Privacy Policy for ExamSathi
Effective Date: September 27, 2025
ExamSathi ("we," "us," or "our") is an online learning platform dedicated to providing educational resources, courses, and tools for students in classes 10, 11, and 12 in Nepal. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, protect, and handle your personal data in compliance with applicable Nepali laws, including the Individual Privacy Act, 2075 (2018), the Individual Privacy Regulation, 2077 (2020), the Digital Privacy and Data Protection Act, 2082 (2025), the Children's Act, 2075 (2018), and the Online Child Protection Procedure, 2021. We also align with international best practices for educational platforms serving minors, prioritizing minimal data collection and obtaining necessary consents.
By using ExamSathi (the "Platform"), you agree to the practices described in this Policy. If you are under 18 years old, please review this Policy with a parent or guardian. We encourage parents and guardians to monitor their children's online activities and assist in using the Platform safely.
1. Information We Collect
We collect only the information necessary to provide and improve our educational services. The information is categorized as follows:
Personal Information
Account Information: When you register, we may collect your name, email address, phone number, school name, class/grade level, date of birth (to verify age), and an optional profile picture.
Contact Details: If you contact us for support, we may collect your name, email, and any details provided in your message.
Payment Information: If you subscribe to premium features, we collect billing details (e.g., name, address) but do not store credit card numbers or sensitive payment data. These are handled securely by third-party payment processors compliant with PCI DSS standards.
Educational Data: Progress reports, quiz scores, assignments, and user-generated content (e.g., notes or forum posts) to personalize learning experiences.
Non-Personal Information
Usage Data: Device information (e.g., IP address, browser type, operating system), log data (e.g., pages visited, time spent), and interaction data (e.g., clicks on lessons).
Cookies and Tracking Technologies: We use essential cookies for functionality (e.g., session management) and analytics cookies (with consent) to understand usage patterns. See Section 9 for details.
Sensitive Information
We do not collect sensitive personal data such as health information, biometric data, or political opinions unless voluntarily provided in educational contexts (e.g., a biology assignment) and only with explicit consent. We comply with restrictions under the Digital Privacy and Data Protection Act, 2082, on processing sensitive data.
We do not collect information from children under 13 without verifiable parental consent. For users aged 13-17, we require parental involvement where feasible.
2. How We Collect Information
We collect information:
Directly from You: During registration, profile updates, course interactions, or support requests.
Automatically: Through cookies, web beacons, and server logs when you access the Platform.
From Third Parties: From schools or educational partners (with your consent) or analytics providers like Google Analytics (anonymized data only).
From Social Media: If you log in via social media (e.g., Google or Facebook), we collect basic profile information with your permission.
We always seek your consent where required by law, and you can withdraw it at any time (see Section 8).
3. How We Use Your Information
We use your information for legitimate educational purposes, including:
Providing and personalizing the Platform (e.g., recommending courses based on your grade and progress).
Communicating with you (e.g., sending lesson reminders, updates, or newsletters – you can opt out).
Processing payments and managing subscriptions.
Improving our services (e.g., analyzing usage trends anonymously).
Ensuring safety and compliance (e.g., detecting fraud or inappropriate content).
Meeting legal obligations, such as responding to government requests under Nepali law.
We do not use your data for targeted advertising without explicit opt-in consent. Data is processed on a "need-to-know" basis, with minimization principles applied.
4. Sharing Your Information
We do not sell your personal information. We share it only in these limited cases:
With Service Providers: Trusted third parties (e.g., cloud storage like AWS, analytics tools) bound by confidentiality agreements and compliant with Nepali data protection laws. These are located in Nepal or jurisdictions with adequate protections (e.g., EU under adequacy decisions).
With Educational Partners: Schools or teachers (with your consent) to share progress reports.
For Legal Reasons: If required by law, court order, or to protect rights, safety, or property.
In Business Transfers: If ExamSathi is acquired, your data may transfer to the new owner under similar protections.
All recipients are required to adhere to equivalent privacy standards.
5. Data Storage and Security
Storage: Data is stored on secure servers in Nepal or compliant international locations. Retention periods are limited: account data is retained for as long as your account is active, plus 1 year; educational data is kept for 5 years post-graduation or as required by law.
Security Measures: We implement encryption (e.g., HTTPS, SSL), firewalls, access controls, regular audits, and pseudonymization where possible. Employees are trained on data protection. In case of a data breach, we notify affected users and authorities within 72 hours, as required by the Digital Privacy and Data Protection Act, 2082.
While we take robust measures, no system is entirely secure. We encourage using strong passwords and caution against sharing credentials.
6. Children's Privacy
ExamSathi is designed for students aged 15-18 (classes 10-12), but we recognize users may be minors under Nepali law (under 18). We comply with the Online Child Protection Procedure, 2021, and Children's Act, 2075:
Age Verification: We collect date of birth to restrict access for users under 13.
Parental Consent: For users under 16, we require verifiable parental consent (e.g., email confirmation or phone verification) before collecting personal data beyond essentials.
Limited Collection: We minimize data collection from minors and do not share it for marketing purposes.
Parental Rights: Parents can review, delete, or refuse further collection of their child's data by contacting us.
Safe Environment: We monitor forums for inappropriate content and promote digital safety education.
If we discover unauthorized data from a child under 13, we delete it immediately.
7. International Data Transfers
If data is transferred outside Nepal (e.g., to secure cloud providers), we ensure safeguards like standard contractual clauses or adequacy assessments, in line with the Digital Privacy and Data Protection Act, 2082.
8. Your Rights
Under Nepali privacy laws, you have the right to:
Access: Request a copy of your data.
Correction: Update inaccurate information.
Deletion: Erase your data (subject to legal retention requirements).
Objection: Opt out of processing for certain purposes.
Portability: Receive your data in a transferable format.
Withdraw Consent: At any time, though this may limit access to certain services.
Complain: To us or the National Information Commission (Nepal's data protection authority).
To exercise these rights, email us at examsathi7@gmail.com. We respond within 30 days, free of charge (unless requests are excessive).
9. Cookies and Tracking
We use:
Essential Cookies: For login and functionality (no consent needed).
Analytics Cookies: For improving the Platform (opt-in consent required).
No Third-Party Advertising Cookies.
You can manage cookies via your browser settings. For more details, see our Cookie Policy (linked on the Platform).
10. Changes to This Policy
We may update this Policy to reflect legal changes or service improvements. Changes will be posted on this page with the new effective date. Significant changes will be notified via email or in-app alerts. Continued use of the Platform constitutes acceptance of the updated Policy.
11. Contact Us
For questions or concerns, contact:
ExamSathi Privacy Officer
Email: examsathi7@gmail.com
Address: Kathmandu, Nepal
This Policy is governed by the laws of Nepal. Thank you for trusting ExamSathi with your education!