LevUp
Home
Privacy Policy

Privacy Policy

Last updated: 21 June 2026

1. Introduction

LevUp (Pty) Ltd (registration number 2026/179991/07) ("LevUp", "we", "us", or "our"), a subsidiary of Change & Knowledge Experience (Pty) Ltd (registration number 2023/586242/07) (referred to as "C&KE"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our platform.

This policy complies with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ("POPIA"), the Electronic Communications and Transactions Act, 2002 (Act No. 25 of 2002) ("ECTA"), and other applicable South African data protection legislation.

2. Definitions

For the purposes of this policy:

  • "Personal Information" means any information relating to an identifiable, living natural person or juristic person, as defined in POPIA.
  • "Processing" means any operation or activity concerning personal information, including collection, receipt, recording, storage, updating, modification, retrieval, use, distribution, or destruction.
  • "Data Subject" means the person to whom personal information relates.
  • "Responsible Party" means LevUp (Pty) Ltd and its parent company Change & Knowledge Experience (Pty) Ltd, the entities that determine the purpose and means of processing personal information on LevUp.
  • "Operator" means a third party who processes personal information on behalf of the Responsible Party.

3. Information We Collect

3.1 Information You Provide Directly

  • Account Information: Full name, email address, and authentication credentials when you register.
  • Funding Assessment Data: Business stage, sector, ownership profile, trading history, funding requirements, financial record status, locale type, and other responses you provide during the diagnostic questionnaire.
  • Community Contributions: Forum posts, comments, replies, and any content you share in the LevUp community.
  • Application Tracking Data: Funder selections, application statuses, readiness scores, uploaded documents, and application notes.
  • Financial Data: Revenue, expenses, profit, and cash-on-hand figures you log for your own tracking purposes.
  • Communications: Messages, feedback, or inquiries you send to us via the contact form, email, or WhatsApp.

3.2 Information Collected Automatically

  • Usage Data: Pages visited, features used, time spent on pages, navigation patterns, and referral sources.
  • Device Information: Browser type, operating system, device type, screen resolution, and language preferences.
  • Session Data: Session identifiers used to group interactions into visits, login timestamps, and session duration.
  • Cookies and Similar Technologies: See Section 9 (Cookie Policy) for details.

4. How We Use Your Information

We process your personal information for the following purposes, in accordance with POPIA's conditions for lawful processing:

  • Service Delivery: Generating your personalised funding matches, powering the LevUp Score, and providing the core functionality of the platform.
  • Account Management: Creating and maintaining your user account, authenticating your identity, and securing your session.
  • Platform Improvement: Analysing aggregated, anonymised usage patterns to improve the matching algorithm, user interface, and overall experience.
  • Community Functionality: Enabling forum participation, thread creation, and community interactions.
  • Communication: Responding to your inquiries, sending service-related notifications, and providing support.
  • Security: Detecting, preventing, and addressing technical issues, fraud, or unauthorised access.
  • Legal Compliance: Complying with applicable laws, regulations, and lawful requests from regulatory authorities.

5. Legal Basis for Processing

Under POPIA, we process your personal information based on the following lawful grounds:

  • Consent: You have given us explicit consent to process your information for the purposes described in this policy.
  • Contractual Necessity: Processing is necessary for the performance of our service (providing funding matches and platform features you request).
  • Legitimate Interests: Processing is necessary for our legitimate business interests (platform improvement, security, analytics), provided these do not override your rights and freedoms.
  • Legal Obligation: Processing is necessary to comply with South African law.

6. Data Sharing and Disclosure

We do not sell, rent, trade, or otherwise disclose your personal information to third parties for their marketing purposes. We may share your information only in the following limited circumstances:

  • Service Providers (Operators): We engage trusted third-party service providers to perform functions on our behalf, including cloud hosting (Base44), authentication services, email delivery, and analytics. These operators are contractually bound to process data only on our instructions and in compliance with POPIA.
  • Funder and Partner Referral Tracking: LevUp's business model includes receiving referral or success fees from funders, incubators, accelerators, and partner organisations when a successful funding match or placement occurs. To facilitate this, we may share limited, de-identified match outcome data with the relevant funder or partner for verification and commission processing purposes. We do not share your full business profile, financial data, or uploaded documents with funders without your explicit consent.
  • Aggregated, De-identified Data: We may share aggregated, anonymised statistics (e.g., "X% of users in the agriculture sector match with Y funders") that cannot be used to identify any individual.
  • Legal Requirements: We may disclose your information if required by law, court order, or regulatory authority, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
  • Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of LevUp (Pty) Ltd's or Change & Knowledge Experience (Pty) Ltd's assets, your information may be transferred as part of that transaction, subject to the same privacy protections.

7. Data Storage and Security

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction, as required by POPIA and the Cybercrimes Act, 2020 (Act No. 19 of 2020). These include:

  • Encryption of data in transit (TLS/HTTPS) and at rest.
  • Secure authentication mechanisms, including OAuth 2.0 for third-party login providers.
  • Access controls limiting data access to authorised personnel on a need-to-know basis.
  • Regular security assessments and monitoring of our infrastructure.
  • Infrastructure provided by Base44, a SOC 2 compliant platform with enterprise-grade security.

Your data is stored on secure servers. Assessment results and account data are retained for as long as you maintain an active account. You may delete your account and all associated data at any time from your Dashboard.

8. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

  • Account Data: Retained until you delete your account or request deletion.
  • Assessment Results: Retained while your account is active. Upon deletion, all quiz results and associated matches are permanently removed.
  • Community Posts: Retained unless you request removal. Anonymised content may remain if removal would break thread continuity for other users.
  • Usage Analytics: Retained in anonymised form for up to 36 months for trend analysis.
  • Financial Logs: Retained while your account is active; deleted with your account.

9. Cookie Policy

Cookies are small text files stored on your device when you visit a website. LevUp uses the following categories of cookies:

9.1 Essential Cookies (Always Active)

These cookies are necessary for LevUp to function. They enable core features such as user authentication, session management, security, and quiz progress persistence. Without these cookies, the platform cannot operate. Under ECTA and POPIA, essential cookies do not require prior consent as they are strictly necessary for service delivery.

9.2 Analytics Cookies (Optional)

We use anonymised analytics cookies to understand how users navigate LevUp — which pages are visited, how long users spend on the platform, and which features are most useful. These cookies do not collect personally identifiable information. You can opt out of analytics cookies when you first visit LevUp via the cookie consent banner, or at any time by clearing your browser cookies and revisiting the site.

9.3 Third-Party Cookies

We do not allow third-party advertising cookies, tracking cookies, or social media pixels on LevUp. The only third-party cookies present are those required by our authentication providers (Google OAuth, when you choose to sign in with Google).

9.4 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can delete existing cookies, block all cookies, or set your browser to alert you when cookies are being placed. Note that blocking essential cookies will prevent LevUp from functioning.

10. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

  • Right of Access: You may request a copy of the personal information we hold about you, free of charge (Section 23 of POPIA).
  • Right to Rectification: You may request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully (Section 24 of POPIA).
  • Right to Object: You may object to the processing of your personal information on reasonable grounds (Section 11(3) of POPIA).
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time.
  • Right to Complain: If you believe we have interfered with the protection of your personal information, you may lodge a complaint with the Information Regulator of South Africa:
    Email: complaints.IR@justice.gov.za
    Website: www.justice.gov.za/inforeg

To exercise any of these rights, contact us at contact@cxke.co.za. We will respond within 30 days as required by POPIA.

11. Children's Privacy

LevUp is not intended for use by persons under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete such information promptly.

12. Cross-Border Data Transfers

Our service providers (including Base44 for cloud hosting) may process data in jurisdictions outside South Africa. In accordance with Section 72 of POPIA, we ensure that any cross-border transfer of personal information is subject to adequate safeguards, including contractual clauses ensuring substantially similar privacy protections as those required under South African law.

13. Data Breach Notification

In the event of a data breach involving your personal information, we will notify you and the Information Regulator as required by POPIA and the Cybercrimes Act. Notifications will include the nature of the breach, the likely consequences, and the measures we have taken or propose to take to address it.

14. Direct Marketing

We do not use your personal information for direct marketing purposes. We do not send promotional emails, newsletters, or marketing communications. Any service-related communications (such as account verification or security notices) are strictly operational in nature. Should we ever introduce optional communications, we will obtain your explicit opt-in consent first, in compliance with Section 69 of POPIA and the Consumer Protection Act, 2008 (Act No. 68 of 2008).

15. Automated Decision-Making

LevUp uses automated processing to match your assessment responses with funding opportunities. This matching does not produce legal effects or similarly significant effects concerning you — it is an informational tool to help you discover funding options. The final decision to apply for any funding instrument rests entirely with you.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform functionality. When we make material changes, we will notify you via a prominent notice on LevUp or by email. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of LevUp after changes are posted constitutes acceptance of the updated policy.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: