Privacy policy

1. Data controller

The controller of personal data is JKLM Firma Usługowa Łukasz Kaczmarek, tax ID (NIP) 7532159822, ul. Brzozowa 6A, 48-385 Otmuchów, Poland. For data protection matters please write to biuro@jklm.eu or to the business address.

2. What data we process

• contact details given in an enquiry: name or company name, email, phone, company, town, postcode of the installation site;
• project data: dimensions and parameters of the signage, uploaded artwork files, a photo of the installation site, notes;
• contract and billing data if an order is placed: invoicing details, delivery and installation address, correspondence;
• technical data: a random browser identifier in a cookie and a hash (HMAC) of the IP address used only to protect forms against abuse – we do not store the full IP address in the database.

3. Purposes and legal bases

• saving projects, calculating the estimated price, answering the enquiry and preparing the Quotation – steps taken at the person's request before entering into a contract (Art. 6(1)(b) GDPR);
• concluding and performing the contract, including production, delivery, installation and complaints (Art. 6(1)(b) GDPR);
• issuing invoices and keeping accounting records (Art. 6(1)(c) GDPR in connection with tax and accounting law);
• security of the Website, protection against abuse, scanning of files and establishing, pursuing or defending claims – JKLM's legitimate interest (Art. 6(1)(f) GDPR).

We do not send marketing without separate consent and make no decisions based solely on automated processing that produce legal effects. The estimated price is a calculation, not a decision – the binding price is set by a person in the Quotation.

4. Who processes data for us

We use service providers who process data on our behalf under data processing agreements:

• Vercel Inc. – hosting of the Website; server functions run in the Frankfurt region (EU);
• Supabase Inc. – database and private file storage for the Website and JKLM's order management system (CRM); servers in Frankfurt (EU);
• Hetzner Online GmbH – JKLM's server in Germany running the virus scanner for uploaded files;
• Google – Google Drive, where we keep documentation of projects in progress;
• Anthropic PBC – AI tools used in JKLM's CRM to support preparing quotations and handling correspondence;
• JKLM's email provider – handling email correspondence.

After a contract is concluded, recipients may also include the invoicing system provider and bank, carriers, installation subcontractors and the accounting office – to the extent necessary for performance and settlement. We disclose data to public authorities only where required by law.

The AI designer in the configurator (optional feature) sends the description you enter and the signage parameters to Moonshot AI (China). Do not enter personal data there. The feature is not needed for an enquiry or Quotation.

5. Transfers outside the European Economic Area

Vercel, Supabase, Google and Anthropic belong to groups headquartered in the USA. Website and CRM data are stored in the EU, but administrative or support access from the USA cannot be ruled out. In such cases the transfer is based on the European Commission's standard contractual clauses or, for certified companies, the EU-US Data Privacy Framework adequacy decision. Information on the safeguards is available at biuro@jklm.eu.

6. How long we keep data

• projects and enquiries that did not lead to an order – up to 12 months after the last save or contact;
• contract data – for the duration of performance and then until the limitation periods for claims expire;
• accounting records – for 5 years from the end of the calendar year in which the tax payment deadline expired;
• IP address hashes for abuse protection – from 2 hours to 2 days;
• incomplete file uploads – until the upload session expires, after which they are deleted automatically;
• cookies – as described in section 7.

7. Cookies and browser storage

The Website uses only cookies and browser storage that are necessary for the features you request. We do not use analytics or advertising cookies.

• project owner cookie (HttpOnly) – recognises the browser in which projects were saved; valid for 90 days;
• project preview cookie (HttpOnly) – set when a preview link is opened; valid for 14 days;
• quotation access cookie (HttpOnly) – until the quotation expires;
• browser storage (localStorage and IndexedDB) – the configuration draft, list of your projects and artwork file; the data stays on your device until you delete it.

You can delete cookies and site data in your browser settings. You will then lose access to projects saved in that browser unless you have a copy in a file.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw).

9. Whether providing data is required

Providing data is voluntary. Without a name and an email or phone number we cannot answer the enquiry, and without invoicing details we cannot conclude or settle a contract.

10. Security

We keep files in private storage without public addresses. A project can be accessed by the browser in which it was saved and by people with the preview link, which can be revoked at any time. Every file is virus-checked before being passed to the CRM. Please do not put personal data that is not needed for the quotation into projects.

11. Changes to this policy

We will announce material changes on the Website. The current version is always available on this page. The Polish version is binding.