CMO Group

CMO Group

PDPA & Regional Data Protection

PDPA and regional data protection notices

This page explains how CMO Group processes personal data in connection with cmogroup.io and regional operations in Thailand, Malaysia, Vietnam, Namibia, and East Africa (Kenya, Uganda, Tanzania).

South Africa-specific notices are published separately: POPIA Privacy Notice and PAIA Manual.

Last updated: August 2026

Common website practices (all regions)

When you use this website or the “Contact Leadership” form, we typically process:

  • Name, email, company (optional), subject, and message
  • Technical metadata such as submission time and IP address (security / abuse prevention)
  • Essential cookies only (no advertising or analytics cookies)

Purposes: respond to enquiries, operate and secure the site, and meet legal duties. We do not sell personal data. Service providers (including cloud hosting and email delivery such as Amazon Web Services) may process data on our instructions.

Group contact: info@cmogroup.io Headquarters: CMO INTERNATIONAL, Fourth Floor, Ebene Mews, 57 Cybercity, Ebene 72201, Mauritius

---

Thailand — Personal Data Protection Act (PDPA)

CMO processes personal data in Thailand under the Personal Data Protection Act B.E. 2562 (2019) (PDPA) and related notifications.

Regional contact (Thailand)

Your rights (Thailand PDPA)

Subject to the Act, you may request access, copy, correction, erasure, restriction, objection, data portability (where applicable), and withdrawal of consent. You may lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand.

---

Malaysia — Personal Data Protection Act 2010 (PDPA)

For personal data processed in connection with Malaysian operations, CMO respects the Personal Data Protection Act 2010 and applicable regulations/codes.

Regional contact (Malaysia)

Your rights (Malaysia)

Subject to the Act, you may request access to and correction of your personal data, and withdraw consent where processing is based on consent. Complaints may be directed to the Personal Data Protection Commissioner / relevant Malaysian authority as updated by law.

---

Vietnam — personal data protection

CMO processes personal data in connection with Vietnamese operations in line with Decree 13/2023/ND-CP on personal data protection and related Vietnamese law.

Regional contact (Vietnam)

  • Entity: CMO Vietnam
  • Office: Ho Chi Minh City
  • Contact: Dr. Tran Thi Thuy Hoa, Country Managing Director
  • Email: hoa@cmogroup.io
  • Phone: +84 903 383 564
  • Data requests: info@cmogroup.io (subject “Vietnam data protection”) or hoa@cmogroup.io

Your rights (Vietnam)

Depending on the circumstances and applicable law, you may request to be informed about processing, access, correction, deletion, restriction, objection, and other rights provided under Decree 13/2023 and related instruments. You may complain to the competent Vietnamese authority.

---

Namibia

Namibia does not yet operate a single comprehensive statute equivalent to South Africa’s POPIA or Thailand’s PDPA in the same form. CMO Namibia still applies fair, lawful, and transparent handling of personal information collected via this website and regional operations.

Regional contact (Namibia)

We will update this section when a dedicated Namibian data-protection law and regulator process apply to our processing.

---

East Africa (Kenya, Uganda, Tanzania)

CMO East Africa operations (including Uganda and Tanzania coverage) handle personal data in line with applicable national laws, including where relevant:

  • Kenya — Data Protection Act, 2019 (Office of the Data Protection Commissioner)
  • Uganda — Data Protection and Privacy Act, 2019
  • Tanzania — Personal Data Protection Act, 2022

Regional contact (East Africa)

  • Entity: CMO East Africa
  • Coverage: Uganda and Tanzania (and related East Africa operations)
  • Contact: Andrew McEwan, Country Managing Director
  • Email: andrew@cmogroup.io
  • Phone: +27 83 676 5668
  • Data requests: info@cmogroup.io (subject “East Africa data protection”) or andrew@cmogroup.io

Your rights (East Africa)

Subject to each country’s Act, you may typically request access, correction, deletion, and objection, and lodge complaints with the relevant national data-protection authority or regulator.

---

Cross-border transfers

CMO is an international group. Personal data may be processed in Mauritius, the country of the relevant regional entity, South Africa, and other locations where we or our service providers operate (including cloud regions). We take reasonable steps appropriate to the applicable law to protect personal data transferred across borders.

Retention and security

We keep enquiry and related records only as long as needed to respond, manage the relationship, meet legal requirements, or resolve disputes, then delete or anonymise where practicable. We apply reasonable organisational and technical security measures; no method of transmission is completely secure.

Related notices

Changes

We may update this page from time to time. The “Last updated” date above will change when we do.

← Back to home