Privacy Policy

Last updated: 1 April 2026 · Effective date: 1 April 2026

1. Who we are

HOCH Capital Marketing ("HOCH", "we", "us", "our") is a digital marketing agency with offices at Kolonakiou, Limassol 4103, Cyprus. We can be reached at info@hochcapital.net or on +357 25 327100.

This Privacy Policy explains how we process personal data in connection with our website (hochcapital.net), our marketing services, and the Google Ads and advertising platform integrations we operate on behalf of our clients. We act as a data controller for data we collect directly, and as a data processor for data we process on behalf of our clients.

2. Personal data we collect

2.1 Information you provide directly

• Contact information — name, email address, phone number, company and role when you fill out a contact, audit request or newsletter form.
• Project information — content of the briefs, messages and attachments you send us.
• Engagement data — invoices, service agreements, NDAs and other contractual records for clients.

2.2 Information collected automatically

• Usage data — pages viewed, referring source, approximate location (country/region), device type, browser, and interactions with our site.
• Cookies and similar technologies — for functional operation, analytics (Google Analytics 4) and, where you consent, marketing attribution.

2.3 Information collected when we manage advertising on your behalf

When you engage us to manage Google Ads, paid social or analytics on your behalf, we may access, process and store data that belongs to you and your users. This can include:

• Google Ads account data (campaigns, keywords, budgets, creatives, reports).
• Analytics and conversion data (GA4, server-side tagging, enhanced conversions).
• First-party customer lists you authorise us to upload as audiences (e.g. Customer Match).
• Creative assets, copy and brand materials you share with us.

We process this data strictly under instruction from you, in accordance with our service agreement and this policy.

3. Google API / Google Ads API compliance

If you grant us access to your Google Ads account via the Google Ads API or Google account OAuth, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We use Google user data only to provide the services you have engaged us for (e.g. Google Ads management, reporting, optimisation).
• We do not transfer Google user data to any third party except as necessary to provide those services, to comply with law, or with your explicit consent.
• We do not use Google user data for advertising our own services or for profiling.
• We do not allow humans to read Google user data except (i) with your explicit consent, (ii) for security purposes such as investigating abuse, (iii) to comply with applicable law, or (iv) where data is aggregated and used for internal operations in line with the policy.
• You can revoke our access to your Google Ads account at any time through your Google Account permissions page.

4. Why we process personal data (legal bases)

• Performance of a contract — to deliver the services we have agreed to deliver for clients.
• Legitimate interests — to respond to enquiries, improve our services, prevent fraud and secure our systems.
• Consent — for non-essential cookies, newsletter subscriptions and marketing communications (you can withdraw consent at any time).
• Legal obligation — to comply with tax, accounting and other regulatory requirements.

5. How we share personal data

We do not sell your personal data. We share it only with:

• Service providers we use to run our business — including cloud hosting, analytics, CRM, email, accounting and payment processors — under written data processing agreements.
• Advertising platforms (Google Ads, Meta, TikTok, LinkedIn, X, etc.) where we operate campaigns on your or your users' behalf, in line with your instructions.
• Professional advisers such as lawyers, auditors and insurers where reasonably required.
• Authorities where disclosure is required by law or to protect our legal rights.

6. International transfers

Some of our service providers (including Google) are based outside the European Economic Area. Where we transfer personal data outside the EEA, we rely on adequacy decisions of the European Commission or Standard Contractual Clauses approved by the Commission, together with appropriate supplementary measures.

7. How long we keep personal data

• Enquiry and newsletter data: up to 24 months from last interaction, or until you unsubscribe.
• Client engagement data: for the duration of the engagement and up to 7 years thereafter, in line with Cyprus tax and accounting law.
• Google Ads and platform access: only for the duration of the service engagement; access is revoked at the end.
• Website analytics: typically 14 months in GA4, in anonymised form.

8. Your rights

Under the EU/UK GDPR and Cyprus data protection law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data (the "right to be forgotten"), subject to legal retention obligations.
• Restrict or object to the processing of your data.
• Receive your data in a portable, machine-readable format.
• Withdraw your consent at any time where processing is based on consent.
• Lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus or your local supervisory authority.

To exercise any of these rights, contact us at info@hochcapital.net.

9. Cookies

Our website uses cookies and similar technologies. Essential cookies are required for the site to function; analytics and marketing cookies are loaded only with your consent through our consent banner. You can change your preferences at any time by clearing cookies for our domain in your browser.

10. Security

We maintain administrative, technical and organisational measures designed to protect personal data — including encryption in transit, access controls, security monitoring, staff confidentiality obligations and regular security reviews. No system is perfectly secure; if we become aware of a data breach affecting you, we will notify you and the relevant authorities as required by law.

11. Children

Our services are intended for businesses and professionals. We do not knowingly collect personal data from children under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be notified to active clients directly.

13. Contact us

If you have any questions about this Privacy Policy or our handling of personal data, please contact:

HOCH Capital Marketing
Kolonakiou, Limassol 4103, Cyprus
Email: info@hochcapital.net
Phone: +357 25 327100