Privacy and cookie policy

1. Who is the data controller

The data controller is ColdBack Sp. z o.o. with its registered office in Warsaw, ul. Kartonowa 11, 04-781 Warszawa, entered in the register of entrepreneurs of the National Court Register under number KRS 0001196763 by the District Court for the Capital City of Warsaw in Warsaw, 14th Commercial Division of the National Court Register. NIP (tax ID) 952 227 23 63, REGON 542311424, share capital PLN 5,000.

Service base and warehouse: ul. Jaśminowa 2, 05-462 Majdan. For matters concerning personal data, write to biuro@coldback.pl or call: 516 338 012. We have not appointed a data protection officer; all matters are handled directly by the company's management board.

2. What data we collect

• Contact form: first name and surname or company name, telephone, e-mail, message content.
• Breakdown report: contact details, site address, description of the fault, optionally photos of the controller or equipment.
• Air conditioning calculator: postcode, description of the rooms and installation location, contact details, optionally photos of the wall and the location for the outdoor unit.
• Telephone and e-mail contact: the data you provide yourself in a conversation or message.
• Technical data: IP address, browser and device type and time of visit in the server logs and the bot protection system.
• Website usage data (only with your consent): identifiers from cookies, pages visited, traffic source (e.g. a search engine), approximate location to city level, clicks and page scrolling.

The configuration from the air conditioning calculator is saved in the page address so that it can be sent as a link. This address does not contain contact details.

3. For what purpose and on what legal basis

• Responding to an enquiry, preparing a quote and arranging a visit: steps taken prior to entering into a contract (Art. 6(1)(b) GDPR).
• Performance of a contract, i.e. installation, service and maintenance inspections: Art. 6(1)(b) GDPR.
• Legal obligations, for example tax, accounting and F-gas documentation in the Central Register of Operators: Art. 6(1)(c) GDPR.
• Website security, protecting forms against spam and pursuing claims: our legitimate interest (Art. 6(1)(f) GDPR).
• Visit statistics, analysis of website performance and measuring advertising effectiveness: only with your consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law Act).

4. How long we keep data

• Enquiries, quotes and reports that did not result in a contract: 90 days from the last contact. Submissions saved through the forms are deleted automatically after 90 days.
• Photos sent through the forms: 90 days, unless they become part of the job documentation.
• Contract data and service documentation: for the period required by tax law (5 years from the end of the tax year) and F-gas legislation, and until the limitation period for claims expires.
• Data in Google Analytics: 14 months, after which it is deleted automatically.
• Server and bot protection logs: for a short time, only for security purposes.
• Data processed on the basis of consent: until consent is withdrawn.

5. Analytics and advertising tools

To know which information is useful to clients and which needs improving, we use the tools below. Those that store cookies are activated only after you give consent in the banner. Without consent the website works the same way; we simply do not collect statistics.

• Tag manager (Google Tag Manager, Google Ireland Ltd): runs the Google tools below. It loads only after your consent in the banner and only to the extent you agree to. We remember your choice in your browser storage (cb_zgody), not in a cookie.
• Google Analytics 4 (Google Ireland Ltd): visit statistics, i.e. the number of visits, popular pages, traffic sources and the paths users take to reach the form. Google Analytics 4 does not store full IP addresses. We have disabled Google signals and data sharing for Google advertising purposes.
• Google Consent Mode (Consent Mode v2): until you give consent, Google tools are informed that there is no consent and do not store analytics or advertising cookies.
• Google Ads (Google Ireland Ltd): if we run ads in Google search, we measure how many enquiries and calls came from the ads (conversions). We do not create remarketing lists and do not personalise ads based on your visit.
• Google Search Console: a Google tool that shows us aggregated data on how the website appears in search results (search queries, number of impressions and clicks, position). It does not store cookies on our website and does not allow us to identify who entered a given search term.
• Cloudflare Turnstile: checks in the background whether a form is being sent by a human rather than a bot. Instead of selecting images, it assesses technical signals from the browser. It is not used for advertising or tracking.

6. Who we share data with

We do not sell data. We share it only with companies that help us run the website and the business, on the basis of data processing agreements or data processing terms:

• Cloudflare, Inc.: website hosting, protection against attacks and bots, storage of form submissions and sending e-mails from the forms (to us and confirmations to you).
• Google Ireland Ltd: company e-mail (Google Workspace), Google Analytics, Google Tag Manager, Google Ads, Google Search Console and the Google Maps map.
• Accounting firm, when an invoice is issued.

The system in which we edit the website content does not process form data. Data may also be disclosed to public authorities where required by law.

Cloudflare and Google may also process data in the United States. This takes place on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework), to which these companies have signed up, and standard contractual clauses.

7. Cookies

Cookies are small text files stored in your browser. We divide them into four groups. Necessary cookies always work, because without them the website would not be secure or would not remember your choice in the banner. Analytics and marketing cookies are stored only with your consent. Third-party cookies are stored by Google Maps when you choose to turn on the map.

Exact names and periods may change when providers update their tools. The consent banner always shows the current list.

How to change or withdraw consent

• Click “Cookie settings” at the bottom of the page and change your choice. Withdrawing consent does not affect what we collected before.
• You can also delete and block cookies in your browser settings. Blocking necessary cookies may make it difficult to send a form.
• You can disable Google Analytics statistics on all websites with the Google add-on: tools.google.com/dlpage/gaoptout (opens in a new tab).

Providers' privacy policies: Google (opens in a new tab), Cloudflare (opens in a new tab).

8. Your rights

You have the right to access your data, to have it rectified, erased, to restrict its processing and to data portability, and to object to processing based on our legitimate interest. You can withdraw consent at any time, without affecting what we did before. We reply to messages within one month. You can also lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa.

Providing data is voluntary, but without a telephone number or e-mail address we cannot reply to an enquiry. We do not make automated decisions and do not profile users for advertising purposes.

9. Changes to this policy

When we change the way we process data, for example by adding a new tool, we will update this page and the date below. In the case of changes concerning cookies, the consent banner will ask you again.