Privacy Policy
This Privacy Policy explains how C-MORE SUSTAINABILITY, LDA. ("C-MORE", "we", "us") processes personal data in connection with the website https://thecmorecompany.com/ (the "Website") and the Due Diligence & Risk Intelligence Supply Chain Platform (the "Platform"). It is provided under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
1. Who we are
The controller is C-MORE SUSTAINABILITY, LDA., taxpayer and registration number 516143107, with registered office at Estrada EN 356, Rua Cidade de Ourém, Quinta da Abadia, 2435-057 Caxarias, Ourém, Portugal.
Data Protection Officer (DPO): dpo@cmore.pt, or by registered letter to the address above, marked "To the attention of the DPO".
Requests to exercise your rights: dpo@cmore.pt.
2. Our two roles — and why it matters to you
The Platform is used by companies (Suppliers) to upload documents about their organization and their workers, and by other companies (Clients) to assess those Suppliers. Depending on the activity, we act in different roles:
| Activity | Our role | Who to contact |
|---|---|---|
| Website, accounts and Users, billing, support, security, marketing, cookies | Controller | C-MORE (this Privacy Policy) |
| Qualification of Suppliers using our methodology | Controller | C-MORE (this Privacy Policy and our Qualification Privacy Notice) |
| Hosting the documents uploaded by Suppliers, extracting data with AI, and sharing it with the Clients chosen by the Supplier | Processor, acting on behalf of the Supplier | The Supplier is the controller. Please contact the Supplier (your employer or contracting company) |
| Use of information by a Client after it has accessed or downloaded it | The Client is an independent controller | The Client |
If you are a worker of a Supplier and you do not know who to contact, write to dpo@cmore.pt. We will answer the requests that concern our processing and forward the others to the Supplier concerned, in time for the legal deadline to be met.
3. What data we process, why, and on what legal basis
3.1 Website visitors
| Purpose | Data | Legal basis |
|---|---|---|
| Operating the Website and ensuring its security | IP address, browser and device data, pages visited, strictly necessary cookies | Our legitimate interest in providing a secure Website (Art. 6(1)(f) GDPR); strictly necessary cookies do not require consent (Art. 5(1) Law 41/2004) |
| Measuring Website audience | Online identifiers, browsing data | Your consent (Art. 6(1)(a) GDPR), given through the cookie banner |
| Measuring the effectiveness of our advertising on Meta (Facebook, Instagram) and LinkedIn, and building audiences for our campaigns | Online identifiers (cookies and pixel identifiers), pages visited, actions on the Website (e.g. sign-up started or completed), IP address, browser data, click identifiers | Your consent (Art. 6(1)(a) GDPR), given through the cookie banner. See section 6 and our Cookie Policy |
| Answering contact or demo requests | Name, email, telephone, company, function, message | Steps taken at your request before entering into a contract, or our legitimate interest in answering business enquiries (Art. 6(1)(b) or (f) GDPR) |
3.2 Users of the Platform (Suppliers' and Clients' representatives and staff)
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and managing accounts and Users, authentication (including multi-factor authentication), and managing the contract with the Account Holder | Name, professional email, telephone, company, function, credentials, authentication factors, account settings, acceptance records | Performance of the contract with the Account Holder and our and the Account Holder's legitimate interest in managing access by its staff (Art. 6(1)(b) and (f) GDPR). For sole traders: performance of the contract (Art. 6(1)(b)) |
| Billing, invoicing, tax and accounting | Billing contact, company and tax data, invoices, payment status (we do not store full card data) | Legal obligation (Art. 6(1)(c) GDPR) and performance of the contract |
| Security of the Platform, audit trails and fraud prevention, including logs of access, sharing, downloads and Qualifications | User identifiers, IP address, device and browser data, date and time, actions performed | Our legitimate interest in protecting the Platform, the data of our customers and their workers, and in being able to demonstrate what happened (Art. 6(1)(f) GDPR) |
| Error monitoring and technical stability (Sentry) | Technical error data; the tool is configured to minimise personal data (IP addresses are not stored and form inputs, document contents and request bodies are not sent | Our legitimate interest in detecting and fixing errors (Art. 6(1)(f) GDPR) |
| Technical support | Name, contact data, content of the request, related technical data | Performance of the contract and our legitimate interest (Art. 6(1)(b) and (f) GDPR) |
| Service communications (security notices, renewal reminders, changes to the Terms) | Name, professional email | Performance of the contract and legal obligation |
| Marketing communications about C-MORE products and events | Name, professional email, company, function, interaction with our emails | Your consent, or, if you are a contact of an existing customer, our legitimate interest in communicating about similar products, with a right to object in every message (Art. 6(1)(a) or (f) GDPR; Art. 13-A Law 41/2004) |
| Handling Qualification contestations, complaints and legal claims | Content of the contestation or complaint, supporting documents, correspondence | Our legitimate interest in defending our methodology and our rights (Art. 6(1)(f) GDPR) |
3.3 Qualification of Suppliers
We issue a Qualification for each Supplier by applying pre-defined, documented rules to the information the Supplier provides. Information about workers is used only as aggregated indicators per Supplier (for example, the percentage of workers with valid mandatory training); we do not score or qualify individual workers. Health data and criminal record data are never used in the Qualification. The legal basis is our legitimate interest, and the legitimate interest of Clients, in assessing suppliers to comply with third-party management and occupational health and safety obligations (Art. 6(1)(f) GDPR). Where the Supplier is a sole trader, the Qualification relates to that person directly.
3.4 Artificial intelligence
- Extraction. On behalf of Suppliers, we use an AI system, built on a general-purpose AI model provided by a third party, to read uploaded documents and extract information (for example, document type, holder name, issuer and expiry date). The Supplier reviews and confirms the extracted data before it is used or shared.
- No training on your personal data. We do not use personal data from uploaded documents to train or improve our AI system, and our AI model provider is contractually prohibited from using them to train or improve its own models and from retaining them beyond the technical processing of each request.
- Anonymised data. On the instructions of our customers, we create anonymised data from the use of the Platform (data that no longer relates to an identified or identifiable person), which we use to improve the Platform, the AI system and our methodology. Anonymised data is not personal data.
- No solely automated decisions. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Every negative Qualification result is validated by a person, and Suppliers can contest results.
4. Where your data comes from
We collect data directly from you (when you visit the Website, register, use the Platform or contact us), from the Account Holder that invites you as a User, and, in the case of workers of Suppliers, from the Supplier that uploads documents. Advertising measurement data is collected through the Meta Pixel and the LinkedIn Insight Tag when you have given your consent.
5. Who we share your data with
We share personal data only with:
- Our service providers (processors), under contracts that comply with Article 28 GDPR: Amazon Web Services EMEA SARL (cloud hosting, EU — Spain; AI model providers (document extraction, EU processing, no training, no retention); Functional Software, Inc. trading as Sentry (error monitoring, EU data region). The up-to-date list of the providers that process data on behalf of our customers is in Appendix 3 to Annex II of our Terms of Service.
- Payment service provider (Stripe Payments Europe, Limited) which processes card payments as an independent controller under its own privacy policy.
- Meta Platforms Ireland Limited and LinkedIn Ireland Unlimited Company, for advertising measurement, only if you consent to marketing cookies (see section 6).
- Clients, in the case of information about Suppliers and their workers, only when and to the extent that the Supplier decides to share it.
- Professional advisers, auditors, insurers and certification bodies, under confidentiality obligations.
- Public authorities and courts, where required by law or to establish, exercise or defend legal claims.
- A buyer or successor of all or part of our business, subject to equivalent protection of your data.
We do not sell personal data.
6. Advertising measurement with Meta and LinkedIn
If you accept marketing cookies on our Website, we use the Meta Pixel and the LinkedIn Insight Tag to measure the effectiveness of our advertising, to understand which campaigns lead to sign-ups, and to show our advertising to relevant audiences on Meta's and LinkedIn's services. These tools are used only on the public pages of our Website and the sign-up flow, and never inside the authenticated areas of the Platform where documents and worker data are processed.
- Joint controllership. For the collection of data through these tools on our Website and its transmission to Meta and LinkedIn, C-MORE is a joint controller with Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) and with LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland), respectively.
- Subsequent processing. After receiving the data, Meta and LinkedIn process it as independent controllers, under their own privacy policies available in their websites including to provide and improve their advertising services. If you are logged into Facebook, Instagram or LinkedIn, they may link this data to your account.
- International transfers. Meta and LinkedIn may transfer the data to their group companies in the United States (Meta Platforms, Inc. and LinkedIn Corporation). Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, for which those companies are certified, and/or on Standard Contractual Clauses.
- Withdrawing consent. You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
7. International transfers
We host the Platform in the European Union. Personal data is transferred outside the European Economic Area only: (i) to Meta and LinkedIn, as described in section 6; (ii) where a service provider or its group company located outside the EEA has remote access for support or security purposes, under the EU-US Data Privacy Framework or Standard Contractual Clauses; and (iii) where a Supplier decides to share information with a Client located outside the EEA, under Standard Contractual Clauses between the Supplier and the Client. You may request a copy of the relevant safeguards by writing to dpo@cmore.pt.
8. How long we keep your data
| Data | Retention period |
|---|---|
| Account and User data | For the duration of the contract with the Account Holder; deleted 30 days after the User is removed or the contract ends, unless needed for the purposes below |
| Invitations and temporary credentials not activated | 30 days from creation |
| Billing and accounting records | 10 years, as required by Portuguese tax law |
| Security logs, access logs and download logs | 24 months from the event |
| Qualification history (rules applied, data used, date, validating person) | 5 years from the date of each Qualification |
| Contestations, complaints and related correspondence | 5 years after closure, or until the end of any legal proceedings |
| Error monitoring data (Sentry) | 90 days |
| Contact and demo requests | 2 years from the last interaction, unless a contract is entered into |
| Marketing contacts | Until you withdraw consent or object, or 3 years after the last interaction |
| Consent records (including cookie consent) | For the duration of the consent and 5 years thereafter, to demonstrate compliance |
| Cookies | As set out in the Cookie Policy |
| Documents uploaded by Suppliers (processed on their behalf) | As configured by the Supplier; by default, 90 days after a document expires, 30 days after a worker is removed and 30 days after the end of the subscription |
9. Your rights
Subject to the conditions set out in the law, you have the right to: access your personal data; rectify inaccurate data; erase data; restrict processing; data portability; object to processing based on our legitimate interest, including the Qualification, on grounds relating to your particular situation, and at any time to direct marketing; and withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.
To exercise your rights, write to dpo@cmore.pt. We will answer within one month, which may be extended by two further months in complex cases, in which case we will inform you. We may ask you to confirm your identity.
You have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or with the supervisory authority of your place of residence or work.
10. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, tenant isolation, multi-factor authentication, malware scanning of uploaded files, access logging and monitoring, and regular security testing. Our information security management system is certified under ISO/IEC 27001.
11. Children
The Website and the Platform are intended for professional use and are not directed at persons under 18.
12. Changes to this Privacy Policy
We may update this Privacy Policy. We will publish the new version on the Website and, where changes are significant, inform Users by email or in the Platform. Where a change requires your consent, we will ask for it again.
Previous versions are available on request.