Version 1.0 · Effective — · [Legal company name] (Sisesium)
1. Who we are
Sisesium is a digital product marketplace operated by [Legal company name], registered at [Registered address, city, postal code, country] (registration [Company registration number], VAT [VAT / tax number]). We act as the controller of the personal data described in this policy.
Privacy contact: [privacy@yourdomain.com]. Data protection contact / DPO: [Data protection contact / DPO name and email]. EU/EEA representative: [EU/EEA representative, if appointed]. UK representative: [UK representative, if appointed].
2. Data we collect
- Account data: name or display name, email address, authentication identifiers and sign-in metadata.
- Order data: products purchased, price, currency, order status, delivery status and download activity.
- Payment data: processed by our payment provider(s). We receive confirmation, amount, currency and a payment reference — never full card numbers.
- Custom product briefs: the answers and instructions you submit so an AI-assisted deliverable can be produced.
- Support and contact data: messages you send us and the correspondence needed to resolve them.
- Consent data: your cookie choices, consent version, timestamp, coarse country/region and browser user agent, kept as proof of compliance.
- Technical and usage data: device type, pages viewed and error diagnostics. Optional analytics data is collected only after you consent.
3. Why we use your data and our legal bases
- To provide the marketplace, create and deliver purchased or AI-generated products, and give you access to downloads — performance of a contract.
- To take payment, prevent fraud and keep accounting and tax records — contract and legal obligation.
- To operate strictly necessary cookies, security and platform integrity — legitimate interests.
- To run analytics, personalisation and marketing/advertising technologies — your consent, withdrawable at any time.
- To send marketing emails where you have separately opted in — consent (or legitimate interests where permitted by local law for existing customers).
- To handle privacy requests, disputes and legal claims — legal obligation and legitimate interests.
4. Marketing and account separation
Creating an account or completing a purchase is never treated as marketing consent. Marketing communications require a separate, optional opt-in that you can manage or withdraw at any time in your Privacy Center, or via the unsubscribe link in any marketing email.
We still send transactional messages (order confirmations, delivery notices, security and account emails) because they are necessary to deliver what you bought.
5. Sharing and service providers
- Payment processing: [Payment provider(s) — configure in admin].
- Hosting and infrastructure: [Hosting / infrastructure provider(s) — configure in admin].
- Transactional email: [Transactional email provider(s) — configure in admin].
- Analytics (consent-based): [Analytics provider(s) — configure in admin].
- Advertising and measurement (consent-based): [Advertising provider(s) — configure in admin].
- Professional advisers, auditors and authorities where legally required.
- We do not sell personal data. The current list of technologies and cookies is maintained in our Cookie Policy.
6. International transfers
Our providers may process data outside your country, including outside the EEA or the UK. Where that happens we rely on an adequacy decision, Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with additional safeguards where needed. You can request details of the mechanism used for a specific provider.
7. Retention
[Retention schedule — e.g. order and tax records kept for the statutory period, marketing data until you opt out, consent logs kept as proof of compliance]
In general: account data is kept while your account is active; order, invoice and tax records are retained for the statutory period; custom-order briefs and deliverables are kept so you can re-download them; consent logs are retained as evidence of compliance; support messages are kept for a limited period after resolution.
8. Security
We use encryption in transit, access control and role-based administration, row-level database security so customers can only read their own records, private storage with short-lived download links, audit logging of sensitive administrative actions, and data minimisation (for example we store a random visitor identifier rather than tracking identities across the web).
9. Your rights
You can start most requests yourself in the Privacy Center at /account/privacy, or email [privacy@yourdomain.com]. We respond within the period required by the applicable law (normally one month).
- Access a copy of your personal data, and correct inaccurate data.
- Request deletion where no legal retention duty applies (accounting and tax records cannot be deleted early).
- Restrict or object to certain processing, including profiling for marketing.
- Withdraw consent for cookies or marketing at any time, without affecting past lawful processing.
- Data portability for data you provided under a contract or consent.
- Lodge a complaint with your local data protection authority, including our lead supervisory authority: [Lead supervisory authority / data protection regulator].
- Where applicable under US state privacy laws, opt out of sale/sharing and targeted advertising, and appeal a refused request.
10. Cookies and similar technologies
We ask for consent before loading any non-essential cookie or script. Details of each category, provider and cookie duration are in our Cookie Policy, and your choices can be changed at any time through the Cookie Settings link in the footer.
11. Children
Our marketplace is not directed at children. We do not knowingly collect data from children below the minimum age required by local law. Contact us if you believe a child has provided us data.
12. Changes to this policy
This policy is versioned with an effective date shown at the top of the page. If we make a material change to how we use cookies or personal data, we update the version and, where required, ask for your consent again.
13. Contact
Privacy: [privacy@yourdomain.com] · Support: [support@yourdomain.com] · Postal: [Registered address, city, postal code, country].
Placeholders in square brackets must be replaced with the operator's registered legal details before publication. Contact: [privacy@yourdomain.com] · [Registered address, city, postal code, country]