Privacy Policy

1. Data Controller & Contact Information

For the purposes of the General Data Protection Regulation (GDPR) and other applicable global data protection laws, the Data Controllers are:

• Names: Tommaso Mangiagalli and Gabriele Bellan (Note: These details will be updated to our registered corporate entity upon formal incorporation).
• Registered Address: Elsa Brandstrom Strasse 24, Metzingen 72555, Germany
• Contact Email: info@lazoneclimbing.com

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your legal rights, please contact us at the email address above.

2. Minimum Age Requirement

Our services are directed to, and intended for use only by, individuals who are at least 16 years of age. We do not knowingly collect or solicit personal data from anyone under the age of 16. If we learn that we have inadvertently collected personal data from a child under 16, we will delete that information as quickly as possible.

3. Personal Data We Collect

We collect several types of information from and about our users, categorized below:

A. Account & Registration Data

• Data: Name, email address, and a securely hashed password.
• Source: Provided directly by you when you create an account.

B. User-Generated Content (UGC)

• Data: Logged climbing routes, boulder configurations, route difficulty ratings, comments, climbing gym posts, and other interactions on the social feed.
• Source: Provided directly by you when you post or interact on the Platform.

C. Camera, Photos, and Visual Media

• Data: Images of climbing routes/boulders and profile pictures (avatars).
• Source: Captured using your device camera or uploaded from your device's photo gallery upon your explicit permission.

D. Push Notifications & Device Identification

• Data: Unique device push tokens (device IDs) generated to route notifications.
• Source: Collected automatically via Firebase Cloud Messaging (FCM) once permission is granted on your device.

E. Technical, Usage, and Analytical Data

• Data: IP address, device hardware model, operating system version, server access logs, crash logs, and general application usage patterns.
• Source: Collected automatically through our servers and Google Firebase SDKs.

F. Payment Data

• None. LaZone does not currently collect, process, or store financial or payment card details.

4. Purposes and Legal Bases for Processing (GDPR Art. 6)

Under the GDPR, we must have a valid legal basis to process your personal data. The table below outlines how and why we use your data:

5. Third-Party Data Processors (Service Providers)

We share your personal data with trusted third-party service providers who process data on our behalf under strict data processing agreements:

• Vercel Inc. (Web Hosting & Frontend deployment)
• Neon AD (PostgreSQL Database Hosting)
• Google LLC / Google Ireland Limited (Firebase Cloud Messaging for push notifications, Firebase Analytics & Crashlytics for app stability and usage performance metrics)
• Transactional Email Provider (e.g., Resend / Amazon SES) (For sending registration, validation, and password reset emails)

6. International Data Transfers

Some of our third-party processors are headquartered or operate servers outside the European Economic Area (EEA), primarily in the United States (such as Google and Vercel).

To ensure your personal data receives an adequate level of protection, we rely on:

• Adequacy Decisions issued by the European Commission (where applicable, such as the EU-U.S. Data Privacy Framework).
• Standard Contractual Clauses (SCCs) approved by the European Commission, which legally bind the recipient to protect your data according to European standards.

7. Data Retention Periods

We retain your personal data only for as long as is necessary to fulfill the purposes outlined in this Privacy Policy:

• Account Data & Profile Pictures: Retained for the lifetime of your active account. If you delete your account, this data is removed immediately or anonymized.
• User-Generated Content (UGC): Climbing logs and route photos remain active to preserve community statistics. Upon account deletion, these are permanently anonymized (re-attributed to a "Deleted User" with no identifying links) or deleted.
• Push Notification Tokens: Retained as long as the application remains installed and registered on your device; stale tokens are automatically purged periodically.
• Server Logs & Analytics: Retained for a maximum of 90 days for security troubleshooting and analytical reporting, after which they are automatically deleted or fully anonymized.

8. Your Rights Under Global Frameworks (GDPR, UK GDPR, CCPA, LGPD)

Depending on your jurisdiction, you have robust rights regarding your personal data. Under the GDPR, you have the following rights:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request that we correct inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You can request the deletion of your personal data (see Section 9 for our direct, self-service process).
• Right to Restrict Processing: You can request that we temporarily limit how we process your data under specific conditions.
• Right to Data Portability: You can request that we transmit your account data to you or another service provider in a structured, machine-readable format.
• Right to Object: You can object to our processing of your data based on our legitimate interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., camera access, push notifications), you can withdraw it at any time via your device settings.

To exercise any of these rights, please contact us at info@lazoneclimbing.com. We will respond to your request within 30 days. You also have the right to lodge a complaint with a data protection authority, such as your local supervisory authority in the EU.

9. Account Deletion Process (Mandatory Store Disclosure)

We believe in putting you in complete control of your data. You can delete your account and all associated personal data easily and at any time:

How to Delete Your Account

1. In-App Self-Service: Navigate to Settings > Account > Delete Account inside either the iOS or Android native application. Confirm your request.
2. Web Request: Alternatively, you can send an explicit account deletion request from your registered email address to info@lazoneclimbing.com.

What Happens Upon Deletion

• Your profile data (Name, Email, Password, and Avatar/Profile Picture) is permanently deleted from our active production databases within 48 hours.
• Your climbing routes, difficulty ratings, and social posts are stripped of all personal identifiers and fully anonymized. They will remain visible to ensure gym maps and climbing history stay accurate for the community, but they will be permanently attributed to an anonymous "Deleted User."
• Backup archives of our database are automatically overwritten and purged within 30 days.

10. Cookies and Local Storage

We use essential cookies and browser local storage to maintain your active login session and remember your app preferences.

• Essential Cookies: These are strictly necessary for the technical operation of our Laravel/Livewire platform and to keep you securely logged in.
• Third-Party Cookies: We do not load third-party tracking or advertising cookies. Any analytics data collected via Firebase is strictly aggregated, anonymized, and used solely for app optimization and crash reporting.

You can manage or disable cookies through your web browser settings, although doing so may prevent certain features of the Platform from functioning correctly. For more detail, see our Cookie Policy.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technological updates, or evolving legal obligations. When we make updates, we will revise the "Last Updated" date at the top of this page. If we make material changes to how we handle your personal data, we will notify you through a prominent notice inside the App or via email before the changes take effect.