Privacy Policy

Introduction

Last updated: August 2026.  Version 1.0

This notice explains how VITA-AMIKI GROUP PTE. LTD. (UEN 202553816C), a company incorporated in Singapore whose registered office is at 10 Anson Road, #32-01, International Plaza, Singapore 079903 ("VITA", "we", "our" or "us"), collects and uses personal data. "VITA Universe" is a trading name of that company. It covers our website, our web application and our mobile apps for iOS and Android.

Our Data Protection Officer can  be reached at dpo@vita-universe.com or by post at the address above.

VITA Universe is a mental strength training platform offering structured programmes that combine psychology-informed content with practical leadership principles. This notice explains how we collect, use, share and protect your personal data when you use our website, our web application and mobile apps.

This notice is not a contract and we are not asking you to agree to it. It tells you what we do and what rights you have. Where we need your consent for something — for example to send you marketing, or to use cookies that are not strictly necessary — we will ask you separately and you can change your mind at any time. 

Information We Collect

Account Information: your name and email address, which you give us when you create an account. If an organisation provides  your access, we also receive from that organisation  your work email address and your licence status, and your job title or team if it chooses to give them to us.

Usage data: information about how you use the platform including which programmes and lessons you open and how far through them you are, together with technical information about your visit such as the date and time, your device and browser, the app version, your language, your IP address and the country we derive it from. On our mobile apps this also includes device identifiers and crash diagnostic information and, if you allow it, push notification tokens. 

Payment Data: Payment processing is handled securely by Stripe. We do not store your full credit card number or payment credentials on our servers. Stripe may collect billing details such as your name, email, and billing address as required to process transactions.

Communications: If you contact us or subscribe to communications, we collect the information you provide, such as your email address and message content.

Cookies and similar technologies: information collected through cookies and similar technologies as described in the section "Cookies and Tracking" below. 

Support and correspondence: if you contact us for support, the content of your message and any information you choose to include in it. 

What You Write for Yourself

Our lessons contain exercises and questions. You answer them for yourself, in your own notes. The platform does not give you a field to type into and we do not receive, see or store anything you write in response. Please keep your answers somewhere private that belongs to you.

What Your Choice of Programme Tells Us

Our programmes cover subjects such as self-esteem, drive and resilience. Which programmes you open, and how far through them you get, is information about you we treat as confidential. We do not sell or share it, we do not use it for advertising or to build a profile of you, and where your access can through an organisation we never tell that organisation what any individual has opened or completed. Reports we may give to organisations are aggregated, do not identify anyone, and are not produced for a group of fewer than 10 people. 

How We Use Your Information

We use your information we collect to:

Run and improve the platform, deliver programme content and keep track of your progress. 

Process payments and send you confirmations and invoices. 

Email you about your account and programmes, and send you marketing where you have agreed to it or we are otherwise permitted to send it , you can opt out at any time.  Prevent fraud and abuse, and enforce our Terms of Service. We do not sell your personal data and we do not use it for advertising. 

 Our Legal Basis for Using Your Data

Where an organisation provides your access, that organisation is the controller of your account data and we act as its processor/ intermediary; its own privacy notice explains the basis on which it uses that data. We are the controller of the data we collect through our website and apps, and of everything you give us if you buy from us directly. 

If you are in Singapore, or your data is handled by us in Singapore, we rely on the Personal Data Protection Act. In most cases, we rely on deemed consent: when you create an account, buy a programme, work through a lesson or write to our support address, you are voluntarily giving us the information we need to do the thing you are asking us to do, and the law treats that as consent for those purposes. We rely on the business improvement exception in the Act to use information about how the platform is used in order to improve it and to understand what our customers find useful. We rely on the exceptions in the First Schedule to the Act where we have to act in an emergency threatening someone's life, health or safety, where we are required by law, and where we need to establish or defend a legal claim. Where your access is provided by an organisation, we handle your name, work email address, job title and licence status as that organisation's data intermediary, and its own privacy notice explains the basis on which it uses them. For marketing, and only for marketing, we rely on your consent, which we ask for separately and which you can withdraw at any time. 

You can withdraw your consent at any time. Tell us and we will stop. We will tell you first what the likely consequences are: for marketing, you will stop receiving it and nothing else changes, but if you withdraw your consent to us holding the information we need to run your account, we will not be able to keep it open and have to close it. 

Third-Party Services

We use other companies to help us run the platform. They may only use your data to provide the service we have engaged them for, they are bound by written contracts requiring them to protect it to a standard no lower than we apply, and they may not use it for their own purposes. The categories of recipient are: providers of cloud hosting, database and backup services; video hosting and streaming provider; an email delivery provider; a payment processor; a content delivery and security provider; a provider that identifies the country a visitor is in from their internet address; a provider of the container in which our mobile apps run and which delivers part of our website code; a domain name and DNS provider; and the business software we use ourselves, including our email and office suite. We keep a current list of the companies in each category, and we will send it to you if you ask. 

Where Your Data IS Stored and Sent 

We are established in Singapore, but the platform, its database and our backups are hosted in the European Union. Some of our other service providers are in the United States, and others in Europe, and our team accesses the platform, including . Other databases, remotely from Singapore and from Denmark. This means your personal data may be transferred outside the country where you live. If we change the region in which the platform is hosted, we will update this notice.

Your account data is currently stored in the European Union. Because our team reaches it from Singapore, that access is itself a transfer for the purposes of European law, and for it we use the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where relevant, and we assess whether additional safeguards are needed. Because your data is stored in outside Singapore, storing it also a transfer for the purposes of Singapore law, for that we comply with section 26 of the Personal Data Protection Act and take steps to ensure a standard of protection comparable to that under that Act. You can ask us for a copy of the safeguards we use.

 How We Keep Your Data Safe

We use encryption for all traffic to and from the platform, role-based access control for administrative access, separate production and development environments, passwords and login tokens stored only in salted, hashed form. We may use regular backups, implement encryption of the storage on which the platform’s data is held and if we use regular backups, encryption of our backups. We have not yet commissioned an independent security test of the platform and we may intend to do so. No system is completely secure, but we take these steps seriously and review them regularly. 

If Something Goes Wrong

If a personal data breach occurs, we will notify the Personal Data Protection Commission in Singapore where the breach is likely to result in significant harm to you or is of significant scale, and we will notify the relevant European supervisory authorities unless the breach is unlikely to result in a risk to you. We will tell you directly where the breach is likely to result in significant harm to you or in a high risk to your rights and freedoms. In each case we act within the timeframes the law requires. 

Your Rights

You have the following rights regarding your personal data:

Access: You may request a copy of the personal data we hold about you.

Correction: You may request that we correct any inaccurate or incomplete personal data.

Deletion: You may ask us to delete your personal data, and we will do so unless the law requires or permits us to keep it — for example tax records, or information we need to establish or defend a legal claim. Where we hold data as your employer's processor, we will pass your request on to them 

Data Portability: You may request a copy of your data in a structured, commonly used, and machine-readable format.

Withdraw Consent: where we rely on your consent, you may withdraw it at any time. We will tell you the likely consequences before you do 

Object and restrict: you may object to our use of your data where we rely on legitimate interests, and ask us to restrict how we use it while we look into a concern.

Opt out of marketing: you may unsubscribe at any time using the link in any marketing email or in your account settings.

Complaint: you may complain to us at any time, and you have the right to complain to a regulator — the Personal Data Protection Commission in Singapore (pdpc.gov.sg), or the data protection supervisory authority in the country where you live or work.

Automated decisions: we do not make decisions about you by automated means that produce legal or similarly significant effects.

To exercise any of these rights, contact our Data Protection Officer using the details below. We may need to verify your identity first. We will respond within 30 days, and will tell you if we need longer. There is no charge, unless a request is manifestly unfounded or excessive. In limited cases the law requires or permits us to refuse a request — for example, we must refuse to give access where doing so could reasonably be expected to cause serious harm to the safety or physical or mental health of you or someone else. If we refuse, we will tell you why. 

Data Retention

We keep your personal data only for as long as we need it. In practice: account data for as long as your account is active and, where an organisation is the controller of it, for as long as that organisation instructs and in any event no more than 60 days after its subscription ends; identifiable usage, device and app diagnostic data for 12 months; support correspondence for 24 months; emails we send you, such as sign-up confirmations and service notices, are retained by our email provider for 30 days and then deleted automatically, and we hold no copy of the content ourselves;billing and tax records for the period required by law, currently 5 years in Singapore; and security and access logs for 12 months. Where your access was provided by an organisation, we ask you to confirm your email address at least once every three months; if it can no longer be confirmed, your access is suspended. If you ask us to delete your account we will do so within 30 days, except where we are required by law to keep something, in which case we will keep only that and only for as long as we must. .

Usage data and analytics may be retained in anonymized or aggregated form for analytical purposes.

Cookies and Tracking 

We use cookies and similar technologies to keep you signed in, to remember your preferences, to keep the platform secure and to understand how it is used. Cookies that are strictly necessary to provide the platform are always on. For anything else, we ask for your consent the first time you visit and you can change your choices at any time through the cookie settings link on our website. Our mobile apps do not use advertising identifiers for tracking.

 Marketing

We only send you marketing if you have separately agreed to receive it. Every marketing email has an unsubscribe link, and we act on unsubscribe requests promptly and in any event within 10 business days. If you use our app and have allowed notifications, we will only send you marketing that way if you have agreed to it separately. We do not need your agreement to send you service messages about your account - confirmations, receipts and notices about your programmes - and you cannot opt out of those while you have an account. 

Children

The platform is for adults. You must be at least 18 to use it. We do not knowingly collect personal data from anyone under 18, and if we learn that we have, we will delete it.

Emergencies

Government and law enforcement requests. If a public authority asks us for your personal data, we will disclose it only where we are legally required to do so, we will disclose the minimum necessary, and we will tell you unless we are prohibited from doing so. Where an authority outside your country asks for data about you, we will require them to use the proper international legal channels, and we will challenge requests we consider unlawful or excessive. If we become aware of information indicating a credible and imminent risk to someone's life or safety, we may take reasonable steps in response, including contacting emergency services, and may disclose the minimum personal data necessary to do so. We would not tell your employer. We do not monitor the platform and we are under no obligation to detect or act on anything 

Artificial Intelligence

We do not use aartificial intelligence to infer your emotions or your state of mind, and we do not generate any score, rating, profile or assessment about you, and we do not use automated means to make any decision about you that has a legal or similarly significant effect. We do not choose which programmes or lessons to show you on the basis of anything we infer about you. . We do use artificial intelligence tools to help create some of the artwork and material on the platform; that idoes not involve your personal data. We do not provide your personal data to any third party for the training of general-purpose or foundation models. 

If Our Business Changes

If our business or part of it is sold or merges with another organisation, personal data may be transferred as part of that transaction. Where that happens we will only share what is necessary, the recipient may only use it for the purposes for which we could have used it, and we or they will tell you that the transfer has taken place. 

Changes to This Notice

We may update this notice. We will change the date and version at the top and, where a change materially affects you, we will tell you by email or through the platform before it takes effect .

Contact Information

If you have any questions about this notice, or if you want to exercise your rights, please contact our Data Protection Officer at dpo@vita-universe.com or write to VITA-AMIKI GROUP PTE. LTD., 10 Anson Road, #32-01, International Plaza, Singapore 079903.

We will respond to your request within 30 days. If we need longer, we will tell you why and when you can expect a full response. If you are not satisfied with how we have handled your request, you may complain to the Personal Data Protection Commission in Singapore or to the data protection authority in the country where you live.