Privacy policy

We collect the minimum needed to get a parcel to a door and to settle the money afterwards. We do not sell personal data, we do not build advertising profiles, and we do not add anyone to a marketing list because they received a parcel from a merchant who uses us.

Everything below is the detail behind that. If any of it is unclear, that is a fault in our writing — tell us and we will fix it.

Udan Express Pvt Ltd., Tinkune, Ward 32, Kathmandu, Nepal, is the controller of the personal data described here.

Where a merchant sends us recipient details in order to have a parcel delivered, that merchant is the controller of those details and we process them on their instruction.

From senders and account holders: business name and registration details, contact name, phone number, email address, business address, bank account details for settlement, and a record of the consignments booked.

From recipients: name, phone number, delivery address, and where a merchant requests it, a photograph of the delivered parcel at the door.

From riders and staff: employment records, and location data during working hours while a route is active.

From website visitors: nothing beyond what is needed to serve the page. There is no advertising tracker on this site.

• To perform the delivery. The recipient's name, phone and address exist so a rider can find a door and call ahead. That is the entire purpose.
• To collect and settle money. COD amounts, ledger entries and bank details, so the right sum reaches the right account.
• To meet legal obligations. Tax records, VAT reporting, and cooperation with lawful requests from authorities.
• To keep the network safe and honest. Audit logs and fraud controls, particularly around changes to settlement bank accounts.

The rider app records location while a route is active, so dispatch can answer “where is it” and so a rider can be found if something goes wrong on the road.

• Collected only while a rider is on duty with an active route.
• Not collected outside working hours, and not when the app is closed.
• Retained for 30 days and then deleted, except where attached to an incident.
• Never shared with merchants or recipients as raw coordinates.

Only where it is necessary to deliver the parcel or required by law:

• Transport partners on hill and far-western routes, who receive the delivery address and recipient phone number and nothing else.
• The sending merchant, who sees the delivery outcome for their own consignments.
• Banks and payment providers, to execute settlement transfers.
• Authorities, where the law requires it — and we require the request to be lawful and specific before complying.

We do not sell personal data to anyone, for any purpose, ever.

• Consignment records: seven years, because tax and accounting law requires it.
• Proof-of-delivery photographs: 90 days, then deleted.
• Rider location traces: 30 days.
• Account and settlement records: seven years from the end of the relationship.
• Support conversations: two years.

• Encrypted in transit everywhere. No plaintext endpoint exists on any of our systems.
• Access is least-privilege and role-based: a packer cannot see settlement data, and support cannot change a bank account.
• Every consequential action is written to an append-only audit log with the person, time and origin.
• Bank account changes require a second approver and a check against the business registration.

No system is perfectly secure. If we suffer a breach affecting your data we will tell you what happened, what was affected and what we are doing about it — promptly and without minimising it.

You can ask us to:

• Tell you what personal data we hold about you.
• Correct anything inaccurate.
• Delete data we no longer have a lawful reason to keep.
• Provide your data in a portable format.

Email support@udanexpress.com and we will respond within thirty days. Where a request concerns data a merchant sent us about a recipient, we will pass it to that merchant and tell you we have done so.

This website sets no advertising or tracking cookies. There is no third-party analytics script embedded in these pages, which is also why there is no consent banner interrupting you.

The merchant panel sets a session cookie so you stay signed in. That is functional, not analytical, and it is the only cookie involved.

Recipients receive transactional SMS about their own parcel: dispatch notification, the COD amount to have ready, and delivery confirmation. These are part of the delivery, not marketing.

We do not send marketing messages to recipients. Receiving a parcel through us does not put anyone on a list.

Our services are for businesses and adults. We do not knowingly collect personal data from children, and we do not target any part of this service at them.

Operational data is held on infrastructure located in or serving Nepal. Where a service provider processes data outside the country, we require contractual protection equivalent to what is described in this policy.

We update this policy when what we do changes — not to quietly widen what we are allowed to do. Material changes are published here with a revised date and notified to account holders by email.

Questions about privacy, or a request about your data: support@udanexpress.com, or by post to Udan Express Pvt Ltd., Tinkune, Ward 32, Kathmandu, Nepal.