Privacy Policy

Impulse Climbing Ltd (“Impulse Climbing”, “we”, “us”, “our”) is a company registered in England and Wales. We design and manufacture climbing equipment sold through our website at impulseclimbing.co.uk.

We are the data controller for the personal information we collect about you. If you have any questions about this policy or how we handle your data, contact us at louiswood3142@gmail.com.

We collect the following personal data depending on how you interact with us:

• Order information — name, email address, delivery address, phone number, and payment details (payment card details are processed directly by Shopify Payments / Stripe and are never stored by us).
• Account information — email address and password if you create an account on our store.
• Email sign-ups — email address if you sign up to be notified about product launches or restocks.
• Communications — any information you include when contacting us by email.
• Usage data — pages visited, time spent, browser type, and device information, collected automatically when you use our website.

We use your personal data to:

• Process and fulfil your orders, including sending order confirmations and shipping updates.
• Manage your account and provide customer support.
• Send you product launch and restock notifications you have opted into.
• Send you marketing communications where you have given consent (you can unsubscribe at any time).
• Improve our website and products by understanding how visitors use them.
• Comply with our legal obligations.

We rely on the following legal bases to process your personal data:

• Contract — processing your order and delivering your goods.
• Consent — sending marketing emails and notifications. You can withdraw consent at any time by clicking “Unsubscribe” in any email or contacting us directly.
• Legitimate interests — improving our website, preventing fraud, and maintaining business records.
• Legal obligation — complying with tax and accounting requirements.

We use the following trusted third-party services to operate our business. Each has its own privacy policy:

• Shopify Inc. — our e-commerce platform, which processes orders and stores customer data on our behalf. Shopify is certified to ISO 27001 and compliant with PCI DSS. Shopify Privacy Policy
• Klaviyo — our email marketing platform, which we use to send product notifications and newsletters to subscribers who have opted in. Klaviyo Privacy Policy
• Vercel Inc. — our website hosting provider, which processes usage data to serve our website. Vercel Privacy Policy
• Royal Mail Group Ltd — our delivery partner. We pass them your name, delivery address and, where you have given it, your email address or phone number, so that they can deliver your parcel and send you tracking updates and delivery options. Royal Mail Privacy Notice

We do not sell your personal data to any third party. We do not share your data with anyone other than the service providers listed above, except where required by law.

Our website uses cookies — small text files stored on your device — to make the site work and to understand how it is used. We use:

• Essential cookies — required for the site and shopping cart to function. These cannot be disabled.
• Analytics cookies — to understand how visitors use our site so we can improve it. These are anonymised and do not identify you personally.

You can control cookies through your browser settings. Disabling essential cookies may prevent the shopping cart and checkout from working correctly.

We keep your personal data for as long as necessary:

• Order data — retained for 7 years to comply with UK tax and accounting law.
• Marketing data — retained until you unsubscribe or ask us to delete it.
• Customer accounts — retained until you delete your account.
• Usage data — typically retained for up to 26 months in an anonymised form.

Under UK GDPR, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data where we have no legal obligation to keep it.
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — withdraw consent for marketing at any time without affecting any prior processing.

To exercise any of these rights, email us at louiswood3142@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. Our website is served over HTTPS and our e-commerce platform (Shopify) is PCI DSS compliant for payment data.

In the unlikely event of a data breach that is likely to affect your rights and freedoms, we will notify you and the ICO within 72 hours as required by law.

We may update this privacy policy from time to time. The date at the top of this page shows when it was last revised. We will notify you of significant changes by email if you have an account or have subscribed to our mailing list.