1. Who we are, and which hat we are wearing
Inkwell Innovations Pvt. Ltd. is a company registered in Nepal (company registration number 334829/80/081), with its registered office at Ward-3, Lalitpur, Nepal. Where this notice says “we” or “Inkwell”, it means that company.
We handle personal data in two quite different roles, and it matters which one you are asking about:
- Our own data, where we are the controller. Enquiries sent through this site, savings-calculator estimates, our outbound email and LinkedIn approaches, and job applications. We decide why and how that data is used, and this notice describes it.
- Your clients’ data, where we are a processor. When we run ad accounts, CRMs, campaigns or reporting for you, the personal data inside those systems is yours, not ours. We act on your written instructions under a data processing agreement. That DPA and our sub-processor list are separate documents, and for that work they govern rather than this page. Ask and we will send both.
2. What we collect, and why
Everything below is business contact data or something you typed into a form on this site. We do not collect special category data, we do not ask for it, and if you send it to us unprompted in a message or a CV we treat it as if you had not.
| Where it comes from | What it is | Why we have it | Lawful basis |
|---|---|---|---|
| The enquiry form on this site | Name, work email, company, your role, what you need, ad spend band, channels of interest, your message, and the exact consent wording that was on screen when you ticked it | To reply to you and to have the conversation you asked for | Legitimate interests: answering someone who contacted us. Consent, separately, for the optional marketing tick |
| The savings calculator | The region, roles and headcount you set, and the estimate that produced. Your email only if you ask us to send it to you | To send you the estimate and discuss it | Legitimate interests, or consent where you asked us to send it |
| Our outbound email and LinkedIn | Name, job title, employer, work email address, company website and publicly stated company information. Sourced from company websites, LinkedIn and B2B data providers | To make a relevant business approach to a company we think we can actually help | Legitimate interests, see section 3 |
| Working with you as a client | Contact details of the people we work with on your side, our correspondence, and the commercial record of the engagement | To run the work, invoice for it and keep proper records | Contract, and legal obligation for the accounting records |
| Job applications | Whatever you send: CV, portfolio, work history, references | To assess your application and, if it goes well, to make you an offer | Steps taken at your request before a contract, and our legitimate interest in hiring well |
| Our web server | IP address, browser, and the page requested: ordinary server logs kept by our hosting provider | Keeping the site up and defending it from abuse | Legitimate interests |
3. Cold outreach, and how to make it stop
We email businesses we have not worked with before. We would rather set out how that works than leave you to guess.
We rely on legitimate interests under Article 6(1)(f). We have written the balancing test down: who we contact, why the approach is relevant to their role, and what we weighed on the other side. If you want to see the assessment that covers a message we sent you, email partnerships@inkwell.com.np and we will send it.
In the United Kingdom
PECR treats sole traders and unincorporated partnerships as individual subscribers, who require consent. It treats limited companies and LLPs as corporate subscribers, who do not. We check entity type before we send, and we do not cold-email sole traders or unincorporated partnerships. If you received a message from us and you are one, that was a mistake and we want to know.
Stopping it
Every message we send identifies us and says how to stop. One reply saying stop is enough, and there is no portal to find and no form to complete. We act on it when we read it, not at the end of a cycle.
When you object we keep the minimum needed to honour the objection: your email address on a suppression list. We keep that indefinitely, because deleting it is how you end up on the receiving end of the same campaign a year later.
4. Cookies and tracking
This site sets no analytics, advertising or social cookies. There is no Google Analytics, no Meta pixel, no LinkedIn insight tag and no session recording. That is why you were not asked to dismiss a cookie banner on the way in.
One thing to be straight about: our forms submit to HubSpot, our
CRM. If your browser already carries a HubSpot tracking cookie
(hubspotutk) from some other site that runs HubSpot's tracking
script, our form reads it and passes it along, so your enquiry attaches to the
right record rather than creating a duplicate. We do not set that cookie, and if
it is not there the form works exactly the same.
If we ever add analytics, a consent banner arrives with it and this section is rewritten before the tag goes live, not after.
5. Who else sees it
We do not sell personal data, and we do not share it so that anyone else can market to you. It goes to three kinds of recipient:
- Service providers we use to run the business. HubSpot for CRM and forms; Hostinger for this website, and for our email and files. Each is bound by contract to process data only on our instructions.
- You, when we work for you. Delivery work naturally involves your systems and your client's data. That flows under the DPA, not this notice.
- Anyone we are legally required to tell. Regulators, auditors or a court order. We would tell you unless we were prohibited from doing so.
The current sub-processor list is a maintained document rather than a paragraph on a web page, because it changes. Email partnerships@inkwell.com.np for the current version and we will add you to the notification list for changes to it.
6. Where in the world the data actually is
We are in Kathmandu. Our people do the work in Nepal, which means personal data you send us is processed in Nepal, and personal data inside client systems is accessed from Nepal.
Nepal is not covered by a UK or EU adequacy decision. We would rather say that plainly than bury it. Transfers of personal data from the UK or the EEA to us therefore rely on the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. For client engagements these sit inside the DPA and are signed before any access is granted.
In practical terms, the safeguards that do the real work are operational: access is granted to named individuals rather than to “the team”, we work inside your systems wherever the work allows it rather than copying data into ours, and we do not take bulk exports of client data as a matter of routine.
7. How long we keep it
| What | How long |
|---|---|
| An enquiry that does not become work | 24 months from our last contact, then deleted |
| Prospect contact data we sourced ourselves | 24 months from the last engagement, then deleted |
| Suppression records | Indefinitely. This is the one record we will not delete on request, because it is what stops us contacting you again |
| Client records | For the engagement, then for as long as Nepali tax and company law require us to keep the accounting record |
| Unsuccessful job applications | 12 months, then deleted, unless you agree to stay on file |
| Server logs | As set by our hosting provider: weeks, not years |
8. Keeping it secure
The controls we consider non-negotiable, because most of what we are trusted with is access to someone else's advertising accounts and CRM:
- Access is granted to named individuals. No shared logins on client accounts, ever.
- Multi-factor authentication on every account that supports it.
- Access is removed the day someone leaves, as part of their last day rather than as a task for later that week.
- Company laptops are encrypted at rest.
- Where the work allows, we operate inside your systems rather than copying data into ours. Data we never hold is data we cannot lose.
Nobody can honestly promise a system will never be breached. What we will commit to is telling you if something happens that affects your data. For client work the DPA sets the notification clock, and it is shorter than the regulatory one.
9. Your rights
If UK or EU data protection law applies to our handling of your data, you have the right to ask us to:
- give you a copy of what we hold about you;
- correct it, if it is wrong;
- delete it;
- restrict what we do with it while a dispute is resolved;
- hand it over in a portable format;
- stop processing it, which includes stopping direct marketing at any time and for any reason; and
- withdraw consent you previously gave, without that affecting what we did before you withdrew it.
We do not make decisions about you by automated means, and we do not profile you in any way that produces a legal or similarly significant effect.
Making a request
Email partnerships@inkwell.com.np. There is no form. We respond within one month, and it costs you nothing. If your request is one we cannot fully act on (a suppression record, or a document we are legally required to retain), we will tell you which part and why rather than quietly doing half of it.
Complaining about us
You can complain to a supervisory authority. In the UK that is the Information Commissioner's Office: ico.org.uk, helpline 0303 123 1113. Elsewhere in the EEA it is the authority for your country. You do not have to raise it with us first, though we would prefer the chance to fix it.
10. Children
This is a business-to-business site. It is not directed at children, and we do not knowingly collect data about anyone under 18. If you believe we have, tell us and we will delete it.
11. Changes to this notice
When we change how we handle data, this page changes first. The date at the top is the date of the current version. If a change materially affects people we already hold data about (a new sub-processor with access to client systems, say, or a new lawful basis), we notify them directly rather than relying on anyone to re-read a web page.
This version: 20 August 2026.
12. How to reach us
For anything in this notice, whether a rights request, a copy of a legitimate interests assessment, our DPA, or the sub-processor list:
- Email: partnerships@inkwell.com.np
- Post: Inkwell Innovations Pvt. Ltd., Ward-3, Lalitpur, Nepal