Privacy Policy

Version: 11 October 2026.

Who is responsible

Online Marketing Kings SRL, operating Social Hulk, is the controller for the personal data processing described here, at Sos. Mihai Bravu 255, 030171 Bucharest, Romania, Trade Register J40/9403/2019, CUI 39465419 and VAT RO39465419. For privacy questions and requests, contact data@socialhulk.com.

This notice covers visits, enquiries, purchases and use of Social Hulk's services. Payment providers and third-party platforms may act as separate controllers for their own processing; their notices explain that processing.

Data, purposes and legal grounds

• Website delivery and security: IP address, requested URLs, time, browser/device information and technical error or security-event data are used as necessary to deliver requested pages, prevent abuse and investigate incidents. The relevant ground is our legitimate interest in reliable, secure operation under Article 6(1)(f), subject to a balancing assessment; this does not justify unrelated optional tracking (GDPR, Articles 6 and 13).
• Enquiries: Your name, email, selected subject, message and associated technical metadata are used to answer and manage your request. The relevant ground is Article 6(1)(b) where necessary for requested pre-contract steps or an existing contract, or Article 6(1)(f) for other legitimate correspondence (GDPR, Articles 6 and 13).
• Orders and accounts: Identity/contact details, billing address, order contents, prices, tax information, account identifiers, payment status and necessary authentication or transaction references are used to conclude and perform the contract. Contract administration relies on Article 6(1)(b), while required accounting/tax processing relies on Article 6(1)(c) (GDPR, Articles 6 and 13).
• Service fulfilment: Campaign materials, landing-page URLs, platform identifiers, authorised access, scheduling information and other data you provide for the purchased service are used only for the agreed purpose. Where Social Hulk processes your customers' or users' personal data on your instructions, the parties must assess controller/processor roles and establish the necessary Article 28 agreement rather than treating these terms as a substitute (GDPR, Article 28).
• Claims and disputes: Relevant correspondence, fulfilment evidence and transaction records may be used to establish, exercise or defend legal claims or comply with a legal obligation. The appropriate ground is Article 6(1)(f) or 6(1)(c), depending on the purpose (GDPR, Articles 6 and 17).
• Optional statistics and attribution: Where enabled lawfully, referral, device, visit and event information may be used to understand site and purchase journeys. Non-essential terminal storage/access requires prior consent unless a specific statutory exception applies, and consent-based personal-data processing relies on Article 6(1)(a) (Romanian Law 506/2004, Article 4, GDPR).

Contacting us is not consent to receive advertising. Optional statistics and attribution are separate choices, not a condition of getting a reply.

Contact form, WordPress and WooCommerce

Social Hulk uses WordPress/WooCommerce for the shop and Jetpack for the contact form, as observed on the website. Jetpack's documentation explains that submissions are stored in the site's database and emailed to the form owner, and that enabled Akismet checks can receive submission content, contact details, IP address and user-agent data (Jetpack's privacy documentation).

Contact enquiries are sent to sales@socialhulk.com and also delivered to the team's support@socialhulk.com mailbox through the local mail route. Use sales@socialhulk.com for questions about an enquiry, and data@socialhulk.com for privacy questions or to exercise your privacy rights.

Jetpack is connected to the site and site synchronization is enabled. Connected-site processing is separate from optional browser statistics; Automattic's visitor privacy notice explains contact submissions and site-activity information, and its Jetpack privacy centre explains feature-specific processing.

WooCommerce administers cart, checkout, orders and any customer account. Information you provide for an order is not made public merely because it is stored in the shop.

Payment recipients

PayPal and card payments through PayPal

When needed for a selected PayPal/card payment, PayPal receives the information required for checkout, transaction processing, authentication and fraud/risk checks; its notice describes transaction, customer, IP and device information and its own automated risk processing (PayPal privacy statement). The EU entity identified there is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, and the notice describes international processing and its binding corporate rules and other transfer mechanisms (PayPal privacy statement).

PayPal's own processing is governed by its notice and applicable relationship with you. The presence of a payment integration does not make all of its scripts on unrelated pages strictly necessary.

NOWPayments and cryptocurrency

For a selected cryptocurrency payment, the NOWPayments integration processes the order reference, amount, currencies, callback/return addresses and payment or wallet references. Its hosted-payment route can also receive the payer's first name and email address. The provider is FD Transfers LLC, Euro House, Richmond Hill Road, P.O. Box 2897, Kingstown, Saint Vincent and the Grenadines; its notices also describe technical data and, where requested, identity or AML verification information (NOWPayments privacy policy, FD Transfers terms).

Blockchain transaction information can be publicly visible according to the selected network's operation. Never send us wallet private keys or recovery phrases.

Saint Vincent and the Grenadines is not covered by an EU adequacy decision (European Commission adequacy list). FD Transfers' terms describe consent to data export and the merchant's obligation to establish the applicable customer-data grounds, but do not identify an EU standard-contractual-clause agreement for those transfers (FD Transfers terms, Section 23). We do not claim that those general terms establish an executed EU transfer-safeguard agreement for Social Hulk.

Accepting this notice or choosing a payment method is not blanket consent to an otherwise unsupported international transfer. You can contact data@socialhulk.com for information about the arrangements relevant to your payment; the checkout also offers the other available payment methods. The applicable protections and any narrowly available exception must be assessed under GDPR, Chapter V.

Bank transfer

For bank transfer, the relevant banks process payment and account information, and Social Hulk processes the reference and settlement information needed to match the transfer to your order. Those banks' own privacy notices apply to their processing.

Other recipients and externally loaded resources

Only people and providers with an appropriate role should receive personal data, such as staff handling enquiries and orders, hosting/email/backup providers, authorised technical support, necessary service suppliers, professional advisers and competent authorities where disclosure is required. Provider roles, confidentiality duties and processor contracts must reflect their actual activity under GDPR, Articles 13 and 28.

Hosting, server management and the server's local email service are supplied by MojoHost B.V., Prinsengracht 530, 1017 KJ Amsterdam, Netherlands. Our hosting order is for its AMS server service, and the production server is in the Netherlands; MojoHost describes its Amsterdam facilities in its Netherlands data-centre information.

The package includes managed backup capacity and technical management. MojoHost's data-processing addendum describes processing on customer instructions, subcontractors and conditional international transfer protections; its privacy policy describes its own customer/support processing. Dutch production hosting does not mean that every group-support or subcontractor operation takes place only in the Netherlands.

Wordfence protects the website, and its Security Network setting is enabled. The provider is Defiant, Inc.; its policy describes IP/device information, international processing and its stated contractual transfer safeguards (Wordfence privacy policy).

The website loads resources from c0.wp.com, fonts.googleapis.com and Fontshare. Optional stats.wp.com and pixel.wp.com requests depend on your statistics choice, while PayPal scripts are used in payment checkout rather than on unrelated Home, product or cart pages (Social Hulk). Loading an external resource exposes the network information needed to deliver it, including IP address, and may expose browser or referrer details depending on the request.

Automattic's Jetpack privacy centre explains processing associated with Jetpack features and connected sites. Payment providers and communication services explain their own processing in their respective notices.

If you choose to follow a Telegram link or use another third-party communication service, that service processes data under its own terms. Do not send identity documents, credentials or sensitive records through a channel merely because it appears on a contact page.

Cookies and similar technologies

Essential storage may be needed for cart/session state, authentication or security of the service you request. The strict-necessity exemption does not automatically cover attribution, marketing measurement or every third-party payment signal under Romanian Law 506/2004, Article 4(6).

The table below lists the choice cookie and optional tracking storage identified on Social Hulk. Optional storage depends on your selected purposes. The durations describe browser storage, not the retention of orders or data on a provider's servers.

Storage	Purpose	Browser duration
shx_consent	Records the version, time and your independent statistics/attribution choices	180 days
shx_cart_line_count	Necessary shopping state: number of product lines in your cart, so cached pages do not display another visit's cart badge	Shopping-session lifetime; browser session where no fixed session expiry is supplied
sbjs_current, sbjs_first, sbjs_current_add, sbjs_first_add, sbjs_migrations, sbjs_udata	Source/referral and visit attribution	Session
sbjs_session	Visit/session attribution	Approximately 30 minutes
tk_or	Automattic referral/attribution	Approximately 400 days
tk_r3d	Automattic referral information	Approximately 3 days
tk_lr	Automattic referral information	Approximately 365 days
tk_ai	Automattic identifier/analytics	Approximately 365 days in the audited browser

Jetpack describes tk_ai as an analytics identifier, and its general examples may use different durations from the installed configuration (Jetpack cookie documentation). Deleting browser cookies does not also delete order records or information already received by a provider.

You can reject optional processing, accept both purposes or manage statistics and attribution separately in the live choice interface on Social Hulk. Use “Cookie settings” to change or withdraw your choice; the site then stops future optional requests for disabled purposes and clears known first-party tracking cookies, while necessary shopping, payments, enquiries and security remain separate.

Accepting the terms, continuing to browse or using the contact form is not consent to optional tracking under GDPR, Article 7.

International processing

Some recipients can process information outside the EEA, as described in the PayPal notice, the Automattic notice and the NOWPayments notice. Not all countries have an EU adequacy decision, and a vendor's country of incorporation is not a verified list of every processing or backup location.

For MojoHost processing outside a protected region, its published DPA requires appropriate transfer protections and, in the circumstances described in Clause 4.2, incorporates the applicable EU standard contractual clauses; its annex distinguishes controller-to-processor and processor-to-subprocessor roles and identifies the US group entity Easy Online Solutions, Ltd. (MojoHost DPA). The DPA is publicly available at that address, and requests about the contractual safeguards applicable to your data can be sent to data@socialhulk.com.

The linked PayPal, Automattic and Wordfence notices explain their respective international-processing arrangements; they are not a blanket certification of every Social Hulk transfer. The distinct NOWPayments position is explained in the cryptocurrency section above. Applicable safeguards or a narrowly available exception remain required under GDPR, Articles 44–49.

Retention

Retention depends on the purpose of the data, the customer relationship, applicable recordkeeping obligations and any specific claim. The periods or criteria for retention must be explained under GDPR, Article 13(2)(a).

• Orders, invoices and tax evidence: Retention follows the applicable accounting/tax obligation and any necessary dispute hold; where a transaction is reported through the EU OSS scheme, the relevant records must be kept for ten years from the end of the supply year, not every item of unrelated site data (European Commission VAT guidance).
• Enquiries: Retention is determined by completing the enquiry and any resulting contract, follow-up or relevant claim, rather than automatic permanent storage.
• Customer accounts and subscriptions: Retention depends on the active relationship and necessary closure/recordkeeping; closing access does not automatically delete invoices that must legally be retained.
• Technical/security records: Retention must be limited to the justified diagnostic or security purpose and any incident investigation.
• Managed hosting backups: The hosting package includes managed backups. MojoHost's published default is a weekly schedule with 28-day retention unless the service description, order or another written agreement specifies a different arrangement; this is a service default, not a claim that each scheduled backup has successfully completed (MojoHost SLA, Section 11). Removal from the active site does not necessarily remove every retained backup copy immediately, and backup expiry is not the same as invoice retention.
• Provider records: Independent recipients have their own retention obligations; Automattic specifically states a 28-day retention for Jetpack Stats logs, which is not a Social Hulk-wide retention period (Jetpack privacy documentation).

WooCommerce does not currently have automatic inactive-account deletion or order anonymisation periods configured. You can send a deletion request to data@socialhulk.com; the team must assess the request against the purposes and legal retention obligations above. This notice does not promise that a fixed automatic deletion schedule is already running.

Your rights and choices

Where the legal conditions apply, you may request access, correction, deletion, restriction, portability and objection to processing based on legitimate interests; consent may be withdrawn without affecting the lawfulness of prior processing (GDPR, Articles 15–21 and 7). An objection to direct marketing must be honoured, including related profiling (GDPR, Article 21).

Send a request to data@socialhulk.com with enough information to identify the relevant relationship. Additional identity information may be requested only where reasonably needed, and responses are normally due within one month, with a justified extension of up to two further months notified during the first month (GDPR, Article 12).

You may complain to a competent supervisory authority, including one in your place of habitual residence, work or the alleged infringement (GDPR, Article 77). In Romania, ANSPDCP provides complaint instructions and its online submission route.

Required data, decisions and updates

Providing enquiry information is voluntary, but we may be unable to answer without an email address or sufficient details. Necessary billing, fulfilment and tax information is required for the relevant purchase; optional tracking must not be a condition of obtaining an unrelated service.

Fraud and security checks may affect a payment or access attempt. PayPal describes its own automated risk processing in its privacy statement; this is separate from a decision by Social Hulk. If a decision raises a privacy concern, contact data@socialhulk.com and identify the payment or service concerned.

A future change to processing must be explained before it takes effect where legally required. Updating this notice is not consent to a new purpose, optional tracking or an unverified international transfer.