Confidentiality & Data Handling Policy

This policy applies to every piece of information the program collects about a farmer or business that registers interest, applies, or is certified, and about the people who own or operate it. It covers the period from first registration, through any application and the life of certification, and through the retention period after certification ends.

It binds The Farmer-Owned Project (the "Standard Owner"), the acting Certification Body, any successor Certification Body under the Master Services Agreement, and every Standards Council member, reviewer, contractor, or service provider who handles program information. It applies everywhere the program operates, because the program is jurisdiction-neutral and certifies businesses in any country, including countries with their own data protection laws.

Information collected from visitors, subscribers, and contributors through this website is covered by our Privacy Policy. Where information about a registrant or applicant is involved, the stricter of the two policies applies.

The program collects only what it needs to verify farmer ownership and control, and to administer certification. It does not collect information about ingredients, recipes, sourcing, or growing practices, because the program does not certify those things. The categories are:

• Registration information (collected on this website): business and brand name, contact name, email, phone, country or region, and a short description of what the business produces, along with a record of the policies agreed to and when. This is a first step only. It is not an application and contains no ownership documents.
• Business and entity information, such as legal name, entity type, country of operation, and contact details.
• Ownership and control documentation, such as capitalization summaries, operating or shareholder agreements, cooperative bylaws, and member rolls.
• Active Farmer evidence, such as agricultural income filings, farm or holding registration, or land and production records, which may include personal information about an individual farmer-owner.
• The signed Applicant Declaration.
• Product (SKU) and brand information used solely to confirm trademark scope.
• Records created by the Certification Body during review, including reviewer notes, structured-interview records, decision files, and related correspondence.
• Records created during ongoing compliance, including annual attestations, material-change reports, and spot-audit and re-audit files.

Ownership, financial, and farmer-evidence documents are submitted to the Certification Body through its own secure intake, not through this website.

The program is built on a public claim, so a limited set of information is intended to be public. Everything else is confidential.

Public. Public information is limited to a certified entity's name, brand, certification status, certification date, and mark usage rights. The program may publish a directory of currently certified entities, consistent with how peer certification programs publish a directory without exposing the underlying application file. Whether a specific decision was Conditionally Approved, Deferred, or Denied is never published. A business that has only registered interest, or is still in review, is not listed publicly unless it has agreed in writing to be, for example as part of the founding cohort.

Confidential. Everything else is confidential, including every ownership document, financial document, piece of personal information about an individual farmer-owner, structured-interview note, decision file, and internal reviewer's reasoning. Confidential information is never published, sold, or used for marketing without the entity's separate written consent.

Information is used only to follow up on a registration; to decide, maintain, and administer certification; to run the desk audit; to confirm continued eligibility through annual attestations, material-change review, spot audits, and triennial re-audits; to administer appeals; and to support the Standards Council's oversight of the Standard. It is never used to evaluate ingredients, sourcing, or growing practices. Neither the Standard Owner nor the approved Certification Body sells applicant or certified-entity information, and neither uses it for any purpose beyond operating the program.

Access is limited to people who need it to do their job:

• Standard Owner staff who handle registrations and program administration, limited to registration information.
• Certification Body reviewers assigned to a specific application or file, per the Audit Protocol.
• A small number of Certification Body and Standard Owner staff responsible for program administration, appeals, and quality oversight.
• Standards Council members, only where a specific case is escalated to the Standards Council for a Standard-interpretation question, and only to the extent needed to resolve it. Escalations are shared with identifying details minimized wherever possible.
• A successor Certification Body, only upon a transfer under the Master Services Agreement, and only for the files that are transferring.
• Regulators, courts, or the applicant's own legal counsel, only as described in Section 14.

No certified brand, competitor, buyer, licensor, or member of the public is ever given access to another entity's confidential file. A buyer cannot use a supplier's certification file to make sourcing or ingredient decisions, consistent with the program's ownership-only claim.

When you register interest on this website, you are asked to consent to the Standard Owner sharing what you submitted with the Certification Body so the full application can begin. We share only what is needed for that purpose, under a written agreement that holds the Certification Body to this policy. You can withdraw your consent by writing to us, and we will stop sharing and remove your registration, to the extent it has not already been passed on for intake.

Everyone who handles program information, whether an employee, contractor, reviewer, or Standards Council member, signs a written confidentiality commitment before receiving access, and that commitment survives after the person's role ends. This mirrors the confidentiality obligations that international certification-body standards, such as ISO/IEC 17065, place on accredited Certification Bodys. Reviewers discuss a file only with colleagues who need it to complete the review, and program information is never stored on personal devices or transmitted through personal email accounts.

Because the program certifies businesses in any country, information routinely crosses borders between an applicant's home country and the systems of the Standard Owner and Certification Body in the United States. Where an applicant is in a jurisdiction with its own data protection law, for example the European Union or United Kingdom's GDPR, the program handles that applicant's personal information under the safeguards that law requires for the transfer, and the applicant may use Section 11 to exercise the rights that law provides. The program never asks an applicant for more personal information than a jurisdiction-equivalent applicant would provide under Section 5 of the Certification Standard.

The program protects information using layered safeguards appropriate to its sensitivity: access controls that limit files to authorized people, multi-factor authentication on the systems that hold program data, encryption of stored and transmitted files, and separation of the Standard Owner's systems from the Certification Body's case files. Vendors that host program data are chosen and reviewed under Section 13, and must meet security commitments at least as strong as this policy.

The program keeps information only as long as it is needed. The figures below are recommended starting points for legal review and Standards Council ratification:

• Registrations that do not become applications: kept until you ask for deletion, or deleted 24 months after the last contact, whichever is first.
• Approved applications and ongoing certification files: retained for the life of certification plus 7 years after certification ends, to support appeals, audits, and legal defense of the mark.
• Denied applications: retained for 3 years after the decision, then deleted, unless the applicant reapplies sooner.
• Withdrawn or abandoned applications: retained for 2 years, then deleted.
• Structured-interview notes and internal reviewer reasoning: retained on the same schedule as the file they support.

An entity may request earlier deletion of its information once it is no longer needed for an open appeal, audit, or legal requirement, using the process in Section 11.

An applicant or certified entity may ask the program to confirm what information it holds about the entity, correct information that is inaccurate, or delete information once it is no longer needed under the retention schedule in Section 10. Requests go to info@farmerownedproject.org, and the program responds within 30 days. These rights are offered to every registrant, applicant, and certified entity worldwide, not only where a local law requires it, because it reflects how the program wants to be trusted.

If the Certification Body ever changes, an entity's certification history should not be lost, and the entity should never have to start over. Consistent with Section 6 of the Master Services Agreement, on the Standard Owner's request or on termination of that Agreement, the outgoing Certification Body makes each certified entity's decision file available to the Standard Owner or to the designated successor Certification Body, in a usable format, so certification can continue without a fresh application. This mirrors the Certification Body-transfer principle used in established certification schemes.

Where the program uses outside vendors, for example cloud storage, contact-management, or case-management software, the vendor is chosen only after confirming it can meet this policy's confidentiality and security commitments, and the vendor is bound by a written confidentiality and data-processing agreement or terms that achieve the same result. Vendors are never permitted to use program data for their own purposes. A current list of the vendors that handle registration information is in the Privacy Policy.

If confidential information is exposed without authorization, the party that discovers it investigates promptly, contains the exposure, and notifies the Standard Owner without undue delay, and in any event within 72 hours of discovery. Affected applicants or certified entities, and any regulator, are notified as required by applicable law, and in any event as soon as reasonably possible once the scope of the exposure is understood.

If a regulator, court, or other legal process requires disclosure of confidential information, the program discloses only what is legally required and, unless the law forbids it, tells the affected entity first so it can respond.

This policy may be updated as the program develops and as the Standards Council is seated. The version date on this page shows the current version, and registrants and certified entities will be told of material changes.