Privacy Policy — CMO Empower

1. Who we are

CMO Empower (“the App”) is a Group Scheme Management Platform for forestry and agriculture certification (FSC, PEFC, EUDR), operated by CMO International, C/O Animo Associates (Mauritius) Limited, 8th Floor, The Core, 62 ICT Avenue, Cybercity, Ebene 72201, Mauritius (“CMO”, “we”, “us”). The App is an enterprise tool used by group scheme managers, regional/resource managers, compliance officers, auditors and enrolled members (farmers). It is not a consumer/public application — access requires an account that CMO provisions.

For any privacy question or request, contact us at ai@cmogroup.io.

2. What data we collect

We only collect what the certification service needs:

Account & authentication: username / email address, hashed password, assigned role, and your authentication session.

Member & FMU records (personal data): member/farmer first and last name, contact number, email, national ID number, date of birth, postal/physical address, and gender; Forest Management Unit (FMU) details, including geographic location (GPS coordinates / mapped plot boundaries captured in the field).

Operational & compliance data: action logs, audits, monitoring registers, uploaded documents, and working-circle/plot data.

Device & technical data: device identifier, platform/OS version and app version (used to sync data offline and deliver notifications), and security audit logs (timestamp, user, action, resource, IP address) for SOC 2 compliance. We do not log passwords, tokens or full personal data in these logs.

The App contains no ads and no third-party advertising trackers, and we do not collect data for advertising.

3. How we use your data

To provide the certification management service; to authenticate you and enforce role-based access; to synchronise your data so the App works offline and uploads when a connection returns; to send operational notifications; and to meet certification (FSC, PEFC, EUDR) and legal/audit obligations.

4. Location data

The App accesses device location only to let field users capture and view the boundaries (polygons) and position of FMUs/plots. Location is tied to the FMU/plot record, used for certification mapping, and is not used to track individuals or for advertising.

5. Legal basis (GDPR)

Where GDPR applies, we process personal data on the basis of performance of a contract (the certification service), our legitimate interests in operating the scheme, your consent where required, and compliance with legal obligations.

6. Sharing & disclosure

We share data with certification bodies / auditors as required to issue and maintain FSC, PEFC and EUDR certification. We use service providers (e.g. cloud hosting on AWS) under appropriate data-processing terms. We do not sell personal data and do not share it for third-party advertising. We may disclose data where required by law.

7. Data security

Encryption in transit (HTTPS / TLS 1.2+) and at rest; role-based access control with session timeouts; and audit logging of access and changes under a SOC 2 Type II program.

8. Data retention

We keep personal data for as long as needed to provide the service and to meet certification, contractual and legal obligations — generally up to 5 years after a member leaves the scheme, unless a longer period is required by law or certification — then delete or anonymise it.

9. Your rights

Subject to applicable law (including GDPR), you may request to access, correct or delete your personal data, or object to/restrict certain processing. Because the App is provisioned by CMO for enrolled members, please send requests to ai@cmogroup.io (or via your group scheme manager). We will respond within the period required by law.

10. Children

The App is an occupational tool for adults involved in a certification scheme. It is not directed at children and we do not knowingly collect data from anyone under 18.

11. Changes to this policy

We may update this policy and will revise the “Last updated” date above. Material changes will be communicated through the App or to scheme managers.

12. Contact

CMO International
C/O Animo Associates (Mauritius) Limited, 8th Floor, The Core, 62 ICT Avenue, Cybercity, Ebene 72201, Mauritius
Email: ai@cmogroup.io
Web: www.cmogroup.io