Parties
This agreement is made between the client company identified when ordering The Climb (the "Controller") and The Tech Nation S.L., NIF B19412451, Passeig de Gràcia 2, 08007 Barcelona, España (the "Processor").
It forms part of the terms of sale and use and is accepted with them when ordering. It meets article 28 of Regulation (EU) 2016/679 (GDPR).
1. Purpose
The Processor processes personal data on behalf of the Controller to provide The Climb, an AI training platform for teams. Details of the processing are in annex 1. For everything related to data protection, this agreement prevails over the terms of sale and use.
2. Term
This agreement applies for the whole term of the contract, then until the deletion of data provided for in clause 10.
3. Instructions
3.1. The Processor only processes data on the documented instructions of the Controller. These instructions are the terms of sale and use, this agreement, the company's settings in the application (invitations, roles, teams, departures) and the Controller's written requests.
3.2. If an instruction seems to breach the GDPR or applicable law, the Processor informs the Controller immediately.
3.3. The Processor does not use team members' data for its own purposes.
4. Confidentiality
People authorised to process the data at the Processor are bound by confidentiality. They only access it as far as needed for the service, support and security.
5. Security
The Processor implements the technical and organisational measures in annex 2 (article 32 GDPR). It may update them without lowering their level.
6. Subprocessors
6.1. The Controller gives a general authorisation to use the subprocessors listed in annex 3.
6.2. Any addition or replacement is announced by email at least 30 days in advance. The Controller may object on reasonable data protection grounds. If no solution is found, it may terminate the affected part of the service at no cost.
6.3. The Processor imposes equivalent data protection obligations on each subprocessor and remains responsible for their compliance.
7. Transfers outside the European Economic Area
7.1. The application is hosted in the United States (annex 3). The Controller is informed of this and accepts it.
7.2. Each transfer relies on the safeguards offered by the provider (Data Privacy Framework or standard contractual clauses), within the meaning of chapter V GDPR: adequacy decision (EU) 2023/1795 for certified companies, or the standard contractual clauses of decision (EU) 2021/914, with supplementary measures where needed.
8. Assistance
The Processor assists the Controller, as far as possible and according to the nature of the processing:
- in answering requests from individuals exercising their rights; any request received directly is passed on within 5 working days;
- in carrying out a data protection impact assessment (article 35 GDPR), by providing the description of the service and of the security measures;
- in consulting the supervisory authority where needed.
9. Personal data breach
The Processor notifies the Controller of any personal data breach without undue delay, and at the latest within 48 hours of becoming aware of it. It provides the information in article 33.3 GDPR available to it, then completes it.
10. End of processing
10.1. A team member leaves. When the Controller's admin records a departure, the person's access is cut immediately. Their data is automatically pseudonymised 30 days later: name, email and team replaced, name erased from their certificates (which remain verifiable without a name), free notes on their blockers and review notes erased, login account deleted if it serves no other company. Progress data remains linked to a profile with no name or email. The admin can cancel the departure before the period ends.
10.2. End of the contract. Data is kept for 6 months to allow reactivation or export, then deleted. Backup copies disappear at the end of their rotation cycle at the hosting provider. During these 6 months, the Controller may ask for an export of its data in a structured format, or for earlier deletion.
10.3. On request, the Processor confirms deletion in writing. Only data that the law requires it to keep remains.
10.4. Certificates. A certificate's cryptographic fingerprint, anchored in the Bitcoin blockchain to prove its date, cannot be erased. It contains no name and cannot be used to identify anyone once the certificate has been deleted.
11. Records and audit
11.1. The Processor keeps the record of processing carried out on behalf of its clients (article 30.2 GDPR). It makes available the information needed to show compliance with article 28.
11.2. The Controller may have an audit carried out at most once a year, except after a data breach, with 30 days' notice, at its own cost, by an auditor bound by confidentiality and without access to other clients' data. The Processor may first answer with a questionnaire and its security documents.
12. Liability
Each party's liability follows article 82 GDPR and the terms of sale and use.
13. Governing law
Spanish law, courts of Barcelona, as in the terms of sale and use.
Annex 1. Description of the processing
| Item | Description |
|---|---|
| Data subjects | the Controller's team members invited to The Climb (employees, interns, contractors), including its admins, People and Sherpas |
| Identity and account | name, work email, role (climber, Sherpa, admin, People), team, status, invitation, arrival and departure dates, login identifier, date of last visit |
| Learning | answers to the entry and follow-up questionnaire question by question (including role and company size), level, six self-assessment scores, badges, experience points, streak, steps and checkpoints, last activity, avatar, AI tool declared, active time (total and per step) |
| Exercises | status, score, attempts and short details per exercise (tool, mode, boxes ticked, review by a Sherpa, validation with support), number of refused proofs, human review (verdict, date, the reviewer's note, erased with the pseudonymisation); the text of answers is not kept |
| Reviews | successes and mistakes per concept |
| Signals | blockers reported with an optional free note; answers to the team weather, including a free field |
| Certificates | full name, company name, programme, level, skills, dates, status, electronic signature, fingerprint anchored in Bitcoin |
| Company settings | logo, programme name |
| Support and audit | support sessions (who asked, reason), log of administration actions without email addresses |
| Technical data | IP address, browser, pages requested, in the hosting providers' logs |
| Sensitive data | none expected; users are asked not to enter any |
| Nature of operations | hosting, storage, consultation, computing levels and progress, display to authorised roles, computing totals per team, issuing and publicly verifying certificates, sending invitations and login emails, support sessions, pseudonymisation and deletion |
| Purposes | training team members in AI, following progress, engaging teams, certificates, dashboards for managers; as totals and without names, improving the content of The Climb (time and refused proofs per step) |
| Visibility | the admin and People see each person's progress by name; each member sees their teammates and the Sherpas by name, other colleagues without a name; team weather and blockers only as totals, from 5 responses; a certificate is visible to anyone who has its link or number |
| Exclusions | no automated decision with legal or similarly significant effects; no assessment by an AI; the application calls no AI model; no advertising |
| Duration | term of the contract, then clause 10 |
Annex 2. Security measures
- Authentication: accounts and logins handled by Clerk; password, code or link sent by email, two-factor authentication available.
- Access control: every server function (Convex) checks the person's role and company before returning any data; each company only sees its own data.
- Encryption in transit: all connections use HTTPS.
- Departures: access cut as soon as a departure is recorded; automatic pseudonymisation after 30 days (clause 10.1).
- Audit log: administration actions and changes made through MCP recorded (author, action, target, date, connected assistant), without email addresses.
- Support: a support session in a member's account is only opened at the request of the Controller or of the person, or to handle an incident; it is recorded with the person who opened it and the reason.
- MCP access: limited to Yetis and the Processor's team, no tools for the client's team members; OAuth authorisation with PKCE, permissions limited by scope, role checked on every call, impersonation sessions refused.
- Data minimisation: the text of exercise answers is not kept; team weather and blockers shown to managers as totals from 5 responses, without free notes.
- Public forms: limits against abuse, IP addresses kept as fingerprints.
- Certificate integrity: Ed25519 electronic signature and timestamping through public anchoring.
- Organisation: the Processor's staff access limited to what is needed and bound by confidentiality; breach notification procedure (clause 9).
Annex 3. Subprocessors
The list of authorised subprocessors, with their service, the data concerned, their location and the transfer safeguards, is published on the Subprocessors page. It forms part of this agreement.