Your data in the portal
Pending publication review. This notice is used for the current pre-production portal. Live provider locations, transfer arrangements, legal bases and automated sales-eligibility safeguards must be verified before production publication.
Who we are
Levitask Limited, Unit 1411, 14/F, Cosco Tower, 183 Queen's Road Central, Sheung Wan, Hong Kong, operates the distributor portal and controls its portal, training, certification and security purposes. Privacy contact: Aku Korhonen at aku@levitask.com, or write to the address above marked “Privacy”. No Data Protection Officer is currently appointed.
Your distributor separately decides whom to invite and how to use team information for its staff-management purposes. Ask it for its employee privacy information. This notice covers Levitask's processing.
Information and sources
An authorised administrator provides invitation and organisation details. You provide registration, training, exam and request information. Google sign-in provides authentication identity details. The portal and service providers generate operational records.
- Account: name, email, user ID, organisation, job title where provided, role, status and authentication information.
- Training: progress, answers, attempts, scores, results and completion dates.
- Certificates: identity, ID/title, course, issue/expiry dates and status.
- Operations: invitations, account/access changes, acknowledgement records, relevant timestamps, service emails and delivery records, support and privacy requests.
Required identity and organisation information enables access; training and exam records enable assessment and certification. Without required information we may not be able to provide those functions. Optional fields are identified when requested. Do not submit sensitive information or identity documents in ordinary training fields.
Purposes and legal basis
Staff data is used only for access, training, certification, security and related service communications—not advertising, unrelated marketing or profiling, or external AI tools. Where GDPR applies, Levitask relies on legitimate interests for secure authorised access, product training and certification standards, necessary team-progress reporting, and operational security and support, subject to necessity and a balance against your rights. Specific legal duties provide a legal-obligation basis where applicable. An employer contract is not automatically a contract with you.
A notice acknowledgement is not consent. Any consent-based optional feature requires a separate choice and withdrawal route. Other applicable laws and automated-decision safeguards must also be satisfied.
Recipients and certificates
Authorised Levitask personnel access data needed for their duties. Your organisation's authorised administrators receive necessary account, training, assessment and certification information for their own team; other distributors are not authorised to access it. Google/Firebase supplies enabled authentication, database, hosting and related infrastructure. Resend supplies transactional email using necessary recipient, message and delivery data. Relevant data may go to advisers or authorities where justified or legally required.
Certificates last one year and are private by default. Users can see their own certificates, Distributor Admins can see their organisation's certificates, and authorised Levitask Admins have administrative access. Public certificate sharing and verification are not currently available. Account deactivation does not automatically revoke a certificate.
Exams and permission to sell
The system compares answers with Levitask's answer key and applies the published pass criteria to determine the result and certification. Pass the exam to become authorised to sell Levitask products. If you do not pass, you can retake it. Retaking is the ordinary failed-exam route. This does not waive rights concerning inaccurate data or automated decisions under applicable law; privacy requests go to aku@levitask.com.
Retention policy
Active-account data is kept only while needed. These are ordinary maximum periods for Levitask-controlled records, not mandatory minimums:
| Record | Retention |
|---|---|
| Profile, training and detailed exam records | 12 calendar months after deactivation; then delete or genuinely anonymise. |
| Minimum certificate evidence | Certificate expiry plus 12 calendar months. |
| Access and administrative audit logs | 12 calendar months from the event. |
| Privacy acknowledgement | While active, plus 12 months after deactivation. |
| Invitation operational records | 30 days after acceptance, expiry or revocation. Tokens become unusable on that event. |
| Minimum privacy-request case record | 12 months after closure; not the full export. |
| Temporary exports | Within seven days of creation, sooner if no longer needed. |
Deactivation blocks access; it is not deletion. A valid request or loss of need may require earlier deletion. A specific legal duty or dispute may require restricted preservation. Provider logs and backups follow verified service-specific cycles; residual copies must remain protected, and deletion instructions must be reapplied on restoration.
International processing
Levitask is established in Hong Kong. Firebase Authentication and Resend customer-data storage are currently understood to involve the United States; other service and administrator-access countries depend on configuration and remain subject to pre-production verification. Where a transfer is restricted, the required lawful arrangements must be in place before it occurs. Contact aku@levitask.com for relevant locations and a copy or explanation of the safeguards. Provider terms alone do not establish every transfer's lawfulness.
Requests, complaints and updates
You may request access or correction. Depending on applicable law, you may also request deletion, restriction or portability, object to legitimate-interest processing, withdraw consent where used, and exercise automated-decision rights. Conditions and exceptions apply. Email aku@levitask.com; no manager approval is needed. Identity checks must be proportionate.
Levitask responds within the applicable deadline and explains limitations or permitted extensions. Under EU GDPR the normal deadline is one calendar month, with any permitted extension explained within that month. You may complain to Hong Kong's Privacy Commissioner or another competent privacy authority and seek available legal remedies. Material changes to this notice will be communicated.