How your data is handled
Privacy Policy
This site collects personal data in one place: the production brief form. Everything below describes what actually happens to it in this build, rather than what a generic policy says usually happens.
This page is a factual description of how the site works, prepared so that a legal adviser has something accurate to review. It is not legal advice and it has not been reviewed by a lawyer. Do not treat it as a finished policy until your own adviser has checked it against the law that applies to you and to the people who contact you.
This policy is published by Nepal Film Production Pvt. Ltd., the Kathmandu based company that operates Hire Fixer in Nepal. It explains what we collect, why we collect it, how long we keep it, who can see it, where it is processed, and the choices and rights you have over it.
It is written to be read, not filed. If you send us a brief, you deserve to know exactly what happens to it, in plain words, before you press submit.
What this page is
This policy is a factual description of how the site works today. When the site changes, this page changes with it, so what you read here matches what the site actually does.
It is written in plain English on purpose. It is not legal advice to you, and data protection law differs from country to country, so if you need a formal legal position for your own organisation you should take your own advice. What we can promise is that the descriptions of how this site behaves are accurate.
The policy at a glance
Four numbers that describe how the site treats your data.
Who we are and who controls your data
The organisation responsible for the personal data described here is Nepal Film Production Pvt. Ltd., the company based in Kathmandu that operates the Hire Fixer in Nepal website. In data protection language, that makes us the data controller: we are the ones who decide what is collected through this site and why.
We collect personal data for a single, narrow purpose, which is to receive and answer enquiries from productions that are considering filming in Nepal. We are a film production support service, not an advertising business, a data broker, or a company that profiles visitors. There is no commercial reason for us to gather more about you than we need to reply to you well, and the site is built to reflect that.
If you want to ask anything about this policy, request a copy of what we hold, or ask us to delete it, you can reach us through the contact page at /contact/, which routes to the same team that reads production briefs. When you get in touch about your data, it helps to say clearly that your message is a privacy request, so it is handled as one rather than treated as a new enquiry.
Some terms, in plain English
A handful of words appear throughout this policy. Here is what each one means, without the jargon.
Personal data
Any information that identifies you or could be linked back to you, such as your name, email address, telephone number, or the details of a production you describe in your own words.
Data controller
The organisation that decides what personal data is collected and why. For this site, that is us, Nepal Film Production Pvt. Ltd.
Data processor
A supplier that handles personal data on the controller’s behalf under instruction, such as a web host that stores the site or an email service that carries a message.
Data subject
The person the data is about. If you send an enquiry, that is you.
Lawful basis
The reason data protection law recognises for handling personal data, for example your consent, or the need to take steps toward a possible piece of work you have asked about.
Consent
A clear, freely given agreement to a specific use of your data. On this site, consent is recorded through the tick boxes on the form, and the two are kept separate on purpose.
Anonymisation
Stripping the personal detail out of a record so that what remains can no longer be tied to you. This site anonymises enquiry records rather than pretending to delete them while keeping the useful parts.
Data subject request
A request you make to exercise a right, such as asking for a copy of your data or asking for it to be erased.
What personal data means here
It is easy to picture personal data as just a name and an email address. In practice it is broader than that, and the production brief form is a good example of why.
Some of what the form collects is obviously personal: your name, your company, your email address, your telephone number. Some of it becomes personal because of the context, even though a single field in isolation might look harmless. Your country, your preferred contact method, the dates you are considering, and the free-text description of what you are making can, together, describe you and your project quite specifically.
We treat all of it with the same care. Whether a field feels sensitive or not, if it can be connected back to you it is personal data, and it lives under this policy. That is why the descriptions below are precise about each category rather than lumping everything into one vague sentence. You should be able to see your own information in this list and know exactly where it goes.
There is one thing worth saying up front. You control how much you put in. Only a few fields are required, and the free-text box is yours to fill as fully or as sparingly as you like. If a detail is not relevant to getting a straight answer, you do not need to give it.
What the form collects
The production brief form has 23 fields. Only a few are required, and you choose what to put in the rest.
About you: name, company, email address, telephone number, country, and your preferred contact method.
About the production: project type, working title, start and end dates, whether the dates are flexible, locations, crew size, which services you need, equipment notes, whether drone work is involved, whether casting is involved, budget indication, and a free-text description.
Also: an optional file attachment, how you heard about us, your consent to be contacted about the enquiry, and a separate optional tick if you want to hear from us about anything else.
The consent tick and the marketing tick are deliberately separate. Agreeing to be answered is not agreeing to be marketed to.
The kinds of information you can share
The same 23 fields, grouped by what they are for.
About you
Your name, company, email address, telephone number, country and preferred contact method. Enough to know who is enquiring and to reply in the way that suits you.
About the production
Project type, working title, dates and whether they move, locations, crew size, the services you need, equipment notes, drone and casting flags, a budget indication and a free-text description.
Your attachment
One optional file, so you can send a treatment, brief or schedule rather than retyping it. PDF, DOC, DOCX or TXT only, up to 8MB.
Your consent choices
Your agreement to be contacted about this enquiry, and a separate optional tick if you also want to hear from us about anything else. The two are never merged.
How you found us
An optional note on how you heard about us, so we understand which pages and referrals are actually useful to people planning shoots in Nepal.
What we hold, why, and for how long
Every category of data the site handles, drawn from the form itself and from how the site is built.
| Information | Why it is collected | How long it is kept |
|---|---|---|
| Your name and company | So we can address you and understand who is enquiring | With the enquiry record, then anonymised at 730 days |
| Email address and telephone number | So we can reply to you and send your confirmation and reference | With the enquiry record, then anonymised at 730 days |
| Country and preferred contact method | So we reply in the way and at the time that suits you | With the enquiry record, then anonymised at 730 days |
| Production details (type, title, dates, locations, crew size, services, equipment, drone and casting flags, budget indication, description) | So we can judge whether the shoot is feasible and what it would involve | With the enquiry record, then anonymised at 730 days |
| Your file attachment | So you can send a treatment, brief or schedule without retyping it | Deleted when the record is anonymised at 730 days |
| How you heard about us | So we understand which pages and referrals are useful | With the enquiry record, then anonymised at 730 days |
| Your consent and marketing choices | To record exactly what you agreed to | With the enquiry record |
| A daily one-way salted hash, not your IP address | To notice a flood of submissions from one source within a day | Rotates daily and cannot be linked across days |
Attachments
You can attach one file. By default the site accepts PDF, DOC, DOCX and TXT only, up to 8MB, and the file type is checked rather than trusted from its name.
Attachments are stored in a protected directory outside the WordPress media library, so they do not appear in the public media browser and are not reachable at a guessable URL. They are served only to a logged-in administrator through a permission check.
An attachment is deleted when its enquiry record is anonymised, so it does not linger after the personal data around it has gone. If you would rather not send a document at all, do not. The attachment is optional, and a shoot can be assessed perfectly well from what you type into the form.
What is not collected
Your IP address is never stored. To stop the form being abused, the site keeps a one-way salted hash that changes every day. That is enough to notice a flood of submissions from one source within a day, and it cannot be turned back into an address or linked across days.
The site sets no tracking cookies. It contacts no advertising network. Fonts are served from this site rather than from Google, so loading a page here does not tell a third party that you visited.
If analytics are switched on later, the event bridge is built so that names, email addresses, telephone numbers, project descriptions and filenames are never sent to an analytics provider, and nothing is sent at all until consent is given where consent is required.
The lawful bases we rely on
Data protection law generally asks an organisation to have a lawful basis before it handles personal data. The bases that matter differ depending on where you are and which regime applies to you, but in plain terms these are the reasons we handle what you send.
When you complete the production brief form and ask us a question, we handle your data in order to answer you and, where relevant, to take the first steps toward a possible piece of work you have asked about. That is the core of it. You reached out, and we are responding to the thing you reached out about.
When you tick the separate marketing box, we rely on your consent to contact you about anything beyond your specific enquiry. Because that consent is separate and optional, you can leave it unticked and still get a full answer, and you can withdraw it later at any time.
We also have a legitimate interest in keeping a workable record of enquiries for our own planning, and in protecting the form from abuse, which is why the anti-spam hash exists. None of these bases is used to build a profile of you or to share your data for anyone else’s marketing.
Cookies, in brief
For an ordinary visitor reading pages and sending an enquiry, this site sets no cookies at all. There are no tracking cookies, no advertising cookies, and no third-party cookies, which is why you will not meet a consent banner here. There is nothing to consent to.
WordPress itself sets cookies only in situations that do not apply to a normal visitor, such as keeping a logged-in administrator signed in. The enquiry form works with cookies blocked, and with JavaScript disabled, so declining cookies costs you nothing on this site.
There is a fuller explanation, including what would change if a video or analytics were ever added, in the cookie policy at /cookie-policy/. If you want the detail on browser storage specifically, read that page alongside this one.
Who can see your information
Two emails are sent when you submit the form. One notifies the team that an enquiry has arrived. One goes to you, confirming what you sent and giving you a reference.
Enquiry records are visible only to site administrators. Editors cannot see them by default, which is deliberate: the people writing pages have no reason to read your budget.
Client names attached to published case studies are held in a separate confidential field and are never published unless permission to name has been explicitly recorded.
Inside the organisation, then, access is limited to the people who actually need to read and answer briefs. Your enquiry is not circulated more widely than that, and it is not treated as material for anything other than replying to you.
Sharing and third parties
We do not sell your personal data, we do not rent it, and we do not share it with anyone for their own marketing. That is a firm line, not a soft aspiration.
Like any normal business website, this site depends on a small number of ordinary service providers to function, and your data touches them only in the course of doing what you asked. A web hosting provider stores the site and the enquiry records it holds. An email service carries the two messages that are sent when you submit the form, which means your confirmation and the internal notification pass through it. These suppliers act on our instruction and for the narrow purpose of running the site and delivering mail, not for their own ends.
We deliberately avoid naming specific vendors in this policy, because suppliers can change and a policy that lists a brand becomes wrong the moment that changes. What does not change is the principle: your data is shared only with the providers needed to run the site and answer you, and only to that extent. If we ever engaged a new kind of processor that materially changed this picture, such as a customer relationship system, this page would be updated to say so before it happened.
We may also disclose personal data where the law genuinely requires it, for example in response to a valid legal obligation. That is a last resort, not a routine, and it is not a route for anyone to obtain your data casually.
Where your data is processed
We are based in Kathmandu, and the productions that contact us are spread across the world, so it is worth being honest about geography. Depending on how the site and its email are hosted, your data may be stored or processed on servers located outside Nepal, and outside the country you are writing from.
This is normal for almost any website, but it matters under some data protection regimes, which set conditions on moving personal data across borders. Where such rules apply to you, the safeguards that are expected of a transfer are a question for the specific arrangements in place at the time, and you are welcome to ask us about them.
The practical reassurance is the same wherever the servers sit: the data is handled only for the purposes described in this policy, access is limited to the people and providers who need it, and it is anonymised on the schedule set out below. Distance does not loosen any of that.
How long we keep things
Enquiry records are kept for 730 days, that is two years, and then anonymised automatically. The record of the enquiry survives for our own planning, but the personal data in it does not, and any attachment is deleted.
If you would rather your data was removed sooner, ask, and we will act on it.
The principle behind this is straightforward. We keep personal data only for as long as it is genuinely useful for the purpose it was collected for, and then we stop. Anonymising rather than simply deleting means we can still learn from the shape of past enquiries, for example which seasons or regions people ask about, without holding onto the details that identify the person who asked. Once a record is anonymised, it is no longer personal data and can no longer be tied back to you.
How we protect your data
Security on this site is built in rather than bolted on, and several of the measures have already been described in their own right. Attachments are validated by file type and stored in a protected directory outside the public media library, reachable only by a logged-in administrator through a permission check. Enquiry records are restricted to administrators, so they are not exposed to everyone with a login. The anti-spam protection uses a daily, one-way hash instead of storing IP addresses, so there is simply less sensitive data lying around to protect in the first place.
Because fonts and assets are self-hosted and no advertising or analytics scripts are loaded, there are fewer third parties in the chain, which is itself a security benefit. Fewer connections mean fewer places where something could go wrong.
No website can promise perfect security, and we will not pretend otherwise. What we can say is that the site is designed to collect less, expose less, and keep less than a typical business site, which is the most effective form of protection there is. If you ever have reason to believe your data has been handled improperly, tell us, and we will look into it.
How to make a privacy request
Exercising a right does not need to be formal. Here is how it works in practice.
Get in touch
Contact us through the page at /contact/ and say clearly that you are making a privacy request. Tell us what you want: a copy of your data, a correction, deletion, or something else. There is no special form to fill in.
Help us find you
So that we act on the right record and do not hand your data to someone pretending to be you, we may ask for enough detail to locate your enquiry and confirm it is yours, such as the email address you used or your reference.
We act on it
For a copy request, the site returns your enquiry records in a readable export. For deletion, it anonymises the records and removes any attachment you sent, rather than leaving fragments behind.
We confirm
We let you know what we have done. We aim to respond as promptly as we reasonably can, and within any period the data protection law that applies to you requires.
Your rights over your data
Depending on where you live, some or all of these rights apply to you. This site is built to handle them properly, and a request for a copy returns your enquiry records in a readable export, while a request for deletion anonymises the records and removes any attachment you sent.
- The right to be told what personal data we hold about you and why
- The right to ask for a copy of that data in a readable form
- The right to have inaccurate data corrected
- The right to have your data deleted, which here means anonymised with any attachment removed
- The right to ask us to restrict how we use your data while a question about it is resolved
- The right to object to a particular use, including any use based on our legitimate interests
- The right to withdraw the separate marketing consent at any time, without it affecting the answer to your enquiry
- The right, under some regimes, to receive your data in a portable format
- The right to complain to the data protection regulator that applies to you if you are not satisfied with how we have handled things
Children
This is a business service for professional film and media production. It is not aimed at children, its content is not directed at children, and nothing on it is designed to appeal to them.
We do not knowingly collect personal data from children through this site. The production brief form is intended to be completed by the adults responsible for planning a shoot. If you believe a child has sent us personal data through the form, contact us and we will delete it. If your production itself involves filming children on the ground, that is a separate matter of consents and safeguarding handled within the work of a specific engagement, not something this website collects data about.
Send only what you need to
The free-text box is generous, but you are in control of what goes in it. There is no need to include sensitive personal information, such as health details, identity document numbers, or anyone’s private data, in order to get a useful first answer. A clear outline of the production is enough. Keeping the sensitive detail for later, once you know who you are working with, is simply good practice, and it means there is less to protect in the meantime.
The best way to protect someone’s data is to collect less of it, expose less of it, and keep it for no longer than it is genuinely useful.
How we workChanges to this policy, and how to reach us
If how the site handles data changes, this page changes with it. We do not treat this policy as a document to be written once and forgotten. When a new provider is engaged, a new field is added to the form, or analytics or an embedded video are ever introduced, the description here is brought into line before the change goes live, so that what you read continues to match what the site actually does.
If you want to raise anything at all about your privacy, whether it is a formal request to see or delete your data, a question about something on this page, or a concern about how a particular enquiry was handled, contact us through the page at /contact/. You will reach the same team that reads production briefs, and a message flagged as a privacy request is handled as one.
For the related detail on browser storage, read the cookie policy at /cookie-policy/. For the terms that govern the use of this website, see the terms and conditions. This policy covers your personal data specifically, and those pages sit alongside it.
The life of a single enquiry
From the moment you press submit to the day a record is anonymised, here is what happens to what you send, and when.
- On submit
The record is created and two emails go out
The form is validated, your file (if you sent one) is checked by type and stored in a protected directory, and an enquiry record is created. Two emails go out at once: one tells the team a brief has arrived, and one lands with you, repeating what you sent and giving you a reference to quote.
- Within days
A person reads and replies
A person on the team reads your brief and replies. Nothing about your enquiry is decided by an automated system, and your data is not passed to anyone outside the small group who answer briefs. Your budget, your dates and your description are read only to work out whether the shoot is feasible and what it would take.
- If it becomes work
The detail feeds the planning
If your enquiry turns into a real piece of work, the details you shared feed straight into planning that shoot. Any further or more sensitive information, such as documents needed for permits, is gathered separately within that engagement rather than through this website, and is handled under the arrangements for that specific job.
- At any time
You can exercise a right
You do not have to wait for any of the above to exercise a right. At any point you can ask for a copy of what we hold, ask for a correction, ask for deletion, or withdraw the separate marketing consent. A request changes what happens next rather than waiting on the clock.
- At 730 days
The record is anonymised
If you have not asked for anything sooner, the record is anonymised automatically once it reaches 730 days, which is two years. The personal detail is stripped out, any attachment is deleted, and what remains can no longer be tied back to you. From then on it is no longer personal data.
Your options, and what each one does
You are not limited to waiting for the two-year clock. These are the things you can ask for, how to ask, and what each one does to the enquiry we hold.
| What you can do | How to ask | What happens | Effect on your enquiry |
|---|---|---|---|
| Ask for a copy of your data | Message us through the contact page and say you would like a copy | Your enquiry records are returned to you in a readable export | Nothing changes; the record stays exactly as it is |
| Ask for a correction | Tell us which detail is wrong and what it should say | We update the record so it is accurate | The corrected version becomes what we hold |
| Ask for deletion | Flag your message clearly as a deletion request | The records are anonymised and any attachment is removed | The personal data goes; a non-identifying record may remain |
| Withdraw marketing consent | Say so at any time; no reason is needed | The optional marketing tick is treated as switched off | None; the answer to your enquiry is unaffected |
| Do nothing | No action is needed from you | The record is anonymised automatically at 730 days | Your personal data is removed on schedule |
Two emails and a reference
Submitting the form sends two emails, and it is worth being clear about both. One is an internal notification that tells the team a new brief has arrived so it can be picked up and answered. The other is your confirmation. It repeats back the details you sent, so you have your own record of the enquiry, and it carries a reference.
That reference is the simplest way to talk to us about a specific enquiry later. If you ever ask for a copy of your data or ask for it to be deleted, quoting the reference helps us find the right record quickly and confirm it is yours, so we are not acting on the wrong person’s data. Keep the confirmation email if you think you may want to make a request down the line. If you lose it, that is not a problem; the email address you used will usually be enough for us to find you.
Profiling, automated decisions and links to other sites
Two topics round out the picture, and both are easier to state than they sound.
The first is profiling and automated decision-making. This site does none. Your enquiry is not scored, ranked, or sorted by an algorithm, and no decision that affects you is made automatically. A person reads every brief and replies to it. We do not build a profile of you from your enquiry, we do not combine it with data bought from anyone else, and we do not use it to predict anything about you. The only automated step in the whole process is the anti-spam hash, which exists to notice a flood of submissions from one source within a day, and even that stores no address and cannot be linked from one day to the next.
The second is links to other websites. From time to time a page here may link out to another organisation, for example an official source, a map, or a reference that is genuinely useful when you are planning a shoot. Once you follow a link and leave this site, you are on someone else’s website, and their handling of your data is governed by their privacy policy rather than this one. We have no control over what another site collects, so it is always worth a quick look at the policy of any site you go on to use. This policy covers only what happens here, on the Hire Fixer in Nepal website.
Questions
What personal data do you actually collect?
Only what you put into the production brief form. That can include your name, company, email address, telephone number, country and preferred contact method, plus details of your production such as type, dates, locations, crew size, services, equipment notes, a budget indication and a free-text description. You can also attach one file. Most fields are optional, so you decide how much to share.
Do you use cookies or track me?
No. For an ordinary visitor the site sets no tracking cookies, no advertising cookies and no third-party cookies, which is why there is no consent banner. It contacts no advertising network, and fonts are self-hosted rather than loaded from Google, so reading a page here does not tell a third party you visited. The cookie policy at /cookie-policy/ has the full detail.
How long do you keep my enquiry?
Enquiry records are kept for 730 days, which is two years, and then anonymised automatically. After that the record survives for our own planning, but the personal data in it does not, and any attachment you sent is deleted. If you would rather your data was removed sooner, just ask and we will act on it.
Can I get a copy of what you hold about me?
Yes. Contact us through /contact/ and say you would like a copy of your data. The site returns your enquiry records in a readable export. We may ask for a little detail to confirm the records are yours before we send them, so that we are not handing your data to someone else, and we will respond as promptly as we reasonably can.
Can I have my data deleted?
Yes. A deletion request anonymises your enquiry records and removes any attachment you sent, rather than leaving fragments behind. Ask through /contact/ and flag it clearly as a deletion request. Once a record is anonymised it can no longer be tied back to you, so it is no longer personal data.
Do you sell or share my data?
No. We do not sell, rent or share your personal data for anyone’s marketing. It touches only the ordinary suppliers needed to run the site, such as the web host that stores it and the email service that carries the two messages sent when you submit the form. Those providers act on our instruction, and only to run the site and reply to you.
Is my attachment stored safely?
Yes. The site accepts PDF, DOC, DOCX and TXT only, up to 8MB, and checks the file type rather than trusting its name. Attachments are stored in a protected directory outside the WordPress media library, so they do not appear in the public media browser and are not reachable at a guessable URL. They are served only to a logged-in administrator through a permission check, and are deleted when the record is anonymised.
What is the difference between the consent tick and the marketing tick?
They are deliberately separate. The first records your agreement to be contacted about the specific enquiry you sent. The second is an optional agreement to hear from us about anything else. Agreeing to be answered is not agreeing to be marketed to, so you can leave the marketing tick unticked and still get a full reply, and you can withdraw that consent later at any time.
Who is the data controller?
Nepal Film Production Pvt. Ltd., the Kathmandu based company that operates Hire Fixer in Nepal. We decide what this site collects and why, and we are the organisation to contact about anything in this policy. The best route is the contact page at /contact/, flagging your message as a privacy request so it is handled as one.
What happens if this policy changes?
The policy is kept in step with how the site actually behaves. If a new provider is engaged, a form field changes, or analytics or an embedded video are ever added, this page is updated to describe it before the change goes live. That way what you read here always matches what the site does, rather than describing an older version of it.