Privacy Policy

This policy explains how Cambodian Network Exchange (CNX) handles personal information when people visit our website, communicate with us, or use a CNX system or service.

Last updated: 13 October 2026

Scope

This policy applies to the CNX public website and documentation, business and support communications, customer and supplier administration, and people authorised to use CNX portals, dashboards, repositories, APIs, support systems, or other managed services.

CNX provides infrastructure services primarily to organisations. An individual normally uses a CNX system because a customer, member, supplier, or partner has authorised that person to act on its behalf.

Relationship with signed agreements

This is a general policy covering practices shared across CNX services. A signed customer or connection agreement, order form, service schedule, data-handling schedule, or other written agreement may contain more specific terms for a service. Those terms may define the information processed, its storage location, authorised access, retention period, reports provided to the customer, and its treatment when the service ends.

The signed terms govern the relevant service where they differ from this policy, subject to applicable Cambodian law. This policy does not create a service-level, data-residency, or fixed-retention commitment unless it states one expressly.

Information CNX records

The information recorded depends on the relationship and service.

Contact and account information

CNX may retain a person's name, organisation, role, business contact details, username, account identifier, assigned permissions, and account status. A customer may provide this information when it nominates authorised contacts or requests access for its personnel.

Authentication and activity information

When a person connects to a protected system, CNX may record the account or identity used, authentication result, date and time, IP or network address, client or device information, session information, and relevant security events.

CNX may also record actions performed through an account, including administrative operations, approvals, configuration changes, repository activity, API requests, certificate requests, downloads, and support actions. These records establish who performed an action, when it occurred, and its result.

Where a customer uses its own identity provider, CNX may rely on the identity, role, and authentication information supplied by that system. CNX does not need the password used with the customer's identity provider. Users must not send passwords, private keys, recovery codes, or active access tokens to CNX by ordinary email or support ticket.

Service and operational information

CNX may process customer configurations, network identifiers, system and service logs, operational metrics, alerts, health checks, security events, audit reports, incident records, and service telemetry. Depending on the contracted service, this may include routing, DNS, certificate, traffic, query, or application information.

Some service information may identify a user or another person directly or when combined with other records. The applicable agreement and service documentation define the information and evidence provided by a particular service.

CNX does not acquire ownership of customer content, configurations, logs, or telemetry merely because CNX stores or processes them to provide a service.

Communications and commercial records

CNX retains information supplied in enquiries, support requests, incident reports, meetings, and correspondence. For customers, members, suppliers, and partners, CNX may also retain authorised contacts, service orders, contracts, connection details, invoices, payment status, and records of notices or approvals.

Public website records

The public website does not provide user accounts. Its server may record standard request information such as an IP address, timestamp, requested page, browser information, response code, and security event.

How CNX uses information

CNX uses personal information where reasonably necessary to:

• establish and administer accounts, contacts, roles, and access permissions;
• authenticate users and authorised systems;
• provide, operate, monitor, support, maintain, and bill for services;
• execute and record requested changes, approvals, and service operations;
• provide the relevant customer with dashboards, reports, alerts, telemetry, and audit evidence;
• respond to enquiries, faults, incidents, and complaints;
• protect customers, users, CNX, and its infrastructure against error, misuse, fraud, and attack;
• maintain an accurate operational and security history;
• enforce signed agreements and access restrictions;
• meet legal, regulatory, licensing, tax, accounting, and contractual obligations; and
• establish, exercise, or defend legal rights.

CNX does not sell or rent personal information. CNX does not use website or service-user information for behavioural advertising.

Customer authority and user accounts

The customer decides who it authorises to use its services and is responsible for keeping its authorised-user and contact information current. The customer must ask CNX to change or revoke access when a person's role or authority changes.

A customer's authorised administrators may manage its accounts and permissions and may receive account, security, operational, or audit information relating to its users. Where information is held for a customer, CNX may refer an individual request to that customer's authorised administrator.

Disabling an account prevents future use but does not erase the account's past actions. Authentication, approval, configuration, security, billing, and audit records may remain attributable to the person who performed the action. This is necessary to preserve the integrity of the service record and meet the relevant agreement.

Where a customer supplies information about its own personnel, users, subscribers, or other individuals, the customer remains responsible for its relationship with those people and for its authority to provide the information to CNX. CNX handles that information to provide and secure the service, follow authorised customer instructions, meet the signed agreement, and comply with law.

Disclosure

CNX may disclose information only as reasonably necessary:

• to the customer organisation and its authorised administrators or contacts;
• to CNX personnel and contractors who require it for their assigned duties;
• to a hosting, communications, payment, professional, security, or other supplier supporting the relevant activity;
• to another provider at the customer's authorised direction;
• to protect the security, rights, or property of CNX, a customer, a user, or another person; or
• when required or authorised by Cambodian law, a court, a regulator, law enforcement, or another competent authority.

CNX limits information disclosed to a supplier to what is reasonably necessary for the relevant task. CNX does not disclose one customer's non-public service information to another customer unless the customers concerned direct the disclosure or the law requires it.

The storage and processing location promised for a contracted service is stated in its signed agreement or service documentation. Business communications, public-website resources, supplier systems, or customer-directed integrations may use providers outside Cambodia unless the relevant agreement states otherwise.

Security

CNX uses administrative, technical, and physical safeguards that are reasonable for the nature of the information and the risks involved. These include restricting access according to role and operational need, authenticating users and systems, monitoring service and security events, controlling changes, and maintaining records required to investigate faults and incidents.

Users are responsible for protecting their credentials and devices, using only the access assigned to them, and reporting suspected compromise promptly. No transmission or storage system is completely secure, and CNX cannot promise absolute security.

CNX handles suspected security incidents under its operational procedures, applicable Cambodian law, and the notification and cooperation requirements in the relevant signed agreement.

Retention

CNX retains information for the period needed to provide and account for the service and for any additional period required by applicable Cambodian law or the signed agreement. Different services and record types have different operational, security, contractual, and audit requirements, so this policy does not assign one retention period to every record.

In particular:

• account and permission information is retained while needed to administer access and may remain afterward where necessary to interpret retained records;
• authentication, approval, configuration, security, and audit records may remain after an account is disabled or a service ends;
• service configurations, logs, reports, and telemetry are retained according to the applicable agreement, service documentation, and CNX operational schedule;
• support and incident records may be retained for service history, security investigation, accountability, and dispute resolution;
• contracts, orders, invoices, notices, and accounting records are retained for the relationship and any further period required for legal, tax, accounting, audit, or dispute purposes; and
• information may be retained longer when subject to a lawful order, legal hold, active security investigation, unresolved dispute, or outstanding contractual obligation.

Backups retain information until the applicable backup cycle expires. Backed-up information is protected from routine use and may remain after deletion from an active system.

When a service ends, CNX returns, exports, deletes, anonymises, or places information beyond routine use as required by the signed agreement. Termination of a service or account does not require CNX to destroy records that it must retain under that agreement, for security and audit integrity, or under law.

Cookies and external website resources

CNX does not use advertising trackers or audience-analytics tools on the public website, and the CNX public-site code does not set cookies.

An authenticated CNX system may use a session cookie, security token, or similar browser storage where technically necessary to sign a user in, maintain a session, or prevent misuse. These mechanisms operate and secure the system; they are not used for advertising.

Some public-website stylesheets and scripts are delivered through external content-delivery services. A visitor's browser sends those providers the technical request information needed to deliver the file, ordinarily including the IP address, requested file, and browser request headers.

Requests and corrections

A person may ask CNX whether it holds personal information about them or ask CNX to correct inaccurate contact or account information. CNX may require evidence of identity and authority before acting.

An individual may also ask CNX to delete information that is no longer required. CNX may decline or limit the request where the information is held for a customer, is required to provide or secure a service, forms part of an audit or contractual record, must be retained by law or agreement, affects another person's rights, or is needed for a legal claim.

A person may ask CNX to stop sending non-essential commercial messages. Service, security, billing, operational, and contractual notices are not marketing and may still be sent to the relevant authorised contacts.

Changes and contact

CNX may update this policy when its services, practices, agreements, or Cambodian law change. The date above identifies the latest revision. A material change applies from the date the revised policy is published unless the applicable customer agreement states otherwise.

For a privacy question or request, email info@cnx.net.kh with the subject Privacy request, or write to:

Cambodian Network Exchange
Connexion Building, Second Floor C-24
Koh Pich, Sangkat Tonle Bassac, Khan Chamkarmon
Phnom Penh 120101
Cambodia

This policy and CNX's handling of personal information are governed by the laws of the Kingdom of Cambodia.