PRIVACY POLICY

BOULDER INDOOR – ROCOLLEIDA SLU

Last updated: 2 September 2026

At Boulder Indoor, we take the privacy and protection of the personal data of users, members, activity participants, families, minors, customers, suppliers, job applicants and people who contact us seriously.

This Privacy Policy explains how ROCOLLEIDA SLU, owner and operator of Boulder Indoor, collects and processes personal data both through the website www.boulderindoor.com and in connection with the services and activities provided at the sports centre.

Personal data is processed in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), and any other applicable legislation.

1. DATA CONTROLLER

Data Controller: ROCOLLEIDA SLU
Trade name: Boulder Indoor
Tax Identification Number (NIF): B25766635
Address: Carrer de Tèrmens, 3, nau G, 25190 Lleida, Spain
Telephone: (+34) 973 125 111
Email: info@boulderindoor.com
Website: www.boulderindoor.com

ROCOLLEIDA is registered with the Commercial Registry of Lleida under company record L-27109.

For any question relating to privacy or data protection, you may contact ROCOLLEIDA using the email address indicated above.

2. PERSONAL DATA WE PROCESS

The personal data processed depends on each person’s relationship with Boulder Indoor and the services they use.

We may process, among other data:

• First and last name.
• Date of birth.
• Telephone number.
• Email address.
• Address and postal code.
• Billing information.
• Information relating to memberships, passes, tickets and contracted services.
• History of access to the centre.
• Access credentials using wristbands, QR codes or other authorised systems.
• Bookings for activities, courses or services.
• Participation in activities, classes, training sessions, competitions or events.
• Information about parents, guardians or legal representatives where minors participate.
• Information contained in liability forms, authorisations and documents relating to sports safety.
• Information concerning incidents or accidents.
• Data relating to sports activity when the corresponding Lizcore features are used, such as visits, activities, progression, routes or boulders completed, scores, rankings or other gamification features.
• Photographs, videos or images where a lawful basis exists for their processing.
• Images captured by video surveillance systems.
• Browsing data and information obtained through cookies or similar technologies.
• Information voluntarily submitted as part of recruitment processes.

ROCOLLEIDA applies the principle of data minimisation and only requests personal data that is necessary for each purpose.

3. HEALTH-RELATED DATA

Boulder Indoor does not generally request health information from its users.

However, due to the nature of the sporting activities carried out at the centre, a user, participant or the legal representative of a minor may voluntarily disclose information concerning a medical condition, allergy, disability, injury or other circumstance relevant to their safety or to the appropriate adaptation of an activity.

Such information will only be processed where necessary and subject to the enhanced safeguards applicable to special categories of personal data under the GDPR.

Where applicable, processing may be based on the explicit consent of the data subject or their legal representative, the protection of vital interests, or the need to establish, exercise or defend legal claims.

4. ENQUIRIES AND CONTACT FORMS

Personal data provided through website forms, email, telephone, WhatsApp or other contact channels will be processed for the purposes of:

• Answering enquiries.
• Providing information.
• Preparing quotations.
• Managing bookings.
• Handling requests.
• Managing incidents.
• Responding to requests relating to Boulder Indoor services.

The legal basis will be taking steps at the request of the data subject prior to entering into a contract, the performance of a contractual relationship or, where applicable, consent.

5. MEMBERS, MEMBERSHIPS, PASSES, TICKETS AND ACCESS CONTROL

ROCOLLEIDA processes the personal data required to manage:

• User registrations and cancellations.
• Memberships and fees.
• Passes and tickets.
• Bookings.
• Access control.
• Visit history.
• Payments.
• Billing.
• Contracted services.
• Compliance with the centre’s access and use rules.

The main legal basis is the performance of the contractual relationship between ROCOLLEIDA and the user.

ROCOLLEIDA may also process certain access and membership-use data on the basis of its legitimate interest in:

• Preventing fraudulent access.
• Ensuring that personal and non-transferable memberships are used correctly.
• Investigating incidents.
• Ensuring the safety of users.
• Protecting the facilities.
• Ensuring compliance with internal rules.

6. LIZCORE: CENTRE MANAGEMENT, ACCESS, BOOKINGS AND SPORTS ACTIVITY

Boulder Indoor uses Lizcore, a platform specialised in the management of climbing gyms and climbing centres.

Depending on the features enabled, Lizcore may be used to manage:

• User profiles.
• Memberships.
• Passes and tickets.
• Access.
• Bookings.
• Activities.
• Payments.
• Billing.
• Visit history.
• Capacity control.
• Information relating to sporting activity.
• Climbing routes and boulders completed.
• Sports progression.
• Rankings, challenges or competitions.
• Other features provided by the platform.

The Lizcore service provider is Lizard Climbing Technologies, S.L.

Lizcore will have the legal status applicable to each specific processing operation and, where it processes personal data on behalf of ROCOLLEIDA, it will act as a data processor in accordance with Article 28 of the GDPR.

The legal basis for processing will mainly be the performance of the contracted service and, for certain optional features, consent or legitimate interest where legally applicable.

7. COURSES, CLASSES, TRAINING SESSIONS AND ACTIVITIES

ROCOLLEIDA processes the personal data required to manage:

• Climbing courses.
• Instructor-led classes.
• Training sessions.
• Performance training groups.
• Extracurricular activities.
• Birthday parties.
• School activities.
• Activities for companies or organisations.
• Competitions.
• Clinics.
• Events.
• Other activities organised by Boulder Indoor.

Processing may include management of participants, groups, timetables, instructors, bookings, attendance, communications and requirements relating to the safety of the activity.

The legal basis will mainly be performance of a contract or taking pre-contractual measures.

8. MINORS

Boulder Indoor provides sporting activities specifically intended for minors and applies enhanced safeguards to the processing of their personal data.

Where processing is based exclusively on consent, children under the age of 14 require the consent of the person holding parental responsibility or legal guardianship.

From the age of 14, minors may provide consent for data protection purposes in accordance with Spanish law, without prejudice to the fact that certain activities, contracts, authorisations or actions may continue to require the participation of their parents or legal representatives.

For activities involving minors, Boulder Indoor may request contact details for their legal representatives and the authorisations required to manage, among other matters:

• Participation in activities.
• Collection of the minor.
• Communications with the family.
• Safety.
• Emergency situations.
• Use of images, where applicable.
• Liability forms or other necessary authorisations.

The personal data of minors will not be used for commercial purposes incompatible with the existing relationship.

9. LIABILITY FORMS, RULES AND CLIMBING SAFETY

Climbing is a sporting activity involving inherent risks.

ROCOLLEIDA may process the information necessary to demonstrate that a user or their legal representative:

• Has been informed of the centre’s rules.
• Has received relevant safety information.
• Has accepted the conditions of access.
• Has completed the corresponding liability form.
• Has received the instructions required to use certain facilities or equipment.

This information may be linked to the user’s profile within the centre’s management systems.

The legal basis is the performance of the contractual relationship, compliance with applicable legal obligations and ROCOLLEIDA’s legitimate interest in:

• Ensuring safety.
• Managing risks inherent to the activity.
• Preventing accidents.
• Investigating incidents.
• Demonstrating compliance with safety protocols.
• Establishing, exercising or defending potential legal claims.

10. ACCIDENTS, INJURIES AND INCIDENTS

In the event of an accident, injury, safety incident or other relevant event occurring at the centre or during an activity organised by Boulder Indoor, ROCOLLEIDA may collect and retain the information necessary to:

• Document the circumstances.
• Properly assist the affected person.
• Investigate the causes.
• Prepare internal reports.
• Report the incident to insurers.
• Manage claims.
• Demonstrate compliance with safety protocols.
• Establish, exercise or defend rights and legal claims.

Where necessary, information may be disclosed to:

• Insurance companies.
• Insurance brokers.
• Healthcare providers.
• Lawyers.
• Court representatives.
• Experts.
• Law enforcement authorities.
• Courts and tribunals.
• Public administrations.
• Other legally competent bodies.

Where such information includes health data, only the data strictly necessary will be processed and in accordance with the legal bases established by the GDPR for special categories of personal data.

11. PAYMENTS AND BILLING

ROCOLLEIDA processes the financial and billing information necessary to manage:

• Fees.
• Memberships.
• Tickets.
• Passes.
• Activities.
• Payments.
• Refunds.
• Invoices.
• Accounting.
• Tax obligations.

The legal basis is the performance of the contractual relationship and compliance with ROCOLLEIDA’s legal obligations.

Where electronic payments are made using Lizcore features, payment processing may be carried out through the corresponding integrated payment gateway, including Stripe.

ROCOLLEIDA does not need to know or store complete payment-card details where those details are processed directly by the payment gateway.

Payment providers will process the required information in accordance with their own legal obligations and applicable terms.

12. MARKETING COMMUNICATIONS AND NEWSLETTER

ROCOLLEIDA uses Mailrelay to manage and send newsletters and electronic communications.

People who have voluntarily subscribed may receive information relating, among other matters, to:

• Activities.
• Courses.
• Events.
• News.
• Promotions.
• Boulder Indoor services.

The legal basis will be the consent of the data subject.

Marketing communications concerning ROCOLLEIDA’s own products or services similar to those previously contracted may also be sent where there is an existing contractual relationship and the requirements established by the LSSI-CE are met.

Mailrelay will act as a data processor where it manages mailing lists and communications on behalf of ROCOLLEIDA.

The data subject may unsubscribe at any time using the mechanism included in the communications received or by contacting:

info@boulderindoor.com

Unsubscribing is free of charge.

13. WHATSAPP AND OTHER MESSAGING SERVICES

Where a person voluntarily contacts Boulder Indoor through WhatsApp or another messaging platform, ROCOLLEIDA may use the information provided to:

• Answer the enquiry.
• Manage a booking.
• Manage an activity.
• Provide information.
• Manage the customer relationship.

The legal basis will be the management of the request, taking pre-contractual measures or performance of a contractual relationship, depending on the circumstances.

Use of these platforms is also subject to their own terms and privacy policies.

14. PHOTOGRAPHS, VIDEOS AND IMAGE RIGHTS

Photographs or audiovisual recordings may be taken during activities, competitions, courses, events or other activities organised by Boulder Indoor.

Where an identifiable individual’s image is intended to be used for promotional, advertising, commercial or communication purposes on websites or social media, ROCOLLEIDA will obtain the appropriate authorisation where legally required.

For minors, the applicable additional safeguards will be applied and the necessary authorisations from parents or legal representatives will be obtained.

Refusal to authorise promotional use of an individual’s image will not prevent participation in an activity where such processing is not required in order to provide the service.

Authorisation for use of an image may be withdrawn for future uses under the conditions established by law.

15. VIDEO SURVEILLANCE

Boulder Indoor facilities have or may have video surveillance systems for the purpose of:

• Protecting people.
• Protecting facilities and property.
• Preventing incidents.
• Investigating security-related events.

Areas under video surveillance will be appropriately identified by the relevant information signs.

Access to recordings will be restricted to authorised personnel.

As a general rule, recordings will be retained for a maximum period of one month, without prejudice to longer retention where necessary to establish evidence of an incident, offence, infringement or claim.

In such cases, recordings may be blocked or made available to law enforcement authorities, courts, tribunals or other competent authorities.

16. JOB APPLICATIONS AND CVs

Where a person voluntarily submits a CV or participates in a Boulder Indoor recruitment process, their information will be processed to:

• Assess their professional profile.
• Contact the applicant.
• Manage the recruitment process.
• Consider their potential incorporation into ROCOLLEIDA.

The main legal basis is taking pre-contractual measures at the applicant’s request.

Where ROCOLLEIDA wishes to retain a CV for consideration in future recruitment processes, it may do so with the consent of the data subject.

As a general rule, CVs retained for future recruitment will be deleted or reviewed after 12 months, unless a legal basis exists for longer retention.

17. SOCIAL MEDIA

Boulder Indoor maintains corporate profiles on various social media platforms.

Where a person follows, comments on, sends a message to or otherwise interacts with a Boulder Indoor profile, their personal data may be processed in order to manage that interaction.

Such processing will be subject both to this Privacy Policy and to the terms and privacy policies of the relevant social media provider.

ROCOLLEIDA does not sell its followers’ personal data or commercially trade it with third parties.

Voluntary participation on a social media platform does not mean that ROCOLLEIDA may use an individual’s information for any unrelated purpose.

18. WEB HOSTING AND EMAIL

ROCOLLEIDA uses Hostsuar for website hosting and/or email services associated with the Boulder Indoor domain and operations.

Hostsuar may have technical access to certain information hosted on its systems solely to the extent required to provide the contracted services.

Where Hostsuar processes personal data on behalf of ROCOLLEIDA, it will act as a data processor in accordance with Article 28 of the GDPR.

ROCOLLEIDA requires its providers to maintain the corresponding contractual safeguards and security measures.

19. SERVICE PROVIDERS AND RECIPIENTS OF PERSONAL DATA

ROCOLLEIDA does not sell, rent or commercially trade users’ personal data.

In order to provide its services, certain service providers may have access to personal data as data processors or under whatever legal capacity applies to the specific processing operation.

The principal technology providers currently used include:

Lizcore

For management of users, memberships, access, bookings, activities and other climbing-gym management functions.

Mailrelay

For sending newsletters and electronic communications.

Hostsuar

For website hosting, infrastructure and/or email services.

Stripe

Where applicable, for processing certain electronic payments made through systems integrated with Lizcore.

Personal data may also be accessed, where necessary, by:

• Employment, tax or accounting advisers.
• Financial institutions.
• Insurance companies.
• Insurance brokers.
• Lawyers.
• Experts.
• IT maintenance professionals.
• Public administrations.
• Law enforcement authorities.
• Courts and tribunals.

Where a provider acts as a data processor, ROCOLLEIDA will establish or maintain the contractual safeguards required by Article 28 of the GDPR.

20. INTERNATIONAL DATA TRANSFERS

Certain technology providers, social media platforms or payment systems may belong to international corporate groups or use infrastructure located outside the European Economic Area.

Where an international transfer of personal data takes place, it will only be carried out using mechanisms recognised by the GDPR, including:

• An adequacy decision adopted by the European Commission.
• The EU-U.S. Data Privacy Framework, where the recipient in the United States is duly certified.
• Standard Contractual Clauses approved by the European Commission.
• Other safeguards permitted by applicable legislation.

ROCOLLEIDA will require its providers to comply with the applicable data-protection safeguards.

21. COOKIES AND SIMILAR TECHNOLOGIES

The website www.boulderindoor.com may use cookies and similar technologies.

Cookies that are strictly necessary for the operation of the website may be used without consent where permitted by law.

Analytics, advertising, personalisation or other non-essential cookies will only be activated where there is an appropriate legal basis and, where required, after obtaining the user’s consent.

Users must be able to:

• Accept cookies.
• Reject non-essential cookies.
• Configure their preferences.

Detailed information concerning the cookies used, their providers, purposes and retention periods will be included in the website’s Cookie Policy.

22. DATA RETENTION PERIODS

ROCOLLEIDA will retain personal data only for the period necessary to fulfil the purposes for which it was collected.

Thereafter, personal data may remain blocked during the applicable limitation periods in which legal liabilities may arise.

As a general guide:

• Contractual and user data: for the duration of the contractual relationship and subsequently for the applicable statutory periods.
• Invoices and accounting or tax documentation: for the periods established by tax and commercial legislation.
• Newsletter: until the person withdraws consent or unsubscribes.
• Enquiries: for the period necessary to answer them and manage possible liabilities.
• CVs retained for future recruitment: generally for up to 12 months.
• Video surveillance: generally for no more than one month.
• Accidents, incidents and claims: for the period necessary to manage the event and for any periods during which liability or claims may arise.
• Documents and acceptances relating to safety: for the period necessary to demonstrate compliance with the centre’s obligations and safety protocols and while liability may arise.

Where a claim, investigation, court case or administrative proceeding exists, related information may be retained until the proceedings have been finally resolved.

23. REQUIREMENT TO PROVIDE CERTAIN DATA

Where certain personal data is necessary to contract a service, participate in an activity, manage a booking, create a membership or comply with safety requirements, failure to provide that data may prevent the service from being provided.

Forms will indicate, where appropriate, which information is mandatory.

ROCOLLEIDA will not require information that is unnecessary for the relevant purpose.

24. ACCURACY OF PERSONAL DATA

Users are responsible for ensuring that information provided to ROCOLLEIDA is accurate and up to date.

Where information changes in a way that may affect provision of the services, the data subject must inform ROCOLLEIDA.

For minors, this responsibility will fall, where applicable, upon their parents, guardians or legal representatives.

25. INFORMATION SECURITY

ROCOLLEIDA applies technical and organisational measures appropriate to the level of risk in order to protect personal data against:

• Destruction.
• Loss.
• Alteration.
• Unauthorised access.
• Unauthorised disclosure.
• Unlawful processing.

Depending on the circumstances, these measures include:

• Access controls.
• Permission restrictions.
• Password management.
• Backups.
• Secure connections.
• System updates.
• Provider security measures.
• Internal incident-management procedures.
• Confidentiality obligations for staff with access to personal data.

ROCOLLEIDA also applies the principles of data protection by design and by default and data minimisation.

26. PERSONAL DATA BREACHES

Where a personal data breach occurs, ROCOLLEIDA will analyse the incident and implement the necessary measures to limit its consequences.

Where required under the GDPR, the breach will be reported to the supervisory authority within the applicable statutory period.

Where the breach is likely to result in a high risk to the rights and freedoms of affected individuals, those individuals will also be informed in accordance with the applicable legal requirements.

27. RIGHTS OF DATA SUBJECTS

Any person may exercise the rights recognised under applicable data-protection legislation:

• Access: obtain information about personal data processed by ROCOLLEIDA.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of personal data where legally applicable.
• Objection: object to certain processing.
• Restriction: request temporary restriction of processing.
• Data portability: receive certain data in a structured format and transmit it to another controller where legally applicable.
• Withdrawal of consent: withdraw consent previously provided at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Not to be subject to certain decisions based solely on automated processing, where applicable.

These rights may be exercised by contacting:

ROCOLLEIDA SLU – Boulder Indoor
Carrer de Tèrmens, 3, nau G
25190 Lleida
Spain
info@boulderindoor.com

The request must sufficiently identify the data subject and state which right they wish to exercise.

ROCOLLEIDA will only request additional identification documentation where there are reasonable doubts concerning the identity of the person submitting the request.

Exercise of these rights is free of charge, subject to the exceptions provided by law.

28. COMPLAINTS TO THE SUPERVISORY AUTHORITY

Where a person considers that ROCOLLEIDA has processed their personal data in breach of applicable legislation, they may lodge a complaint with the competent supervisory authority.

In Spain, the supervisory authority is:

Spanish Data Protection Agency – Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid
Spain
www.aepd.es

Before lodging a complaint, the data subject may contact ROCOLLEIDA at:

info@boulderindoor.com

to seek resolution of any issue concerning the processing of their personal data.

29. AUTOMATED DECISION-MAKING AND PROFILING

As a general rule, ROCOLLEIDA does not make decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect them.

Statistical, sports-related, ranking, challenge, gamification or analytical functionality provided by platforms such as Lizcore will not be used to make legal or similarly significant decisions concerning users without the safeguards required under the GDPR.

If such an automated decision-making system is implemented in the future, affected individuals will be informed beforehand.

30. CONFIDENTIALITY

ROCOLLEIDA staff and any other authorised person with access to personal data are subject to a duty of confidentiality.

Personal data may not be used for purposes other than those authorised or disclosed to third parties without a lawful basis.

This duty of confidentiality will continue even after the relevant employment, professional or contractual relationship has ended.

31. CHANGES TO THIS PRIVACY POLICY

ROCOLLEIDA may amend this Privacy Policy in order to adapt it to:

• Legislative changes.
• Guidance issued by data-protection authorities.
• Judicial developments.
• New services.
• New service providers.
• Technological changes.
• Changes in the personal-data processing carried out by Boulder Indoor.

The version currently in force will always be the version published at www.boulderindoor.com and will indicate the date of its latest update.

Where an amendment substantially affects processing based on consent, ROCOLLEIDA will obtain fresh consent where legally required.

32. CONTACT

For any enquiry concerning this Privacy Policy or the processing of personal data:

ROCOLLEIDA SLU – Boulder Indoor
Carrer de Tèrmens, 3, nau G
25190 Lleida
Spain
Telephone: (+34) 973 125 111
Email: info@boulderindoor.com

Last updated: 2 September 2026