Privacy Policy

1. Data Controller

ClimaHQ is a culture analytics platform operated within the European Union.

• Contact email: [email protected]

For the purposes of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), the data controller is the entity identified above.

1a. Legal Entity

[PLACEHOLDER: legal review] These entity details are not yet final and must be confirmed before this policy is published.

• Legal name: [PLACEHOLDER] ClimaHQ, S.L.
• Registered address: [PLACEHOLDER] Address to be confirmed, Spain
• Registration number: [PLACEHOLDER] CIF/registration number to be confirmed

1b. Controller and Processor Roles

We act as a data controller for account data (the information you and your organization's administrators provide to create and manage your account) and for usage data collected to secure and operate the service.

We act as a data processor for the employee data your organization submits or connects for survey responses, HRIS-imported records, and demographic data: your organization is the controller of that data, and we process it on your organization's instructions under the Data Processing Agreement referenced in our Terms of Service.

1c. Data Protection Contact

[PLACEHOLDER: legal review] Whether this role is filled by a named Data Protection Officer or a general privacy contact point is not yet finalized.

Questions or requests concerning this policy or our data protection practices can be directed to [email protected].

2. Data We Collect

We collect and process the following categories of personal data:

2.1 Account information

When you register, we collect your name, email address, and organization name. This data is necessary to create and manage your account.

2.2 Survey responses

When employees complete pulse surveys, responses are pseudonymous: they are linked to a system reference rather than a name, are never shown to managers or administrators individually, and are only ever displayed as part of an aggregate of 5 or more responses. Demographic data (department, gender, ethnicity) is collected only if provided via HRIS import; gender and ethnicity are encrypted at rest.

2.3 Usage data

We automatically collect technical information when you use the service, including IP addresses, browser type, pages visited, and timestamps. This data helps us maintain security and improve the service.

2a. Subprocessors

We use the following categories of subprocessor to provide the service. Any subprocessor that processes personal data on our behalf is bound by a data processing agreement consistent with Article 28 GDPR.

• HRIS integration providers (BambooHR, Gusto), when your organization connects one, to import employee and demographic records.
• Slack, when your organization connects it, to deliver surveys, rituals, and nudges.
• Microsoft Teams, when your organization connects it, to deliver surveys, rituals, and nudges.
• Our analytics sidecar service, which computes culture and risk scores from the data described in this policy.

2b. Special Category Data

Gender and ethnicity, where your organization chooses to provide them, are special category data under Article 9 GDPR. We rely on the following conditions to process them, rather than consent:

• Occupational health and safety (Art. 9(2)(b)): Processing necessary to assess and report on equity gaps and psychosocial risk as part of your organization's workplace health and safety obligations.
• Legal obligation in the field of employment law (Art. 9(2)(b)): Processing necessary to produce the pay register, equality plan, and related compliance evidence your organization is legally required to hold.

2c. Automated Decision-Making and Profiling

The Predictions feature computes burnout and attrition risk scores for teams from aggregated survey and practice data. This is a form of profiling under Article 22 GDPR.

These scores are decision support for your organization's people leaders, not an automated decision with legal or similarly significant effect on any individual: no score triggers an automated action, and every score is reviewed by a human before it informs a decision about a person.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 GDPR:

• Contract performance (Art. 6(1)(b)): Processing account data and survey responses is necessary to provide the ClimaHQ service under our terms of service.
• Legitimate interest (Art. 6(1)(f)): We process usage data for security, fraud prevention, and service improvement. Our legitimate interest does not override your fundamental rights.
• Consent (Art. 6(1)(a)): Where required, we obtain explicit consent before processing, for example, for optional demographic data collection. You may withdraw consent at any time.

4. Data Retention

4.1 Practice data

• Account data: Retained for the duration of your account and up to 30 days after deletion, unless longer retention is required by law.
• Survey data: Aggregated survey scores are retained for the duration of your account. Raw survey responses are retained for 24 months from submission, after which they are automatically and permanently deleted.
• Usage and security logs: Retained for up to 90 days.

4.2 Statutory and compliance evidence

Compliance reports, evaluations, and other evidence generated to demonstrate a specific legal obligation (for example, a pay register or equality plan) are retained separately from the practice data above, for as long as the underlying obligation requires the evidence to be produced on request, even where that period exceeds the 24-month survey retention period.

The exact retention period for statutory evidence is obligation-specific and has not yet been confirmed for every obligation this policy covers; treat this section as a placeholder for the correct figure per obligation, not a finalized retention schedule.

5. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): Obtain confirmation of whether your data is being processed and request a copy.
• Right to rectification (Art. 16): Request correction of inaccurate personal data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interest.
• Right to restriction (Art. 18): Request restriction of processing in certain circumstances.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

6. International Transfers

Your data is processed and stored within the European Economic Area (EEA). We do not transfer personal data outside the EEA. If this changes, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Cookies

ClimaHQ uses strictly necessary cookies to maintain your session and authenticate you. These cookies are essential for the service to function and do not require consent.

We do not use third-party tracking or advertising cookies.

8. Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS), encryption at rest (AES-256-GCM), access controls, and regular security reviews. For full details, see our Security page.

9. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by email or by posting a prominent notice on the service. The "effective date" at the top of this page indicates when the policy was last revised.

11. Contact

For any questions about this privacy policy or our data practices, contact us at [email protected].