Privacy Policy — Hitek Nova Ltd.
Version: 1.0
Effective: 8 August 2026
Last updated: 8 August 2026
At a glance
- Who we are: Hitek Nova Ltd. (registration number 0313995949), registered in Vietnam.
- What we collect: business contact information (name, email, phone, company, billing address, tax ID), payment details (via PayPal), and — when you use TestPod — device data such as identifiers, diagnostic results, and erasure records.
- Why we collect it: to provide the TestPod service, send invoices, respond to support requests, and meet our legal obligations.
- We do not currently send marketing emails. If we offer an optional newsletter or product-update subscription, we will collect your email only with your consent.
- We share data with: PayPal, our service backend at api.testpod.space, our customer chat provider (Facebook), our video host (YouTube), Cloudflare (bot protection on our signup form), Twilio (WhatsApp messaging), our hosting provider, and the code and download providers listed in Section 6. We do not sell your data.
- We measure our own website traffic with first-party, cookieless analytics that we run ourselves. We do not use Google Analytics, advertising pixels, or cross-site tracking.
- If you connect a marketplace seller account (eBay, Back Market, Amazon) to Hitek Operations Suite, we import your orders — including buyer contact and shipping details — only so you can fulfill them. See Section 16.
- You can: ask what we have, correct it, delete it, withdraw any consent, or file a complaint. Email privacy@hiteknova.com.
- We store data: only as long as needed, then we delete or anonymize it.
- Your data may be processed outside Vietnam (United States, where some of our service providers operate). We use legal safeguards.
1. Who we are and our role
We are Hitek Nova Ltd. ("Hitek", "we", "us", "our"), a company registered in Vietnam under business registration (MST) number 0313995949.
- Registered office: C60 Xom Chieu, Xom Chieu Ward, Ho Chi Minh City, Vietnam
- Trading website: https://hiteknova.com
- Product website: https://testpod.space
- Privacy contact: privacy@hiteknova.com
Role of Hitek
For customer account, billing, website, payment, and support data, Hitek Nova Ltd. acts as the personal data controller because we decide why and how that information is processed.
For device data, diagnostic reports, erasure records, operator activity, or other information processed through TestPod on behalf of a business customer, Hitek may act as a processor / service provider. In that case, the business customer is responsible for ensuring it has the right to collect and submit the data to TestPod, and Hitek processes the data according to the customer's instructions, our agreement, and applicable law.
For Vietnamese personal data protection law purposes, including Law No. 91/2025/QH15 on Personal Data Protection (in effect from 1 January 2026), Decree 356/2025/ND-CP, and other applicable implementing regulations, Hitek complies with the applicable obligations of personal data controllers, processors, and controller-processors where relevant. For EU/UK GDPR purposes, Hitek acts as controller for our own customer account, billing, website, payment, and support data, and may act as processor where we process personal data on behalf of a business customer.
2. People we collect information about
We mainly collect information about:
- Customers and prospective customers of TestPod and other Hitek products
- Customer representatives, employees, and operators using TestPod on behalf of a customer
- Visitors to our websites
- People who contact us for support, sales, or business inquiries
- Administrators of our back-office (Hitek employees only)
3. Information we collect
We collect personal information in three ways: (a) information you give us, (b) information we collect automatically, and (c) information from third parties.
3.1 Information you give us
When you register for TestPod (customer registration form):
- Company name and tax ID
- Contact person's full name
- Email address
- Phone number (with country code)
- Country
- Billing address (up to three address lines)
- Choice of printer model and label size
- Service preferences (diagnostics, auto-erase, auto-print-label flags)
- Payment information (processed by PayPal; if you pay in cryptocurrency, the transaction ID — we do not store full card numbers)
- Your PayPal account email (so we can reconcile incoming payments to your account)
If you start registration but do not finish it: we save what you had already entered as a pending registration, before any payment completes, so that you can come back and continue and so our support team can help you. We may send you a limited number of reminder emails with a link to finish signing up. These are service messages about a registration you started, not marketing, and you can ask us to stop or to delete the pending registration at any time.
When you contact us through the contact form or booking form: full name, email, phone, company name, country, message content. If a submission is automated or unsolicited marketing we may keep it, hidden from the site, so we can recognise and block repeat abuse.
When you subscribe to email updates (optional, with your consent): email address.
When a customer creates accounts for its employees or operators to use TestPod: name, email, username, role, access permissions, login logs, and activity logs of those operators.
When an administrator signs in to the back-office (Hitek employees only): username, hashed password, IP address, timestamp.
3.2 Device and service data processed by TestPod
When you (or your operators) use TestPod to test, erase, label, or report on devices, certain technical information is processed. This data may not always be personal data on its own, but it can become personal data when linked to a customer, operator, device owner, invoice, or report.
Device and service data may include device identifiers such as serial number, IMEI/MEID where applicable, model information, capacity, battery information, lock or account status, SIM/carrier information where available, diagnostic results, erasure records, labels, report links, timestamps, station identifiers, and operator activity.
TestPod is not designed to collect or upload personal content stored on tested devices, such as photos, contacts, messages, call history, documents, app content, or browsing history. TestPod processes the technical condition and service data of a device, not the private content stored on it.
TestPod may record technical or aggregate device-state metadata needed for diagnostics or erasure verification, but it is not designed to collect or upload the actual personal content stored on the device.
Where this data is processed on behalf of a business customer, Hitek acts as processor under that customer's instructions (see Section 1).
Report access may require authentication or a unique report link. Customers are responsible for controlling who they share report links with.
Public certificate and report lookup. Our website offers a lookup page where anyone holding a certificate code or report link can view the matching record. When a code is submitted, we send it to our TestPod service backend and display the record returned, which may include device identifiers, model details, diagnostic results, erasure status, timestamps, station information, the customer's logo, and the operator name where the record contains one. Anyone who has the code can view that record, so treat certificate codes and report links as confidential.
3.3 Information we collect automatically
- IP address of the device used to access our website (used to detect abuse).
- Browser and device information sent automatically by your browser.
- Website analytics that we run ourselves. Every page view on our website sends a small record to our own server, which we store in our own database. That record contains the page address you visited, the page or advertisement that referred you, any campaign tags in the link (utm_source, utm_medium, utm_campaign), your browser's user-agent string, whether we judged the visit to be automated, and a pseudonymous visitor identifier. The visitor identifier for page views is a one-way hash that changes every day, so it cannot be used to follow you over time; the identifier used for funnel events does not rotate daily. We use this to understand which pages and campaigns work. It is cookieless and first-party — the data goes only to us, never to an advertising network — so it is not covered by the cookie banner.
- Pages visited and actions taken, also recorded in ordinary server logs.
- Cookies and similar technologies (see Section 12).
3.4 Information from third parties
- From PayPal: payment status, payer identifier, transaction reference. We do not receive card numbers.
- From Facebook Customer Chat (if you use the chat widget): your chat messages and Facebook profile name.
3.5 Information we do not collect
- We do not knowingly collect personal information from anyone under 16.
- We do not collect special-category data (health, biometric, racial, religious, political, sexual orientation, etc.).
- We do not currently use Google Analytics, Meta Pixel, TikTok Pixel, Hotjar, or any behavioural-advertising trackers. We measure our own traffic instead, as described in Section 3.3.
4. How we use your information
| Purpose | What it covers | Legal basis |
|---|---|---|
| Account creation and management | Creating your TestPod account, enabling login, sending technical setup instructions, hardware provisioning | Performance of a contract — Vietnam Law 91/2025/QH15 / GDPR Art. 6(1)(b) / LGPD Art. 7, V |
| Billing and payment reconciliation | Generating invoices, processing payments via PayPal, matching incoming PayPal payments to your account, sending receipts | Performance of a contract + legal obligation (Vietnamese accounting / tax law) |
| Customer support | Responding to your questions, troubleshooting, handling warranty claims | Performance of a contract |
| Service delivery, including TestPod device flows | Sending you device tracking codes, diagnostic reports, erasure certificates, and product updates that are part of the service | Performance of a contract (controller for our account/billing data; processor for device data processed on behalf of a business customer) |
| Operator account management (B2B) | Provisioning operator accounts and access on behalf of a business customer, logging operator activity for the customer | Processor under the customer's instructions and applicable agreement |
| Finishing an interrupted registration | Storing a pending registration before payment completes and sending a limited reminder with a link to continue | Steps taken at your request before entering a contract / legitimate interests |
| Understanding how our website is used | First-party, cookieless measurement of page views, referrers, and campaign tags to see which pages and campaigns work | Legitimate interests |
| Security and fraud prevention | Logging admin sign-ins, monitoring for suspicious activity, anti-bot honeypots, and bot protection (Cloudflare Turnstile) on our public signup form | Legitimate interests / legal obligation |
| Legal compliance | Retaining invoices for tax, responding to lawful requests | Legal obligation |
| Improving our product and support | Reviewing customer feedback, support requests, error reports, and service performance information | Legitimate interests |
| Marketing communications | We do not currently send marketing emails. If we offer an optional newsletter or product-update subscription, we will collect your email only with your consent and you can withdraw it at any time. | Consent — GDPR Art. 6(1)(a) / LGPD Art. 7, I / Vietnam Law 91/2025/QH15 |
We will never use information collected for billing/support purposes to send marketing without separately asking for your consent.
5. Data Processing Agreements with business customers
Where Hitek processes personal data on behalf of a business customer (for example, device data, operator activity, and reports generated by that customer's use of TestPod), the customer remains responsible for having a lawful basis to collect and upload that data. We process such data according to our agreement with the customer, the customer's instructions, our data processing terms, and applicable law. We can provide or agree appropriate data processing terms with business customers where required. Contact privacy@hiteknova.com to discuss.
6. Who we share your information with
| Recipient | Purpose | Where they process data |
|---|---|---|
| api.testpod.space (our service backend) | Storing customer accounts, devices, billing, support tickets. Operated by Hitek and our affiliates. | United States (Google Cloud, us-central1) |
| PayPal | Processing payments; we store your PayPal account email to reconcile payments | Singapore, United States, with offices in EU |
| Meta Platforms Ireland Ltd. (Facebook) | Customer Chat widget on our website — loaded only after you accept third-party cookies | EU, with data flows to United States |
| Google Ireland Ltd. (YouTube) | Embedded product videos on our website — loaded only after you accept third-party cookies | EU, with data flows to United States |
| Cloudflare, Inc. | Turnstile bot protection on our public signup form (receives your IP address and browser signals), and hosting of a common code library used by our contact form. Necessary for security and for the form to work, so it loads regardless of your cookie choice. | United States and its global network |
| jsDelivr | Hosting of a common code library used by our contact form; receives your IP address and browser information when the file loads | Global content-delivery network |
| Twilio Inc. | Delivering and receiving WhatsApp messages where you contact us that way; receives your WhatsApp number and message content | United States |
| Amazon Web Services | Hosting our downloadable installer files; receives your IP address and browser information when you download software | United States |
| Marketplace providers (eBay, Back Market, Amazon and similar) | Only if you connect a marketplace seller account to Hitek Operations Suite — importing your orders and sending order status and tracking back. See Section 16. | United States, EU, and other countries depending on the marketplace |
| StableHost LLC | Website hosting; default outbound SMTP for transactional emails | United States |
| Professional advisers (accountants, auditors, lawyers) | Legal, tax, and audit support | Vietnam, possibly other jurisdictions |
| Government authorities | Only when legally required (court order, regulatory request, tax filing) | Vietnam |
We do not sell or rent your personal information to anyone for any purpose.
We do not share your personal information with advertising networks or data brokers.
We do not currently use a third-party bulk email or SMS service. Transactional email is sent via our hosting provider's mail server, and we do not send SMS. We do use Twilio to send and receive WhatsApp messages where a customer chooses to contact us on WhatsApp.
If we ever undergo a corporate transaction (merger, acquisition, sale of assets), personal information may be transferred. We will tell customers about such a transfer as soon as we are permitted to, and in advance wherever that is possible.
7. International data transfers
Some of our service providers (notably PayPal, Google Cloud, Meta, Google/YouTube, Cloudflare, Twilio, Amazon Web Services, our hosting provider, and any marketplace you connect) are based in the United States and other countries outside Vietnam and the European Union.
When personal data is transferred from Vietnam, the EU, the UK, or Brazil to a country that has not been recognized as providing an "adequate" level of data protection, we use the legally required safeguards:
- From Vietnam: we comply with applicable Vietnamese requirements for cross-border transfer impact assessments and related filings where required under Law No. 91/2025/QH15 and its implementing regulations.
- From the EU/UK/Brazil: where required, we rely on appropriate transfer safeguards made available by our service providers, such as Standard Contractual Clauses or equivalent contractual/data-transfer mechanisms.
You can request a copy of the safeguards we use by emailing privacy@hiteknova.com.
8. How long we keep your information
We aim to retain personal data only for the periods listed below, unless a longer period is required by law, needed to resolve disputes, enforce agreements, provide support, or maintain security. Some deletion or anonymization may occur during normal backup rotation or periodic maintenance rather than immediately.
| Data | Retention period |
|---|---|
| Customer account information (name, email, company, address, tax ID) | For the duration of your account, plus 6 years after account closure to support legal claims and warranty obligations |
| Billing records, accounting documents, and invoices | Up to 10 years from the document date or as otherwise required by the Vietnamese Law on Accounting and tax regulations. Some accounting documents may have shorter or longer mandatory retention periods. |
| Support tickets, contact-form messages, and chat history | 3 years after the ticket is closed or the message is received. Submissions identified as automated or unsolicited marketing are kept, hidden from the site, for up to 12 months so we can block repeat abuse. |
| Pending (unfinished) registrations | 12 months from the last time you worked on it, or until you ask us to delete it — whichever comes first |
| Website analytics records (page views and funnel events) | 24 months, after which we delete them or keep only aggregate counts that identify nobody |
| Marketplace order and buyer data (Hitek Operations Suite) | See Section 16 |
| Device data and diagnostic reports processed on behalf of a business customer | Retained according to the customer's instructions and our agreement with that customer. Unless otherwise agreed, we retain such records while the customer account is active and delete or anonymize them after account closure, subject to backup cycles, legal requirements, and any retention needed to resolve disputes or provide support. |
| Marketing consent records (when applicable) | For as long as the consent is active, plus 2 years after withdrawal, as proof of past consent |
| Email subscription | Until you unsubscribe, plus 30 days to process the unsubscribe |
| Administrator login logs | 12 months |
| Server logs and error logs (including IP) | 90 days |
| Cookies | See Section 12 |
| Backups containing the above | Our own backups run on a rolling 30-day cycle, so data we have deleted from the live system normally disappears from our backups within about 30 days. Backups are held by our hosting and cloud providers, so we cannot guarantee an exact deletion moment; deleted data is not restored into the live system. |
9. Your rights
Depending on the country you are in, you have some or all of the following rights:
- Right to know / Right of access. Confirm whether we hold your personal information and request a copy.
- Right to correction. Fix information that is wrong or out of date.
- Right to deletion ("right to be forgotten"). Delete your personal information, unless we have a legal reason to keep it (e.g. tax records).
- Right to restrict processing. Stop using your information while we investigate a complaint or correct an error.
- Right to object. Object to specific uses of your information.
- Right to data portability. Get a copy of your information in a machine-readable format.
- Right to withdraw consent. Where processing depends on your consent, withdraw it at any time.
- Right to lodge a complaint. Complain to us at privacy@hiteknova.com or to a supervisory authority — see Section 14.
- Right not to be subject to fully automated decision-making. We do not currently make any such decisions about you.
We answer rights requests within the time the law that applies to your request requires. Where Vietnamese personal data protection law applies, some requests carry short statutory deadlines — we acknowledge those within 2 business days and complete them within the period the law sets, which for deletion and similar requests is measured in days rather than months. In all other cases we respond within 30 days, and we may extend that where the applicable law allows it for complex requests — if we do, we will tell you why. We may need to verify your identity. There is no charge unless the request is clearly excessive.
If you are using TestPod on behalf of a business customer, please direct rights requests to your employer first; we will support them in fulfilling your request.
10. How to exercise your rights
Email privacy@hiteknova.com with: your full name and the email address associated with your account, what right you want to exercise, and (optionally) the country you are in.
We acknowledge within 5 business days — within 2 business days where Vietnamese law sets that shorter deadline — and respond fully within the period described in Section 9.
11. Security
We use commercially reasonable technical and organizational measures: HTTPS for all traffic, password hashing, access controls, regular software updates, logging and monitoring of administrative access, anti-bot honeypot fields, captcha on administrator login, and Cloudflare Turnstile bot protection on our public signup form. Marketplace credentials, where you connect a marketplace account, are stored encrypted.
No method of transmission or storage is 100% secure. If we discover a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.
12. Cookies and similar technologies
A "cookie" is a small text file that a website saves on your device. We use cookies in three ways:
| Type | Purpose | Examples | Consent needed? |
|---|---|---|---|
| Strictly necessary | Keep you signed in, remember language, security | PHP session cookie, language preference, cookie-consent state | No |
| Functional | Functional cookies requested by the user, such as language preference or interface preference | Language preference; a referral cookie that remembers the referral code from the link you arrived on, so the signup form can fill it in for you | No |
| Security | Bot protection on our public signup form | Cloudflare Turnstile | No — necessary for the form to work |
| Third-party (chat, video) | Facebook Customer Chat; YouTube embeds | Cookies set by facebook.com and youtube.com | Yes |
We do not use analytics cookies, advertising cookies, or cross-site tracking pixels. Our website measurement is cookieless and first-party — see Section 3.3.
Facebook Customer Chat and YouTube video embeds are blocked from loading until you accept third-party cookies through our cookie banner. You can change your choice at any time using the "Cookie settings" link in the footer.
13. Children's privacy
Our service is intended for businesses and adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time. For material changes to your rights, we will update the effective date, notify you by email if you have an account, and display a prominent notice on the website for at least 30 days.
The current version is always at https://hiteknova.com/post/policy. Older versions on request.
15. Contact and complaints
General privacy contact
Email: privacy@hiteknova.com
Post: C60 Xom Chieu, Xom Chieu Ward, Ho Chi Minh City, Vietnam — attention: Data Protection contact.
Vietnam — Supervisory authority
You may complain to the competent personal data protection authority designated under Vietnam's Law on Personal Data Protection and its implementing regulations.
European Union / United Kingdom
You can lodge a complaint with your local Data Protection Authority. EU DPA list: https://edpb.europa.eu/about-edpb/about-edpb/members_en. UK: Information Commissioner's Office at https://ico.org.uk.
Brazil
LGPD (Law 13.709/2018) applies. Authority: Autoridade Nacional de Proteção de Dados (ANPD), https://www.gov.br/anpd.
California
If California privacy law (the CCPA as amended by the CPRA) applies to us, California residents may have rights including the right to know, delete, correct, and limit the use of sensitive personal information. We do not sell personal information, we do not use behavioural advertising or cross-context tracking, and we do not run analytics or advertising pixels on our website.
Canada
PIPEDA applies. Complain to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca.
16. Marketplace order data (Hitek Operations Suite)
This section applies only if you connect your own marketplace seller account — for example eBay, Back Market, or Amazon — to Hitek Operations Suite. It does not apply to TestPod on its own.
When you connect a marketplace account, we import your orders from that marketplace. Those orders can include buyer personal data: name, shipping address, contact details, marketplace order identifiers, and shipment or tracking status provided by the marketplace.
- Purpose. We process buyer data only so that you can fulfill the order: create your sales documents, ship the device, handle warranty and returns, keep the legal records you are required to keep, and send tracking back to the marketplace. We never sell it, use it for advertising, or share it with anyone except as needed to fulfill the order.
- Our role. For this data we act as a processor on your behalf. You remain responsible for having a lawful basis to import and use it, and for complying with the marketplace's own data-protection rules.
- Storage and security. Marketplace credentials (access tokens, API keys) are stored encrypted. Buyer data is stored in your account and is visible only to users you authorize.
- International transfers. This data is processed by the marketplace provider and by our service backend in the United States, and may be processed in other countries where a marketplace operates. The safeguards in Section 7 apply.
- Retention and erasure. Buyer personal data is kept only as long as needed for fulfillment, warranty, dispute handling, and legal record-keeping, and no longer than the relevant marketplace's data-protection rules allow. Where a marketplace notifies us that one of its users has deleted their account, or otherwise requires deletion, we delete or anonymize that user's personal data from imported orders, except where we are legally required to retain it.
- Your controls. You can disconnect a marketplace at any time, which stops all further imports, and you can revoke our access from the marketplace's own security settings.
Version 1.0 — effective 8 August 2026. Last updated 8 August 2026.