Kamma Website Privacy & Cookies Policy

Published 15th October 2026

1. Who we are and what this policy covers

1.1 This policy explains how Kamma Limited (Kamma, we, us, our) collects and uses personal information when you visit www.kammadata.com or www.kammaclimate.com (each a Website), use their free tools, or contact us through them. It also explains how we use cookies. References to the Website mean whichever of these sites you are using.
1.2 Kamma Limited is registered in England and Wales under company number 09546202, with its registered office at Unit 207, Elementa Workspace, 1 Giltspur Street, London EC1A 9DD. We are the controller of the personal information described in this policy, and are registered with the Information Commissioner's Office under number ZA119280.
1.3 This policy does not cover personal information processed in our services (the Services). These include Kamma Suite, Kamma Applications and Kamma Quick Check, and our climate products: property-level climate data and reporting, and Retrofit Explorer. It also does not cover property, landlord, tenant or homeowner information processed in them. That is explained in our Platform User Privacy Notice at www.kammadata.com/support/platform-privacy/ and, for landlords and managers whose information we receive from an agent, our Landlord and Manager Privacy Notice at www.kammadata.com/support/privacy-notice.
1.4 For any question about this policy or your information, contact us at support@kammadata.com or write to us at the address above.
1.5 The Website is aimed at businesses and adults. It is not intended for children under 16 and we do not knowingly collect their information.

2. Information we collect

2.1 Information you give us. When you fill in a form on the Website, email us or call us, we collect what you provide. Depending on the form, this may include:
- (a) your name, job title and company name;
- (b) your email address and phone number;
- (c) the property address you check with a Free Tool, and the number and type of properties you manage;
- (d) the content of your message, the date and time you'd like for a demo or consultation, and any webinars, events or white papers you sign up for; and
- (e) if you apply for a job, your CV, cover letter and any other details you choose to send.
2.2 Information we collect automatically. When you visit the Website, our servers and cookies collect technical information. This includes your IP address, browser and device type, operating system, pages viewed, how you arrived at the Website, and how you interact with it, such as clicks, scrolling and mouse movements. Analytics and marketing cookies are only used if you consent (see section 8).
2.3 Information from others. We may receive business contact details from event organisers, partners such as the National Residential Landlords Association (NRLA) when you ask them to introduce you to us, and publicly available sources such as company websites and LinkedIn.
2.4 We do not seek to collect special category information (such as health, ethnicity or religious beliefs) through the Website. Please don't include it in messages to us.

3. How we use your information and our legal bases

3.1 We only use your information where the law allows. The table sets out what we use it for and the legal basis for each use.

What we use it for	Information used	Legal basis
Responding to enquiries, arranging demos and consultations, and registering you for webinars, events and white papers	Contact details, message, demo preferences	Legitimate interests: answering people who contact us and developing our business. Where you are acting for yourself and ask us to take steps before a contract, contract.
Sending you Free Tool reports you request	Email address, property address checked	Legitimate interests: providing the tool you asked to use
Sending marketing emails, including our newsletter	Name, email, company, how you interact with our emails	Business contacts: legitimate interests, with an unsubscribe link in every email. Individuals and sole traders: consent, unless you are an existing customer, in which case legitimate interests ("soft opt-in")
Following up with you after a Free Tool report about our Services	Contact details, property address checked	Legitimate interests: telling interested people about our Services. You can opt out at any time
Considering job applications	Application details	Legitimate interests: recruiting staff; and taking steps before an employment contract
Running, securing and improving the Website	Technical information	Legitimate interests: keeping the Website working and secure. Where this uses non-essential cookies, consent (see section 8)
Understanding how the Website is used	Analytics data, including recordings of how you move through pages (Microsoft Clarity, kammadata.com only)	Consent, given through our cookie banner
Measuring our advertising	Marketing cookie data	Consent, given through our cookie banner
Complying with the law, and establishing, exercising or defending legal claims	Any of the above, as needed	Legal obligation; legitimate interests

3.2 Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for more detail, and you have the right to object (see section 6).
3.3 Where we rely on consent, you can withdraw it at any time, for free, using the unsubscribe link in our emails, the cookie settings link on the Website, or by contacting us. This does not affect our use of your information before you withdrew.
3.4 We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
3.5 We may use aggregated information that does not identify anyone, such as visitor numbers, for any purpose.

4. Who we share your information with

4.1 We do not sell your personal information. We share it only with:
- (a) Service providers who run the Website and our business for us, under contracts that require them to keep it secure and use it only on our instructions. These include Rocket.net (website hosting); HubSpot (forms, CRM, email marketing and meeting scheduling); Teamtailor (job applications); Google Analytics and Microsoft Clarity (analytics, only with your consent); Google Ads (advertising measurement, only with your consent); and YouTube (embedded video, only when you play a video).
- (b) The NRLA, if you ask us to pass your details to them.
- (c) Professional advisers, such as lawyers, accountants, auditors and insurers.
- (d) Authorities and regulators, where the law requires it or to protect the rights, property or safety of Kamma, our users or others.
- (e) A buyer or investor, if we sell, merge or restructure all or part of our business. They would have to use your information in line with this policy.
4.2 International transfers. Some of our service providers are based outside the UK, or access data from outside the UK. Where we transfer personal information to a country without UK adequacy regulations (a "data bridge"), we use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or another safeguard permitted by UK law. This applies in particular to Google and Microsoft, which may process website analytics data in the United States. Contact us for more detail about these safeguards.

5. How long we keep your information, and how we protect it

5.1 We keep personal information only for as long as we need it for the purposes in section 3, including to meet legal, accounting and reporting requirements. Our usual periods are:

Information	How long we keep it
Enquiries and demo requests that don't lead to a contract	2 years after our last contact with you
Marketing contact details	Until you unsubscribe or object, or 2 years without any engagement. We keep a minimal suppression record so we don't contact you again
Free Tool report requests	2 years after the report was sent
Unsuccessful job applications	6 months after the role is filled, or longer with your consent
Website analytics data	14 months, set in Google Analytics

5.2 We may keep information for longer if there is a complaint, or if we reasonably believe there is a prospect of legal action.
5.3 We use appropriate technical and organisational measures to protect your information, including encryption in transit, access controls and staff training. No transmission over the internet is completely secure. If a personal data breach occurs, we will notify you and the regulator where the law requires.

6. Your rights

6.1 Under UK data protection law you have the right to:
- (a) access the personal information we hold about you and receive a copy;
- (b) rectification: have inaccurate or incomplete information corrected;
- (c) erasure: ask us to delete your information in certain circumstances;
- (d) restriction: ask us to limit how we use your information in certain circumstances;
- (e) portability: receive information you gave us in a structured, machine-readable format, where we use it based on consent or a contract and by automated means;
- (f) object to our use of your information based on legitimate interests, on grounds relating to your situation; and
- (g) object to direct marketing at any time. If you do, we will stop.
6.2 To exercise any right, email support@kammadata.com. We will respond within one month. For complex or multiple requests, we may extend this by up to two further months and will tell you why. If we need more information to confirm your identity or find your data, the time limit starts when we receive it. For access requests, we will carry out reasonable and proportionate searches.
6.3 These rights are free to exercise. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it, and we will explain why. Some rights have legal exceptions, which we'll explain if they apply.

7. Complaints

7.1 If you are unhappy with how we have handled your personal information, please complain to us first by:
- (a) emailing support@kammadata.com with "Data protection complaint" in the subject line; or
- (b) writing to us at the address in section 1.2, marked "Data protection complaint".
7.2 We will acknowledge your complaint within 30 days of receiving it. We will then look into it without undue delay, keep you informed of progress, and tell you the outcome once we have finished.
7.3 You also have the right to complain to the UK data protection regulator, the Information Commissioner's Office (ico.org.uk, 0303 123 1113). The regulator will usually expect you to have complained to us first.

8. Cookies

8.1 Cookies are small files stored on your device when you visit a website. We also use similar technologies, such as pixels and local storage, and "cookies" in this policy includes them.
8.2 Your choices. When you first visit the Website, our banner asks which optional cookies you accept. We set only strictly necessary and preference cookies until you choose. You can change your choices at any time using the [cookie settings] link at the bottom of every page. You can also block or delete cookies in your browser settings, though some parts of the Website may then not work.
8.3 We use four categories of cookies:
- (a) Functional (always on): needed for the Website to work and to stay secure. These don't need consent.
- (b) Preferences: remember your cookie choices and similar settings.
- (c) Statistics (consent): Google Analytics and, on kammadata.com, Microsoft Clarity. They tell us how many people visit, where they come from, which pages they use and how they interact with them. Clarity records sessions of mouse movements, clicks and scrolling and is set to mask text typed into forms. Google may process this data in the United States.
- (d) Marketing (consent): let us see when you arrive from one of our adverts or emails (Google Ads and HubSpot), link your visits to forms you submit (HubSpot), and enable embedded YouTube videos. These cookies may be set by third parties, who may also use them for their own purposes under their own privacy policies.
8.4 Cookies we currently use:

Cookie	Provider	Category	Purpose	Expires	Used on
cmplz_banner-status, cmplz_policy_id, cmplz_consented_services	Kamma (consent tool)	Functional	Remember whether you have seen the banner and what you chose	365 days	Both
cmplz_functional, cmplz_preferences, cmplz_statistics, cmplz_marketing	Kamma (consent tool)	Preferences	Store your choice for each category	365 days	Both
_ga	Google Analytics	Statistics	Distinguishes visitors to count visits	2 years	Both
_ga_[ID]	Google Analytics	Statistics	Keeps the state of your current visit	2 years	Both
_clck	Microsoft Clarity	Statistics	Keeps a consistent ID for your visits	1 year	kammadata.com
_clsk	Microsoft Clarity	Statistics	Joins page views into one session recording	1 day	kammadata.com
__hstc	HubSpot	Marketing	Tracks visits, including the first and latest visit	6 months	Both
hubspotutk	HubSpot	Marketing	Identifies your browser so a form you submit is linked to your visits	6 months	Both
__hssc, __hssrc	HubSpot	Marketing	Tracks the current session	30 minutes / end of session	Both
_gcl_au	Google Ads	Marketing	Measures sign-ups and enquiries from our adverts	90 days	kammadata.com
YSC	YouTube	Marketing	Records video views in an embedded player	End of session	Both
VISITOR_INFO1_LIVE	YouTube	Marketing	Estimates your bandwidth for the video player	6 months	Both

8.5 For more about how Google uses data from sites that use its services, see Google's explanation.

9. Links, changes and contact

9.1 Other websites. The Website links to other sites, including local authorities and our partners. They have their own privacy policies, and we are not responsible for how they use your information.
9.2 Changes to this policy. We may update this policy from time to time. The date at the top shows when it was last updated. If we make a significant change, we will show a notice on the Website, and, where appropriate, tell you by email.
9.3 Contact us. Kamma Limited, Unit 207, Elementa Workspace, 1 Giltspur Street, London EC1A 9DD. Email: support@kammadata.com.