Privacy policy

1. Who are we?

Levia (“we”, “our service”) is a multi-tenant HR management SaaS published from Tunis, targeting the Maghreb (Tunisia, Algeria, Morocco, Libya) and France. The data controller within the meaning of GDPR is Levia SAS (corporate name to be confirmed at registration), registered office in Tunis, Tunisia.

GDPR contact: legal@leviahr.com · External DPO: legal@leviahr.com.

2. What data do we collect?

2.1 Data provided by the client organization

When an organization subscribes to Levia, it shares with us about its employees:

• Identity: last name, first name, email, phone, date of birth, profile photo (optional), ID number/passport.
• Professional profile: position, department, manager, start date, contract type.
• Payroll: base salary, IBAN, BIC, social security number, number of dependents, allowances, deductions. IBAN, BIC and ID number are encrypted in the database via AES-256-GCM.
• Time tracking: clock-in/clock-out timestamps, geolocation (only with employee consent), selfies (only if enabled by admin), biometric references (not templates, see §6).
• Leave and absences: types, dates, reasons (optional), medical certificates encrypted at the application level (GDPR Art. 9 · health data).
• Performance and training: objectives, KRs, reviews, declared skills, training enrollments.

2.2 Data provided by prospects (contact form)

If you fill out a form on our marketing site, we collect: name, business email, phone (optional), company (optional), estimated headcount, current solution, free-form message, conversion source. See §10 for lead retention.

2.3 Technical data (logs and cookies)

• Server logs: IP address, user-agent, visited pages, timestamps · retained 90 days for attack detection and debugging.
• Session cookies: an encrypted authentication cookie (Better-Auth) to maintain the connection. Strictly necessary · no banner required (CNIL).
• Language cookie (levia-locale): saves your FR/AR/EN choice. Duration 1 year. Non-sensitive.
• No third-party tracking cookies (Google Analytics, Meta Pixel, etc.) · see cookies policy.
• Origin of sensitive actions: for each action by a signed-in user that changes data, the organization's audit log keeps the truncated IP address (last octet masked), the device family (for example “Chrome on Windows”) and a session reference. This information is used to attribute an action in the event of a security incident · it is kept for the retention period of the organization's audit log.

3. Why do we process this data?

GDPR Art. 6 legal basis:

• Contract performance (Art. 6.1.b): provide the Levia service subscribed by the organization. Most processing falls under this basis.
• Legal obligation (Art. 6.1.c): generation of payslips, CNSS/DSN declarations, retention of employment contracts.
• Legitimate interest (Art. 6.1.f): service security, fraud prevention (time tracking anti-fraud), anonymized product improvement.
• Explicit consent (Art. 6.1.a + Art. 9): biometric data, health data (sick leave, medical certificates), employee geolocation.

4. Who has access to your data?

• The employee: their own data via their space.
• Their direct manager: data needed for management (attendance, leave, performance).
• HR/ORG administrators of their organization: full access to the organization's HR data.
• The Levia team: strictly limited access for support engineers, on explicit client request (access procedure via signed ticket). All accesses are audited.
• Subprocessors: see §5.

Data is never sold, rented or shared with third parties for commercial purposes.

5. Subprocessors (GDPR Art. 28)

All subprocessors have signed a Data Processing Agreement with Levia in accordance with Article 28 of GDPR. The nominative list of our subprocessors is provided to client organisations on request at legal@leviahr.com.

6. Biometric data (GDPR Art. 9)

Levia distinguishes two uses. For biometric time clocks (ZKTeco, Suprema, Hikvision, etc.), no template is stored at Levia: it stays in the client's device.

For these time clocks, Levia only stores:

• A reference "employee X is enrolled on device Y" to link clock-ins
• The clock-in timestamp
• The written consent signed by the employee (PDF in encrypted storage)

Before any biometric enrollment, the client must have the employee sign an explicit consent form (automatically generated by Levia). For Tunisia, a declaration to INPDP is recommended beyond 100 enrolled employees.

In-app face verification (off by default): if the organisation turns it on and the employee consents themselves, Levia keeps a face template as an encrypted numeric vector, never the photo. The comparison happens in the employee's browser, no face is sent to a third-party service, withdrawing consent erases the template, and this check never blocks a clock-in.

7. Health data (GDPR Art. 9)

Medical certificates uploaded by employees (sick leave) are stored encrypted and accessible only to:

• The employee
• Their direct manager (for leave validation)
• HR_ADMIN and ORG_ADMIN of their organization

HTTP cache: private, no-store · never cached by an intermediate proxy.

8. Your rights (GDPR Art. 15-22 + local laws)

• Right of access: copy of your data in a structured format (CSV, JSON).
• Right of rectification: correction of inaccurate data (accessible directly in /settings/profile).
• Right to erasure (Art. 17): self-service workflow at /settings/account/delete. Your direct personal data (name, email, phone, IBAN, national ID, etc.) is anonymized immediately and all your sessions are invalidated. You have a 7-day window to revoke the request. Final permanent erasure occurs at D+90 (ghost-member pattern). Fiscal exception: your payslips remain archived with no identifiable link for the legal retention period (TN 10 years Commercial Code / FR 6 years Commercial Code L123-22).
• Right to portability: full export in CSV/JSON format within 30 days.
• Right to object: marketing, profiling. Unsubscribe in one click.
• Right to restriction of processing: possible in case of dispute.

To exercise these rights: legal@leviahr.com. Reply within 30 days as per Art. 12 GDPR.

You may lodge a complaint with:

• 🇹🇳 INPDP (Tunisia): inpdp.nat.tn
• 🇫🇷 CNIL (France): cnil.fr
• 🇲🇦 CNDP (Morocco): cndp.ma
• 🇩🇿 ANPDP (Algeria): authority being structured (law 18-07 of June 10, 2018)

9. Security

• Encryption at-rest: encrypted disks (Supabase, R2). Sensitive fields additionally encrypted at the application level via AES-256-GCM.
• Encryption in-transit: TLS 1.2+ required on all routes. HSTS enabled.
• MFA: required for HR_ADMIN, PAYROLL_ADMIN, ORG_ADMIN, Platform Owner roles. TOTP via Google Authenticator/Microsoft Authenticator.
• Audit log: every sensitive action (payroll validation, IBAN modification, biometric access) is logged with automatic masking of encrypted data in payloads.
• Penetration testing: annual (starting 2026, by external firm).
• Secret rotation: application encryption keys rotated annually with data migration.
• Backups: daily, retained 30 days. Restorable within 4 hours.

10. Retention periods

11. International transfers

All data is hosted in the European Union (Paris, Frankfurt, Dublin). Some of our subprocessors are companies incorporated under US law; any transfers are governed by standard contractual clauses and documented in our processing register.

Exception: if you are based outside Europe and use the AI assistant, requests transit through our AI provider's European infrastructure (Frankfurt region). It does not reuse client data to train its models (contractual clause).

12. Minors

Levia is not intended for minors under 16. If an employed minor is registered (apprentice for example), parental consent is required for biometric enrollment in accordance with Art. 8 GDPR.

13. Modifications to this policy

We may modify this policy. In case of substantial change, we notify client organizations by email 30 days in advance. The current version is always dated at the top of this page.

14. Contact

Levia SAS · Tunis, Tunisia
Email: legal@leviahr.com · DPO: legal@leviahr.com
Reply within 30 days.