Privacy Policy

01 — Data Controller

KLIMB GROUP determines the purposes and means of processing personal data collected through goklimb.com, in compliance with Regulation (EU) 2016/679 (GDPR, Articles 12 to 14) and French Law No. 78-17 of January 6, 1978 (Loi Informatique et Libertes).

KLIMB GROUP has not appointed a Data Protection Officer (DPO) as it is not required to do so under Article 37 of the GDPR. For any inquiries related to personal data, contact us at hello@goklimb.com.

02 — Data We Collect

Data you provide directly

When you fill out a contact form, request our Notion brief template, subscribe to updates, or reach out via email, we may collect:

• First name and last name
• Email address
• Phone number (if provided)
• Company name and job title
• The content of your message or inquiry

Data collected automatically

When you visit goklimb.com, certain technical data may be collected automatically through cookies and similar technologies (subject to your consent where required):

• IP address (anonymized where possible)
• Browser type, operating system, and device information
• Pages visited, time spent, and navigation paths
• Referring website or source

No sensitive data (as defined in Article 9 of the GDPR) is collected through this website.

03 — Purposes and Legal Bases

In accordance with Article 6 of the GDPR, each processing activity is based on a lawful basis:

Where processing is based on legitimate interest, KLIMB GROUP has conducted a balancing test to ensure that your rights and freedoms are not overridden. You may request details of this assessment at any time.

KLIMB GROUP does not sell, rent, or trade your personal data to third parties for marketing purposes.

04 — Data Recipients

Your data may be shared with the following categories of recipients, strictly for the purposes described above:

• KLIMB GROUP team members involved in business development and project management
• Hosting provider: Webflow, Inc. (San Francisco, USA), acting as data processor under a Data Processing Agreement with Standard Contractual Clauses
• Analytics tools: Google Analytics (if enabled), subject to your cookie consent, with IP anonymization activated
• Email service providers: for newsletter delivery, if applicable, acting as data processors

All data processors are bound by contractual obligations in accordance with Article 28 of the GDPR.

05 — International Data Transfers

Some of our service providers (notably Webflow, Inc. and Google LLC) are established in the United States. When personal data is transferred outside the EEA, KLIMB GROUP ensures that appropriate safeguards are in place in accordance with Chapter V of the GDPR (Articles 44 to 49):

• EU-US Data Privacy Framework: where the recipient is certified under the DPF adequacy decision adopted by the European Commission on July 10, 2023
• Standard Contractual Clauses (SCCs): as approved by the European Commission (Decision 2021/914), incorporated into our data processing agreements
• Supplementary measures: including encryption in transit and at rest, data minimization, and access controls

You may request a copy of the safeguards in place by contacting us at hello@goklimb.com.

06 — Data Retention

At the end of the applicable retention period, your data is securely deleted or fully anonymized. Retention periods comply with CNIL guidelines and applicable French law.

07 — Your Rights

Under the GDPR (Articles 15 to 22) and French Law No. 78-17 (Articles 48 to 56), you have the following rights:

• Right of access (Art. 15): request a copy of the personal data we hold about you
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion of your data ("right to be forgotten")
• Right to restrict processing (Art. 18): request that we limit how we use your data
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interest, including profiling
• Right to withdraw consent (Art. 7): withdraw consent at any time, without affecting the lawfulness of prior processing
• Post-mortem directives (French law, Art. 85): define directives regarding the retention, erasure, and disclosure of your data after your death

To exercise any of these rights, contact us at hello@goklimb.com or write to KLIMB GROUP, 10 rue de Penthievre, 75008 Paris, France. We will respond within one (1) month. This period may be extended by two (2) additional months if necessary, in accordance with Article 12(3) of the GDPR. If the deadline is extended, we will inform you within the initial one-month period.

Right to lodge a complaint — Commission Nationale de l'Informatique et des Libertes (CNIL)

3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — Phone: +33 (0)1 53 73 22 22

• Online complaints: www.cnil.fr/fr/plaintes
• Website: www.cnil.fr

08 — Security

In accordance with Article 32 of the GDPR, KLIMB GROUP implements appropriate technical and organizational measures to ensure a level of security adapted to the risk:

• SSL/TLS encryption for all data in transit (HTTPS enforced site-wide)
• Secure hosting infrastructure via Webflow with SOC 2 compliant data centers
• Restricted access to personal data on a strict need-to-know basis
• Regular review of security practices and access controls

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL within 72 hours and inform you without undue delay, in accordance with Articles 33 and 34 of the GDPR.

09 — Changes to This Policy

KLIMB GROUP reserves the right to update this Privacy Policy at any time. Changes will be posted on this page with an updated revision date. Material changes will be communicated through appropriate means (e.g., email notification or website banner). We encourage you to review this policy periodically.

Last updated: April 2026