How Climbo complies with the General Data Protection Regulation. Questions? help@climbo.com
Climbo is an Italian company with registered office at Via Marsala 29H, 00185 Roma (RM), Italy. As a European company, we build and run Climbo under Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), and applicable national data protection laws. This page summarises how we meet those obligations for agencies and the local businesses they serve.
Summary
When an agency uses Climbo to manage its clients' reviews, messages, contacts and campaigns, the agency is the Controller of that personal data and Climbo acts as Processor. We process personal data only on the agency's documented instructions and only to provide the Services.
For the personal data of our own customers (account, billing and usage data), Climbo is the Controller, as described in our Privacy Policy.
Our Data Processing Agreement forms part of the agreement with every agency. It sets out the subject matter, nature and purpose of the processing, the categories of data and data subjects, our security measures and our list of authorised sub-processors, as required by Article 28 GDPR.
Climbo is hosted in Germany and personal data is processed in the European Union. We do not transfer personal data outside the European Economic Area unless appropriate safeguards are in place, such as an adequacy decision of the European Commission or Standard Contractual Clauses.
We apply technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Access is limited to personnel who need it to provide the Services, and everyone authorised to process personal data is bound by confidentiality obligations.
We use a limited number of trusted service providers, such as Stripe for payments and our hosting provider, only when strictly necessary. Every sub-processor is bound by written data protection obligations at least as protective as our DPA. We inform agencies of any intended change, and agencies may object on reasonable data protection grounds within 30 days.
We help agencies respond to requests from the people whose data they manage in Climbo, including:
If we receive a request directly about data we process on behalf of an agency, we confirm receipt and redirect the person to that agency.
If we become aware of a personal data breach affecting data processed on behalf of an agency, we notify the agency without undue delay, with the information needed to assess the breach, and we cooperate in investigating, mitigating and documenting it.
Climbo's AI features, such as review replies, social posts and blog articles, process personal data only as needed to provide those features. We do not use agency personal data to train general-purpose AI models unless expressly agreed in writing with the agency.
When agencies send review requests, SMS, WhatsApp messages, emails or campaigns through Climbo, the agency remains responsible for having a lawful basis or valid consent, providing privacy notices to recipients and respecting opt-outs and unsubscribe requests. Climbo provides the tools to send these communications as Processor.
Personal data is kept for the duration of the Services. When the Services end, we delete or return the data at the agency's choice, unless the law requires us to keep it. Agencies can export available data from the platform. Limited backup copies may be kept for a reasonable period, protected, and deleted according to our backup schedule.
For any question about GDPR, data protection or our Data Processing Agreement, write to help@climbo.com.