Skip to content
MyHissab MyHissab

Legal information

Privacy policy

MyHissab processes personal data to provide the invoicing service. This page explains which data, for what purpose and what your rights are.

Last updated: [To be completed by the publisher]

1. Data controller

The controller is the site publisher identified in the “Site publisher” box. For client data entered by a user, the user is the controller and MyHissab acts as a processor.

2. Data collected

When the account is created and during use, the following data is processed:

  • User identity: first and last name (French and Arabic), e-mail address, phone, business address, logo.
  • Professional identifiers: auto-entrepreneur card number, ANAE activity domain, NIF.
  • Data of the user’s clients: name or company name, contact, address, phone, e-mail, RC, NIF, NIS, AI.
  • Commercial documents (quotes, invoices, credit notes, delivery notes) and their amounts.
  • Technical data: IP address, browser, login logs, session cookies.
  • In-house audience measurement, with no cookie and no third-party service: a technical log of the pages visited by signed-in users (page address without its parameters or access keys, request type (viewing or submitting a form), date, result, name of the previous page of the site, device type), kept 90 days then erased, and deleted with the account; anonymous, aggregated visit statistics for the public pages (no IP address or browser identifier is kept); anonymous counters of the sign-up journey (sign-ups, verified addresses, first documents, deleted accounts) and, when an account is deleted, an anonymised summary of its journey (account age, number of actions, last screens viewed, with no identity or page address), kept 90 days.

3. Purposes

This data is used to provide the service (generating and archiving documents), manage the account and subscription, answer support requests, keep the service secure and meet legal invoicing obligations.

No data is sold. Data entered in the application (account, clients, documents) is never used for advertising.

The public content pages display Google AdSense ads, funded by advertising (see “Cookies”).

Measuring visits to the site and improving the journey of sign-up and use, from the in-house audience measurement described above, with no advertising or profiling.

4. Legal basis

Processing is based on the performance of the contract (the terms of use), on the publisher’s legitimate interest (security, service improvement) and on legal invoicing obligations, within the framework of Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data.

Formalities completed with the national data protection authority: [To be completed by the publisher].

5. Retention period

Account data is kept for as long as the service is used, then deleted or anonymised after the account is closed, subject to the legal retention periods for accounting documents.

Precise durations (account, documents, technical logs, contact messages): [To be completed by the publisher].

6. Recipients and processors

Data is accessible to the publisher’s team, within the limits of its duties, and to the technical providers required for the service:

  • Hosting provider: [To be completed by the publisher].
  • SofizPay, for payment by CIB or Edahabia card (name, phone, e-mail and transaction amount).
  • E-mail delivery provider: [To be completed by the publisher].
  • Google Ireland Limited (Google AdSense), for ads on public pages: cookie or device identifiers, IP address, pages viewed. Google policy: https://policies.google.com/technologies/ads

7. Your rights

You can access your data, correct it, request its deletion or object to a processing by writing through the contact form or to the publisher’s e-mail address. A reply is given within a reasonable time.

A user’s clients exercise their rights with that user; MyHissab assists if necessary.

8. Cookies

The signed-in area of the application only uses technical cookies: session, protection against request forgery, language and display preferences.

The public content pages (home, guides, information pages) display Google AdSense ads. Google and its partners may set or read advertising cookies there to serve and measure ads, prevent fraud and, with your consent, personalise ads.

Visitors from the European Economic Area, the United Kingdom and Switzerland: a certified consent message (IAB TCF framework) records your choice before any personalised advertising cookie. Refusing does not prevent access to the content; non-personalised ads may then be shown. You can change your choice from that message and manage personalisation at https://adssettings.google.com

Possible audience measurement tools and their configuration: [To be completed by the publisher].

9. Security

Exchanges are encrypted (HTTPS), passwords are stored hashed, access is logged and regular backups are made. In the event of an incident affecting your data, you will be informed as soon as possible.