Privacy Policy
What we collect, why we collect it, and what you can ask us to do about it.
Who we are
This policy explains what we collect when you visit hoxmedia.net, write to us, send a brief, apply for a job or enrol in HOX Academy. It says why we collect it, who else sees it, how long it stays and what you can ask us to do about it. It is written to be read, not to be survived.
HOX Media is a creative studio and media production house based in Prishtina, Kosovo. When you visit this site, write to us, send a project brief, apply for a job or enrol in HOX Academy, HOX Media decides why and how your personal data is used. Under the GDPR and under Kosovo's Law No. 06/L-082 on the Protection of Personal Data, that makes us the controller.
- Company
- HOX Media
- Address
- Rruga C, Prishtinë, Kosovo
- info@hoxmedia.net
- Phone
- +383 49 133 000
We are not required to appoint a Data Protection Officer and we have not appointed one. Anything about your data goes to the address above and is handled by a person here.
What we collect
We collect what we need to answer you and to run the work you ask for, and we stop there. It reaches us in three ways.
- What you type into a form. The Reach Out and contact forms ask for your name, your email and your message. A project brief adds your company, the budget range you have in mind and what you want built. A job application adds your CV, the role you are after and any portfolio link you share. An academy enrolment adds the course and, where a course requires it, your date of birth.
- What your browser sends. Your IP address, your browser and device type, the pages you open and the site that sent you here. This reaches us through analytics, and only after you have accepted analytics cookies in the banner.
- What you send us directly. Anything inside an email, a WhatsApp message or a phone call you make to us, kept where it arrived.
We never ask for card or bank details anywhere on this website, we do not buy contact lists, and we do not collect special category data such as health or political opinions. If a CV you send us happens to contain some, we do not use it and we do not keep it separately.
Why we use it, and on what legal basis
Article 6 of the GDPR allows personal data to be used only on one of six grounds. Below is every use we make of yours, and the ground it rests on. Where that ground is your consent, you can take it back at any time and nothing about how we treat you changes.
| Purpose | What we use | Legal basis |
|---|---|---|
| Answering an enquiry and preparing an offer | Name, email, phone, your message | Steps taken at your request before a contract, Art. 6(1)(b) |
| Delivering a project you signed for | Contact details, project files, invoices | Performance of a contract, Art. 6(1)(b) |
| Reviewing a job application | CV, application form, portfolio links | Steps before employment, Art. 6(1)(b), and your consent to stay on file, Art. 6(1)(a) |
| Running an academy enrolment | Enrolment details, attendance | Performance of a contract, Art. 6(1)(b) |
| Understanding how this site is used | Analytics data from cookies | Your consent, Art. 6(1)(a) |
| Measuring our own advertising | Marketing cookies and pixels | Your consent, Art. 6(1)(a) |
| Keeping the site secure and stopping abuse | Server logs, IP addresses | Our legitimate interest, Art. 6(1)(f) |
| Keeping the books and answering the tax office | Invoices, contracts | Legal obligation, Art. 6(1)(c) |
Where we rely on a legitimate interest, we have weighed it against your rights and recorded the result. Ask and we will tell you what that assessment says.
Cookies and analytics
The banner on your first visit is a real choice, not a formality. Until you decide, nothing that is not strictly necessary runs, and Google Consent Mode starts with every permission denied. That is what the ePrivacy Directive requires and it is how the site is actually built.
You can accept some categories and refuse others, and refusing costs you nothing: the site works the same either way. Your answer is stored in your browser, not in a cookie sent back to us, so it never leaves your device.
Every cookie we set, what it stores and how long it lives is listed in the Cookie Policy.
Who else sees your data
The list is short and we intend to keep it that way. Each provider below is a processor under Article 28 of the GDPR: it works for us under a written contract, may use your data only for the task we hand it, and may not use it for anything of its own.
- Our hosting provider, which runs the server this site sits on, inside the European Union.
- Our email provider, which carries the message a form sends to our inbox.
- Google Ireland Limited, for Google Analytics and Tag Manager, and only after you accept analytics cookies.
- Meta Platforms Ireland Limited, for the advertising pixel, and only after you accept marketing cookies.
- Our accountant, for the invoices the law requires us to keep.
Beyond that, we share your data only where a court or a public authority in Kosovo or in the EU requires it of us in law, and we tell you when we are allowed to.
We do not sell your data, we do not rent it, and we do not share it for anyone else's advertising.
Where it is kept
Your data sits on servers inside the European Union. Kosovo's data protection law and the GDPR both allow it to be sent further only under safeguards, and two of ours involve a transfer.
- Google and Meta may process part of the analytics and advertising data in the United States, under the European Commission's adequacy decision for the EU to US Data Privacy Framework, and under Standard Contractual Clauses where that decision does not reach.
- No other provider we use moves your data outside the European Economic Area.
If that ever changes, this section changes with it before the transfer starts.
How long we keep it
Data that has no reason left to exist is deleted, not archived out of habit. These are the periods we work to.
| What | How long it stays |
|---|---|
| An enquiry that does not become a project | 12 months from your last message |
| Client project records and correspondence | For the project, then 3 years |
| Invoices and accounting records | 6 years, because the law says so |
| Job applications | 6 months after the decision, longer only if you agree |
| Academy enrolments | For the course, then 3 years |
| Analytics data | 14 months |
| Server logs | 30 days |
How we protect it
The whole site runs over an encrypted connection. Access to form submissions and project files is limited to the people here who need it for the work, each through their own named account, and everyone at HOX is bound by a confidentiality clause. Backups are encrypted and kept apart from the live server.
No system is perfect and we will not pretend ours is. If a breach ever puts your rights at risk, Articles 33 and 34 of the GDPR give us 72 hours to tell the supervisory authority, and we will tell you directly in the same breath.
Your rights
Articles 15 to 22 of the GDPR give you the rights below, and Kosovo's Law No. 06/L-082 gives you the same ones. Using them is free, and asking never costs you anything in the service you get from us.
- Access. Ask what we hold about you and receive a copy of it.
- Rectification. Correct anything that is wrong or out of date.
- Erasure. Have your data deleted where we have no reason left to keep it.
- Restriction. Have us pause using it while a dispute about it is settled.
- Objection. Object to any use that rests on our legitimate interest.
- Portability. Take your data to another provider in a common machine readable format.
- Withdrawal. Take back a consent you gave, at any moment, without giving a reason.
Write to info@hoxmedia.net and you get an answer within 30 days, which the GDPR allows us to extend by two months only for a genuinely complex request, and only by telling you why.
If our answer does not satisfy you, you can complain to the Information and Privacy Agency of the Republic of Kosovo, or to the supervisory authority of the EU country where you live or work. Complaining to them costs you nothing and does not require you to go through us first.
Automated decisions and profiling
We do not make decisions about you by automated means alone, and nothing on this site produces a legal effect on you or anything similar to one. A job application is read by a person here. An enquiry is answered by a person here.
The only profiling in play is the audience measurement inside Google and Meta after you accept marketing cookies, and you can refuse that in the banner or withdraw it later without losing anything.
Children
This site is made for businesses and professionals. It is not aimed at anyone under 16 and we do not knowingly collect their data. Where an academy course is open to a younger student, we ask for a parent or guardian to enrol them and we keep that consent on file.
If you are a parent and believe your child has sent us something, write to info@hoxmedia.net and we will delete it.
Changes to this policy
When this policy changes, the new version appears on this page with a new date at the top. If a change affects what we do with data we already hold, we will say so on the site before it takes effect, and where the law requires your consent for the new use, we will ask for it rather than assume it.
Contact us
Any question about this policy, or about your data, goes to the same place.
- info@hoxmedia.net
- Phone
- +383 49 133 000
- Post
- HOX Media, Rruga C, Prishtinë, Kosovo
You will get an answer from a person here, not a template.
