How we handle your information

Last updated 4 November 2026. This notice covers himalayan-tech-solutions.hrm.blackrocknepal.com: the home page, the request access form, and BRHRMS accounts with the employment records kept in them.

The short version

We collect what we need to review your request and run the company's HR, and nothing more.
The home page sets no cookies and runs no analytics or tracking scripts.
We never sell your information or use it for advertising.
Nobody gets an account until an Admin approves the request.
You can ask to see, correct or delete your information at privacy@blackrocknepal.com.

Who we are

BRHRMS is the HR system of Black Rock, in Kathmandu, Nepal. Black Rock decides how the information in this notice is used and is responsible for it. Write to privacy@blackrocknepal.com about anything here.

What we collect and why

When you visit

The home page sets no cookies and runs no analytics or tracking scripts. The sign-in page and the request access form set the cookies that run a session, even before you sign in, and signing in sets the ones that keep you signed in. Our servers record the IP address, time, page and browser of each request. We use these records only to keep the service secure and working, never to track or profile visitors.

When you request access

Your name and work email, and a phone number and a note if you add them. We also record the time and your IP address, to stop abuse such as repeated or automated requests. We use this only to confirm your email address, review your request and write to you about it. You give your consent with the checkbox on the form, and you can withdraw it at any time.

When you have an account

Your name, email address, phone if you gave one and your roles; your password, which we store only as a one-way hash; and your sign-in history, with the time and IP address of each sign-in. We use this to let you sign in, keep your account secure and send the emails the service needs, such as password links.

Your employment records

The details HR and you enter for your work: your employee record, attendance, leave, payroll and payslips, documents and letters, and appraisals. We use them only to run the company's HR. Who can open them depends on their role: you see your own, managers see their team's, and HR and payroll see what their work needs.

Notices to your phone

If a Super Admin has turned them on, some of the app's notices, such as a leave decision, also go to the mobile number on your record, by WhatsApp or SMS. You can turn this off in your Settings.

Emails

We send confirmations, decisions, welcome and password links, and the notices the service needs. We do not send marketing email.

Who we share it with

Black Rock's Admins and Super Admins, who review requests and run the service, and the HR staff and managers whose roles allow it.
Service providers who work for us: Contabo GmbH, a German hosting company whose servers hold BRHRMS, so your information is stored outside Nepal; Cloudflare, which carries the site's traffic and protects it; and Nepal Fillings, which delivers our emails, and our WhatsApp and SMS messages if they are turned on. They handle it only to provide their service to us.
BRAccount, Black Rock's accounting system, if it is connected: the payroll and employee details its books need.
Authorities, when the law requires us to.

We never sell personal information and never share it for advertising.

How long we keep it

A request whose email address was never confirmed: Deleted within a day after its 24-hour confirmation link expires.
A confirmed request, approved or not: Kept as the record of who asked and who decided. You can ask us to delete a request that was not approved.
Your account: Until the company closes it.
The record of who has which access: Kept, so that every change to access can be traced.
Your employment records: As long as the company needs them for your employment, and as Nepal's labour and tax laws require.
Web server logs (IP address, time, page and browser): A log of fixed size on our server: the oldest lines are overwritten as new ones arrive, so there is no fixed period yet. Requests first pass through Cloudflare and a front server shared with other services, which keep their own logs.
Sign-in history (time and IP address): 90 days.
Copies of the emails we send: 30 days.
WhatsApp and SMS messages we send: 90 days.
Error reports: 14 days.
Backups: Made every night; the 14 most recent are kept on our server. Deleted information can remain in a backup until that backup is removed.

How we protect it

Everything travels over HTTPS.
Passwords and the links in our emails are stored only as one-way hashes. Email links work once and expire: 24 hours to confirm an email address, 72 hours to set a password.
The keys of the services we use are stored encrypted.
What each person can open depends on their role, and every change to who has what access is recorded.
Repeated or automated requests are limited, and the server is backed up every night.

Your choices and rights

Nepal's Privacy Act, 2075 (2018) protects your personal information, and we follow it. You can ask us to:

show you the information we hold about you;
correct anything that is wrong;
delete your information, except what the law requires us to keep;
withdraw your consent, after which we stop reviewing your request and delete it.

Write to privacy@blackrocknepal.com from the email address you used with us, so that we can confirm the request is yours. We aim to reply within 30 days. HR can also correct the details in your employment records.

Changes to this notice

When we change this notice we update the date at the top. If a change affects how we use information we already hold, we tell account holders by email before it applies.

Contact

Questions and requests: privacy@blackrocknepal.com. Black Rock, Kathmandu, Nepal. To ask for an account, use the request access form.