Reffero Solutions Pvt. Ltd. ("Reffero", "we", "our", "us") is a company registered in Nepal operating a digital commerce and brand protection platform. This Privacy Policy explains how we collect, use, process, store, and protect personal data.
This Privacy Policy is issued in compliance with the following laws of Nepal:
- a) Electronic Commerce (E-Commerce) Act, 2081;
- b) Privacy Act, 2018 (Nepal);
- c) Consumer Protection Act, 2018 (Nepal);
- d) Electronic Transactions Act, 2063 (Nepal); and
- e) Applicable AML/KYC and electronic transaction regulations.
By accessing or using our platform ("Platform"), you acknowledge that you have read and understood this Privacy Policy.
1. Data Controller
Reffero Solutions Pvt. Ltd. is the data controller for all personal information collected through the platform:
2. Categories of Personal Data We Collect
2.1 Identity Data
- a) Full name;
- b) Date of birth (if required for verification);
- c) Government-issued identification documents (for KYC).
2.2 Contact Data
- a) Email address;
- b) Phone number;
- c) Business address.
2.3 Financial Data
- a) Bank account details;
- b) Payment transaction information;
- c) Tax identification details (VAT/PAN, where required).
2.4 Business and Platform Data
- a) Vendor/brand registration documents;
- b) Product listings and content;
- c) Creator storefront data;
- d) Sales and transaction history.
2.5 Technical and Usage Data
- a) IP address;
- b) Device information;
- c) Browser type;
- d) Cookies and analytics data;
- e) Log files.
2.6 Compliance Data
- a) AML/KYC verification status;
- b) Risk scoring and fraud monitoring results.
3. Confidentiality of Personal Information
In accordance with applicable e-commerce laws of Nepal, Reffero is obligated to maintain the confidentiality of the personal information and personal identifying details of any person associated with electronic commerce transactions conducted through our platform.
Reffero shall not disclose any such personal information to any person, or use it for any purpose other than the purpose for which it was collected, except:
- a) As expressly required or permitted by applicable law; or
- b) For the purpose of transaction-related communication between the buyer, the vendor, and any delivery carrier, to the extent necessary to complete a transaction on the platform.
4. Your Rights Over Your Personal Data on the Platform
Under applicable e-commerce and privacy laws of Nepal, Reffero guarantees the following rights to all users with respect to their personal data on the platform:
- a) Right to enter: You may provide your personal information on the platform at the time of registration or at any time thereafter.
- b) Right to access: You may view all personal information held about you on the platform at any time.
- c) Right to correct and update: You may amend or update your personal details on the platform at any time.
- d) Right to close identity sources: You may close or deactivate any identity source or identifier linked to your account. Reffero shall not prevent any user from exercising this right.
To exercise any of these rights, please contact us at legal@reffero.com. We may verify your identity before fulfilling the request.
5. Lawful Basis for Processing
- a) Contractual Necessity: To create accounts, process orders, facilitate payments, and deliver platform services.
- b) Legal Obligation: To comply with AML/KYC, tax, consumer protection, e-commerce, and other regulatory requirements under Nepalese law.
- c) Legitimate Interests: For fraud prevention, platform security, brand protection services, and service improvement and analytics.
- d) Consent: For marketing communications and optional cookies. Where processing is based on consent, you may withdraw consent at any time.
6. Purpose of Processing
We use personal data to:
- a) Operate and maintain the platform;
- b) Facilitate transactions between vendors, creators, and customers;
- c) Process payments and payouts;
- d) Provide brand protection and monitoring services;
- e) Verify identities under AML/KYC requirements;
- f) Prevent fraud and abuse;
- g) Handle disputes, grievances, and complaints;
- h) Comply with applicable legal obligations; and
- i) Improve user experience and platform performance.
7. AML and KYC Compliance
To comply with anti-money laundering and financial regulations:
- a) We may request identity verification documents.
- b) We may conduct transaction monitoring.
- c) We may retain compliance records as required by law.
- d) Suspicious activities may be reported to competent authorities.
Failure to provide required verification information may result in service suspension.
8. Data Sharing and Recipients
We may share personal data with:
- a) Payment processors and banking institutions;
- b) Cloud infrastructure providers;
- c) KYC verification service providers;
- d) Analytics providers;
- e) Legal and regulatory authorities;
- f) Professional advisors (lawyers, auditors); and
- g) Buyers, vendors, and carriers, to the extent necessary to complete a specific transaction on the platform, as permitted under applicable e-commerce laws of Nepal.
All third parties are contractually obligated to protect personal data and process it only for specified purposes. We do not sell personal data.
9. International Data Transfers
Personal data may be processed or stored outside Nepal. Where personal data is transferred internationally, we implement appropriate contractual and technical safeguards to protect it in accordance with applicable Nepalese law. By using the platform, you acknowledge that your data may be transferred and stored outside Nepal.
10. Data Retention
We retain personal data only for as long as necessary to:
- a) Fulfil contractual obligations;
- b) Comply with legal requirements;
- c) Resolve disputes and grievances; and
- d) Prevent fraud.
Transaction records and related personal data shall be retained for the period prescribed under applicable tax laws of Nepal, as required by e-commerce regulations. Financial and KYC records shall be retained for the applicable statutory compliance periods. After the applicable retention period, data will be securely deleted or anonymised.
11. Your Rights
Under applicable privacy and e-commerce laws of Nepal, you have the following rights in relation to your personal data:
- a) Right to access your personal data held by Reffero;
- b) Right to correct or update inaccurate or incomplete personal data;
- c) Right to request deletion of personal data where it is no longer legally required to be retained;
- d) Right to object to certain processing of your personal data; and
- e) Right to close or deactivate identity sources linked to your account on the platform.
To exercise any of these rights, please submit a request to legal@reffero.com. We may require identity verification before fulfilling requests.
12. Automated Decision-Making and Profiling
We may use automated systems for fraud detection, risk assessment, and transaction monitoring. No decisions producing legal or similarly significant effects are made solely by automated means without human review.
13. Data Security
We implement appropriate technical and organisational measures to protect personal data, including:
- a) Encrypted data transmission (SSL/TLS);
- b) Access control policies;
- c) Secure cloud infrastructure;
- d) Audit logging; and
- e) Periodic security assessments.
While we strive to protect data, no system can guarantee absolute security.
14. Cookies and Tracking Technologies
We use cookies for session management, analytics, security, and performance optimisation. Non-essential cookies are deployed only with user consent, which you may withdraw at any time through your browser or account settings.
15. Children's Data
Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.
16. Consumer Protection Compliance
In accordance with applicable consumer protection and e-commerce laws of Nepal:
- a) Transaction records may be retained to address complaints and grievances.
- b) Customer data may be processed to investigate disputes.
- c) Vendors are required to provide accurate product and service information.
Reffero acts as a platform facilitator and may assist in dispute resolution. As an intermediary business operator, Reffero cannot disclaim responsibility for complaints or grievances solely on the ground that it did not produce, import, or supply the goods or services in question.
17. Data Breach Notification
In the event of a personal data breach:
- a) We will assess the risk and take prompt remedial action.
- b) We will notify the relevant authority as required under applicable law.
- c) Affected users will be notified where legally required.
18. Updates to This Policy
We may update this Privacy Policy periodically to reflect changes in applicable law or our practices. Notice of material updates will be provided via the platform or by email. Continued use of the platform after updates constitutes acceptance of the revised policy.