Privacy Policy

1. Scope of This Privacy Policy

This Privacy Policy applies to our website, Compliance Manager Plus web application, customer support services, marketing communications, product demonstrations, trial accounts, and subscription services. This policy does not apply to third-party services that integrate with Compliance Manager Plus.

2. Information We Collect

We collect information to provide, improve, and secure our Services. The types of information we collect include:

Personal Information

When you create an account or contact us, we may collect full name, email address, job title, organization name, business address, and country or region.

Account Information

When registering for Compliance Manager Plus, we collect username, encrypted password, account preferences, user roles and permissions, login history, and authentication settings. Passwords are encrypted and are never stored in plain text.

Organization Information

Organizations using Compliance Manager Plus may provide company name, business information, departments, organizational structure, locations, compliance frameworks, and internal contacts.

Audit and Compliance Data

As part of delivering our Services, organizations may create, upload, or manage information including audit plans, audit schedules, audit templates, custom checklists, audit responses, audit findings, audit observations, evidence files, photos and attachments, non-conformance (NC) records, corrective & preventive actions (CAPA), audit logs, dashboard metrics, PDF reports, Excel reports, comments and notes. This information remains the property of the customer organization.

Payment Information

Subscription payments are securely processed by Paddle, our Merchant of Record. Compliance Manager Plus does not store complete credit card or payment information. Payment processors may collect billing name, billing address, payment method, transaction information, tax information, and invoice details.

Cookies and Similar Technologies

We use cookies and similar technologies to maintain user sessions, authenticate users, remember preferences, improve performance, analyze website usage, and enhance user experience. More information is available in our Cookie Policy.

3. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Compliance Manager Plus platform.
• Manage user accounts and permissions.
• Plan and execute audit workflows.
• Store audit records and evidence.
• Generate dashboards and reports.
• Process subscriptions and billing.
• Deliver notifications and reminders.
• Respond to customer support requests.
• Improve platform functionality.
• Monitor system security.
• Detect fraud or unauthorized activity.
• Comply with legal and regulatory obligations.

We do not sell your personal or organizational information.

4. Legal Basis for Processing

Where required by applicable privacy laws, we process personal information based on one or more of the following legal grounds:

• Performance of a contractual agreement.
• Compliance with legal obligations.
• Legitimate business interests.
• Consent, where required by law.

5. Sharing of Information

We share information only when necessary to provide our Services or comply with legal obligations. Information may be shared with trusted service providers supporting cloud hosting, payment processing, email delivery, customer support, authentication services, security monitoring, and analytics. All service providers are required to protect customer information and use it only for authorized purposes. We do not sell customer data or share it for advertising purposes.

6. Data Storage and Security

Protecting customer information is fundamental to Compliance Manager Plus. We implement industry-standard security measures, including encryption of data in transit, end-to-end encryption where applicable, secure authentication, role-based access control, two-factor authentication (supported plans), single sign-on (supported plans), audit logs, secure cloud infrastructure, backup and recovery procedures, continuous security monitoring, and regular software updates. Although we take reasonable measures to protect information, no internet-based service can guarantee absolute security.

7. Data Retention

We retain information only for as long as necessary to provide the Services, fulfill contractual obligations, comply with legal requirements, resolve disputes, and enforce our agreements. When data is no longer required, it is securely deleted or anonymized where practical.

8. International Data Transfers

Depending on your location, your information may be processed or stored in countries other than your own. Where required, we implement appropriate safeguards to protect personal information during international transfers.

9. Your Rights

Depending on applicable law, you may have the right to access your personal information, correct inaccurate information, delete your personal information, restrict processing, object to processing, withdraw consent, request a copy of your data, request data portability, and lodge a complaint with a supervisory authority. Requests may be submitted using the contact information provided below.

10. Customer Responsibilities

Organizations using Compliance Manager Plus are responsible for ensuring they have appropriate rights to upload data, managing user permissions, protecting login credentials, complying with applicable privacy laws, and removing unnecessary personal information from uploaded documents where appropriate.

11. Children's Privacy

Compliance Manager Plus is intended for business and organizational use. Our Services are not directed toward individuals under the age of 18, and we do not knowingly collect personal information from children. If we become aware that such information has been collected, we will take appropriate steps to remove it.

12. Marketing Communications

We may send communications relating to account activity, security alerts, subscription updates, audit notifications, product enhancements, platform maintenance, customer support, and educational resources. You may opt out of marketing communications at any time; however, essential service-related communications will continue to be sent.

13. Third-Party Links

Our website or platform may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies before providing any personal information.

14. Security Incidents

If we become aware of a security incident affecting personal information, we will investigate promptly and, where required by law, notify affected customers and relevant authorities within applicable timeframes.

15. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our services, legal requirements, or business practices. When significant changes are made, we will update the "Last Updated" date and, where appropriate, notify customers through the platform or by email. Continued use of the Services after the updated Privacy Policy becomes effective constitutes acceptance of the revised policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at support@cmpmanager.com.

17. Data Controller

For the purposes of applicable data protection laws, Compliance Manager Plus acts as the data controller for personal information collected through our website and services, except where we process customer data on behalf of organizations using the platform. In those cases, the customer organization acts as the data controller, and Compliance Manager Plus acts as the data processor.