HR Khata

GDPR Compliance

Last Updated: September 2026

HR Khata respects privacy and is committed to protecting personal information.

HR Khata is primarily designed for businesses and organizations in Nepal. However, some customers may have employees, customers, partners, or operations that are subject to the General Data Protection Regulation (GDPR).

Where GDPR applies to the processing of personal data through HR Khata, we aim to support our customers in meeting their data protection responsibilities.

This page explains how HR Khata approaches GDPR related data protection. It should be read together with our Privacy Policy, Cookies Policy, and Terms & Conditions.

1. When GDPR May Apply

The GDPR may apply when personal information is processed in connection with individuals in the European Economic Area (EEA) or in other situations covered by the GDPR.

HR Khata does not claim that every use of our platform is subject to GDPR.

Whether GDPR applies depends on the Customer, the individuals involved, the nature of the processing, and other circumstances.

Customers are responsible for determining whether GDPR or other data protection laws apply to their particular use of HR Khata.

2. Our Role Under GDPR

The role of HR Khata depends on the type of information being processed.

HR Khata as a Data Processor

When a business uses HR Khata to store and manage employee information, the business generally decides:

What information is collected
Why the information is collected
How the information is used
How long the information should be retained

In this situation, the business is generally the Data Controller and HR Khata acts as the Data Processor.

HR Khata processes Customer Data to provide the Services and according to the Customer’s instructions, subject to our contractual obligations and applicable law.

HR Khata as a Data Controller

HR Khata may act as a Data Controller for information that we collect and use for our own business purposes.

This may include:

Account information
Contact information
Billing information
Website enquiries
Customer support communications
Information required to maintain security
Website analytics and similar information
Information needed to operate and improve our business

Where HR Khata acts as a Data Controller, we determine the purposes and methods of processing that information.

3. GDPR Principles

Where GDPR applies, HR Khata aims to follow the main principles of data protection.

Lawfulness, Fairness and Transparency

We aim to process personal information lawfully, fairly, and in a way that is understandable to users.

Purpose Limitation

We collect and use information for specific and legitimate purposes and do not intentionally use it for unrelated purposes.

Data Minimization

We aim to collect and process only the information reasonably required for the relevant service or purpose.

Accuracy

We provide tools that allow authorized users and customers to update information where appropriate.

Customers are responsible for maintaining the accuracy of employee information that they enter into HR Khata.

Storage Limitation

We retain information only for as long as reasonably necessary for the relevant purpose, subject to legal, contractual, accounting, security, and statutory requirements.

Security

We use reasonable technical and organizational measures to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

Accountability

We maintain processes intended to support responsible handling of personal information and data protection obligations.

4. Legal Bases for Processing

Where HR Khata acts as a Data Controller and GDPR applies, personal information may be processed based on one or more of the following legal bases:

Contract

Processing may be necessary to provide the services requested by a customer or user.

Legal Obligation

We may process information where necessary to comply with applicable legal, tax, accounting, regulatory, or other legal requirements.

Legitimate Interests

We may process information where necessary for legitimate business interests, such as:

Maintaining service security
Preventing fraud and misuse
Providing customer support
Improving service reliability
Managing our business

We consider the interests and rights of individuals when relying on legitimate interests.

Consent

Where consent is required, we will seek appropriate consent before processing information based on that consent.

Consent may be withdrawn where applicable.

5. Employee Data and Customer Responsibilities

When an employer uses HR Khata to manage employee information, the employer is generally responsible for ensuring that the processing has an appropriate legal basis.

This includes responsibility for:

Providing employees with appropriate privacy information
Collecting information lawfully
Using appropriate employee permissions or consent where required
Configuring access appropriately
Keeping employee information accurate
Determining appropriate retention periods
Responding to employee requests where the employer is the Data Controller

HR Khata provides the technology to support these activities but does not make employment decisions on behalf of customers.

6. Data Subject Rights

Where GDPR applies, individuals may have rights regarding their personal information.

Depending on the circumstances, these may include:

Right of Access

You may request information about the personal data being processed about you.

Right to Rectification

You may request correction of inaccurate or incomplete personal information.

Right to Erasure

You may request deletion of personal information in circumstances where GDPR provides this right.

The right to erasure is not absolute. Information may need to be retained where there is a legal, contractual, security, accounting, or other lawful reason.

Right to Restrict Processing

You may request that processing of your information be restricted in certain circumstances.

Right to Data Portability

Where applicable, you may request your personal information in a structured and commonly used format.

Right to Object

You may object to certain types of processing, including processing based on legitimate interests, where the GDPR provides this right.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect processing that took place before consent was withdrawn.

7. How to Exercise Your Rights

If your information is processed through an HR Khata account managed by your employer, you should normally contact your employer or HR administrator first.

The employer may be the Data Controller and therefore responsible for responding to your request.

If HR Khata acts as the Data Controller for the relevant information, you may contact us directly.

We may need to verify your identity before processing a data protection request.

For privacy and GDPR related requests:

Email: privacy@hrkhata.com

Address: Thirbum Marg, Gyaneshwor, Kathmandu, Nepal

We will review and respond to valid requests within the period required by applicable law.

8. Data Processing Agreements

Organizations that require formal documentation of the relationship between the Customer and HR Khata may contact us regarding a Data Processing Agreement (DPA).

A DPA may define matters such as:

The subject and duration of processing
The nature and purpose of processing
Categories of personal information
Categories of data subjects
Customer instructions
Confidentiality obligations
Security measures
Subprocessor arrangements
Assistance with data subject requests
Data breach responsibilities
Data deletion or return

Where GDPR applies, the applicable contractual requirements will be considered when processing personal information on behalf of a Customer.

9. Security Measures

HR Khata uses reasonable technical and organizational measures to protect personal information.

Depending on the service and infrastructure involved, these measures may include:

Encryption during data transmission
Encryption of stored information
Role based access controls
Secure authentication
Access restrictions
Security monitoring
Audit logs
Regular software and security updates
Backup and recovery procedures
Restricted access to sensitive information

We regularly review our security practices and may improve them as our systems and technology develop.

No internet based service can guarantee complete security.

10. Data Breach and Security Incidents

HR Khata takes security incidents seriously.

If we become aware of a security incident involving Customer Data, we will investigate the incident and take reasonable steps to contain and address it.

Where HR Khata acts as a Data Processor, we will notify the affected Customer without undue delay where required under applicable law or the relevant agreement.

The Customer remains responsible for determining whether notification to employees, regulators, supervisory authorities, or other parties is required.

Where HR Khata is acting as a Data Controller, we will assess the incident and take any notification steps required by applicable law.

11. International Data Transfers

HR Khata may use cloud infrastructure and third party service providers that operate in countries outside Nepal or the EEA.

Where personal information subject to GDPR is transferred internationally, HR Khata will seek to use appropriate safeguards required by applicable law.

Depending on the circumstances, these safeguards may include:

Adequacy decisions
Standard Contractual Clauses
Appropriate contractual protections
Other legally recognized transfer mechanisms

The location of data processing may vary depending on the infrastructure and service providers used by HR Khata.

Customers requiring specific information about data locations or international transfers may contact us.

12. Third Party Service Providers

HR Khata may use third party providers to operate and support the platform.

These providers may provide services such as:

Cloud hosting
Data storage
Email delivery
SMS delivery
Payment processing
Security services
Analytics
Customer support

Where a third party processes personal information on behalf of HR Khata, we aim to use appropriate contractual and security arrangements.

Customers may contact HR Khata if they require additional information about service providers involved in processing their data.

13. Data Retention

HR Khata does not retain personal information indefinitely.

Information may be retained for as long as necessary to:

Provide the Services
Meet Customer instructions
Meet legal and statutory requirements
Maintain security records
Resolve disputes
Prevent fraud and misuse
Meet accounting and business requirements

When information is no longer required, it may be deleted, anonymized, or otherwise securely handled according to applicable requirements.

For customer accounts, data retention and deletion are also described in our Privacy Policy and applicable customer agreement.

14. Privacy by Design

Where reasonably practical, HR Khata considers privacy and security when developing and improving its services.

This may include:

Limiting unnecessary data collection
Applying access controls
Separating customer information
Protecting sensitive information
Providing role based permissions
Reviewing security practices
Supporting appropriate data deletion and retention processes

Privacy and security requirements may vary depending on the feature and type of information being processed.

15. Children’s Data

HR Khata is a business focused HR and payroll platform and is not designed as a service for children.

If an employer legally employs a person under the age of 18 and processes their information through HR Khata, the employer is responsible for ensuring that the processing complies with applicable employment and data protection requirements.

16. Cookies and Similar Technologies

HR Khata may use cookies and similar technologies on its website and platform.

These technologies may be used for:

Secure login
Maintaining sessions
Remembering preferences
Website analytics
Security
Improving website performance

For more information, please see our Cookies Policy.

17. No Sale of Personal Information

HR Khata does not sell customer or employee personal information to third parties.

We use personal information to provide our services, operate our business, maintain security, meet legal requirements, and perform other purposes described in our Privacy Policy.

18. No Use of Customer Employee Data for General AI Training

Customer employee information is confidential business information.

HR Khata does not intend to use identifiable customer employee records to train general purpose artificial intelligence models.

If a future feature requires a different use of customer data, we will address that use through appropriate product terms, notices, customer instructions, or other applicable requirements.

19. Relationship With Our Privacy Policy

This GDPR Compliance page provides additional information for situations where GDPR applies.

Our Privacy Policy explains more generally how HR Khata collects, uses, stores, protects, and shares personal information.

Our Terms & Conditions govern the use of HR Khata services.

Our Cookies Policy explains the use of cookies and similar technologies.

These documents should be read together.

20. Changes to This GDPR Statement

We may update this page when our services, technology, legal requirements, or data protection practices change.

When we make changes, we will update the “Last Updated” date at the top of this page.

For significant changes, we may provide additional notice where appropriate.

21. Contact Us

For GDPR, privacy, or data protection questions, please contact:

HR Khata

Data Protection and Privacy: privacy@hrkhata.com

General Support: support@hrkhata.com

Website: hrkhata.com