC) prioritises protecting the privacy and personal data of all individuals who interact with the organisation including students, clients, guardians, staff, and other stakeholders. This Policy explains, clearly and transparently, what personal data NEC collects, why, on what legal basis, how long it is kept, who it may be shared with (including overseas), and what rights individuals have.
NEC supports students applying to study destinations worldwide, including Australia, New Zealand, the United Kingdom, the United States, Canada, UAE/Dubai, Sri Lanka, Malaysia, Germany, the Netherlands, and other countries. This Policy applies to all of NEC's services regardless of destination country, and reflects Nepali law together with internationally recognised data protection standards, which NEC adopts as good practice across all its operations.
2. Who We Are
Nepal Education Consultancy Pvt. Ltd. (NEC) is the data controller responsible for the personal data described in this Policy, meaning NEC decides how and why personal data is processed. In some circumstances (for example, where a university or institution sets the purpose for which data is used), NEC may instead act as a data processor on that organisation's behalf. Where that happens, the partner's own privacy notice may also apply.
3. Commitment to Privacy
NEC’s approach to privacy includes:
● Upholding the trust of students, families, and institutional partners by collecting only the essential information needed to provide quality educational and advisory services.
● Treating all personal data, including identity information, academic records, contact details, and immigration documents, as confidential, with effective measures for protection, secure processing, and responsible sharing.
● Providing clear explanations of how information will be used, stored, and, where necessary, shared, enabling individuals to make informed choices and exercise control over their data.
4. Scope of the Policy
This Policy applies to all services and interactions provided or facilitated by NEC, including but not limited to:
● Education counselling for students and families, across all destination countries NEC supports
● Processing applications and supporting scholarship or visa procedures
● Conducting language courses and exam preparation programmes (e.g., IELTS)
● Conducting marketing activities and service promotions
● Communicating through digital platforms, such as NEC's website, social media, LinkedIn, WhatsApp, email, telephone, and in-person (walk-in) consultations
This Policy applies to prospective students, students, applicants, parents, guardians, sponsors, dependants, visitors, event participants, website and social-media users, and other individuals who communicate or work with NEC.
5. Legal and Ethical Principles
The principles in this Policy are grounded primarily in Nepali law, and are also informed by internationally recognised data protection standards, which NEC applies as a matter of good practice given the international nature of its services:
● The Privacy Act, 2018 (Nepal) — rights and responsibilities relating to the collection and protection of personal data.
● The Privacy Regulation, 2020 (Nepal) — practical guidelines for securing, processing, and managing sensitive information.
● The Electronic Transactions Act, 2006 (2063) (Nepal) — minimum standards for the safe handling of digital information.
● The Act Relating to Children, 2018 (Nepal) — special safeguards, parental consent, and protections for minors.
● Internationally recognised data protection standards, including the UK's Data Protection Act 2018(incorporating UK GDPR) and Australia's Privacy Act 1988.
This Policy also reflects NEC's own Code of Conduct on confidentiality and ethics. NEC considers compliance with these standards essential to all operations, even where a formal legal requirement does not apply.
6. Information We Collect
NEC collects only the information necessary to provide quality educational, advisory, and support services. The categories below explain what NEC may request or receive, and why. The exact information collected depends on the services requested and the requirements of the relevant institution, visa authority, or partner.
● Identity & contact information: name, date of birth, nationality, gender where required, photograph, address, telephone number, email address, and signature.
● Academic and employment records: transcripts, certificates, CVs, reference letters, recommendation letters, English-language test scores, work history, and career plans.
● Application and counselling records: course preferences, eligibility assessments, counselling notes, application forms, statements of purpose, interview notes, offers, enrolment and scholarship information.
● Visa & immigration information: passport details, photographs, visa history, refusals, immigration status, travel history, and supporting application documents.
● Financial information: tuition and fee payment records, proof of funds, sponsor income evidence, bank statements, education loans, and transaction confirmations.
● Family and relationship information: details about parents, guardians, spouses, dependants, and sponsors where relevant to an application, finance, or immigration requirement.
● Communications: emails, messages, feedback forms, call records, meeting records, complaints, and notes from counselling sessions.
● Student learning data: class attendance, assignments, progress reports, and mock test performance.
● Digital, technical & marketing data: enquiries via NEC's website and social media (Facebook, Instagram,TikTok, WhatsApp, Google), IP address, device/browser information, cookie identifiers, basic analytics, and walk-in records maintained in NEC's student information system.
● Security information: visitor records and CCTV images, where CCTV is installed and appropriately signposted.
● Special category data: only where necessary and legally permitted — for example, medical information required for insurance or accommodation, disability support requirements, or criminal record information requested by an institution or visa/immigration authority. This data receives additional protection, and NEC only processes it where a specific lawful condition for special category or sensitive data applies, normally relying on explicit consent unless another lawful condition applies (such as protection of vital interests or the establishment/defence of legal claims)
7. Where We Obtain Personal Data
NEC usually receives personal data directly from the individual concerned. NEC may also receive it from:
● parents, guardians, spouses, dependants, sponsors, or authorised representatives;
● schools, colleges, universities, testing bodies, employers, or referees;
● education and pathway providers, and authorised representatives;
● visa and immigration authorities, embassies, high commissions, or official application systems;
● banks, loan providers, insurers, accommodation providers, and payment processors;
● publicly available sources and social media platforms, where relevant and lawful; and
● third-party lead or event platforms, where an individual has asked to be contacted or has consented to their information being shared.
If you provide NEC with another person's information, you should ensure you are authorised to do so and that the person has received this Policy or equivalent privacy information.
8. How We Use Your Information, and Our Lawful Basis for Doing So
NEC only uses personal data where it has a valid lawful basis to do so. The table below sets out our core activities and the lawful basis relied on for each.
Where NEC relies on consent as its lawful basis (for example, for marketing communications), individuals have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of any processing carried out before the withdrawal, and will not affect processing carried out under a different lawful basis (for example, records NEC must keep for legal or accounting reasons). To withdraw consent, contact NEC using the details in Section 2 or use the unsubscribe option in marketing communications.
9. Automated Decision-Making and Profiling
NEC does not use solely automated decision-making, including profiling, that produces legal effects or similarly significant effects on individuals. Decisions on university/college admissions, scholarships, and visa or immigration applications are made by the receiving institutions and government authorities, not by NEC, and always involve human review. Where NEC uses basic analytics on enquiries or website activity, this is used only to improve service quality and does not result in automated decisions about any individual. Education providers, visa authorities, banks, testing bodies, or online platforms may use their own automated tools under their own privacy notices, which NEC does not control.
10. Sharing of Information
NEC only discloses personal data to trusted parties where strictly needed to deliver its services or meet legal obligations. All recipients are bound by confidentiality obligations comparable to NEC's own. NEC does not sell or rent personal data, and never shares it for commercial purposes unrelated to the client's engagement with NEC. Depending on the case, NEC may share information with:
● Universities, colleges, pathway providers, scholarship bodies, and institutions you apply to.
● Visa and immigration authorities (embassies, consulates, application centres, government bodies).
● Test providers and credential evaluators (e.g., IELTS and related exam bodies).
● Banks, education-loan providers, payment processors, and auditors.
● Technology providers (email, CRM, cloud storage, cyber-security) who process information on NEC's behalf under contract.
● Service partners (accommodation, insurance, health checks, travel).
● Professional advisers, regulators, or courts, where disclosure is necessary and lawful.
● NEC staff, branches, authorised representatives, and contractors who need access for their role and are subject to confidentiality obligations.
NEC does not permit service providers to use personal data for their own unrelated purposes, and requires them to protect it through appropriate contractual and security obligations.
11. International Data Transfers
Because NEC supports applications to study destinations outside Nepal, personal data is, by the nature of the service, transferred internationally to universities, colleges, visa and immigration authorities, and related service partners in the client's chosen destination country.
These transfers are necessary for the performance of NEC's contract with the client (i.e., to process the application or visa on their behalf), and clients are informed of this at the point they engage NEC's services. Where personal information is transferred internationally, NEC takes reasonable steps to ensure appropriate safeguards are in place.
These safeguards may include:
● Contractual confidentiality obligations.
● Data processing agreements.
● Secure encrypted transmission methods.
● Limiting access to authorised personnel.
● Transferring only information necessary for the intended purpose.
● Working with organisations that maintain recognised privacy and security standards.
While privacy laws differ between countries, NEC takes reasonable steps to ensure personal information remains protected throughout the transfer process. Institutions, authorities, and other recipients in the United Kingdom and Australia are separately subject to their own applicable data protection law (including the UK GDPR and Australia's Privacy Act 1988) for how they handle personal data once received.
12. Data Retention
NEC keeps personal data only for as long as necessary for the purpose it was collected, taking into account legal, regulatory, and operational requirements. Standard retention periods are set out below; they may be extended where necessary for an ongoing service, a legal or contractual requirement, a dispute, or another legal hold
When data is no longer required, NEC will securely delete, destroy, or irreversibly anonymise it, and will periodically review retained data to remove unnecessary duplicates and working copies.
13. Safeguarding and Confidentiality
NEC is committed to a trustworthy, safe, and respectful environment for everyone it serves. Every NEC team member is bound by confidentiality standards that fulfil both legal requirements and NEC's ethical commitments.
● Confidentiality: All NEC staff are bound by confidentiality obligations under our Code of Conduct. Client details, documents, and records are not shared without consent, except where legally required.
● Children & Minors: For students under 18, NEC requires parental/guardian consent for applications, classes, or visa support.
● Counsellor & Instructor Integrity: Staff will not misuse documents (e.g., passports remain the client's property and are never retained without necessity).
● Client Care: All staff must treat students and guardians with respect, courtesy, and professionalism.
● Duty to Protect: Where NEC believes a client may be at risk of harm to themselves or others, it may disclose the minimum necessary information to appropriate parties for safety reasons.
These safeguards are consistent with Nepal's Privacy Act, 2018, and NEC's own Code of Conduct, which treats any breach of confidentiality as a serious violation subject to disciplinary action.
14. Data Security
NEC employs technical and organisational safeguards to prevent unauthorised access, misuse, or loss of personal data, reviewed and strengthened in line with legal standards and industry best practice.
● Role-based access to internal systems, limited to staff who need it for their role.
● Password protection and multi-factor authentication where applicable.
● Secure handling of physical files and locked storage.
● Encryption where appropriate, secure document transfer, backups, and malware protection.
● Staff confidentiality training, with disciplinary measures enforced for breaches.
No method of transmission or storage is completely secure. If NEC becomes aware of a data breach that poses a risk to individuals, it will investigate promptly, take appropriate remedial action, and notify affected individuals and the relevant authority where required by applicable law.
15. Your Rights
All students, clients, stakeholders, and users engaging with NEC — whether directly or through third-party platforms — are entitled to the following rights regarding their personal data, subject to applicable legal conditions and exemptions:
● Right of access: request a copy of the personal data NEC holds about you.
● Right to rectification: request correction of any inaccurate or outdated information.
● Right to erasure: request deletion of your data, subject to applicable legal and regulatory requirements.
● Right to restrict processing: request that we temporarily limit how your data is used while an issue (such as an accuracy dispute) is resolved.
● Right to data portability: where technically feasible, request that certain data be provided to you, or transferred to another organisation, in a structured, machine-readable format.
● Right to withdraw consent: where NEC relies on your consent to process your data (e.g., for marketing), withdraw that consent at any time, without affecting processing already carried out.
● Right to object: object to processing based on legitimate interests, including direct marketing.
● Right to lodge a complaint: raise concerns directly with NEC at any time. Individuals also have the right to lodge a complaint with the relevant authorities in Nepal under the Privacy Act, 2018.
To exercise any of these rights, contact NEC using the details in Section 2. NEC will respond promptly and provide clear guidance on the applicable process.
16. Cookies and Website Use
NEC's website uses cookies and similar technologies for essential functions: ensuring the website operates correctly (strictly necessary cookies), analysing visitor activity to improve services (analytics cookies, such as Google Analytics), and remembering preferences such as language and form settings (preference cookies).
Individuals can manage or disable cookies at any time through their browser settings, though some website features may not work as intended if cookies are disabled. NEC does not use cookies to directly identify individuals, and cookie data is not shared with or sold to third parties for marketing or external purposes.
NEC's website may contain links to external websites operated by universities, institutions, or authorities. NEC isnot responsible for the privacy practices of these third-party sites, and encourages clients to review their privacy policies separately.
17. Governing Law
NEC is established in Nepal and primarily operates under Nepali law. Because NEC supports students applying to institutions in multiple countries, it also endeavours to meet applicable privacy obligations in those jurisdictions where relevant to the services provided, as reflected throughout this Policy. Nothing in this Policy limits any right or protection available to an individual under the law of their own jurisdiction.
18. Complaints
Please contact NEC first, using the details in Section 2, so that concerns can be investigated and resolved promptly. Individuals also have the right to lodge a complaint with the relevant authorities in Nepal under thePrivacy Act, 2018.
19. Updates to This Policy
This Policy is reviewed periodically and updated where necessary — including to reflect changes in law, our services, or destination-country requirements. The most recent version is always available on our website.
20. Contact Us
For any inquiries, requests, or concerns related to this Policy or the handling of personal data, contact NEC directly. All communications are treated with the utmost respect for confidentiality.
Nepal Education Consultancy Pvt. Ltd. (NEC)
Putalisadak, Kathmandu, Nepal
Email: ananta@applynec.com / shashank@applynec.com
Phone: +977 5910770
Office Hours: 9:00 AM – 6:00 PM, subject to change in accordance with requirements
