Privacy policy

1. Controller

The controller responsible for processing personal data is:

Hulo Media – Josip Jelavic
Gewerbepark Süd 28, Top 9
8431 Gralla
Austria

Email: office@hulomedia.com
Website: www.hulomedia.com

This privacy policy explains which personal data we process, for what purposes, on what legal basis and what rights you have.

2. General principles

We process personal data exclusively on the basis of applicable legislation, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Telecommunications Act (TKG).

Personal data is processed only for a specific purpose, such as providing this website, communication, handling enquiries, preparing quotations, carrying out projects, performing contracts, invoicing, meeting legal obligations, IT security or improving our services.

We do not sell or rent personal data to third parties.

3. Legal bases for processing

Depending on its purpose, personal data is processed on the following legal bases:

• Article 6(1)(a) GDPR, where you have given consent.
• Article 6(1)(b) GDPR, where processing is necessary to perform a contract or take steps prior to entering into a contract.
• Article 6(1)(c) GDPR, where we are legally required to process the data.
• Article 6(1)(f) GDPR, where processing is necessary for legitimate interests, such as communication, IT security, documentation, enforcement of legal rights, or improvement of our website and services.

4. Data we process

Depending on your use of the website, contact with us or collaboration, the following data may in particular be processed:

• First and last name
• Email address
• Telephone number
• Business details
• Website, store or domain
• Project information and message content
• Invoice and payment details
• Technical data such as IP address, browser, device, operating system and time of access
• Marketing and tracking data, where the relevant consent has been given

5. Website operation, hosting and server log files

Our website is operated through Shopify. When you visit it, technical data may be processed automatically where necessary to provide the website securely, reliably and with full functionality.

This data may include:

• IP address
• Date and time of access
• Browser type and version
• Operating system
• Device type
• Referrer URL
• Pages and files accessed
• HTTP status codes
• Volume of data transferred
• Technical log data for troubleshooting and system security

This data is processed on the basis of our legitimate interest in the secure and uninterrupted operation of our website.

Further information about Shopify's data processing is available at: https://www.shopify.com/legal/privacy

6. Contact and contact forms

If you contact us through a contact form, by email, WhatsApp, telephone, video call or social networks, we process your details to handle your enquiry and communicate with you further.

This may include your name, email address, telephone number, business details, project information, message content and technical information.

Processing is based on steps prior to entering into a contract, performance of a contract or our legitimate interest in professional communication and handling enquiries.

Where a contact form is used on the website, the data entered is processed to handle the enquiry. Technical safeguards may be used to protect against misuse or spam.

Form details are processed through Shopify and transmitted for handling the enquiry to our internal CRM at crm.hulomedia.com . Automated notifications and process steps may use Make . Forms are protected against misuse using hCaptcha . The providers involved may process connection and usage data that is technically necessary.

7. Email communication

When we communicate by email, the data you provide is processed to handle your enquiry, communicate about a project, prepare quotations or perform a contract.

Please note that unencrypted emails may involve security risks. Complete protection against access by third parties cannot be guaranteed in email communication.

8. WhatsApp communication

If you voluntarily communicate with us through WhatsApp, your telephone number, communication content, metadata and other technical information may be processed by the relevant provider.

Using WhatsApp is voluntary. The provider's own privacy terms also apply to its processing of data.

9. Video conferences using Microsoft Teams or Zoom

Microsoft Teams, Zoom or comparable video conferencing services may be used for introductory calls, consultations, project meetings or internal coordination.

The following data may in particular be processed:

• Name and contact details
• Email address
• Meeting metadata
• IP address and technical connection data
• Audio and video data provided voluntarily
• Chat messages, if used during the meeting

Processing serves the relevant communication and is based on steps prior to entering into a contract, performance of a contract or our legitimate interest in efficient communication.

Conversations are recorded only where this has been expressly announced or appropriate consent has been given.

10. Cookies and consent

Our website may use cookies and similar technologies. Some cookies are technically necessary for basic website functions. Others serve analytics, marketing or optimisation purposes.

Non-essential cookies are set only if you have consented through the cookie banner. You can change or withdraw your consent at any time.

Details of individual cookies, categories, storage periods and withdrawal options may be shown in the relevant cookie notice or consent banner.

We use the consent manager Consentmoto manage your consent. Your choice is stored so it can be taken into account on subsequent page visits.

11. Analytics, tracking and marketing

We may use analytics and marketing tools such as Meta Pixel, Meta Conversions API, Google Analytics or comparable services to understand how our website is used, measure advertising campaigns and improve our content.

Depending on your consent and the technical configuration, the following data may be processed:

• Page views
• Clicks and interactions
• Technical device information
• Pseudonymised events
• Conversion data
• Campaign performance information

This data is not used to provide guarantees of commercial outcomes. Advertising results depend on many factors, including the offering, market, budget, website, audience and competition.

12. Meta Pixel, Conversions API and remarketing

We may use services from Meta Platforms, in particular Meta Pixel, Meta Conversions API, conversion measurement, Custom Audiences and remarketing functions.

These services may help evaluate advertising campaigns, analyse audiences statistically, optimise campaigns and re-engage people who have interacted with our website or content.

Processing takes place only within the applicable legal requirements and, where necessary, on the basis of your consent.

Further information is available in Meta's privacy policy: https://www.facebook.com/privacy/policy

13. Social media profiles

We may maintain a presence on social networks such as Facebook and Instagram. When you visit our profiles or interact with our content, personal data may be processed by the relevant platform operator.

We have only limited influence over data processing by these platforms. The respective providers' privacy terms also apply.

Where we receive enquiries or communicate through social media, we process the data provided to handle the relevant enquiry.

14. Use of AI tools

We may use AI-assisted tools in our work, for example for drafting text, structuring information, analysis, generating ideas, coding assistance, translation, research, internal efficiency processes or preliminary creative work.

We take care not to enter personal data, sensitive information, credentials, internal business figures or confidential project details into AI systems unnecessarily.

Where AI tools are used to support projects, they are used only to the extent necessary and with appropriate data protection and security measures.

AI outputs are not used as binding decisions without review. No solely automated decision with legal effects is made.

15. Project work, stores and client systems

When we create, revise or manage online stores, landing pages, Meta Ads campaigns or digital systems for clients, project-related data may be processed.

This includes in particular:

• Credentials, where necessary
• Store, website or campaign data
• Product information
• Business information
• Technical settings
• Communication and project information
• Analytics and performance data

Sensitive payment data relating to end customers is processed by the respective payment providers, not by us.

16. Shopify in client projects

In projects involving Shopify stores, Shopify may process data directly. This applies in particular to store data, customer data, order information, technical data and payment information.

Shopify processes certain data as an independent controller or within the relevant contractual arrangements and system settings.

Further information is available at: https://www.shopify.com/legal/privacy

17. Payment processing

For paid services, we process invoice and payment data to perform the contract, maintain accounts and fulfil statutory retention obligations.

Depending on the payment method, payment service providers, banks, PayPal, Stripe, Shopify Payments or comparable providers may be involved.

Payment providers generally process data as independent controllers. Their own privacy terms also apply.

18. Technical resources, fonts and CDNs

Our website may use technical resources such as fonts, scripts, stylesheets, content delivery networks (CDNs), Shopify assets or comparable services to deliver content correctly, securely and quickly.

Technically necessary connection data such as IP address, browser information, device data and time of access may be processed.

Where external fonts such as Google Fonts or comparable services are used, processing is based on technical provision or, where required, consent. Where possible, fonts may be hosted locally.

19. Processors and service providers

We may work with selected service providers, including in particular:

• Shopify for website and store systems
• Meta Platforms for advertising, tracking and campaign measurement
• Google for communication, analytics or project organisation
• Microsoft Teams or Zoom for video conferences
• PayPal, Stripe, Shopify Payments or banks for payment processing
• The internal Hulo CRM for handling and documenting enquiries
• Make for automated transfers and notifications
• hCaptcha to protect forms against misuse
• Consentmo for managing cookie consent
• AI and automation tools for internal support
• Hosting, security, CDN, font and technical infrastructure providers
• Other technical providers where needed for a project

Service providers are involved only to the extent necessary and process data on the basis of appropriate legal, technical and organisational safeguards.

20. Disclosure of data

Personal data is disclosed only where:

• It is necessary to perform a contract
• You have given consent
• There is a legal obligation
• Technical service providers are needed for implementation
• We need to assert legitimate interests

Data is not disclosed for third-party advertising purposes.

21. International data transfers

Some service providers may process data outside the European Union or the European Economic Area, particularly in the United States or other third countries.

Such transfers take place only where there is an adequacy decision or appropriate safeguards are used, such as standard contractual clauses, additional protective measures or comparable legal mechanisms.

22. Retention periods

We retain personal data only for as long as necessary for the relevant purpose or required by statutory retention obligations.

Retention periods depend in particular on:

• The duration of communication
• The duration of the collaboration
• Statutory retention obligations
• Accounting and tax obligations
• Legitimate interests in documentation or enforcement of legal rights

Invoice and accounting-related data is generally retained for seven years in accordance with statutory retention obligations.

Contact enquiries are deleted once they are no longer needed and no legal obligations or legitimate interests require continued retention.

23. Data security

We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.

These measures may include:

• SSL/TLS encryption of the website
• Access restrictions
• Careful handling of credentials
• Regular software and security updates
• Organisational measures to maintain confidentiality
• Appropriate backup and protective measures

24. Your rights

Under the GDPR, you have in particular the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to withdraw consent
• Right to object to certain processing
• Right not to be subject to a solely automated decision

You can send requests at any time to office@hulomedia.com .

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the Austrian Data Protection Authority.

25. Withdrawal and objection

You can withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal.

Where processing is based on legitimate interests, you may object to that processing subject to the statutory requirements.

26. Automated decisions and profiling

No solely automated decision-making or profiling within the meaning of Article 22 GDPR takes place.

27. Changes to this privacy policy

We reserve the right to update this privacy policy if technical, legal or organisational changes arise.

The current version is available on this website.

Last updated: September 2026.