Cookie Policy

1. What are cookies?

Cookies are small text files that a website places on your device (computer, tablet, or mobile phone) when you visit it. They are widely used to make websites work, to work more efficiently, and to provide information to the site's owners.

We also use a few similar technologies that work like cookies:

• Local storage / session storage — used by your browser to store data (for example, to keep you signed in to the app or remember your preferences). Technically not a cookie, but treated the same way in this policy.
• Pixels / web beacons — tiny images used to understand whether a page or email was viewed. (Only include this line if you actually use them — e.g. in marketing emails.)
• Session cookies — temporary; deleted when you close your browser.
• Persistent cookies — remain on your device for a set period, or until you delete them.
• First-party cookies — set by us (EngSutra).
• Third-party cookies — set by another organisation whose service we use (for example, Cloudflare or an analytics provider).

2. Why we use cookies

We use cookies and similar technologies to:

• Keep the Platform secure and protect it from abuse, spam, and automated attacks.
• Keep you signed in and remember your session as you move between pages.
• Remember your preferences and settings (such as language or display choices).
• Understand how visitors use the Platform so we can improve it.
• Make our contact and sign-up forms work correctly.

We do not use cookies to sell your personal data. (Keep this only if true.)

3. Categories of cookies we use

3.1 Strictly necessary cookies

These cookies are essential for the Platform to function and cannot be switched off in our systems. They are usually set in response to actions you take, such as signing in, filling in a form, or setting your privacy preferences. Without them, parts of the Platform will not work. These do not require your consent.

Examples on our Platform include:

• Session and authentication cookies that keep you signed in to the app.
• Security cookies from Cloudflare that protect the Platform against malicious traffic.
• Cookies set by Cloudflare Turnstile to verify that form submissions come from a real person and not a bot.
• Cross-site request forgery (CSRF) protection tokens on our forms.

3.2 Functional / preference cookies

These cookies allow the Platform to remember choices you make and provide enhanced, more personal features. They may be set by us or by third-party providers whose services we have added to our pages.

Examples: remembering your language, remembering that you have dismissed a notice, or remembering interface preferences.

3.3 Analytics / performance cookies

These cookies help us understand how visitors interact with the Platform by collecting and reporting information anonymously or in aggregate — for example, which pages are most visited and whether users encounter errors. This helps us improve how the Platform works.

(If you use Google Analytics, Plausible, Cloudflare Web Analytics, or similar, name it here. If you use a privacy-friendly, cookieless analytics tool such as Cloudflare Web Analytics or Plausible, you may not set analytics cookies at all — in that case, say so and remove the cookies from the table below.)

3.4 Marketing / advertising cookies

(Include this section only if you actually run advertising or retargeting — e.g. Meta Pixel, Google Ads. If you do not, replace this section with the single line below.)

We do not use advertising or marketing cookies, and we do not use cookies to track you across other websites for advertising purposes.

4. Cookies we set (cookie table)

⚠️ You must replace this table with your own cookie audit. The rows below are typical examples for a stack like ours (Cloudflare + Django + Turnstile). Verify names and durations against what your site actually sets before publishing.

5. Third-party services that may set cookies

Some cookies are placed by third parties who provide services on our Platform. We do not control these cookies, and you should review the relevant provider's own policy. These may include:

• Cloudflare — content delivery, security, and bot protection. See Cloudflare's cookie/privacy documentation.
• Cloudflare Turnstile — CAPTCHA-alternative human verification on our forms.
• [Analytics provider, if used] — usage analytics.
• Payment gateways (Khalti, eSewa, or other providers) — when you make a payment, you may be redirected to the payment provider's own pages, which set their own cookies under their own policies. We do not receive or store your full payment credentials.
• Embedded content (only if applicable) — if we embed content such as videos (e.g. YouTube) or maps, those providers may set cookies.

6. How you can manage or disable cookies

You have several ways to control cookies:

Our cookie banner / settings. Where we show a cookie consent banner, you can accept or reject non-essential cookies, and change your choice at any time via [link to your cookie settings / "Cookie Settings" in the footer].

Your browser settings. Most browsers let you view, delete, and block cookies. Instructions are available in your browser's help section — for example, in Chrome, Firefox, Safari, and Edge under Settings → Privacy. You can also browse in "private" or "incognito" mode.

To opt out of analytics specifically, you can [use the provider's opt-out tool, e.g. the Google Analytics Opt-out Browser Add-on — include only if relevant].

Please note: Strictly necessary cookies cannot be disabled through our banner because the Platform will not function without them. If you block all cookies through your browser, some parts of the Platform — including signing in and submitting forms — may not work correctly.

7. Consent

When you first visit the Platform, we will ask for your consent to set non-essential cookies (functional, analytics, and marketing, where applicable) through a cookie banner. Strictly necessary cookies are set automatically, as they are required for the Platform to operate.

You can withdraw or change your consent at any time via [your cookie settings link]. Withdrawing consent will not affect the lawfulness of any processing carried out before you withdrew it.

(If you decide not to use a cookie banner and instead rely only on strictly necessary cookies plus cookieless analytics, adjust this section accordingly — but note that if you use any analytics or marketing cookies, a consent mechanism is strongly recommended, and expected under privacy best practice and Nepal's Individual Privacy Act 2075.)

8. Legal basis

We process cookie data in accordance with applicable Nepali law, including the Individual Privacy Act, 2075 (2018) and the Electronic Transaction Act, 2063 (2008), and, where relevant to international visitors, in line with generally accepted data-protection and e-privacy principles. Our legal basis for strictly necessary cookies is our legitimate interest in operating a secure and functional Platform; for all other cookies, our legal basis is your consent.

9. Changes to this Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in the cookies we use or for operational, legal, or regulatory reasons. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify you through the Platform. We encourage you to review this page periodically.