Privacy Policy

In Short

We only collect what we need to answer your enquiries, sell and activate our software, deliver updates and keep this website running safely. We sell exclusively to businesses. We do not sell personal data, and we do not use analytics, advertising trackers or tracking cookies. The business data you manage in our desktop software stays on your own computer – we cannot see it.

The sections below explain this in more detail.

1. Who Is Responsible

The party responsible for processing personal data on this website and for our software sales (the ‘controller’) is:

Opto Softechs Pvt. Ltd.
Nagarjun Municipality – 1, Kathmandu, Nepal
Email: contact@optosoftechs.com

If you have any question about your data, write to us at the address above.

2. When You Visit This Website

2.1 Server log data

Whenever a page is opened, our web server automatically records technical information: your IP address, date and time, the page requested, the referring page, and your browser and operating system. We need this to deliver the page, to detect attacks and to fix errors. The log files are deleted automatically after 14 days. An individual entry is kept longer only if it is needed to investigate a specific security incident, and only until that incident is resolved.

Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).

2.2 No tracking, no third-party content

We do not use analytics tools, advertising pixels or tracking cookies. Fonts, icons and all other files needed to display this website are delivered from our own server, so opening a page does not send your data to other companies apart from our hosting provider (see Section 7). More about cookies is in our Cookie Policy.

2.3 Blog comments

If you leave a comment on our blog, we store the name, email address and optional website you enter, your comment, your IP address, your browser identifier and the time. Your name, website and comment are published; your email address and IP address are not. We keep the IP address so that we can deal with unlawful comments and protect the comment function against spam.

Legal basis: our legitimate interest in offering a comment function and protecting it against abuse (Art. 6(1)(f) GDPR). How long: for as long as the comment is published. You can ask us to delete your comment at any time.

3. When You Contact Us or Request a Licence

Our contact and sales forms ask for your name, email address and message, and optionally your company name, phone number and preferred plan. For software orders we also ask for your company or trading name, an optional VAT ID, and your confirmation that you are buying for your business. When a form is sent, we also record your IP address and the time, to protect the forms against misuse.

We use this information to answer you, to prepare an offer and to handle your order. The form content reaches us by email. The fields marked as required are needed to answer you or to conclude a contract; without them we cannot process your request.

Legal basis: if you contact us as a sole trader or freelancer, steps before or for a contract with you (Art. 6(1)(b) GDPR). If you contact us on behalf of a company, our legitimate interest in communicating with our business customers and prospects (Art. 6(1)(f) GDPR). For the IP address, our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

How long: enquiries that do not lead to an order are deleted once the matter is closed. Correspondence relating to an order is kept as described in Section 9.

4. When You Buy a Licence

To sell and deliver a licence we process: name, email address, company name, VAT ID (if given), billing details, order or transaction number, plan, price and purchase date. We use them to deliver your licence key and download link, to issue invoices, to provide support and updates, and to keep our accounts.

Payments are handled by an external payment provider. Depending on the provider, it may act as reseller (‘merchant of record’) and be your contractual partner for the purchase itself. In that case it processes your payment and billing details as an independent controller under its own privacy policy, which is shown during checkout. We receive only the order details listed above – never your full card or bank details.

Legal basis: performing the contract (Art. 6(1)(b) GDPR) where you buy as a sole trader or freelancer; otherwise our legitimate interest in handling orders from our business customers (Art. 6(1)(f) GDPR). For bookkeeping, our legitimate interest in meeting the accounting and tax obligations that apply to us (Art. 6(1)(f) GDPR).

5. Licence Activation, Updates and Downloads

Each licence may be used on a limited number of computers. To enforce this fairly, the software contacts our server when you activate it and when it checks for updates. For this we process:

• Activation: licence key, email address, a device identifier, an optional device name, the software version, your IP address and the dates of activation and last contact
• Update checks: licence key, the installed version and your IP address
• Downloads: licence key, email address, selected operating system, IP address, browser details and time of the download

The device identifier is a code calculated on your computer from its hardware characteristics and sent to us only in hashed form; the hardware details themselves cannot be read from it. It is still linked to your licence, so we treat it as personal data.

We use this data to check that a licence is valid, to show you and let you remove your activated devices on the ‘Manage Licence’ page, to deliver updates you are entitled to, and to detect shared or stolen licence keys. Download links are only valid for a short time.

Legal basis: performing the licence contract (Art. 6(1)(b) GDPR) or, where the licence belongs to a company, our legitimate interest in providing the licensed service (Art. 6(1)(f) GDPR); in both cases also our legitimate interest in protecting our software against misuse (Art. 6(1)(f) GDPR).

How long: for as long as the licence exists, and afterwards only as long as needed to settle any open claims.

6. Your Business Data in the Desktop Software

Everything you enter into the desktop software – products, stock, sales, customers, invoices – is stored in a database on your own computer. It is not sent to us, and we have no access to it. Only the licence and update checks described in Section 5 connect to our server.

If you choose to send us files or screenshots for support, we use them only to solve your problem and delete them afterwards. Because we do not store or process your business data on your behalf, we do not act as your data processor.

7. Who Receives Data

We only pass data on where this is necessary for the purposes above:

• Amazon Web Services, which hosts this website, our licence server and the software installation files on servers in Stockholm, Sweden (EU)
• our email provider, through which form messages and customer correspondence reach us
• the payment provider handling your purchase (see Section 4)
• our tax advisor or accountant, for bookkeeping
• authorities, if we are legally obliged to disclose data

Service providers that process data on our behalf are bound by data processing agreements (Art. 28 GDPR). We do not sell personal data.

8. Where Your Data Is Processed

Our servers are located in the EU (Stockholm, Sweden). As our company is based in Nepal, our team accesses the data described in this policy from Nepal in order to handle enquiries, orders, licences and support. The European Commission has not issued an adequacy decision for Nepal. We access the data only for the purposes described in this policy and protect it as described in Section 11.

Where one of our service providers processes data outside the EU, we make sure this is covered by an adequacy decision of the European Commission (for example the EU–US Data Privacy Framework) or by the EU Standard Contractual Clauses.

9. How Long We Keep Data

We delete personal data as soon as it is no longer needed for the purpose it was collected for. Invoices, accounting records and order-related correspondence are kept for the periods required by the accounting and tax laws of Nepal that apply to us, and are used only for that purpose during that time.

10. Your Rights

You can ask us at any time to:

• tell you which data we hold about you and give you a copy (Art. 15 GDPR)
• correct wrong data (Art. 16 GDPR)
• delete your data, unless we still need it for one of the purposes above (Art. 17 GDPR)
• restrict the use of your data (Art. 18 GDPR)
• hand over data you gave us in a common machine-readable format (Art. 20 GDPR)

Just write to contact@optosoftechs.com. We answer within one month.

Right to object: where we process your data based on our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time for reasons arising from your particular situation. We will then stop, unless we can show compelling legitimate grounds or need the data for legal claims. You can object to direct marketing at any time without giving reasons (Art. 21 GDPR).

You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work.

We do not make decisions about you based solely on automated processing.

11. Security

This website is only reachable over an encrypted connection (HTTPS). Access to our systems is limited to people who need it. Device identifiers are stored only as hashed values, and our forms and licence server are protected against automated abuse. No system is completely secure, but we work to keep your data protected.

12. Changes to This Privacy Policy

We may change this Privacy Policy at any time, for example when our services, our service providers or the law change. The version published on this page applies from the date it is published. If a change significantly affects how we use personal data we already hold about you, we will inform affected customers in advance by email or by a notice on this website. Where a change requires your consent, we will ask for it before applying the change. Earlier versions can be viewed through the version history.

This Privacy Policy is effective as of October 2026.