Privacy
statement.

Introduction

This Privacy Statement explains how HULO collects, processes, and protects your personal data, and how you can exercise your rights under the General Data Protection Regulation (GDPR).

HULO provides AI-powered solutions and services, including applications that process data for business and operational purposes for utilities. We are committed to safeguarding your personal information and ensuring compliance with all relevant privacy regulations. If you have any questions, you can contact us at privacy@hulo.ai.

What are personal data?

Personal data refers to any information that can be traced back to an individual, such as:

• Name
• Email address
• Phone number
• IP address
• Business or home address
• Payment information

For more details, check the official Data Protection Authority website.

Why does HULO use your personal data?

We process personal data for various purposes, including:

HULO maintains a data processing register for transparency and accountability.

Cookies

HULO uses cookies on its website. Some technologies may be used for essential analytics and performance monitoring.

Which cookie, and who receives it

We use one service, PostHog, and it stores the data on servers in the European Union. It counts which pages are read, it ties an enquiry to the pages you read before it, and it is also what carries a form you send us: an enquiry, a demo request or a newsletter sign-up reaches us as a PostHog event, which is why sending a form needs this cookie. There is no screen recording and no session replay. It is not needed to read this site.

When you write to us, the enquiry is passed on to HubSpot, which is where we keep customer records and answer from. That happens between the two services after you press Send. HubSpot sets nothing in your browser and does not know you were here until you write to us.

The cookie is first-party and lasts six months, as does your answer to the cookie question itself. We do not sell what it collects, and we run no advertising network on this site.

Having it deleted

Write to privacy@hulo.ai and we will delete what these cookies collected, along with any contact record they created. You do not have to give a reason, and section 08 sets out this and your other rights in full; section 05 says how long we keep data when you do not ask. Clearing the cookies in your browser stops the collection but does not remove what was already sent, so write to us for that.

You choose whether we may set them at all. The consent panel opens from Cookies at the bottom of every page, and withdrawing consent there is as easy as giving it. You can also manage your tracking preferences in your browser settings.

How long does HULO retain your data?

We store personal data only as long as necessary, considering:

• Legal requirements (e.g., tax laws, compliance regulations)
• Business relationships (e.g., customer, job applicant)
• Legal or dispute-related purposes

Specific retention periods

• Account data. Retained for the duration of your account, plus up to 2 years after account closure.
• Recruitment data. If an applicant is not hired, their data is deleted within 4 weeks unless agreed otherwise.
• Product improvement data. Retained for up to 5 years, but only with explicit consent.
• Aggregated & anonymized data. May be retained indefinitely for analytics and statistical purposes.

How does HULO protect your data?

We implement strict security measures to protect your data from loss, theft, or misuse:

• Access controls & encryption
• Monitoring & security audits
• Secure data storage & backups
• Multi-factor authentication (MFA) for system access
• Non-disclosure agreements (NDAs) with employees and partners
• Role-based access control (RBAC) for data access management

Only authorized employees and verified third-party service providers have access to personal data under strict confidentiality agreements.

Does HULO share your data?

HULO only shares data when necessary, such as:

• Legal requirements (e.g., compliance with regulations)
• Third-party service providers (e.g., cloud storage, payment processors)

Main data recipients

• IT service providers (hosting, cloud storage)
• Payment processors
• Legal advisors & accountants
• Regulatory authorities & courts

All external partners sign data processing agreements to ensure compliance.

International data transfers

HULO operates within the European Economic Area (EEA) to the extent possible. Any data transfers outside the EEA are subject to:

• EU Standard Contractual Clauses (SCCs)
• Adequate data protection mechanisms
• Explicit approval from the data processor or recipient

Your privacy rights

Under GDPR, you have the following rights:

• Access. Request a copy of your data.
• Correction. Fix inaccurate data.
• Erasure ("right to be forgotten"). Request deletion of your data.
• Objection. Object to processing of your data.
• Data portability. Receive your data in a structured format.

To exercise your rights, email privacy@hulo.ai. We will respond within one month. If an extension is needed, we will notify you accordingly.

Data breaches & security incidents

If you suspect a data breach, report it immediately to our Information Security Compliance Manager (ISCM) via privacy@hulo.ai.

Please include

• Your name & contact details
• A description of the incident
• The affected personal data
• How & when you discovered it

We will investigate and take necessary action immediately.

Questions & complaints

For privacy-related inquiries, contact privacy@hulo.ai. That address reaches our Information Security Compliance Manager (ISCM).

If you are dissatisfied with our response, you can file a complaint with your local Data Protection Authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

Updates to this privacy statement

HULO reserves the right to modify this statement at any time. Changes take effect upon publication on this page.

General terms & conditions

Our services are delivered under the NLdigital Terms, the standard terms of the Dutch trade association for the digital sector. The Dutch text is the binding one; the English text is a translation, provided so that a non-Dutch reader can review the same document.