Privacy Notice

1. Who is responsible for your data?

The controller for the processing described here is:

Rie Brn Pvt. Ltd
trading as Riebrn Engineering Solutions
Goreto Complex, Dhumbarahi ,P.O Box 1490
Kathmandu 44600 Nepal

• Email: [email protected]
• Phone: +977 9712065505

For any question about this notice, about how we handle your data, or to exercise your rights, write to [email protected]. Our full company details are in our Legal Notice.

Where we address visitors in the European Union, we process personal data in accordance with the EU General Data Protection Regulation ("GDPR").

2. When you visit our website

Server log files

Each time a page is called up, your browser automatically transmits technical data that our server records in log files: browser type and version, operating system, the referring page, the pages requested, date and time of access, the amount of data transferred, and your IP address.

We process this data to deliver the pages you requested, to keep the site functional and secure, to detect and investigate misuse or attacks, and to provide law-enforcement authorities with the information necessary in the event of a cyber attack. The legal basis is our legitimate interest in the secure and reliable operation of our website (Art. 6(1)(f) GDPR). Log files are deleted at the latest after 30 days, unless a specific incident requires us to keep them longer as evidence.

Cookies and your consent

We set a single necessary cookie, riebrn_cookie_consent, which stores the choice you make in our cookie banner. It contains no information that identifies you personally. It is kept for 12 months if you accept cookies and for 7 days if you decline, so that we do not ask you again on every visit. The legal basis is our legal obligation to document consent decisions together with your consent where applicable (Art. 6(1)(c) and (a) GDPR).

All other cookies and technologies are set only after you actively agree to them in the banner (Art. 6(1)(a) GDPR). You can change or withdraw your decision at any time by deleting the consent cookie in your browser settings, which brings the banner back.

Google Analytics

If — and only if — you consent to analytics cookies, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We run it with IP anonymisation enabled, so your IP address is shortened before any further processing. Analytics tells us in aggregate how our site is used: which pages are visited, how visitors arrive, which devices they use and how long they stay. We use this to improve the site's content and structure.

The legal basis is your consent (Art. 6(1)(a) GDPR, and § 25(1) TDDDG for storing information on your device). You may withdraw it at any time with effect for the future. Google may transfer data to Google LLC in the USA; for these transfers Google relies on the EU Standard Contractual Clauses and its certification under the EU–US Data Privacy Framework. Analytics cookies expire after 24 months at the latest. Further information is available in Google's privacy policy.

Google Maps on our contact page

Our contact page embeds a Google Maps map so you can find our office. When that page loads, your browser connects to Google servers and your IP address is transmitted to Google Ireland Limited; Google may set cookies and process the data for its own purposes. The legal basis is our legitimate interest in making our location easy to find (Art. 6(1)(f) GDPR). If you would rather not have this connection made, simply do not open the contact page — the same address and directions are given in text form on that page and in our Legal Notice.

Fonts and other resources

All fonts used on this site are hosted on our own servers. No connection is made to external font services when you browse our pages.

Links to social networks

Our pages contain icons linking to our profiles on LinkedIn, Facebook and WhatsApp. These are plain links, not embedded plug-ins: no data is transmitted to those providers unless you actively click one. What happens after you click is described in section 5.

3. When you contact us

If you use the form on our contact page, we process the name, email address, telephone number (optional) and message you enter. The same applies when you write to us by email, call us, or message us on WhatsApp or a social network.

Your enquiry is recorded as a lead in our own ERP system (Odoo), which we operate on our own infrastructure at erp.riebrn.com, and is handled by the colleagues responsible for your request. Everything you send us is transmitted over an encrypted connection between your browser and our servers.

Purpose and legal basis: we process this data to answer your enquiry and, where your message concerns a possible engagement, to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR). In all other cases the basis is our legitimate interest in responding properly to enquiries addressed to us (Art. 6(1)(f) GDPR).

Retention: we keep your enquiry for as long as we need it to deal with your request and for any follow-up. After that, data is deleted unless statutory limitation periods (as a rule three years) or commercial and tax retention obligations (as a rule up to ten years) require us to keep it.

4. When you apply for a job

You can apply through the application form on our vacancies pages, through our LinkedIn job postings, or by sending your documents to us by email.

Through our own form we ask for your first and last name, your email address and, optionally, a telephone number, a short description of yourself and the documents you upload (typically a CV, certificates and references). If you apply through LinkedIn, we receive the profile and application data that LinkedIn transmits to us for the position concerned.

Applications are stored in the recruitment module of our own ERP system (Odoo) and are accessible only to the people involved in filling the position — as a rule our management and the team the role belongs to. We do not pass applicant data to third parties, and we do not use automated decision-making to assess applications.

Purpose and legal basis: we process your data to assess your suitability and to carry out the application procedure, i.e. to decide on entering into an employment relationship (Art. 6(1)(b) GDPR, and § 26(1) BDSG for applicants in Germany). Information you provide voluntarily is processed on the basis of our legitimate interest in a complete picture of your application (Art. 6(1)(f) GDPR). Please do not send us special categories of data (for example health data, religious or political beliefs) unless a position specifically requires it.

Retention: if we cannot offer you a position, we delete your application no later than six months after we have told you our decision. We keep your documents beyond that only with your explicit consent, so that we can consider you for future openings — for a maximum of 24 months, and you can withdraw that consent at any time. If we do work together, the relevant documents are transferred to your personnel file.

5. Our social media presences

We maintain company profiles on LinkedIn, Facebook, Instagram and WhatsApp Business. If you visit or interact with them, the platform operator processes your data under its own responsibility and largely outside our influence — we cannot switch that processing off, and we cannot delete your posts, comments or messages on those platforms.

What we do

• Page statistics. The platforms give us aggregated statistics about visitors and followers of our pages — reach, interactions, and broad demographics such as age group, gender and region. These reports do not allow us to identify individual people.
• Notifications and interactions. When you follow us, react to or comment on a post, we are notified with your user name, profile picture and the interaction itself, and we may reply to you.
• Messages. If you write to us on a platform or via WhatsApp, we process your user name, your contact details and the content of your message in order to answer you.
• Recruiting. On LinkedIn we publish job openings and may contact people whose public profile matches a role we are hiring for.

The legal basis for these processing operations is our legitimate interest in presenting our company, communicating with interested people and reaching potential colleagues (Art. 6(1)(f) GDPR); where your message concerns a possible engagement or application, Art. 6(1)(b) GDPR also applies.

Joint responsibility with the platforms

For the page statistics described above, we and the platform operator are joint controllers within the meaning of Art. 26 GDPR. The operators have each assumed the primary responsibility for informing you and for handling your rights in respect of that processing:

• LinkedIn — LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (privacy policy)
• Facebook and Instagram — Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (privacy policy)
• WhatsApp — WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (privacy policy)

These providers also process data on servers outside the EU, in particular in the USA, and use it for their own purposes such as advertising and market research. We have no influence over that. To exercise your rights in respect of the platforms' own processing — and to change what they may do with your data — please use your account settings there or contact the provider directly. We can help you only with the processing we carry out ourselves.

6. Who receives your data

Within our company, only those colleagues have access to your data who need it for the purposes described above.

In addition we work with service providers who support us, in particular with hosting and IT operations, email delivery, and the maintenance of our website and business systems. Where these providers process personal data on our behalf, they act only on our instructions under a data processing agreement in accordance with Art. 28 GDPR, and they are bound to confidentiality. We do not sell personal data, and we do not pass it on for third-party advertising.

Beyond that, we disclose data only where we are legally obliged to do so, or where it is necessary to establish, exercise or defend legal claims.

Transfers outside the EU

Our website and our business systems are hosted on servers in the European Union. However, our company is established in Nepal, and our team there accesses the data described in this notice in order to answer enquiries, process applications and run our services. Nepal is a third country for which the European Commission has not issued an adequacy decision. We therefore protect these transfers by contractual and organisational safeguards, and limit access to the people who need it.

Some of the third-party providers named above — Google, Meta, LinkedIn and WhatsApp — also process data in the USA. They rely on the EU Standard Contractual Clauses and, where applicable, on certification under the EU–US Data Privacy Framework.

7. Your rights

Under the GDPR you have the following rights in relation to your personal data. To exercise any of them, write to [email protected] — no particular form is required, and it costs you nothing.

• Access (Art. 15) — you can ask us whether and how we process your data and request a copy of it.
• Rectification (Art. 16) — you can ask us to correct inaccurate data and complete incomplete data.
• Erasure (Art. 17) — you can ask us to delete your data. This does not extend to data we still need for a contract, for legal claims, or which we are legally obliged to retain.
• Restriction (Art. 18) — you can ask us to restrict processing, for example while a dispute about accuracy is being resolved.
• Data portability (Art. 20) — you can receive the data you provided to us, where we process it on the basis of consent or a contract, in a structured, commonly used, machine-readable format.
• Withdrawal of consent (Art. 7(3)) — where processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of processing carried out before the withdrawal is not affected.

Right to object (Art. 21): you can object at any time to processing we base on our legitimate interests, on grounds relating to your particular situation. We will then stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. You can object to direct marketing at any time without giving reasons.

Complaint to a supervisory authority (Art. 77): if you believe our processing infringes data protection law, you can lodge a complaint with the data protection supervisory authority of the EU Member State in which you live or work, or in which the alleged infringement took place. We would of course appreciate the chance to address your concern directly first.