Skip to content
Book a call

Legal

Privacy policy

How Muloo collects, uses and protects your personal information, under POPIA and the GDPR.

Last updated 16 September 2026

This policy explains what personal information Muloo collects when you use wearemuloo.com, get in touch with us or work with us, what we do with it, and the choices you have. We have written it to be read, not just to exist.

1. Who we are

Muloo (Pty) Ltd ("Muloo", "we", "us", "our") is a technical systems partner for HubSpot, custom engineering and AI, based in Cape Town and working with clients in South Africa, the United Kingdom, Europe and further afield.

  • Company registration number: 2020/546441/07
  • Registered address: 54 Old Sir Lowry's Pass Road, Cape Town, South Africa
  • Information Officer: Jarrud van der Merwe
  • Privacy contact: hello@muloo.co

We are the responsible party under the Protection of Personal Information Act, 2013 (POPIA) and the data controller under the EU and UK General Data Protection Regulation (GDPR) for the personal information described in this policy.

2. What we collect

Information you give us

  • Contact details such as your name, email address, phone number, company and job title, when you fill in a form, book a meeting, download a resource, request an audit or message us on WhatsApp.
  • What you tell us about your business, your systems and your project, in forms, calls, emails, chat and meetings.
  • Billing and contract details if you become a client.

Information collected automatically

  • Technical data such as IP address, browser, device type and approximate location.
  • How you use the site: pages viewed, time on page, the page that referred you, and which of our emails you open or click.
  • Cookies and similar technologies, described in section 6.

Information from other sources

  • Business contact information that is publicly available, for example on your company website or LinkedIn profile.
  • Referrals from partners such as HubSpot, where you have asked to be introduced.

We do not intentionally collect special personal information (such as health, religious or biometric data), and we ask you not to send it to us.

3. How we use it

  • To reply to enquiries, book and hold meetings, and prepare proposals.
  • To deliver the services and tools you have asked for, including audits, calculators and downloads.
  • To manage our relationship with clients, including contracts, invoicing and support.
  • To send you insights, updates and event invitations where you have agreed to receive them or where we are otherwise allowed to.
  • To understand how the site performs and improve it.
  • To keep the site and our systems secure and prevent spam and abuse.
  • To meet our legal, tax and regulatory obligations.

We do not sell your personal information. We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you.

We process personal information only where we have a lawful reason to, namely:

  • Consent, for example when you subscribe to our emails or accept analytics cookies. You can withdraw it at any time.
  • Contract, where we need the information to take steps you have asked for before entering into a contract, or to perform one.
  • Legitimate interests, such as running and improving our business, responding to business enquiries and keeping our systems secure, where those interests are not overridden by your rights.
  • Legal obligation, where the law requires us to keep or disclose information.

5. Email and your subscription preferences

We only send marketing email to people who have opted in or, where the law allows, to existing clients about services similar to those they already use. Every marketing email includes a link to unsubscribe or to change which types of email you receive. You can also manage your subscription preferences here at any time. We will still send you service and transactional messages that relate to work we are doing for you.

6. Cookies and tracking

The site uses cookies to make it work, to remember your cookie choices and, with your consent where required, to understand how the site is used and measure our advertising. These include:

  • Strictly necessary cookies that keep the site secure and remember your consent choice.
  • HubSpot analytics and tracking cookies, which connect site visits to form submissions and email engagement in our CRM.
  • Google Analytics and Google Ads, which help us measure traffic and campaign performance.
  • Google reCAPTCHA on some forms, to block spam.

You can accept or decline non essential cookies through the cookie banner, and you can clear or block cookies in your browser settings. Blocking some cookies may affect how parts of the site work, such as embedded forms and meeting booking.

7. Who we share it with

We share personal information only with people who need it to help us run the business, and only as much as they need:

  • Service providers acting on our instructions, including HubSpot (CRM, website, forms, email, chat and meetings), Google (workspace, analytics and advertising), Meta (WhatsApp, when you message us), our cloud hosting providers, and our accounting and payment providers.
  • Delivery specialists and partners who work with us on your project, under confidentiality obligations.
  • AI tools we use to support our work, only under business terms that do not allow the provider to train its models on your information.
  • Professional advisers such as lawyers, auditors and insurers.
  • Authorities, where the law requires it or to protect our rights.
  • A buyer or successor, if all or part of our business is sold or restructured.

8. International transfers

Some of our service providers store or process information outside South Africa, the United Kingdom or the European Economic Area, for example in the United States. When that happens we rely on appropriate safeguards, such as adequacy decisions, Standard Contractual Clauses or the UK International Data Transfer Addendum, and we meet the conditions for transborder information flows under section 72 of POPIA.

9. How long we keep it and how we protect it

We keep personal information only for as long as we need it for the purpose we collected it for, or as long as the law requires. As a guide:

  • Enquiries and marketing contacts: until you unsubscribe or ask us to delete your details, and in any case we review contacts with no engagement for more than three years.
  • Client and contract records: for the life of the relationship and up to seven years after it ends, for tax and legal purposes.

We protect information with appropriate technical and organisational measures, including encrypted connections, least privilege access, multi factor authentication on our business systems, and confidentiality obligations on everyone who works with us. No system is perfectly secure, and if a breach affects your information we will notify you and the relevant regulator where the law requires.

10. Client data we process on your behalf

When we implement, migrate or support systems for a client, such as their HubSpot portal, we may access personal information that belongs to that client and its contacts. In that work we act as an operator (POPIA) or processor (GDPR) on the client's instructions, and the terms are set out in our agreement with that client, not in this policy. If you are a contact of one of our clients, please direct questions about your information to that organisation.

11. Muloo products and platforms

Muloo products that sit on their own domains, such as the Muloo Hub reporting platform, Muloo Signals and Muloo Audit, may connect to data sources you authorise (for example HubSpot, Google Analytics or advertising accounts) and have their own privacy terms. See, for example, the Muloo Hub reporting platform privacy policy. Where a product's own policy applies, it takes precedence for that product.

12. Your rights

Depending on where you live, you have the right to:

  • ask whether we hold personal information about you, and for a copy of it;
  • ask us to correct information that is inaccurate or incomplete;
  • ask us to delete it, or to restrict how we use it;
  • object to our processing, including for direct marketing, at any time;
  • receive your information in a portable format;
  • withdraw consent where we rely on it.

To use any of these rights, email hello@muloo.co. We may need to confirm your identity first, and we will respond within the time the law allows, usually within 30 days.

If you are not happy with how we have handled your information, please talk to us first. You also have the right to complain to a regulator:

  • South Africa: the Information Regulator, inforegulator.org.za
  • United Kingdom: the Information Commissioner's Office, ico.org.uk
  • European Union: the data protection authority in your country

13. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. If we make a material change, we will make it clear on this page and, where appropriate, tell you by email.

14. Contact us

Muloo (Pty) Ltd, 54 Old Sir Lowry's Pass Road, Cape Town, South Africa. Email hello@muloo.co or use our contact page.