GDPR & Data Protection
Our commitment
Dream Chaser Nepal handles personal data of clients in the European Union. We take our obligations under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) seriously and have implemented organisational and technical measures to protect the data you share with us.
Where data is processed
Dream Chaser Nepal is established in Nepal, which has not been granted an adequacy decision by the European Commission. Whenever personal data is transferred to us, we establish a legal basis under Chapter V of the GDPR:
- Standard Contractual Clauses (SCCs) — signed with our EU business partners where they act as data controller.
- Data Processing Agreements (DPAs) — provided to all EU clients, covering the categories of data, purposes, retention and security safeguards.
- Explicit consent where applicable.
Processors we use
We use the following sub-processors. Each is covered by an agreement that includes appropriate safeguards for international transfers:
| Processor | Purpose |
|---|---|
| Cloudflare, Inc. | CDN, caching and security |
| Google LLC (GA4, Search Console) | Analytics and search performance |
| Microsoft Corporation (Clarity) | Session analytics (consent-based) |
| MaxMind / GeoLite2 | Country detection for forms |
| Cloudflare Workers AI / OpenAI | AI assistant and content generation |
EU representative (Article 27 GDPR)
Because Dream Chaser Nepal is established outside the EU, we are appointing a representative within the European Union in accordance with Article 27 GDPR. Details will be published on the Imprint page as soon as the appointment is finalised.
Security measures
- All traffic served over HTTPS (TLS 1.2+)
- CSRF and honeypot protection on all forms
- Security headers (X-Content-Type-Options, X-Frame-Options, HSTS, Permissions-Policy)
- Data minimisation: we only collect the fields needed to deliver our services
- Access to client data restricted to authorised staff only
Your rights
As a data subject in the EU, you have the right to access, rectify, erase, restrict and port your data, and to object to processing. To exercise any of these rights, contact us at info@dreamchasernepal.com. We respond within one month, as required by Article 12 GDPR. You may also lodge a complaint with your local supervisory authority.
Contact
Questions about data protection? Contact us at info@dreamchasernepal.com or via the contact form. We are happy to sign a DPA before starting any engagement.