Privacy

When a farmer joins a cluster we record their name, their father or husband's name, village, cluster, mobile number and — where they choose to give it — their CNIC. We record their farms: land area, ownership, water source, soil, elevation and the farm's location. As they work we record crops, trees, livestock, diary entries, the organic practices they carry out and the photographs that evidence them.

A farmer can be registered without a CNIC or a mobile number. Neither blocks registration; both can be added later by their Cluster Leader.

Nothing below ever appears on this website, in a marketplace listing, in an eco-tourism listing, or in any response this site's public pages return:

• CNIC numbers
• Private phone numbers
• Home addresses
• Exact farm coordinates
• Income, payments and any financial data
• Any farmer's record without their consent

A published product or farm experience shows the produce, the cluster, the village it comes from, and the farmer's first name and photograph only where that farmer has consented. Consent is off until a farmer turns it on.

A farmer sees their own record and no one else's — there is no farmer directory, no leaderboard, and no way to compare one farmer's income with another's. A Cluster Leader sees only farmers in the cluster they are assigned to. That boundary is enforced on the server, so it cannot be crossed by a search, an export or a hand-typed web address.

Every photograph is stored with the farm it belongs to, the date it was taken, where it was taken and the task or diary entry it evidences. That is what lets a Cluster Leader judge a piece of evidence, and what makes a certification file hold up years later.

Farmers can hide a photograph from their own gallery. It is not deleted: COM and the Cluster Leader keep the record, because evidence that can be removed after the fact is not evidence.

Every change to a record is written to an audit log with who made it, when, and the old and new values. Reads of sensitive fields — CNIC, phone, address, location — are logged too, including when a COM administrator makes them. Administrators have full access and every use of it leaves a trace.

The log is read-only. There is no way to edit or delete an entry, including for us.

Farm records are kept for as long as the farmer is part of the programme and afterwards for as long as certification and reporting require. History is never rewritten: a mistake is corrected by adding a correcting entry, not by editing the original.

You can ask what we hold about you, ask for it to be corrected, or withdraw consent for your name and photograph to appear publicly, at any time. Ask your Cluster Leader, or write to privacy@chitralorganic.org.

Withdrawing public consent removes your name and photograph from listings. It does not remove your farm records, which the programme needs in order to stand behind the certification already issued.