Privacy Notice

Levocell Privacy Notice

Last updated: October 2026

1. About This Privacy Notice

This Privacy Notice explains how Levocell Ltd ("Levocell", "we", "us" or "our") collects, uses, stores and protects personal information when you use our software applications, websites, platforms and related services (collectively, the "Services").

Our Services may include HR management, employee management, attendance and time management, task management, document management, inventory management, business operations and other workplace functionality.

This Privacy Notice applies to:

• customers who purchase or subscribe to our Services;
• administrators and authorised users of customer accounts;
• employees, workers, contractors and other individuals whose information is entered into the Services by a customer;
• visitors to our websites; and
• individuals who communicate with Levocell for support, sales or other business purposes.

2. Our Role Under Data Protection Law

Depending on how the Services are used, Levocell may act as either a data controller or a data processor.

Customer Data

Where a business customer uses Levocell to manage information about its employees, workers, contractors, customers or other individuals, the customer will generally determine why and how that information is processed.

In these circumstances, the customer will generally act as the data controller, and Levocell will generally act as a data processor processing information on the customer's documented instructions.

Our processing of customer data is governed by our Data Processing Agreement.

Levocell's Own Data

Levocell may act as a controller for information required to:

• create and manage customer accounts;
• administer subscriptions and contracts;
• process payments;
• provide customer support;
• communicate with customers;
• maintain platform security;
• prevent fraud and misuse;
• maintain technical and operational records;
• comply with legal and regulatory obligations; and
• improve the reliability, security and performance of our Services.

3. Information We May Collect

Depending on how the Services are configured and used, we may process:

Account Information

• name;
• business email address;
• work telephone number;
• job title;
• organisation;
• user ID;
• account and authentication information;
• role and permissions.

HR and Workforce Information

Where enabled by a customer, the platform may process:

• employee records;
• employment information;
• job information;
• working hours;
• attendance records;
• clock-in and clock-out information;
• leave and holiday records;
• performance or task information;
• training records;
• documents uploaded by authorised users;
• organisational information.

Customers are responsible for determining which information they choose to enter into the platform and for ensuring that they have an appropriate lawful basis for doing so.

Business and Operational Information

Depending on the Services used:

• tasks;
• projects;
• stock records;
• inventory information;
• warehouse movements;
• purchase and sales information;
• documents;
• operational records;
• asset information;
• internal communications.

Technical Information

We may automatically process limited technical information such as:

• IP address;
• device type;
• operating system;
• browser type;
• application version;
• login timestamps;
• authentication events;
• error and diagnostic information;
• security logs.

We use this information primarily to operate, secure and troubleshoot the Services.

4. Location Information

The Services do not use continuous background GPS tracking unless a specific feature has been enabled and clearly disclosed.

Where a customer enables location-based functionality, the relevant customer is responsible for ensuring that the processing is lawful, proportionate and appropriately communicated to affected individuals.

For example, a customer may configure attendance functionality that verifies that a user is within an approved workplace location.

Any such functionality should be used only for legitimate business purposes and in accordance with applicable data protection and employment laws.

5. Camera, Photos, Files and Documents

Some features may allow users to:

• scan inventory;
• upload documents;
• photograph business assets;
• upload evidence or records; or
• capture information required for operational processes.

The application will request permission before accessing relevant device functionality where required by the operating system.

Levocell does not access personal photos, contacts, microphone or camera functionality unless the relevant feature requires it and the user or administrator has enabled or authorised that functionality.

6. How We Use Information

We may use information to:

• provide and operate the Services;
• authenticate users;
• manage permissions;
• provide HR and workforce functionality;
• manage attendance and working-time records;
• manage inventory and business operations;
• provide customer support;
• maintain security;
• detect and prevent misuse;
• investigate technical problems;
• maintain audit records;
• communicate service updates;
• process subscriptions and payments;
• comply with legal obligations; and
• maintain and improve the Services.

We will not sell personal information to data brokers.

We do not use customer employee data for advertising.

7. Legal Bases

Depending on the circumstances, Levocell may rely on:

• performance of a contract;
• compliance with a legal obligation;
• legitimate interests;
• consent; or
• another lawful basis available under applicable data protection law.

Where Levocell processes personal information on behalf of a customer, the customer is responsible for determining the appropriate lawful basis for its processing.

8. Employee Monitoring and Attendance

Some Levocell functionality may allow customers to record attendance, working hours, task activity, access events or other workplace information.

Levocell provides these features as business tools. Customers remain responsible for deciding whether and how they use such functionality.

Customers must ensure that their use of monitoring functionality is lawful, proportionate, transparent and appropriately communicated to affected workers.

Levocell does not intend its platform to provide covert employee surveillance.

9. Special Category Data

The platform may technically allow customers to enter certain categories of sensitive information, depending on the functionality enabled.

Customers should not upload special category data unless the relevant feature specifically supports it and the customer has established an appropriate lawful basis and additional condition under applicable data protection law.

Where appropriate, customers should complete a Data Protection Impact Assessment before introducing higher-risk processing.

10. Data Sharing

Levocell may share information with:

• infrastructure providers;
• hosting providers;
• security providers;
• payment providers;
• authentication providers;
• communications providers;
• technical support providers;
• professional advisers;
• regulators or law enforcement where legally required.

Third-party providers are required to provide appropriate safeguards for information they process.

11. Sub-processors

Levocell may use carefully selected third-party service providers to operate the Services.

Examples may include providers used for:

• cloud infrastructure;
• hosting;
• security;
• authentication;
• application distribution;
• communications;
• monitoring;
• payment processing.

A current list of material sub-processors may be made available to customers through the Levocell website or customer portal.

12. International Transfers

Where personal information is transferred outside the United Kingdom, Levocell will implement appropriate safeguards required by applicable data protection law.

These may include adequacy regulations, appropriate contractual safeguards, or other lawful transfer mechanisms.

13. Security

Levocell implements appropriate technical and organisational security measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• destruction;
• alteration;
• disclosure; and
• other unlawful processing.

These measures may include access controls, authentication controls, encryption, logging, monitoring, secure development practices and regular security reviews.

14. Data Retention

Personal information will be retained only for as long as reasonably necessary for the purposes for which it was collected, contractual requirements, legitimate business requirements or applicable legal obligations.

Customer data is retained in accordance with the customer's configuration and the applicable customer agreement.

Following termination of a customer's subscription, customer data will be deleted or returned in accordance with the applicable Data Processing Agreement and contractual arrangements, subject to legal retention requirements and legitimate security backups.

15. Data Protection Rights

Depending on the circumstances, individuals may have rights including:

• access to their personal information;
• correction of inaccurate information;
• deletion;
• restriction of processing;
• objection to certain processing;
• data portability; and
• withdrawal of consent where processing relies on consent.

Where Levocell processes information on behalf of a customer, requests concerning that information should normally be directed to the relevant customer.

16. Security Incidents

If Levocell becomes aware of a personal data breach affecting customer data, we will assess the incident and notify the relevant customer in accordance with our contractual and legal obligations.

Customers remain responsible for determining whether they are required to notify the ICO or affected individuals.

17. Children's Information

The Services are business and workplace applications and are not intended for children.

Customers should not knowingly use the Services to collect children's information unless specifically agreed with Levocell, and appropriate safeguards are implemented.

18. Changes to This Notice

We may update this Privacy Notice periodically to reflect changes to our Services, technology, legal requirements, or business practices.

The latest version will be published through the relevant Levocell website or application.

19. Contact

For privacy and data protection enquiries:

Email: privacy@levocell.ai