Privacy Policy

1. Overview

At Everest Wireless Network Pvt. Ltd. ("Company", "we", "us", or "our"), we respect your personal privacy and are committed to protecting the confidentiality and security of the information you share with us.

This Privacy Policy outlines how we collect, use, store, process, and safeguard your personal information when you subscribe to our internet and broadband services, access our website, or interact with our enterprise solutions.

This Policy is formulated in accordance with the Constitution of Nepal (Article 28), the Individual Privacy Act, 2075 (2018), the Electronic Transactions Act, 2063 (2006), and the operational and cybersecurity directives mandated by the Nepal Telecommunications Authority (NTA).

Operating under NTA License No.: Fi. Ja. 1-102

2. Information We Collect

To deliver reliable internet services and comply with statutory regulatory standards, we collect the following categories of information:

2.1. Know-Your-Customer (KYC) Data

• Individual Subscribers: Full legal name, permanent/temporary address, contact numbers, email address, national identity details (Citizenship Number, Passport Number, or Driving License Number), and passport-sized photographs.
• Corporate / Enterprise Subscribers: Company registration documents, Tax/PAN/VAT registration certificates, official contact details, board resolutions, and photo identification of authorized representatives.

2.2. Technical and Network Service Logs

• Network Identifiers: Assigned IP addresses (static or dynamic IPv4/IPv6), MAC address of Customer Premises Equipment (CPE/ONU), and subscriber portal account login parameters.
• Connection Metadata: Duration of session, bandwidth usage metrics, and network traffic diagnostic logs collected for operational stability, network optimization, and lawful retention mandates prescribed by the NTA.
• Website Security Access Log (when enabled): Full normalized source IP address, UTC request time, HTTP method, stable route label, and HTTP response status for website security and operational diagnostics. Access is restricted to authorized administrators. This log does not contain request bodies, query strings, cookies, referrers, or browser user-agent strings, and is separate from optional visitor analytics.

2.3. Payment and Billing Data

• Invoice history, transaction records, tax breakdown details, and digital payment wallet/banking transaction IDs associated with service billing.
• We do not store complete banking PINs or credit card CVV details on our servers.

3. Purposes of Data Collection and Processing

We collect and process your personal data strictly for specified, legitimate, and lawful purposes under Nepalese law:

• Service Provisioning: To activate, configure, monitor, maintain, and manage your high-speed fiber or wireless internet connection.
• KYC Compliance: To fulfill statutory subscriber verification requirements mandated by the Nepal Telecommunications Authority (NTA) and local government administration.
• Billing and Accounting: To issue invoice statements, process subscription renewals, enforce credit control policies, and satisfy statutory tax reporting under the Inland Revenue Department (IRD).
• Technical Support: To respond to network service requests, diagnose connectivity faults, and improve line performance.
• Network Security: To safeguard our infrastructure against cyberattacks, fraudulent operations, unauthorized VoIP bypass, and network abuse.

4. Data Sharing and Legal Disclosure

We do not sell, rent, trade, or commercially lease subscriber personal data to third parties. Disclosure of subscriber information occurs solely under the following defined circumstances:

4.1. Authorized Service Partners

Data may be shared with trusted technical contractors or payment gateway processors operating on our behalf, solely to perform specific operational tasks (such as field installation or bill processing) under strict confidentiality agreements.

4.2. Mandatory Statutory and Legal Disclosure

Under the Individual Privacy Act, 2075 and Nepalese criminal procedure statutes, the Company may disclose subscriber identity details, IP session logs, or connection history upon receipt of:

• A formal judicial court order from a competent Court of Nepal.
• Written law enforcement demands issued in connection with authorized criminal investigations or cybercrime proceedings under the Electronic Transactions Act, 2063.
• Official administrative directives issued by the Nepal Telecommunications Authority (NTA) or the Ministry of Communication and Information Technology (MoCIT).

5. Data Protection and Security Measures

In accordance with NTA Cybersecurity Byelaws and the Individual Privacy Act, 2075, we employ robust technical and organizational measures to prevent unauthorized access, loss, alteration, or disclosure of subscriber data:

• Technical Safeguards: Firewall systems, end-to-end encrypted administrative channels, secure database storage, and restricted network administrative access.
• Operational Controls: Subscriber personal records are accessible only by authorized personnel bound by strict non-disclosure obligations.

6. Data Retention Policy

6.1. Operational and KYC Data

Subscriber identification records and service contracts are retained for the active duration of the subscription service and for the mandatory legal period required by tax, accounting, and telecommunications regulations following account termination.

6.2. Network Traffic Logs

Technical connection logs and IP allocation records are stored for the minimum period specified by NTA data retention directives and security guidelines.

6.3. Website and Infrastructure Access Logs

The dedicated CMS website security access log, when enabled, is retained for no more than seven days. Other infrastructure logs are managed separately under their own rotation policies: Nginx access logs may contain the request target (including query string), referrer, and user-agent and are rotated after up to 14 days; PHP-FPM access and diagnostic logs are rotated after up to 12 weeks; and application logs are rotated after up to 30 days. These separate operational logs may contain source IP addresses and request diagnostic metadata.

7. Subscriber Rights (Privacy Act, 2075)

Subject to applicable Nepalese telecommunications regulations and security retention requirements, you hold the following rights regarding your personal information:

• Right to Information: The right to request confirmation regarding what personal information we hold about you and how it is being processed.
• Right to Rectification: The right to request immediate correction or updating of inaccurate, incomplete, or outdated personal KYC details.
• Right to Complain: The right to seek administrative or legal redress before competent regulatory authorities or judicial forums in Nepal if you believe your privacy rights have been infringed.

8. Cookies and Online Portal Tracking

Our official website and subscriber self-care portals may utilize session cookies to authenticate user log-ins, store language preferences, and enhance web navigation. Cookies used do not gather personal files or track your activity on external third-party websites.

First-party website analytics is optional and begins only after you choose Accept analytics in the consent notice. You can choose Reject analytics there, or later open Privacy preferences and choose Withdraw consent. When enabled with your consent, EW-NET uses first-party pseudonymous identifiers to measure public page visits and selected interactions. Analytics does not store your IP address, full page URLs or full referrer URLs; it may retain a normalized external referrer hostname. It does not store contact-form contents, application information, or raw browser user-agent, and it uses no external analytics provider.

The analytics cookies and their maximum lifetimes are:

• ewnet_analytics_consent stores your consent choice for up to 180 days.
• ewnet_analytics_visitor is a pseudonymous visitor identifier retained for a maximum of 30 days.
• ewnet_analytics_session identifies an analytics session and expires after 30 minutes of inactivity.

Withdrawing consent stops further collection, clears the analytics identifier cookies, and deletes your raw analytics session and event data. Previously aggregated anonymous statistics are not linked to your identifiers and remain until their retention limit. Raw analytics events and detailed sessions are retained for no more than 30 days. Anonymous daily aggregates are retained for up to 13 months. Collection remains disabled until the feature is released and enabled.

Separately from optional Visitor Analytics, when the website security access log is enabled EW-NET records your full normalized source IP address, UTC request timestamp, HTTP method, route label, and response status for security and operational diagnostics. Only authorized administrators can view this dedicated log, and its records are retained for up to seven days. It does not store query strings, request bodies, cookies, referrers, or browser user-agent strings and does not depend on analytics consent.

Existing infrastructure logs are separate from the seven-day CMS access log. Nginx access logs may include source IP, request target including query string, referrer, and user-agent for up to 14 days; PHP-FPM access and diagnostic logs are retained for up to 12 weeks; application logs are retained for up to 30 days and may contain source IP and operational/audit context.

9. Updates to This Privacy Policy

We reserve the right to revise or update this Privacy Policy to reflect changing legal requirements, technological developments, or NTA operational guidelines. Any revisions will be published on our official website with an updated revision date. Continued use of our services following notice of changes constitutes acceptance of the updated terms.

10. Contact Our Privacy Officer

For questions regarding this Privacy Policy, requests for data verification, or to update your subscriber KYC information, please contact our compliance desk: