HellCold Privacy Policy

Last updated: 22 October 2026

1. General information

This Policy explains how personal data is processed through the HellCold website and the related customer portal (the “Service”). It takes into account, in particular, Regulation (EU) 2016/679 (GDPR), the Polish Personal Data Protection Act and applicable electronic communications rules.

It applies to people contacting HellCold, Service users and authorised customer-portal users. The data processed depends on the features used.

2. Data controller and contact

The controller is:

HellCold Sp. z o.o.
ul. Zofii Kossak 98
43-436 Górki Wielkie, Poland
KRS: 0001002959 · VAT ID: PL5482672515 · REGON: 363784210

For privacy questions, contact the Controller at office@hellcold.pl or by phone at +48 33 85 13 795.

3. Personal data we process

Depending on your relationship with the Controller, this may include:

• identification and contact details, including name, business email address, phone number, company and job title;
• inquiry and correspondence content and information you choose to provide in a form, such as details about a facility, project, device or requested product;
• information needed to handle an order, agreement, invoice, payment, project or service request;
• portal account and access information, including user identifier, role and customer assignment;
• technical and security data, such as IP address, request time and details, browser information, error logs and information needed to prevent abuse.

The contact form requires a name, email address and message. Other fields depend on the inquiry type and are generally optional. Do not submit passwords, special-category personal data or confidential documents in the form. Documentation links should point to resources the recipient is authorised to access.

4. Purposes and legal bases

The Controller processes personal data for the following purposes:

1. Responding to inquiries, communicating and preparing proposals — Art. 6(1)(b) GDPR where the individual is a party or requests pre-contractual steps, or Art. 6(1)(f) GDPR where the person contacts us on behalf of an organisation or for another purpose; the legitimate interest is handling correspondence and inquiries.
2. Entering into and performing agreements, customer support, orders, projects and service requests — Art. 6(1)(b) GDPR; for contact persons acting on behalf of a customer, Art. 6(1)(f) GDPR may apply to managing the business relationship.
3. Accounting and legal obligations — Art. 6(1)(c) GDPR in conjunction with applicable laws, including tax and accounting requirements.
4. Service security, abuse prevention, diagnostics and the establishment, exercise or defence of claims — Art. 6(1)(f) GDPR; the legitimate interests are protecting systems, rights and business continuity.
5. Sign-in and access to the customer portal — Art. 6(1)(b) GDPR for use of the agreed service and Art. 6(1)(f) GDPR for access control and security.

The Service does not provide a newsletter sign-up form. Data submitted through the contact form is not automatically used to send a newsletter. If the Controller conducts separate marketing communications that require consent, consent will be obtained before they begin.

5. Contact form and service providers

The contact form may use Cloudflare Turnstile to prevent automated spam. This verification may involve sharing technical data, including IP address and browser information, with the provider. The form also applies a request-rate limit; in production it may use Upstash Redis, and the rate-limit identifier is a cryptographic hash of a technical value such as an IP address.

When email delivery is configured, inquiries are sent through Resend to the contact address for the selected form language. Sender details and inquiry content are used to respond and handle the case. If email delivery is not configured, the Service may prepare a draft in the user's email application; opening a draft does not mean the Controller has received the inquiry.

6. Customer portal and integrations

The customer portal is available to authorised users who sign in through Microsoft Entra ID. Depending on the user's role and enabled features, the portal may process account and access data, customer information, and details about orders, invoices, catalog items, projects and service requests.

In a configured environment, the portal communicates with Microsoft Business Central to retrieve or manage business data assigned to the user. Access tokens used for these communications are handled server-side and within the authenticated session; they are not intended for public disclosure. If a link to Autodesk Tandem is provided, Autodesk verifies sign-in and model permissions.

Users are responsible for keeping their sign-in credentials confidential and using the portal according to their assigned role. The Controller may record technical events needed to protect accounts and diagnose errors.

7. Data recipients

Data may be shared only to the extent needed for the purposes above, including with:

• hosting, infrastructure and IT-support providers;
• Microsoft, for Entra ID sign-in and, when enabled, Business Central;
• form and email providers, including Cloudflare Turnstile, Resend and, when configured, Upstash;
• accounting, legal, consulting, courier or logistics providers where needed;
• public authorities where disclosure is required by law.

Processors acting on the Controller's behalf are subject to appropriate agreements and instructions. Following an external link, for example to a map or Autodesk Tandem, takes you to a service whose operator processes data under its own policies.

8. Transfers outside the EEA

Some infrastructure or service providers may process data outside the European Economic Area. Where such a transfer takes place, the Controller uses a GDPR transfer mechanism applicable to that provider and transfer, such as an adequacy decision or standard contractual clauses. The specific location and mechanism depend on the current configuration and provider terms.

9. Data retention

Retention depends on the purpose and legal basis:

• inquiries and correspondence — for as long as needed to handle the matter, and afterwards for the applicable limitation period or until an effective objection where relevant;
• agreement, project, service and accounting data — for the duration of the relationship and any period required by law or needed to establish, exercise or defend claims;
• portal account and session data — while the account or access remains active; technical logs are retained as needed for security and diagnostics;
• data processed based on consent — until consent is withdrawn, unless another legal basis applies to further processing.

Specific periods depend on the type of matter, provider agreements and applicable law. When the purpose ends, data is erased or anonymised, subject to legal retention duties and legitimate claims.

10. Your rights

Subject to the conditions and limits in the GDPR, you may request access to your personal data, a copy, rectification, erasure or restriction of processing, and data portability. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation; you may object to direct marketing at any time. You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Send requests to office@hellcold.pl. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO). These rights may be limited where permitted by law.

11. Whether providing data is required

Providing fields marked as required is necessary to submit an inquiry; without them, the form cannot be sent. Other information is voluntary but may help us prepare a response or proposal. Data required for an agreement or by law is necessary to enter into, perform or account for that agreement.

12. Cookies and similar technologies

The Service currently does not use analytics or advertising tools based on cookies. It may set technical cookies necessary for operation and security, including an authentication-session cookie for the protected portal. The session cookie is marked HttpOnly and, in production, Secure; its settings include SameSite Strict. It is not used for advertising tracking.

The contact form may load the Cloudflare Turnstile script, which uses technologies needed for anti-spam verification. Details depend on the current operation of Cloudflare's service. The Service also contains links to external services; the operator's privacy policy applies after you visit those services.

You can restrict or delete cookies in your browser settings, but blocking a necessary cookie may prevent portal sign-in or use. If optional cookies or new tools are introduced, this Policy and, where required, the consent mechanism will be updated before they are used.

13. Logs, profiling and automated decisions

The server and security services may automatically record technical information such as IP address, request time, requested resource and browser data. This information is used for security, abuse prevention and troubleshooting.

The Controller does not make decisions about users that produce legal or similarly significant effects solely by automated means, and does not profile users for that purpose.

14. Security and changes to this Policy

The Controller applies technical and organisational measures appropriate to the risks, including access controls and encrypted connections. No method of transmission or storage can guarantee absolute security.

This Policy may be updated when the law, Service features, providers or data-processing practices change. The current version is published on this page.