Privacy policy

1. Controller

The controller responsible for processing personal data is:

Hulo Media e.U. – Proprietor Josip Jelavić
Gewerbepark Süd 28, Top 9
8431 Gralla
Austria

Email: office@hulomedia.com
Website: www.hulomedia.com

This privacy policy explains which personal data we process, for what purposes, on what legal basis and what rights you have.

2. General principles

We process personal data exclusively on the basis of applicable legislation, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Telecommunications Act (TKG).

Personal data is processed only for a specific purpose, such as providing this website, communication, handling enquiries, preparing quotations, carrying out projects, performing contracts, invoicing, meeting legal obligations, IT security or improving our services.

We do not sell or rent personal data to third parties.

3. Legal bases for processing

Depending on its purpose, personal data is processed on the following legal bases:

• Article 6(1)(a) GDPR, where you have given consent.
• Article 6(1)(b) GDPR, where processing is necessary to perform a contract or take steps prior to entering into a contract.
• Article 6(1)(c) GDPR, where we are legally required to process the data.
• Article 6(1)(f) GDPR, where processing is necessary for legitimate interests, such as communication, IT security, documentation, enforcement of legal rights, or improvement of our website and services.

4. Data we process

Depending on your use of the website, contact with us or collaboration, the following data may in particular be processed:

• First and last name
• Email address
• Telephone number
• Business details
• Website, store or domain
• Project information and message content
• Invoice and payment details
• Technical data such as IP address, browser, device, operating system and time of access
• Marketing and tracking data, where the relevant consent has been given

5. Website operation, hosting and server logs

Our website is provided through Shopify. When you visit, technical connection data is processed, including your IP address, date and time, browser, operating system, requested pages and files, and error and security information. This is necessary to deliver and protect the website and is based on Article 6(1)(f) GDPR.

Shopify also provides infrastructure and delivers images, fonts and other files. Optional analytics and advertising are controlled separately through your consent. Further information: Shopify privacy policy.

6. Contact and enquiry forms

When you contact us, we process the details you provide to answer your enquiry, prepare an offer or perform an agreed service. Depending on the form, this includes your name, email address, telephone number, business and website details, selected service and message.

Our custom enquiry forms send the information to our internal CRM at crm.hulomedia.com. We also record the enquiry’s entry point and source; marketing campaign data is stored and attributed only with the relevant consent. Handling an enquiry does not depend on marketing consent.

The legal bases are Article 6(1)(b) GDPR for pre-contractual steps or contract performance and Article 6(1)(f) GDPR for other business enquiries. Make may be involved in notifications and internal workflows. Our custom forms use technical spam protection. For native Shopify forms, Shopify may also use hCaptcha, which processes technical connection data for security. Further information: hCaptcha privacy policy.

7. Email communication

When we communicate by email, the data you provide is processed to handle your enquiry, communicate about a project, prepare quotations or perform a contract.

Please note that unencrypted emails may involve security risks. Complete protection against access by third parties cannot be guaranteed in email communication.

8. WhatsApp communication

If you voluntarily communicate with us through WhatsApp, your telephone number, communication content, metadata and other technical information may be processed by the relevant provider.

Using WhatsApp is voluntary. The provider's own privacy terms also apply to its processing of data.

9. Video conferences using Microsoft Teams or Zoom

Microsoft Teams, Zoom or comparable video conferencing services may be used for introductory calls, consultations, project meetings or internal coordination.

The following data may in particular be processed:

• Name and contact details
• Email address
• Meeting metadata
• IP address and technical connection data
• Audio and video data provided voluntarily
• Chat messages, if used during the meeting

Processing serves the relevant communication and is based on steps prior to entering into a contract, performance of a contract or our legitimate interest in efficient communication.

Conversations are recorded only where this has been expressly announced or appropriate consent has been given.

10. Cookies and consent

We use Consentmo to manage your selection for necessary, analytics, marketing and preference technologies and pass it to Shopify. Storing your choice is technically necessary. Necessary functions rely on section 165(3) of the Austrian Telecommunications Act 2021 and, where personal data is processed, Article 6(1)(f) GDPR.

Optional analytics and marketing technologies rely on your consent under section 165(3) of that Act and Article 6(1)(a) GDPR. You can reject optional categories, make a selection and change it later. Our two custom advertising pixels currently require both marketing and analytics consent in Shopify.

Open Cookie settings to change your choice or withdraw consent for the future. Details about technologies and storage periods appear in our Cookie policy. Provider information: Consentmo privacy policy.

11. Usage analytics and campaign attribution

Shopify provides usage analytics. We also use the advertising pixels described below. With the relevant consent, page views, browser and device information, timestamps, campaign identifiers and conversion events are processed to understand website use and advertising performance.

Our website code temporarily stores permitted campaign parameters in browser session storage and may associate them with an enquiry. This campaign storage is cleared when marketing consent is withdrawn. Google Analytics is not currently integrated as a separate analytics service on this website.

12. Advertising measurement with Meta and OpenAI

Meta

We use the Meta Pixel and Shopify’s Facebook and Instagram integration for advertising measurement and attribution. Page views, form completions, URL and campaign information, timestamps, browser data, IP addresses and cookie identifiers may be sent to Meta. The Shopify integration may also send events server-side through the Conversions API. Recipients include Meta Platforms Ireland Limited; processing by affiliated companies, including in the USA, is possible.

Our custom Meta pixel reports page views and successful enquiries. The event parameters defined in that custom code do not include message contents, names, email addresses or telephone numbers. Meta may combine signals with information it already holds and use them for advertising measurement and optimisation. Further information: Meta privacy policy.

OpenAI / ChatGPT Ads

We also use the OpenAI Measurement Pixel to measure advertising in ChatGPT. Our code reports form submissions as enquiry events. Event type and time, advertising click and browser identifiers, the originating website and technical connection data may be processed. Our custom event call does not contain form contents or contact details.

The recipient is OpenAI. The service may process data outside the EEA. See the OpenAI privacy policy for information about processing and the relevant OpenAI entities, and the Measurement Pixel documentation for technical details.

Advertising measurement is based on your consent, which you can withdraw in Cookie settings. See our Cookie policy and sections 21 and 22 below for retention and international transfer information.

13. Social media profiles

We may maintain a presence on social networks such as Facebook and Instagram. When you visit our profiles or interact with our content, personal data may be processed by the relevant platform operator.

We have only limited influence over data processing by these platforms. The respective providers' privacy terms also apply.

Where we receive enquiries or communicate through social media, we process the data provided to handle the relevant enquiry.

14. Use of AI tools

We may use AI-assisted tools in our work, for example for drafting text, structuring information, analysis, generating ideas, coding assistance, translation, research, internal efficiency processes or preliminary creative work.

We take care not to enter personal data, sensitive information, credentials, internal business figures or confidential project details into AI systems unnecessarily.

Where AI tools are used to support projects, they are used only to the extent necessary and with appropriate data protection and security measures.

AI outputs are not used as binding decisions without review. No solely automated decision with legal effects is made.

15. Project work, stores and client systems

When we create, revise or manage online stores, landing pages, Meta Ads campaigns or digital systems for clients, project-related data may be processed.

This includes in particular:

• Credentials, where necessary
• Store, website or campaign data
• Product information
• Business information
• Technical settings
• Communication and project information
• Analytics and performance data

Sensitive payment data relating to end customers is processed by the respective payment providers, not by us.

16. Shopify in client projects

In projects involving Shopify stores, Shopify may process data directly. This applies in particular to store data, customer data, order information, technical data and payment information.

Shopify processes certain data as an independent controller or within the relevant contractual arrangements and system settings.

Further information is available at: https://www.shopify.com/legal/privacy

17. Payment processing

For paid services, we process invoice and payment data to perform the contract, maintain accounts and fulfil statutory retention obligations.

Depending on the payment method, payment service providers, banks, PayPal, Stripe, Shopify Payments or comparable providers may be involved.

Payment providers generally process data as independent controllers. Their own privacy terms also apply.

18. Fonts and technical resources

Our font files are delivered through this website or Shopify’s infrastructure. They are not loaded from the Google Fonts service, so displaying our fonts does not require requests to fonts.googleapis.com or fonts.gstatic.com.

Images, stylesheets and scripts are mainly delivered through Shopify. Necessary resources support secure website operation. Optional Meta and OpenAI advertising scripts are subject to the consent settings described above.

19. Service providers and recipients

This website uses Shopify for technical delivery, Consentmo for consent management, our internal Hulo CRM for enquiry handling, and Meta and OpenAI for consent-based advertising measurement. Shopify security functions may involve hCaptcha. Make may be used for internal notifications and workflows.

Communication and client projects may also involve the video, payment, AI and project providers described in the relevant sections. This does not mean their services are loaded merely by visiting this website.

Depending on the processing, providers act as processors or as independent or joint controllers. Appropriate agreements are required where processing takes place on our behalf. Provider information is linked in the relevant sections.

20. Disclosure of data

Personal data is disclosed only where:

• It is necessary to perform a contract
• You have given consent
• There is a legal obligation
• Technical service providers are needed for implementation
• We need to assert legitimate interests

Consent-based disclosure to advertising platforms is described in section 12.

21. International data transfers

Some service providers may process data outside the European Union or the European Economic Area, particularly in the United States or other third countries.

Such transfers take place only where there is an adequacy decision or appropriate safeguards are used, such as standard contractual clauses, additional protective measures or comparable legal mechanisms.

22. Retention periods

We retain personal data only for as long as necessary for the relevant purpose or required by statutory retention obligations.

Retention periods depend in particular on:

• The duration of communication
• The duration of the collaboration
• Statutory retention obligations
• Accounting and tax obligations
• Legitimate interests in documentation or enforcement of legal rights

Invoice and accounting-related data is generally retained for seven years in accordance with statutory retention obligations.

Contact enquiries are deleted once they are no longer needed and no legal obligations or legitimate interests require continued retention.

23. Data security

We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.

These measures may include:

• SSL/TLS encryption of the website
• Access restrictions
• Careful handling of credentials
• Regular software and security updates
• Organisational measures to maintain confidentiality
• Appropriate backup and protective measures

24. Your rights

Under the GDPR, you have in particular the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to withdraw consent
• Right to object to certain processing
• Right not to be subject to a solely automated decision

You can send requests at any time to office@hulomedia.com .

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the Austrian Data Protection Authority.

25. Withdrawal and objection

You can withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal.

Where processing is based on legitimate interests, you may object to that processing subject to the statutory requirements.

26. Automated decisions

We do not make solely automated decisions with legal or similarly significant effects within the meaning of Article 22 GDPR on the basis of your website visit. Consent-based advertising event analysis and attribution are described in section 12.

27. Changes to this privacy policy

We reserve the right to update this privacy policy if technical, legal or organisational changes arise.

The current version is available on this website.

Last updated: 6 October 2026.