Your data, explained
Privacy policy
What personal information we collect through this website and at the centre, why, how long we keep it and what your rights are.
Who we are
The data controller for personal information collected through this website and at the climbing centre is Golden Gecko Climbing Ltd (trading as UCLIMBING). We use the UK GDPR and the Data Protection Act 2018. Our details are in the Legal Notice. For any privacy question or to use your rights, You can call 01392 436 850, use the contact form or write to us at 34 Romsey Industrial Estate, Greatbridge Road, Romsey, Hampshire, SO51 0HR, United Kingdom.
What we collect
When you send an enquiry through this website
The activity you’re interested in, your name, email address, optional telephone number, preferred and alternative dates and time of day, number of participants, ages of any under-18s, climbing experience, any group or organisation name and anything you write in the message box. We also check your IP address in a hashed form for spam protection (see below).
When you register or visit the centre
When you climb, we collect registration details in person at the centre (name, contact details, emergency contact, date of birth or age for under-18s, a health declaration and signed acceptance of risk or parental consent). Health information is “special category” data, which we ask for only to help keep you safe. We also keep records of accidents and incidents, payment records for passes and memberships, and booking details for sessions.
Technical information
Our web host may log technical information such as your IP address, browser type and the pages you request, for security and to keep the site running. We don’t use analytics or advertising trackers on this website. See the Cookie Policy.
The enquiry form is submitted directly to PHP using a standard POST request and uses a hidden field for basic spam protection. Submitted values are processed transiently to validate the form and return the confirmation page; the form contents are not written to website storage.
Why we use it
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Replying to your enquiry, checking availability and arranging a session you’ve asked for | Steps at your request before entering a contract; and our legitimate interests in running our business (Art. 6(1)(b) and (f)) |
| Registration, induction, safety records, supervising and looking after climbers | Contract, legitimate interests in operating safely, and legal obligations (Art. 6(1)(b), (c), (f)) |
| Health declarations and information about medical conditions | Your explicit consent, and where necessary to protect vital interests (Art. 9(2)(a) and (c)) |
| Payment, accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Spam protection and website security | Legitimate interests (Art. 6(1)(f)) |
We don’t send marketing emails through this website, and we don’t sell your data. If we ever begin to offer a newsletter, we will ask for your consent separately.
We use your acknowledgement email address only to reply about your enquiry. We don’t make automated decisions about you.
Who we share it with
We share personal data only where needed: with our email, hosting and IT providers who process data on our instructions; with our insurers, advisers and, where required, regulators or the emergency services; and with a parent or guardian where a child is involved. We don’t share your data for advertising.
How long we keep it
- Website form submissions: not written to website storage.
- Booking, pass and membership and payment records: normally 6 years, to meet accounting and tax obligations.
- Registration and health declarations: for as long as your registration remains current, and then for a limited period afterwards in case of claims.
- Accident and incident records: for as long as the law or our insurers require, which can be much longer for children.
- Spam-protection data: up to two hours.
Children
Children under 18 can climb at the centre, but enquiries and registration for them must be made by a parent or guardian. If you’re under 18, please ask a parent or guardian to use the enquiry form. Only enter information about a child that’s needed for us to plan a safe session, such as their age and any health or access needs.
Security
We use reasonable technical and organisational measures to protect personal data, including restricting access, using encrypted connections where our hosting allows and avoiding storing enquiry contents on the website. No system is perfectly secure, so please don’t send sensitive information in the message box unless needed.
International transfers
If our email or hosting providers process data outside the UK, we rely on UK adequacy regulations or appropriate safeguards (such as the UK International Data Transfer Agreement or Addendum) to protect it.
Your rights
You have the right to be told how your data is used, to access it, to have it corrected or deleted, to restrict or object to certain uses, to data portability in some cases, and to withdraw consent at any time where we rely on it (this doesn’t affect earlier use). To use your rights, You can call 01392 436 850, use the contact form or write to us at 34 Romsey Industrial Estate, Greatbridge Road, Romsey, Hampshire, SO51 0HR, United Kingdom. We’ll usually respond within one month. You can also request a copy of the data we hold about you.
Complaints
If you’re unhappy with how we’ve used your data, please talk to us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
Changes
We may update this policy as our business or the law changes. The review date at the top shows when it was last checked.
Contact us about this page
You can call 01392 436 850, use the contact form or write to us at 34 Romsey Industrial Estate, Greatbridge Road, Romsey, Hampshire, SO51 0HR, United Kingdom.