Privacy Policy

Controller and Scope of the Policy

The controller of the personal data provided in the contact form is KMLCode sp. z o.o. Data is processed to the extent necessary for the operation of the website, handling submissions, ensuring service security, and forwarding the enquiry to FP KLIMA upon user consent.

FP KLIMA receives the submission as an entity that should contact the client regarding air conditioning installation, preparation of an offer or servicing. Upon receipt of data, FP KLIMA may act as a separate controller for further contact and performance of agreements with the client.

What data can be processed

The contact form includes full name or first name, phone number or email address, optional installation address, and an optional short message. The system also records information necessary to document consent, identifying the submission, date of sending, source page of the form, and status of message handling.

A separate support form for KMLCode is located at /support and accepts report category, message from 1 to 1000 characters, optional email address for response, and optional image. The image is decoded on the server side, stripped of metadata, resized, and stored solely as a highly compressed WebP; the original, file name, and type provided by the browser are not retained.

For security, anti-spam protection, and website diagnostics, basic technical data from requests may be processed, such as IP address, browser type, visited page address, response time, and server response code. The public part of the service does not require user account creation or providing payment details.

The website may record so-called silent leads, which are signals of interest in contact or an offer, for example, clicking on a phone number, email address, transition button to the form, social media link, or starting or sending a form. In such an event, the following can be recorded: strictly allowed type of event and CTA location, masked subpage path without query string and fragment, canonical technical link destination, limited form state code, date and time, temporary IP address and its hash and prefix, hash of a device identifier from technical cookie, user-agent, and safe referrer (only path for own page and only the hostname for an external page). We do not record silent lead contents of form fields, name, email, phone number, address, message or names or content of files.

A silent lead is sent exclusively to FP KLIMA's own endpoint. The service does not currently have a mechanism for explicit consent for analytics, so these events are not copied to dataLayer, gtag or any other external analytical system. Such integration can be activated only after the implementation of voluntary opt-in consent, without affecting the operation of first-party recording.

Purposes and legal bases for processing

Data is processed for the following purposes:

• acceptance of a submission and enabling contact regarding air conditioning,
• transferring a submission to FP KLIMA on the basis of user consent,
• correspondence management, confirmations and technical status of message delivery,
• protecting forms from spam, abuse, and excessive numbers of enquiries,
• managing error reports and general messages sent to KMLCode,
• measurement of the effectiveness of contact buttons and identification of contact intent not yet submitted,
• maintenance of website security, error diagnosis and technical statistics on traffic,
• potential establishment, investigation or defence of claims.

The basis for processing may be the user's consent, the need to take steps at the request of the person submitting an enquiry, a legitimate interest in securing the service and obligations arising from legal provisions.

Data Recipients

Form data may be made available to FP KLIMA for contact with the person interested in installation or servicing of air conditioning. Data may also be accessed by authorised personnel handling submissions and by providers of technical infrastructure, hosting, database and email services, solely to the extent necessary for service operation.

Data is not sold to external entities and is not used for automatic subscription to a newsletter. Social media links lead to external services operating on their own privacy terms.

To enrich the IP address with an approximate location, we use the IPInfo service. The raw IP address is passed to IPInfo solely through a shared, delayed batch process with limits on the number of calls and local cache; we do not make a query to IPInfo at the time of click. The raw address is stored only until successful enrichment or completion of attempts; once its status is enriched, failed or skipped, it is deleted. Disabling silent lead collection or the provider also ends pending attempts and deletes the raw address. We record the result needed for administrative preview in the service, specifically country, and if the service returns such data, city, region, time zone, or operator. Bot events, administrative paths, and recognised administrator devices are skipped before recording and are not submitted for enrichment.

Retention Period

We store form data only as long as it is necessary for handling the submission, confirming proper message transmission, and securing potential claims. When further storage is no longer justified, submissions are deleted or anonymised.

Technical data related to security and proper website operation are stored for a limited time, solely in the scope necessary for protecting the service, error diagnostics, and basic technical statistics. We do not publish configuration details or security measures to avoid weakening application security.

Silent leads are stored for no longer than 180 days and automatically deleted from the database after that time. The application does not accept new entries if it cannot create and confirm an index implementing this retention. Hashes identifying recognised administrator devices are automatically deleted 365 days after the last administrator login; the state of both retention indexes is a condition of readiness to store records.

KMLCode support messages are automatically deleted no later than 180 days. After marking a message as archived, its retention term is shortened to no more than 30 days. Storage is blocked if the application cannot confirm an exact retention index.

Rights of the data subject

The data subject may request access to their data, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent insofar as the processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

For privacy-related matters, please use the contact details provided at the bottom of this page. The data subject also has the right to lodge a complaint with the President of the Office for Personal Data Protection.

Cookies, local storage and security

The service stores a necessary language-preference cookie fpklima_locale containing only the selected language code. It is used solely to remember this preference and does not change the language of an indexable page; on public pages, the locale encoded in the URL remains the source of truth. The cookie may be stored for up to 365 days and is not used for marketing profiling. The service also uses a secure device-identifier cookie to exclude administrator devices from public analytics and link basic technical events; only a hash of that identifier is stored in the database. Providers of external services reached through social-media links may use their own technologies.

We implement organisational and technical measures proportionate to the nature of the service, including access restrictions, form validation, abuse filtering, and monitoring of correct operation. Details of security measures, server configuration, and administrative tools are not publicly disclosed.