Effective date: January 1, 2026 · Last updated: May 1, 2026
1. Introduction
Hetoli Marketing ("we," "us," or "our") is a digital marketing agency providing cold email outreach, ecommerce email marketing, social media management, and B2B lead generation services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at hetoli.com, contact us, or use our services.
We comply with applicable data protection laws including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), the UK Data Protection Act, and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
2. Information we collect
Information you provide to us
- Contact information: Name, email address, phone number, company name, and job title when you submit a contact form, book a discovery call, or sign a service agreement.
- Communications: Messages you send us via email, contact form, or scheduled calls.
- Payment information: If you become a client, billing details processed through our payment provider (Stripe). We do not store full payment card numbers on our servers.
- Service-related data: For clients, we receive ICP definitions, brand assets, account credentials (when needed), and historical performance data necessary to deliver our services.
Information collected automatically
- Usage data: IP address, browser type, device information, pages viewed, time spent on pages, referring URLs.
- Cookies and similar technologies: We use cookies for analytics, performance, and basic functionality. See our Cookies section below for details and opt-out options.
3. How we use your information
We use your information for the following purposes:
- To provide and deliver our digital marketing services to clients
- To respond to inquiries, schedule discovery calls, and send proposals
- To process payments and manage billing
- To send service-related communications (account updates, performance reports, billing notices)
- To send marketing communications (only with your consent — you can unsubscribe at any time)
- To improve our website, services, and client experience
- To comply with legal obligations and protect our legitimate business interests
4. Legal basis for processing (GDPR)
If you are located in the European Economic Area (EEA) or United Kingdom, our legal basis for collecting and using your personal information depends on the context:
- Contract: Processing necessary to deliver services under a signed agreement.
- Legitimate interest: Responding to inbound inquiries, improving our website, and protecting our business.
- Consent: Sending marketing communications and setting non-essential cookies.
- Legal obligation: Complying with tax, accounting, and regulatory requirements.
5. How we share your information
We do not sell your personal information. We share it only in these limited circumstances:
- Service providers: Vetted third-party tools we use to deliver our services — including ESPs (Klaviyo, Mailchimp), cold email platforms (Smartlead, Instantly), CRMs, payment processors (Stripe), analytics providers, and cloud hosting (AWS, Google Cloud). All providers are contractually bound to data protection terms.
- Legal requirements: If required by law, court order, or to protect our rights and the rights of others.
- Business transfers: In connection with any merger, acquisition, or sale of assets — with notice to affected users.
6. Data retention
We retain personal information only as long as necessary to fulfill the purposes outlined in this policy. Specific retention periods:
- Inquiry contacts: Up to 24 months after last interaction
- Active client data: For the duration of the engagement plus 7 years for tax and accounting purposes
- Marketing subscribers: Until you unsubscribe
- Website analytics: Up to 26 months
7. Your rights
Depending on your location, you may have the following rights regarding your personal information:
- Access: Request a copy of personal information we hold about you
- Correction: Request that we correct inaccurate or incomplete information
- Deletion: Request that we delete your personal information (subject to legal exceptions)
- Restriction: Request that we limit how we process your information
- Portability: Request a machine-readable copy of your information
- Objection: Object to processing based on legitimate interest or for marketing
- Withdraw consent: Withdraw consent for processing where consent is the legal basis
To exercise any of these rights, email us at legal@hetoli.com. We respond within 30 days.
8. Cookies and tracking
Our website uses cookies and similar tracking technologies for the following purposes:
- Strictly necessary cookies: Required for basic site functionality. Cannot be disabled.
- Analytics cookies: Help us understand how visitors use the site (Google Analytics or similar). You can opt out via your browser settings.
- Performance cookies: Help us improve site speed and usability.
You can control cookies through your browser settings. Disabling certain cookies may affect site functionality.
9. Security
We use industry-standard technical and organizational measures to protect your personal information, including encryption in transit (TLS), access controls, and regular security audits. No system is 100% secure, but we work hard to protect your data and notify you promptly of any breach affecting your information, as required by law.
10. International transfers
We are based in Pakistan and serve clients worldwide. Your information may be transferred to and processed in countries outside your home country, including the United States and EU member states. For transfers from the EEA/UK, we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms.
11. Children's privacy
Our services are not directed to individuals under 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us immediately.
12. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent version. Material changes will be communicated by email (for clients and subscribers) and via a banner on our website.
13. Contact us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at: