Privacy policy

CLIMB is made by BeGOOD Solutions Ltd (“we”, “us”), a company registered in England and Wales with company number 16854996, at 128 City Road, London EC1V 2NX.

This policy covers our website (climb.begood.solutions), the CLIMB app for employees, the CLIMB Coach app for owners and managers, and the services behind them. For anything about your data, email help@begood.solutions.

Under UK data protection law, we play two different roles.

• We are the controller for information about website visitors, people who contact us, and the account details you use to sign in to CLIMB. We decide how that information is used, and this policy explains it.
• We are a processor for the workplace information a business puts into CLIMB about its people, such as employee records and attendance. The business (your employer, if you work for a CLIMB customer) is the controller: it decides what to collect and why, and we process it only on its instructions, under the data processing terms in our terms of service.

If you use CLIMB through your employer, your employer’s own privacy notice applies to your workplace data, and they are the right first contact for questions or requests about it. We will help them respond.

When you visit our website

We use Vercel Web Analytics, Speed Insights and PostHog to count page views, see which parts of a page people click, measure how quickly pages load and catch errors on the site. They do not use cookies or store anything in your browser, do not identify you, and do not track you across other websites. They record things like the page visited, where you clicked, the referring site, your browser and device type and your approximate country. PostHog tells repeat visits apart with a code made from your IP address and browser that changes every day and can’t be traced back to you; the IP address itself isn’t kept. Our hosting provider also keeps short-lived server logs, including IP addresses, to keep the site secure and working.

When you contact us

If you email us, for example to ask for early access, we receive your name, email address and whatever you choose to tell us about your business.

When you have a CLIMB account

• Account details: your name, email address and whether you have verified it.
• Password: stored only as a one-way hash. We never see or store the password itself.
• Two-factor authentication: if it’s on (required for owners and managers), the key your authenticator app uses and your backup codes, both encrypted.
• Passkeys: if you add one, its public key, a name for it (such as “iPhone”) and a usage counter. Your fingerprint, face and PIN never leave your phone.
• Your company and role: which businesses you belong to, your role in each (owner, manager or employee) and invitations you send or receive, including the invitee’s email address.
• Sign-in and security records: active sessions with the IP address and device or browser they were created from, and short-lived records of sign-in attempts by IP address, which we use to block password-guessing attacks.

Workplace information (processed for your employer)

Depending on which features a business uses, this can include:

• Employee records: name, employee number, contact details, address and, if the business chooses to record it, National Insurance number.
• Attendance: clock-in and clock-out times, which workplace tag was tapped and at which site, hours worked, and failed or rejected scans.
• A change history of who changed a record or attendance entry, what changed and when. Sensitive values are hidden in this history.

Notifications

When you sign in to a CLIMB app, it registers your phone with our notification provider, OneSignal, and links it to your CLIMB user ID, so alerts such as a new invitation reach the right person. OneSignal receives an identifier for the app on your phone and basic device details, such as the phone model, operating system and language. This happens whether or not you allow notifications, and the link is removed when you sign out. Notifications are only shown if you allow them, and you can turn them off at any time in your phone’s settings.

How you use CLIMB

We record which screens you open in the apps and key things you do in CLIMB: creating an account, verifying your email, creating a company, inviting someone or accepting an invitation, clocking in or out, and registering an NFC tag. Each is linked to your CLIMB user ID, your company and, where relevant, your role or how you clocked in (the button or a tag), never to your name or email and never with what you typed. Our servers record the key actions; the apps record the screens. If you work for us, these records are marked as internal so we can leave them out of our figures. We use this to see which features are used and where people get stuck.

You can turn it off: “Share how I use the app” in Account (or Settings in CLIMB Coach). The choice is saved on your account, so it applies on every device and to what our servers record. Crash reports are sent either way: what went wrong, the phone model, system and app version, and your CLIMB user ID.

What we don’t collect

CLIMB does not collect your location. When you clock in, it records which of your workplace’s tags you tapped, not where your phone is. If we add optional location checks in future, we will update this policy first, and businesses that turn them on must tell their staff when and why location is used. We don’t ask for special category data such as health information; please don’t enter it into CLIMB.

• To provide CLIMB: creating and running your account, letting you join your company and use the features your role allows. Lawful basis: contract.
• To send service emails: email verification, password resets and invitations. These are part of the service, so you can’t opt out of them while you have an account. Lawful basis: contract.
• To send push notifications: registering your phone with our notification provider when you sign in, so alerts reach the right person. Lawful basis: legitimate interests in delivering service alerts reliably. Notifications are only shown after you allow them on your device. Lawful basis: consent, which you can withdraw in your phone’s settings.
• To keep CLIMB secure: preventing fraud, abuse and unauthorised access, including rate limiting by IP address. Lawful basis: legitimate interests in protecting our users and services.
• To answer enquiries and run early access. Lawful basis: legitimate interests in responding to people who contact us.
• To understand and improve our website and apps, using website analytics and app usage data, which you can turn off. Lawful basis: legitimate interests in improving the service.
• To meet legal obligations, such as keeping records or responding to lawful requests. Lawful basis: legal obligation.

We don’t sell personal data, we don’t use it for advertising, and we only send marketing emails if you have asked for them. CLIMB doesn’t make automated decisions about people that have legal or similarly significant effects.

We use trusted service providers (sub-processors) to run CLIMB. They may only use personal data to provide their service to us:

• Vercel: hosts our website and services, and provides our cookie-free website analytics.
• Our database provider: stores CLIMB data in a UK or EU data centre.
• Resend: delivers our service emails.
• PostHog (EU data centre): stores our service logs, such as sign-ins, blocked requests and errors, with your CLIMB user ID and IP address; error and crash reports with your CLIMB user ID; app usage data; and our website analytics, so we can spot attacks, fix problems and improve CLIMB. Never passwords, two-factor codes or message contents.
• OneSignal: sends push notifications to the CLIMB apps.
• Apple and Google: deliver notifications to iPhones and Android phones, and distribute the apps through their stores.

Within a business, people see CLIMB data according to their role: for example, managers can see their team’s attendance, and staff see their own. We may also share information with professional advisers, with authorities where the law requires it, or with a buyer if our business is sold, in which case this policy continues to apply.

We store CLIMB’s data in the UK or the European Economic Area. Some of our providers are based in, or access data from, the United States. When personal data leaves the UK, we make sure it is protected by an adequacy decision, such as the UK Extension to the EU-US Data Privacy Framework, or by the UK International Data Transfer Agreement or Addendum. Email us for more detail on these safeguards.

• Sign-in sessions for owners and managers end after 30 minutes without use and at most 12 hours after signing in; for employees they last up to 30 days. They end straight away when you sign out, reset your password, change two-factor settings or your role changes. Sign-in attempt records and email verification and reset links expire within hours. Service logs are kept for 14 days, and records of security events (such as sign-ins and blocked requests) for 90 days. App usage data and crash reports are kept for up to a year.
• Account details are kept while your account is open, and deleted or anonymised within 90 days of it closing.
• Workplace information is kept for as long as the business uses CLIMB, or as its instructions require. When a business leaves, it can export its data for 30 days, and we delete it within 90 days of the account closing. Businesses remain responsible for keeping the records the law requires them to, such as payroll records.
• Enquiries are kept for up to 2 years after our last contact, unless they become part of a customer relationship.

• Data is encrypted in transit between the apps and our servers.
• Passwords are stored only as strong one-way hashes, and passwords must be at least 12 characters. New passwords are checked against Have I Been Pwned’s list of breached passwords: only the first five characters of a hash of the password are sent, never the password.
• Owners and managers must use two-factor authentication, and confirm it’s them again (a code or a passkey) before deleting records, voiding shifts, changing tags or changing someone’s role.
• The apps lock themselves when unused (Climb after 30 minutes, Climb Coach after 2) and unlock with Face ID, a fingerprint or your phone’s passcode. Your phone checks these; we never receive biometric data.
• Sign-in is protected by email verification and rate limiting, and the apps keep your session in your phone’s secure storage.
• Access is limited by role, and changes to records and attendance are logged.
• Our hosting providers encrypt stored data.

No system is perfectly secure. If a breach affects your personal data and puts your rights at risk, we will tell you (or the business we process it for) and the Information Commissioner’s Office as the law requires.

Under UK data protection law, you can ask us to:

• give you a copy of your personal data;
• correct it if it is wrong or incomplete;
• delete it, or limit how we use it;
• stop using it where we rely on legitimate interests;
• send it to you or another provider in a portable format.

Where we rely on your consent, you can withdraw it at any time. To use any of these rights, email help@begood.solutions. We will reply within one month. For workplace information, please start with your employer: they control that data, and we will help them respond.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Our website doesn’t set cookies or store anything in your browser for analytics or advertising, so there’s nothing to accept or reject. The CLIMB apps store a sign-in token in your phone’s secure storage so you stay signed in, which is strictly necessary for the apps to work. They also store an identifier for usage data and crash reports, and a copy of your choice about sharing usage data so it applies before you sign in.

Our website and services are aimed at businesses and are not directed at children. Where a business employs young workers, it is responsible for using CLIMB in a way that is lawful and appropriate for them.

We will update this policy when CLIMB or the law changes, and change the date at the top. If a change materially affects how we use your data, we will tell account holders by email or in the apps before it takes effect.

Questions or requests about privacy: help@begood.solutions, or write to us at BeGOOD Solutions Ltd, 128 City Road, London EC1V 2NX.