INTRODUCTION

This Privacy Policy sets out how Climb Up, a trading name of Play Valley Limited, collects, uses, stores and protects your personal data. We are committed to protecting your privacy and handling your personal data in an open and transparent way.

Play Valley Limited is the data controller for the personal data we collect about you through Climb Up. We are registered in England, Company No. 10189466.

If you have any questions about this policy or how we handle your personal data, please contact us at:

Email: hello@climb-up.co.uk

Website: www.climb-up.co.uk

WHAT PERSONAL DATA WE COLLECT

We may collect and process the following personal data about you:

Information you provide directly:

• Name, address, email address and telephone number
• Date of birth of all participants (required for age-restricted climbing activities and supervision policy)
• Emergency contact name and telephone number
• Health and medical information provided in your Participant Waiver
• Payment information – note we do not store card details; payments are processed securely via our payment provider
• Booking details and transaction history
• Signed Participant Waiver and associated declarations
• Communications you send us including emails, enquiries and feedback

Information we collect automatically:

• Details of your visits to our website including pages viewed and resources accessed
• Technical information including IP address, browser type and operating system
• Cookie data — see our Cookie Policy in Section 9

HOW WE USE YOUR PERSONAL DATA

We use your personal data for the following purposes:

• To process and manage your bookings and payments
• To send you booking confirmations and related communications
• To administer your account on our booking platform (Fusemetrix)
• To manage and verify Participant Waivers before each session
• To comply with our legal and regulatory obligations including health and safety law, RIDDOR reporting requirements and LOLER equipment inspection records
• To maintain safety and incident records in accordance with our legal obligations
• To contact your emergency contact in the event of an incident during your session
• To send you marketing communications where you have given us permission to do so
• To improve our services and website through analysis of usage data
• To respond to your enquiries and complaints

HEALTH & MEDICAL DATA

The information you provide in your Participant Waiver may include health and medical data, which is classified as special category personal data under UK GDPR. We collect this data because it is necessary for reasons of substantial public interest – specifically to ensure the safety of participants in climbing activities and to comply with our health and safety obligations.

Health and medical data collected through the Participant Waiver will be:

• Used solely for the purpose of assessing fitness to participate and ensuring participant safety
• Accessible only to authorised Climb Up staff who need it to deliver safe climbing sessions
• Stored securely and retained for a minimum of 3 years in accordance with our legal obligations
• Never shared with third parties except where required by law or in a medical emergency

LEGAL BASIS FOR PROCESSING

We process your personal data on the following legal bases under UK GDPR:

• Contract: processing is necessary to fulfil your booking and deliver the climbing services you have requested
• Legal obligation: processing is necessary to comply with our legal and regulatory obligations including health and safety law
• Legitimate interests: processing is necessary for our legitimate business interests, including improving our services and preventing fraud, where these interests are not overridden by your rights
• Consent: where you have given us clear consent to process your data for a specific purpose, such as receiving marketing communications or appearing in photography
• Substantial public interest: for the processing of health and medical data provided in the Participant Waiver

WHO WE SHARE YOUR DATA WITH

We will never sell your personal data to third parties. We only share your personal data in the following limited circumstances:

• Fusemetrix Systems: our booking platform provider, who stores booking, waiver and customer data securely on our behalf
• Payment processors: to process card payments securely. We do not store card details
• Play Valley Limited: as the parent company and data controller, relevant staff may have access to Climb Up customer data where necessary for operational purposes
• Legal and regulatory authorities: including HSE and local authority Environmental Health Officers where we are required to report incidents under RIDDOR or other legislation
• Emergency services: in the event of a medical emergency, relevant personal and medical information may be shared with emergency responders
• Professional advisors: including solicitors, accountants and insurers where necessary

All third parties with whom we share data are required to handle it securely and in accordance with UK data protection law.

HOW LONG WE KEEP YOUR DATA

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including:

• Booking and transaction records: 7 years (in accordance with HMRC requirements)
• Participant Waiver records: minimum 3 years from the date of signing
• Safety and incident records: minimum 3 years (or longer where required by law or where legal proceedings are anticipated)
• Customer account data: we retain your account data for as long as you remain a customer. If you would like your account data removed, please contact us and we will action this promptly, subject to any legal obligations to retain certain records
• Marketing consent records: until you withdraw consent

If you wish to have your personal data removed from our systems before these periods expire, please contact us and we will action this promptly, except where we are required by law to retain it.

YOUR RIGHTS

Under UK GDPR you have the following rights in relation to your personal data:

• Right of access: you have the right to request a copy of the personal data we hold about you
• Right to rectification: you have the right to request that we correct any inaccurate personal data
• Right to erasure: you have the right to request that we delete your personal data in certain circumstances
• Right to restrict processing: you have the right to request that we restrict how we use your personal data in certain circumstances
• Right to data portability: you have the right to receive your personal data in a structured, commonly used format
• Right to object: you have the right to object to our processing of your personal data in certain circumstances, including for direct marketing
• Right to withdraw consent: where we process your data on the basis of consent, you have the right to withdraw that consent at any time

To exercise any of these rights, please contact us at hello@climb-up.co.ukWe will respond to your request within one month. There is no charge for making a request.

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

DATA SECURITY

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction or alteration. These include:

• Secure encrypted servers for storing all customer and waiver data via Fusemetrix
• Secure encrypted payment processing – we do not store card details
• Access controls – only authorised Climb Up staff can access customer and waiver data
• Regular review of our data security practices

Where you have been provided with a password or user ID to access your account, you are responsible for keeping these confidential. Please do not share them with anyone.

COOKIE POLICY

Our website at www.climb-up.co.uk uses cookies to help personalise your online experience and to improve our services. A cookie is a small text file placed on your device by our website server.

We use the following types of cookies:

• Essential cookies: necessary for the website to function correctly, including enabling you to make bookings
• Analytics cookies: help us understand how visitors use our website so we can improve it
• Marketing cookies: used to monitor the success of advertising campaigns and improve your browsing experience

You can accept or decline non-essential cookies through our cookie consent banner when you first visit our website. Declining certain cookies may affect your ability to use some features of our website.

CHILDREN’S PRIVACY

We are committed to protecting the privacy of children. We do not knowingly collect personal data directly from children under the age of 13. Where we collect personal data about children (including for booking and waiver purposes), this is provided by and collected from the parent or guardian making the booking, who is responsible for ensuring the information is accurate and that they have the authority to provide it.

Health and medical data relating to child participants is treated with the highest level of care and accessed only by authorised staff for the purposes of ensuring safe participation.

PHOTOGRAPHY & VIDEO

Climb Up may take photographs or video footage during sessions for use in marketing and promotional materials. We will always seek your consent before using images in which you or your child are clearly identifiable. You can indicate your preferences on the Participant Waiver or by speaking to a member of staff before your session.

Where customers take their own photographs or video footage during a session, we ask that you are considerate of other visitors. Please do not post images or video footage of other people’s children on social media without the permission of their parent or guardian.

MARKETING COMMUNICATIONS

We will only send you marketing communications where you have given us your consent to do so. You can withdraw your consent and unsubscribe at any time by:

• Clicking the unsubscribe link in any marketing email
• Contacting us at hello@climb-up.co.uk
• Withdrawing consent will not affect the lawfulness of any processing carried out before withdrawal.

THIRD PARTY WEBSITES

Our website may contain links to third party websites. This Privacy Policy applies only to www.climb-up.co.uk and Climb Up services. We are not responsible for the privacy practices of third party websites and encourage you to read their privacy policies before providing any personal data.

CHANGES TO THIS POLICY

We reserve the right to amend this Privacy Policy at any time to better protect your personal data and to comply with prevailing legal regulations. The current version will always be available at www.climb-up.co.uk. We will notify you of any significant changes by email where we hold your contact details.

CONTACT US

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

Email: hello@climb-up.co.uk

Website: www.climb-up.co.uk          

Registered in England. Company No. 10189466