HellCold
/

HellCold Privacy Policy

Last updated: 31 October 2026

1. General information

This Policy explains how personal data is processed through the HellCold website and the related customer portal (the “Service”). It takes into account, in particular, Regulation (EU) 2016/679 (GDPR), the Polish Personal Data Protection Act and applicable electronic communications rules.

It applies to people contacting HellCold, Service users and authorised customer-portal users. The data processed depends on the features used.

2. Website operators, data controllers and contact

The Service is operated by two companies. Each is a separate controller of inquiry data for its own departments:

HELLCOLD POLSKA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ

ul. Zofii Kossak 98, 43-436 Górki Wielkie, Poland District Court in Bielsko-Biała, 8th Commercial Division of the National Court Register KRS: 0000602695 · NIP: 5482672403 · REGON: 363739451

Departments: AI and ISV.

HELLCOLD SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ

ul. Zofii Kossak 98, 43-436 Górki Wielkie, Poland District Court in Bielsko-Biała, 8th Commercial Division of the National Court Register KRS: 0001002959 · NIP: 5482672515 · REGON: 363784210

Departments: HVAC/R, BIM, Digital Twin, BMS, Indoor and Aroma. This company also handles product and service inquiries and the customer portal.

The form identifies the controller for the selected department. In the rest of this Policy, “Controller” means the company responsible for the matter in question. Operating the website together does not in itself mean joint control of all inquiry data.

Customer portals are separated by the company they serve: HELLCOLD is the controller for the hellcold portal, and HELLCOLD POLSKA is the controller for the polska portal. Business Central data and integrations are separated between those environments. If a customer agreement specifies a different allocation of roles, the allocation in that agreement applies.

For privacy questions, contact the appropriate Controller through the shared contact point at office@hellcold.pl or by phone at +48 33 85 13 795, specifying the company or department concerned.

3. Personal data we process

Depending on your relationship with the Controller, this may include:

  • identification and contact details, including name, business email address, phone number, company and job title;
  • inquiry and correspondence content and information you choose to provide in a form, such as details about a facility, project, device or requested product;
  • information needed to handle an order, agreement, invoice, payment, project or service request;
  • portal account and access information, including user identifier, role and customer assignment;
  • technical and security data, such as IP address, request time and details, browser information, error logs and information needed to prevent abuse.

The contact form requires a name, email address and message. Other fields depend on the inquiry type and are generally optional. Do not submit passwords, special-category personal data or confidential documents in the form. Documentation links should point to resources the recipient is authorised to access.

4. Purposes and legal bases

The Controller processes personal data for the following purposes:

  1. Responding to inquiries, communicating and preparing proposals — Art. 6(1)(b) GDPR where the individual is a party or requests pre-contractual steps, or Art. 6(1)(f) GDPR where the person contacts us on behalf of an organisation or for another purpose; the legitimate interest is handling correspondence and inquiries.
  2. Entering into and performing agreements, customer support, orders, projects and service requests — Art. 6(1)(b) GDPR; for contact persons acting on behalf of a customer, Art. 6(1)(f) GDPR may apply to managing the business relationship.
  3. Accounting and legal obligations — Art. 6(1)(c) GDPR in conjunction with applicable laws, including tax and accounting requirements.
  4. Service security, abuse prevention, diagnostics and the establishment, exercise or defence of claims — Art. 6(1)(f) GDPR; the legitimate interests are protecting systems, rights and business continuity.
  5. Sign-in and access to the customer portal — Art. 6(1)(b) GDPR for use of the agreed service and Art. 6(1)(f) GDPR for access control and security.
  6. Generating AI-assistant responses — information voluntarily entered in the chat, where it is personal data, is processed to provide this feature; the legal basis is Art. 6(1)(b) GDPR for the service requested by the user or Art. 6(1)(f) GDPR for handling a business inquiry.
  7. Public-page analytics and performance measurement — where enabled, technical data is processed on the basis of Art. 6(1)(f) GDPR; the legitimate interest is assessing and improving the public website.

The Service does not provide a newsletter sign-up form. Data submitted through the contact form is not automatically used to send a newsletter. If the Controller conducts separate marketing communications that require consent, consent will be obtained before they begin.

5. Contact form and service providers

The contact form loads Cloudflare Turnstile to prevent automated spam. The provider may receive technical data, including IP address and browser information; the server sends the verification token and IP address to Cloudflare.

The request-rate limit runs in the server process's memory: an IP address is stored as the key for up to 60 seconds. The form code does not hash this key or use Upstash Redis. This memory is temporary and may be cleared when the process restarts; the hosting provider may keep separate technical logs.

When email delivery is configured, inquiry emails are sent through Resend to the address for the selected form language. Sender details and inquiry content are used to respond and handle the case. If email delivery is not configured, the Service may prepare a draft in the user's email application; opening a draft does not mean the Controller has received the inquiry.

The AI assistant is provided through IBM watsonx Orchestrate on the home page. Messages entered in the chat are sent to IBM to generate a response. Do not enter personal data, passwords or confidential information. Chat logging, retention, processor terms and any further use of data depend on the IBM account configuration and must be checked before publication.

6. Customer portal and integrations

The customer portal is available to authorised users who sign in through Microsoft Entra ID. Separate environments exist for HELLCOLD and HELLCOLD POLSKA. Depending on the user's role and enabled features, the portal may process account and access data, customer information, and details about orders, invoices, catalog items, projects and service requests.

In a configured environment, the portal communicates with Microsoft Business Central to retrieve or manage business data assigned to the user. Access tokens used for these communications are handled server-side and within the authenticated session; they are not intended for public disclosure. If a link to Autodesk Tandem is provided, Autodesk verifies sign-in and model permissions.

Users are responsible for keeping their sign-in credentials confidential and using the portal according to their assigned role. The Controller may record technical events needed to protect accounts and diagnose errors.

7. Data recipients

Data may be shared only to the extent needed for the purposes above, including with:

  • hosting, infrastructure and IT-support providers, depending on the active deployment configuration;
  • Microsoft, for Entra ID sign-in and, when enabled, Business Central;
  • Cloudflare, for Turnstile form verification;
  • Resend, for contact email delivery when enabled;
  • IBM, for handling AI chat messages;
  • Vercel, for website analytics and performance measurements on public pages;
  • accounting, legal, consulting, courier or logistics providers where needed;
  • public authorities where disclosure is required by law.

Processors acting on the Controller's behalf are subject to appropriate agreements and instructions. Following an external link, for example to a map or Autodesk Tandem, takes you to a service whose operator processes data under its own policies.

8. Transfers outside the EEA

Some infrastructure or service providers may process data outside the European Economic Area. Where such a transfer takes place, the Controller uses a GDPR transfer mechanism applicable to that provider and transfer, such as an adequacy decision or standard contractual clauses. The specific location and mechanism depend on the current configuration and provider terms.

9. Data retention

Retention depends on the purpose and legal basis:

  • inquiries and correspondence — for as long as needed to handle the matter, and afterwards for the applicable limitation period or until an effective objection where relevant;
  • agreement, project, service and accounting data — for the duration of the relationship and any period required by law or needed to establish, exercise or defend claims;
  • portal account and session data — while the account or access remains active; technical logs are retained as needed for security and diagnostics;
  • data processed based on consent — until consent is withdrawn, unless another legal basis applies to further processing.

Specific periods depend on the type of matter, provider agreements and applicable law. When the purpose ends, data is erased or anonymised, subject to legal retention duties and legitimate claims.

10. Your rights

Subject to the conditions and limits in the GDPR, you may request access to your personal data, a copy, rectification, erasure or restriction of processing, and data portability. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation; you may object to direct marketing at any time. You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Send requests to office@hellcold.pl. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO). These rights may be limited where permitted by law.

11. Whether providing data is required

Providing fields marked as required is necessary to submit an inquiry; without them, the form cannot be sent. Other information is voluntary but may help us prepare a response or proposal. Data required for an agreement or by law is necessary to enter into, perform or account for that agreement.

12. Cookies, analytics and similar technologies

Public pages use Vercel Web Analytics and Speed Insights. According to the provider's documentation, these tools do not use cookies for cross-site tracking. They may process page paths without query parameters, device type, browser, country-level location and performance measurements. Analytics uses a temporary hash on the provider's side, retained for up to 24 hours. Query parameters and URL fragments are removed before the application sends events. These tools are disabled on customer portal, internal and sign-in paths.

The basket stores selected product codes, names, quantities and currency locally in the browser, only after a product is added to the basket. This feature does not automatically send basket data to the server; it can be removed from the basket or browser settings. Users may also visit external services, such as Maps or Autodesk Tandem, by following a link.

The contact form loads the Cloudflare Turnstile script for spam prevention; the provider may use its own technologies needed for that verification. Portal sign-in requires a technical session cookie marked HttpOnly and, in production, Secure, with SameSite Strict. Production cookies and similar technologies must be reviewed when provider configuration changes. Before any technology requiring consent is used, consent must be obtained before storing or accessing information on the user's device.

13. Logs, profiling and automated decisions

The server and security services may automatically record technical information such as IP address, request time, requested resource and browser data. The form rate limit holds an IP address in process memory for up to 60 seconds; infrastructure-provider logs may have separate retention periods.

The Controller does not make decisions about users that produce legal or similarly significant effects solely by automated means, and does not profile users for that purpose.

14. Security and changes to this Policy

The Controller applies technical and organisational measures appropriate to the risks, including access controls and encrypted connections. No method of transmission or storage can guarantee absolute security.

This Policy may be updated when the law, Service features, providers or data-processing practices change. The current version is published on this page.