This policy explains what personal data Train Climb processes, why, and what rights you have under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Romanian law (Law no. 190/2018).
1. Who is responsible
- COSMIC ATMAN SRL
- Registered office: B-dul Dacia 18, Iași, România
- Trade Register number: J2024041140002
- Tax ID (CUI): 50880742
- Email: office@trainclimb.com
- Phone: +40740623913
For privacy questions or to exercise your rights, write to office@trainclimb.com.
Coaches, clubs and their athletes
When a coach or club uses Train Climb to train athletes, the coach or club decides what athlete data is collected and why. For that training data the coach or club is the controller, and we process it on their behalf as a processor under our Data Processing Agreement. Athletes should contact their coach or club first; we will help them answer your request. For account data, website visits and athletes who train on their own, we are the controller.
2. What we collect
| Category | Examples |
|---|---|
| Account data | Name, username, email address, password (stored only as a one-way hash), profile photo, role (coach or athlete). |
| Training data | Training sessions and plans, exercises and their recorded values, duration, intensity, metres climbed, perceived effort and mood, notes, climbs (route name, location, grade, attempts, photos). |
| Health and wellbeing data | Recovery metrics such as heart rate variability, resting heart rate, sleep hours, fatigue and soreness scores, and physical and mental metrics you choose to record. |
| Communication | Messages between coaches and athletes about training reports, and emails you send us. |
| Billing data | For paid plans: billing name, company details, invoices and payment status. Card details are handled by the payment provider and never stored by us. |
| Technical data | IP address, browser type, date and time of requests, and security logs. |
| Parent accounts | For a parent who follows an athlete: their name, email address and password (as a one-way hash), which athletes they follow, and when they last looked. |
| Website statistics | For pages of the public site: the page, the time, the site you came from, your type of device, and a code made each day from your IP address and browser so a visitor is counted once a day. The code changes every day, so it can't be used to follow you over time. No cookies. |
3. Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, providing the Service, support | Performance of a contract (Art. 6(1)(b) GDPR) |
| Recording and showing health and wellbeing data | Your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time by deleting the data or asking us or your coach |
| Invoicing and accounting | Legal obligation (Art. 6(1)(c) GDPR) |
| Keeping the Service secure, preventing abuse, fixing errors | Legitimate interest (Art. 6(1)(f) GDPR) |
| Counting visits to the public site and downloads of our guides, to see which pages are useful | Legitimate interest (Art. 6(1)(f) GDPR); no cookies, and the daily code can't identify you |
| Newsletter: training tips, blog articles, product news, promotions and offers | Your consent (Art. 6(1)(a) GDPR); every email has an unsubscribe link |
We do not sell personal data, and we do not use it for advertising profiles. We do not make decisions about you based solely on automated processing. Workload and readiness scores are calculations to support your coach's judgement.
4. Young athletes
Parents following training. An athlete can let a parent see a short summary of their training (how often and how long they train, what is planned, competitions, their yearly climbing total and test results), by inviting the parent or allowing a parent who asked. The athlete decides and can stop it at any time; this is separate from a parent's consent to a young athlete's account. Parents never see notes, check-ins, health data, messages or private climbs, and change nothing. A club can let parents write to coaches; the athlete sees those messages.
Many climbers train from a young age. We ask every athlete for their date of birth. Athletes under 16 can use the Service only with the consent of a parent or legal guardian, given in one of two ways:
- By the parent, online: the athlete gives a parent's email; we send the parent a link explaining what is recorded and who sees it, and the account stays locked until they agree. We keep a record of the consent (name, email, date, the text they agreed to, IP address).
- Through the club: a club that already holds a signed parental consent form can confirm it in the app. The club keeps the signed form; we record who confirmed it and when.
Recovery check-ins (heart rate variability, resting heart rate, sleep, fatigue and soreness) are health data and are only recorded for an athlete under 16 if the parent's consent covers them. The parent also decides whether coaches see training logged before the athlete joined their club. We show no analytics or advertising to athletes under 16.
Parents can change their choices or withdraw consent at any time with the link in their consent email; withdrawing locks the account. Parents and guardians can also contact us or the coach to see, correct or delete their child's data.
5. Who receives your data
- Your coach or athletes: athletes' training data is visible to the coach or club they train with; plans and messages from the coach are visible to the athlete.
- Service providers who work for us under contract: web hosting and database hosting, email delivery, payment processing, accounting, and the text-editor service used in the app. They may only use the data to provide their service to us.
- Authorities, when the law requires it.
We store data in the European Union. If a provider needs to access data from outside the European Economic Area, we use the safeguards required by the GDPR, such as the European Commission's standard contractual clauses or an adequacy decision.
6. How long we keep it
- Account and training data: while your account is active. When an account is closed, we delete or anonymise its data within 30 days. Backups are overwritten within a further 30 days.
- Invoices and accounting records: 10 years, as required by Romanian accounting law.
- Security logs: up to 90 days.
- Website statistics: 13 months, then only daily totals per page.
- Newsletter: your email address and proof of consent (the consent text, date and IP address), and which newsletter emails were sent to you, until you unsubscribe; after that only the proof of consent and the date you left. Sign-ups that are never confirmed are deleted after 30 days.
- Emails with us: up to 2 years after the conversation ends, unless they are needed for a legal claim.
7. Security
We protect data with access controls, encrypted connections (HTTPS), hashed passwords and restricted, logged administrative access. Each user only sees the data their role allows. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the supervisory authority as the law requires.
8. Your rights
You have the right to:
- access your data and get a copy of it;
- correct inaccurate data;
- have your data deleted;
- restrict or object to processing based on legitimate interest;
- receive your data in a structured, machine-readable format (data portability);
- withdraw consent at any time, without affecting processing done before you withdrew it.
Write to office@trainclimb.com. We answer within one month. You can also complain to the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro.
9. Cookies
We only use cookies that are needed for the site to work. Details are in the Cookie Policy.
10. Changes
We will update this policy when our processing changes and show the date of the last update at the top of the page. We will tell registered users about significant changes by email or in the app.