Private purchase and delivery
What this checkout records, and what it never asks for.
This notice is a working draft. Checkout remains closed while its legal and infrastructure release gates are incomplete.
1. Controller and contact
HiCellTek, the individual business operated by Takwa Sebai, is the controller for purchase, delivery and customer-library data. SIREN 882 716 228, registered in Antony, France. Privacy requests can be sent to privacy@hicelltek.com.
2. Data collected
- purchase email, billing country and buyer type;
- company name and VAT number when supplied by a business buyer;
- the accepted terms and privacy versions;
- immediate-supply, withdrawal acknowledgement and optional marketing choices;
- a random order reference and the corresponding Stripe Session identifier;
- product entitlement, magic-link and email-delivery status;
- hashed IP and browser identifiers used for security and rate limiting;
- separate facts for a download request and a completed file stream.
HiCellTek does not receive complete card details. This checkout does not ask for an HLOG, trace, KPI export, customer name, operator identifier or investigation evidence.
3. Why the data is used
- to create and perform the purchase contract;
- to prove the buyer’s digital-supply instructions;
- to deliver and restore private product access;
- to meet accounting, tax and consumer-law obligations;
- to protect the service against abuse and unauthorised redistribution;
- to send product marketing only when the optional consent is selected.
4. Recipients and processors
Data is limited to HiCellTek and the providers needed to run the transaction: Stripe for payment, o2switch for website and private delivery hosting, and the configured transactional email service. Their own notices govern data they process for their services.
5. Retention
- abandoned checkout intents: 30 days;
- one-time access tokens: until used or expired;
- active library entitlement: while the purchased product remains supported;
- contract and consent proof: the contractual relationship and applicable limitation period;
- invoice and accounting records: the period required by French law, generally 10 years;
- security and download delivery events: 12 months unless required for an active dispute;
- marketing data: until consent is withdrawn or, at the latest, three years after the last relevant customer contact.
6. Security
The paid ZIP and commerce database are kept outside the public document root. Sensitive database values are encrypted, lookup values are keyed hashes, access links are single-use and short-lived, and Stripe webhook signatures are verified before an entitlement is created.
7. Your rights
Depending on the legal basis and circumstances, you may request access, correction, deletion, restriction, portability or objection. You may withdraw optional marketing consent at any time without affecting the earlier lawful processing.
Send the request to privacy@hicelltek.com. You may also lodge a complaint with the CNIL or the competent supervisory authority in your country.