Privacy policy

Version anglaise

PRIVACY AND COOKIES POLICY

Version effective as of October 6, 2026

The protection of your personal data is at the heart of our concerns.

At Arkose&Co, we want to provide you with all the necessary information to understand how we use your data, with complete transparency!

This policy applies to data we collect online (on our website and our Arkose+ mobile application), offline (in our Climbing Lofts, during our events, etc.), as well as from our partners and subcontractors. It applies worldwide, whenever we interact with you, whether you are:

  • a climber or a customer in our spaces ;
  • a visitor browsing our website or mobile application;
  • a prospective employee applying for one of our job openings or a member of our team;
  • one of our partners, suppliers, or service providers;
  • or, quite simply, whenever we need to contact you in connection with our activities!

Because our activities (and laws!) evolve, we may need to update this personal data protection policy. Please feel free to consult this page regularly to check for updates.

Table of contents

  1. A bit of vocabulary
  2. Who is responsible for your data?
  3. On what occasions do we collect your data?
  4. What data do we collect?
  5. How and for how long do we use your data?
  6. With whom do we share your data?
  7. Where is your data stored?
  8. How do we protect minors?
  9. How is your data secured?
  10. What are your rights and how can you exercise them?
  11. Management of cookies
  12. A question, an incident, or a complaint: how to contact us

1. A bit of vocabulary

Because we prefer plain language to legal jargon, here are the definitions of essential terms to ensure proper mutual understanding:

  • "Data Protection Authority": the public and independent body responsible for verifying that everyone complies with personal data rules. In France, this is the CNIL.
  • "Personal Data": simply any information that allows you to be identified directly or indirectly (your last name, first name, email address, or even your IP address!).
  • "Sensitive Data": highly specific information that touches upon your privacy or highly protected aspects of your life (racial/ethnic origin, religion, health data, etc.).
  • "Data Subject": the climber, customer, website or Arkose+ visitor, job applicant, or member of our team whose data is being used.
  • "Data Controller": the entity that uses your data and decides the "why" and "how".
  • "GDPR": the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, applicable as of May 25, 2018).
  • "Gym(s)" or "Climbing Loft": refers to all establishments under the "Arkose" brand, including bouldering and route climbing areas, canteens, shops, and bars, located in mainland France, Spain, and Belgium.
  • "Data Processor": a trusted technical service provider or partner who assists us daily (such as our web host or payment provider) and handles your data strictly according to our instructions.
  • "Processing": any operation or set of operations performed on your data, whether automated or not. Example: collecting your information upon registration, recording it, storing it on our servers, or deleting it.

Terms starting with a capital letter in this policy are defined in this article.

2. Who is responsible for the use of your data?

In the course of our activities, your Personal Data is processed by:

  • Arkose&Co, parent company of the Arkose Group;
  • Its subsidiaries, Arkose Belgium and Arkose Climbing SL; and
  • Its franchisee partners.

Arkose&Co acts as Data Controller: it centralizes and manages all your data. On the one hand, it publishes and administers all our global services (our website, the Arkose+ application, our communications, your subscriptions, etc.). On the other hand, it directly manages the daily operation of our Climbing Lofts located in France (excluding franchised Gyms).

Our subsidiaries act under the direction of Arkose&Co to ensure the daily operation of our Gyms located in Belgium and Spain.

Our franchisee partners operate their establishments independently and act as Data Controllers, jointly with Arkose&Co, solely for the data of their own customers. This joint management enables you to maintain a single account and access all Gyms in the network.

You can find all our legal notices as well as those of our subsidiaries and franchisee partners in the "Legal Notices" section of our website.

In this policy, "we", "us", or "Arkose" refers to all these entities combined.

3. On what occasions do we collect your data?

We collect your Personal Data at specific times, whether directly in our Gyms or online (on our website www.arkose.com and our application plus.arkose.com / Arkose+), depending on your relationship with us:

  • When you are a customer at Arkose: when you order our products or services (purchase of an annual subscription, climbing sessions, registration for camps or classes, etc.).
  • In the context of our professional relationships: if you are a supplier, service provider, or partner (for example, when you contact us by email, phone, or simply hand us your business card).
  • During our events: when you participate in events organized by Arkose (competitions, parties, etc.), we may collect certain data necessary for your participation and event organization.
  • If you join the Arkose adventure: when you apply for a job offer, send us an unsolicited application, or if you are already part of our team as an employee or corporate officer.
  • Via third-party bodies, partners, and service providers: more indirectly, when we receive information from third-party organizations (rating agencies or legal information websites like Infogreffe) or from our partners and service providers (public Wi-Fi management platforms or marketing tools).
  • During your online sessions: as soon as you browse our website or application or use the features and services available or accessible through them.

To fully enjoy our website and application, certain information is essential. You are naturally free not to communicate your Personal Data to us. However, without it, certain services or features may not function, or at least only partially.

4. What data do we collect?

At Arkose, we only collect data that is strictly necessary to offer you the best possible experience. Each collected data item has a specific purpose and depends on how you interact with us.

Your situation Collected data
When you visit our Climbing Lofts Customer account & booking: last name, first name, gender, date of birth, email, phone number, postal code, sports level, photo.

Subscription & payment: postal address, bank details (IBAN/card), purchase/quote/order history, invoices, and due dates.

Minors (independent access from age 12 and above): last and first names (child and parent/guardian), family relationship, postal address, phone number.

Suspension/termination for medical reasons or relocation for professional reasons: medical certificate of sports contraindication and any professional proof at your discretion.

CCTV: images captured by security cameras installed in our facilities.

Commercial follow-up & feedback: your responses to our satisfaction surveys, as well as any additional data you choose to share with us to personalize your experience.

Free Wi-Fi access: IP address, MAC address, connection logs, email address, identification data.
When you browse our website or Arkose+ application Simple visit: IP address, connection logs (date & time), visited pages, and cookies.

Contact form: Last name, first name, email, phone number, message content.

Newsletter : your choice to subscribe or not to receive our commercial solicitations and newsletter.
When you use our application and/or the Arkose+ loyalty program User account: name or nickname, gender, date of birth, email, company.

Activity on the app: visit history, achievements (tops, flashes), challenges, boulders viewed/set, comments, videos, and favorites.

Loyalty program: date of joining & unsubscription, history of visits / events / subscriptions and purchases taken into account for your rewards.
When you interact on our social media Statistics & interactions: age group, gender, general location, views, likes, and comments on our posts or advertisements.
If you are a B2B supplier / service provider / client Contractual relationship: last name, first name, company, position, professional address (and billing address), pro email, pro phone number, and order notes of our contacts within your company, as well as any information useful for follow-up.
If you apply for a job or are an employee/corporate officer at Arkose Applying at Arkose: last name, first name, photo, contact details, CV, cover letter, diplomas, and professional background.

All necessary information for administrative and HR management: identity, civil status, personal contact details, professional background, diplomas, bank details (RIB/IBAN), social security number, etc.

In the normal course of our activities, we do not seek to collect Sensitive Data (such as your racial origin, religion, or health data). However, this may occur in the following cases:

  • If we have obtained your explicit consent and you provide us, for example, with a medical certificate to suspend or terminate your subscription;
  • If law requires or permits us to do so (notably for mandatory declarations);
  • For the detection and prevention of criminal offenses (such as fraud).

If you provide us with Sensitive Data concerning a third party (a relative or parent), you must explicitly inform us.

5. How and for how long do we use your data?

Each use of your Personal Data is based on a specific legal reason (referred to as the "legal basis").

Processing Legal Basis
Customer account Performance of a contract
Bookings, purchases, and subscriptions Performance of a contract
Arkose+ loyalty program Consent
Newsletters, commercial communications, and promotional offers Consent
Contact form Legitimate interest
Exercise of GDPR rights Legal obligation
Customer support Performance of a contract
Community features on Arkose+ Performance of a contract
Satisfaction surveys and quality audits Legitimate interest
Competitions / Contests Performance of a contract
Free Wi-Fi access in gym Performance of a contract and legal obligation
Cookies and statistics Consent and legitimate interest
Gym safety Legitimate interest
IT security and cybersecurity Legitimate interest
Accounting, financial, legal management, and audits Legal obligation
Tenders and B2B relations Legitimate interest and performance of a contract
Market studies, media analysis, and trends Legitimate interest
Recruitment and application management Legitimate interest
Employee and corporate officer management Legal obligation and legitimate interest
Pre-litigation and litigation management Legitimate interest

We apply strict rules to ensure that your Personal Data is kept only for the time strictly necessary for the purposes for which it was collected.

At the end of the retention periods defined below, we delete your data from our systems or anonymize it so that you can no longer be identified.

  • Customers and prospects (commercial relationship & support): your data is retained throughout our contractual relationship, then for a maximum period of 3 years from your last contact (e.g., last purchase, last login, click on a link in an email, or support request).
  • Loyalty program and consents: data related to your loyalty program or newsletter subscriptions are kept until you withdraw your consent or, failing that, for a maximum period of 3 years from your last contact.
  • Arkose+ application and website: if you delete your user account or the application, your content and information uploaded to the platform are deleted. Your profile Personal Data is kept for an additional 6 months before definitive deletion.
  • Suppliers, service providers, and partners (B2B): data relating to our B2B commercial relationships are kept for the duration of the contract, then archived during the applicable legal limitation period, i.e., 5 years from the end of the relationship or last contact.
  • Legal and accounting obligations: certain data is kept longer when required by law. This is particularly true for accounting records, invoices, and financial documents, which are kept for 10 years from the close of the fiscal year.
  • Applications (Recruitment): CVs and cover letters submitted for unsuccessful applications are kept for a maximum of 2 years from the last contact with the applicant.
  • Security and traceability:
    • CCTV images in Gyms are kept for a maximum of 30 days.
    • Wi-Fi connection logs are kept for 1 year.
    • Cookies are kept for a maximum of 12 months.
  • Litigation management:
    • In case of pre-litigation, data is kept until amicable settlement of the dispute or, failing that, until the expiration of the corresponding legal limitation period.
    • In case of litigation, data is kept until all possible legal remedies against the decision rendered have been exhausted.

6. Avec qui partageons-nous vos données ?

At Arkose, we never sell your Personal Data. We only share it with targeted recipients when strictly necessary for the operation of our services, compliance with our legal obligations, or the safety of our premises.

Depending on your situation, your data may be transmitted to the following categories of recipients:

  • Our authorized internal teams: Arkose employees who need access within the scope of their duties (Gym reception, customer and sales service, marketing and data teams, accounting and legal departments, etc.).
  • Our Data Processors: technical and operational partners who help us run our daily activities (our management software vendor, cash register systems, web hosts, etc.);
  • Our external professional advisors: our chartered accountants, auditors, lawyers, and external auditors, all bound by confidentiality obligations;
  • Public and judicial authorities: legally authorized bodies (police, courts, tax authorities), solely upon official requisition or to report real or suspected security flaws, in accordance with the law;
  • In the event of structural changes: any potential buyer or partner in the event that we sell or transfer all or part of our business (including merger, reorganization, dissolution, or liquidation).

When we use external service providers to process your data, we require an irreproachable level of security and confidentiality from them. Each of our Data Processors is bound to us by contractual commitments requiring them to:

  • Process your data solely according to our prior written instructions;
  • Implement rigorous security measures to protect the confidentiality and integrity of your Personal Data;
  • Comply with all obligations imposed by applicable regulations.

7. Where is your data stored?

To guarantee a maximum level of security and confidentiality, your Personal Data is stored and processed on servers located exclusively within the European Union.

8. How do we protect minors?

In order to comply with the legal framework and protect the privacy of minors, the collection of their Personal Data, whether in our Climbing Lofts or on our online services, is subject to strict rules:

  • For any climbing activity in Gyms (notably independent access from age 12 for bouldering), registration for a class, camp, or event, minors must imperatively have authorization granted by their legal representative.
  • Before creating any account on our website or Arkose+ application, minor users are deemed to have obtained the prior consent of their parents or legal guardians.

Parental authorization may be checked at any time by our teams (in Gyms or during account verifications). If the requested proof or parental authorization is not provided immediately, Arkose reserves the right to suspend or terminate without delay the minor's access to our facilities and online account.

9. How is your data secured?

The security and confidentiality of your Personal Data are at the core of our concerns. We implement all appropriate technical and organizational measures to protect your information against loss, alteration, disclosure, destruction, modification, or unauthorized access.

To ensure the security of your data on a daily basis, we apply strict access and control rules:

  • Strictly restricted access: only authorized employees, representatives, and Data Processors with a need-to-know basis in the performance of their duties can access your data.
  • Confidentiality obligation: any person with access to your Personal Data is bound by a strict confidentiality commitment and faces disciplinary measures and/or legal sanctions in case of breach.

Because the Internet is an open network, online data transmission can never be 100% guaranteed. Although we make every effort to protect your data on our servers and platforms, transmission of data over the network is at your own risk.

If you observe or suspect misuse, loss, or unauthorized access to your Personal Data, contact us immediately according to the procedures presented in Article 12 of this policy. Our teams will promptly take the necessary steps to verify and secure your situation.

10. What are your rights and how can you exercise them?

In accordance with the GDPR, you retain control over your information. You have several rights that you can exercise at any time.

Right of access Request, in an understandable format, a copy of part or all of the personal data concerning you in our possession.
Right to rectification Request the correction of your data if it is inaccurate, obsolete, or incomplete.
Right to erasure ("Right to be forgotten") Request the permanent deletion of your Personal Data.
Right to object Object to the use of your data for reasons related to our legitimate interest.
Withdrawal of consent Cancel at any time your agreement for processing operations based on your consent (newsletter, loyalty program, etc.).
Right to restriction of processing Request the temporary freezing of your data (storage only without active processing).
Right to data portability Receive the data you provided to us in a structured, machine-readable format, or transfer it to another service.

Please note, however, that exercising certain rights involves exceptions:

  • The right to erasure does not apply to data we are legally required to retain (e.g., invoices and accounting documents kept for 10 years) or that are necessary for the establishment, exercise, or defense of legal claims.
  • In case of exercising your right to object, we may continue processing if there are compelling legitimate grounds that override your interests, rights, and freedoms.
  • The withdrawal of your consent does not affect the lawfulness of processing operations carried out prior to such withdrawal.
  • Providing a copy of your data is free of charge. However, in case of manifestly unfounded, repetitive, or excessive requests, we may charge reasonable administrative fees or refuse the request (systematically justifying our decision).
  • Portability applies solely to data you provided directly to us and which is subject to automated processing based on your consent or the performance of a contract.

To exercise any of these rights or for any question regarding the management of your data, simply contact us via the contact details in Article 12 of this policy. To protect your data and avoid identity theft, proof of identity may be requested. We undertake to respond as soon as possible (in principle within 1 month, which may be extended if the request requires complex analysis).

11. Management of cookies

When you browse our website, our application, or read our electronic communications, information may be stored on or read from your terminal (computer, tablet, smartphone), subject to obtaining your prior express consent.

What is a cookie?

A cookie is a small text file stored on your device that records data relating to your browsing. During subsequent visits, it allows us to recognize you, remember your preferences, prevent you from logging in again on every page, or analyze traffic.

Cookies do not damage your system and fall into two lifespan types:

  • Session cookies: temporary, stored only during your browsing, and automatically deleted as soon as you close your browser.
  • Persistent cookies: remain stored on your device after closing the browser and allow the site to remember you during your next visit (notably used for Google Analytics and customizing choices).

To provide you with a smooth experience, we classify cookies by function:

  • Strictly necessary cookies: essential for the operation of our site and application. They allow you to use our services effectively and securely. They cannot be disabled and do not gather information for commercial purposes.
  • Performance cookies: allow us to measure audience, count visits, identify traffic sources, and see which pages are most visited to improve site performance and usability.
  • Functional cookies: allow our site to remember your choices (username, language, country, font size, etc.) to offer personalized navigation, display adapted updates, or view videos and comment on our blog.
  • Personalization cookies: allow us to communicate information about offers or solutions likely to interest you based on your usage.

How to control and configure your choices?

With the exception of strictly necessary cookies, no cookie is deposited without your consent. You can change your preferences at any time:

  • From your web browser: most browsers are set by default to accept cookies. You can configure your browser to warn you before a cookie is deposited or block all cookies systematically (check your browser's "Help" menu).
  • Via third-party information and opt-out sites: you can get more information on cookie management and opt out of cookies from certain advertising companies on the following sites:

Please note: total disabling of cookies on your browser may affect your browsing experience and prevent access to certain features (Arkose is not affiliated with these third-party sites and declines responsibility for their content).

12. A question, an incident, or a complaint: how to contact us

At Arkose, we are committed to guaranteeing the protection of your Personal Data and ensuring total transparency. Whether you wish to ask a question, exercise your rights, unsubscribe from communications, or report a security issue, our teams are at your service.

You can contact our data protection contact at any time:

  • By email: vosdonnees@arkose.com
  • By post: Arkose&Co — Service Gestion des Données, 37-39, rue des Grands Champs — 75020 PARIS (FRANCE)

You may use these contact details for any subject related to your data, and in particular to:

  • Ask a question about this privacy policy;
  • Exercise your rights;
  • Manage preferences and opt out of commercial communications;
  • Report an incident or suspected compromise: although we implement rigorous security measures, no technology is completely infallible. If you believe the security of your data has been compromised or misused, notify us immediately.

We will investigate each request diligently and confidentially to provide a clear and appropriate response as soon as possible.

If, after contacting us, you feel your rights are not respected or data processing does not comply with regulations, you have the right to lodge a complaint with the competent supervisory authority of your country of residence:

  • In France, you can contact the CNIL:
    • Website: www.cnil.fr
    • By post: Commission Nationale de l'Informatique et des Libertés (CNIL), 3, place de Fontenoy — TSA 80715, 75334 PARIS CEDEX 07 (FRANCE)
  • In Belgium, you can contact the APD / GBA:
  • In Spain, you can contact the AEPD:
    • Website: www.aepd.es
    • By post: Agencia Española de Protección de Datos (AEPD), Edificio Cuzco IV, Paseo de la Castellana, 141, planta 9 — 28046 Madrid (ESPAÑA)