Privacy Policy & Data Governance

At FOMAX TECHNOLOGIES ("FOMAX", "we", "our", or "us"), we recognize the vital importance of protecting personal and institutional data. Whether you are a corporate client commissioning custom software, an educational institution deploying our School ERP, a retailer using FOMAX RMS, or a student enrolled in our Academy, your trust is foundational to our operations.

This Privacy Policy explains how we collect, process, encrypt, and safeguard information in compliance with Law No. 2010/012 of 21 December 2010 on Cybersecurity and Cybercrime in the Republic of Cameroon, alongside international best practices (such as GDPR principles).

Depending on your relationship with FOMAX, we collect and process the following categories of information:

• Direct Client & Lead Data: Name, professional email address, WhatsApp/phone number, organization name, project scope specifications, and billing details provided via our contact channels.
• Institutional & Student Records (Data Processor Role): Student names, matriculation numbers, grades, terminal assessments, parent phone numbers, and tuition balances processed strictly on behalf of client schools.
• Retail & Commercial Records: Product SKUs, inventory logs, cashier register shifts, and anonymous point-of-sale receipt codes.
• Technical & Server Logs: IP addresses, browser user agent, device operating system, request timestamps, and firewall intrusion logs used to ensure server stability.

FOMAX TECHNOLOGIES strictly processes your information for legitimate engineering and operational purposes:

• To design, develop, deploy, and maintain custom web applications, APIs, and database architectures.
• To automate academic operations (e.g., GCE report card generation, parent SMS result alerts, and tuition payment tracking).
• To fulfill our contractual warranty obligations and 1-year included technical support.
• To prevent security breaches, thwart malicious SQL injections, and protect server uptime.

For all e-commerce stores, tuition payment portals, and client invoicing, FOMAX integrates directly with telecom API endpoints (MTN MoMo API & Orange Money Webhook Engine).

• Zero PIN Storage: We never capture, transmit, or store user Mobile Money PINs or credit card CVV codes. All authorization occurs on the carrier's encrypted USSD gateway.
• Encrypted Webhooks: Payment confirmations use cryptographic HMAC-SHA256 signature verification to prevent spoofing or replay attacks.

When educational institutions commission FOMAX School ERPs, the school serves as the Data Controller and FOMAX operates as the Data Processor.

• Role-Based Access Control (RBAC): Teachers only view marks for assigned courses; parents can exclusively access report cards belonging to their verified children.
• Child Privacy Safeguards: In accordance with minor protection standards, student records are accessible solely to authorized school staff and legal guardians.

For retail chains and wholesalers running FOMAX RMS, every business operates on an isolated database schema or dedicated container. Your sales volume, supplier discount structures, and inventory profit margins remain completely sandboxed and inaccessible to competing stores.

To deliver high-availability cloud performance, FOMAX partners with select, enterprise-grade infrastructure providers:

• Cloudflare Inc.: Sub-second CDN edge distribution, SSL/TLS certificate management, and DDoS mitigation.
• Tier-3 Cloud Data Centers: VPS instances hosting production databases with 24/7 biometric physical security.
• Telecom Aggregators: MTN Cameroon and Orange Cameroun for Mobile Money payment processing and direct parent SMS notifications.

We retain project records, backup snapshots, and communications only as long as necessary to fulfill contractual agreements or satisfy legal accounting requirements (typically 5 years for tax invoices). Upon contract termination, clients can request a complete SQL database dump, followed by cryptographic wiping of staging copies within thirty (30) business days.

Our engineering team enforces defense-in-depth security standards across all production systems:

• AES-256 Encryption: Applied to stored passwords, API keys, and sensitive financial logs at rest.
• TLS 1.3 Transport Encryption: Mandatory HTTPS enforcement for every web app, eliminating eavesdropping risks.
• Bcrypt Salting: Passwords are never stored in plaintext; all credential hashes use salted bcrypt iteration.

Our websites and client portals utilize strictly necessary functional cookies and authentication tokens (e.g. PHP Session IDs, JWT Bearer tokens) to maintain user login states and secure shopping carts. We do not deploy third-party cross-site behavioral tracking beacons.

Under applicable data protection laws, you retain clear legal rights over your personal data:

• Right to Access: Request a copy of all personal records maintained about you in our systems.
• Right to Rectification: Request prompt correction of incomplete or erroneous contact details.
• Right to Erasure ("Right to be Forgotten"): Request deletion of personal records where legal retention mandates permit.

If you have inquiries regarding this Privacy Policy, wish to exercise your data subject rights, or require a formal Data Processing Agreement (DPA) for your enterprise, please contact our dedicated desk: