Privacy Policy

1. Data Controller

ClimaHQ is a culture analytics platform.

• Contact email: [email protected]

For the purposes of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), the data controller is the entity identified above.

1a. Legal Entity

The legal entity details are being finalised and will be published here.

• Legal name: To be confirmed
• Registered address: To be confirmed
• Registration number: To be confirmed

1b. Controller and Processor Roles

We act as a data controller for account data (the information you and your organization's administrators provide to create and manage your account) and for usage data collected to secure and operate the service.

We act as a data processor for the employee data your organization submits or connects for survey responses, HRIS-imported records, and demographic data: your organization is the controller of that data, and we process it on your organization's instructions under the Data Processing Agreement referenced in our Terms of Service.

1c. Data Protection Contact

Questions or requests concerning this policy or our data protection practices can be directed to [email protected].

2. Data We Collect

We collect and process the following categories of personal data:

2.1 Account information

When you register, we collect your name, email address, and organization name. This data is necessary to create and manage your account.

2.2 Survey responses

When employees complete pulse surveys, responses are pseudonymous: they are linked to a system reference rather than a name, are never shown to managers or administrators individually, and are only ever displayed as part of an aggregate of 5 or more responses. Demographic data (department, gender, ethnicity) is collected only if provided via HRIS import; gender and ethnicity are encrypted at rest.

2.3 Usage data

We automatically collect technical information when you use the service, including IP addresses, browser type, pages visited, and timestamps. This data helps us maintain security and improve the service.

2a. Sub-processors and integrations

These are the parties that process customer data on our behalf. Each is bound by a data processing agreement consistent with Article 28 GDPR.

Integrations you enable

Optional and customer-initiated: you choose to connect these and you contract with the provider. They are not ClimaHQ sub-processors.

Our analytics service, which computes culture and risk scores from the data described in this policy, runs on our own infrastructure and is not a third party.

2b. Special Category Data

Gender and ethnicity, where your organization chooses to provide them, are special category data under Article 9 GDPR. We rely on the following conditions to process them, rather than consent:

• Occupational health and safety (Art. 9(2)(b)): Processing necessary to assess and report on equity gaps and psychosocial risk as part of your organization's workplace health and safety obligations.
• Legal obligation in the field of employment law (Art. 9(2)(b)): Processing necessary to produce the pay register, equality plan, and related compliance evidence your organization is legally required to hold.

2c. Automated Decision-Making and Profiling

The Predictions feature computes burnout and attrition risk scores for teams from aggregated survey and practice data. This is a form of profiling under Article 22 GDPR.

These scores are decision support for your organization's people leaders, not an automated decision with legal or similarly significant effect on any individual: no score triggers an automated action, and every score is reviewed by a human before it informs a decision about a person.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 GDPR:

• Contract performance (Art. 6(1)(b)): Processing account data and survey responses is necessary to provide the ClimaHQ service under our terms of service.
• Legitimate interest (Art. 6(1)(f)): We process usage data for security, fraud prevention, and service improvement. Our legitimate interest does not override your fundamental rights.
• Consent (Art. 6(1)(a)): Where required, we obtain explicit consent before processing, for example, for optional demographic data collection. You may withdraw consent at any time.

4. Data Retention

4.1 Practice data

• Account data: Retained for the duration of your account and up to 30 days after deletion, unless longer retention is required by law.
• Survey data: Aggregated survey scores are retained for the duration of your account. Raw survey responses are retained for 24 months from submission, after which they are automatically and permanently deleted.
• Usage and security logs: Retained for up to 90 days.
• Contact requests: Demo, partner, waitlist and contact requests sent through the website are retained for 24 months, then permanently deleted.
• Channel reports: Reports with no investigation opened within 3 months of receipt are permanently deleted, leaving only an anonymous counter (received date, category, outcome). Closed cases are permanently deleted 10 years after closure, or sooner if the organization sets a shorter period.
• Channel access: Only the investigators assigned to a case and the organization's designated system manager can open it. Organization administrators who are neither cannot, and neither can ClimaHQ staff impersonating them. Every attempt to open a case is logged.

4.2 Statutory and compliance evidence

Compliance reports, evaluations, and other evidence generated to demonstrate a specific legal obligation (for example, a pay register or equality plan) are retained separately from the practice data above, for as long as the underlying obligation requires the evidence to be produced on request, even where that period exceeds the 24-month survey retention period.

4.3 Retention schedule

How long each kind of record is kept. Periods that depend on a legal reading are marked as such.

• Whistleblowing channel: 3 months if not investigated, at most 10 years after closure (Ley 2/2023, arts. 26 and 32).
• Time records: 4 years (Art. 34.9 ET), then the rule for the workplace's country from the time registry: Spain 4 years, Germany 2 years, France 1 year, other EU countries 4 years.
• Website analytics (funnel): 13 months.
• Contact requests (leads): 24 months after last contact, then permanently deleted. This period is under legal review.
• Psychosocial evaluations and reports: Kept as long as the law requires you to keep this evidence; we will publish exact periods.
• Pay register: Kept as long as the law requires you to keep this evidence; we will publish exact periods.
• Audit log: Kept as long as the law requires you to keep this evidence; we will publish exact periods.

5. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): Obtain confirmation of whether your data is being processed and request a copy.
• Right to rectification (Art. 16): Request correction of inaccurate personal data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interest.
• Right to restriction (Art. 18): Request restriction of processing in certain circumstances.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

6. International Transfers

Customer data is stored on servers. Traffic passes through Cloudflare's network. If you connect an optional integration based outside the EEA (Slack, Microsoft, Google, Okta, BambooHR, Gusto), data you choose to sync is transferred under that provider's terms, the EU-US Data Privacy Framework or Standard Contractual Clauses.

7. Cookies

ClimaHQ uses strictly necessary cookies to maintain your session and authenticate you. These cookies are essential for the service to function and do not require consent.

We do not use third-party tracking or advertising cookies.

8. Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS), encryption at rest (AES-256-GCM), access controls, and regular security reviews. For full details, see our Security page.

9. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by email or by posting a prominent notice on the service. The "effective date" at the top of this page indicates when the policy was last revised.

11. Contact

For any questions about this privacy policy or our data practices, contact us at [email protected].