The Nest's Privacy Policy
Last updated: 15th October 2026
1. Who We Are
The Nest Climbing Limited ("TheNest", "we", "us") is the controller of the personal data described in this policy. We are registered in England and Wales (company number 10167827) and with the Information Commissioner's Office (registration number ZB116600). The Nest is part of the Heligo Group. Contact us about privacy at enquiries@thenestclimbing.co.uk or The Nest Climbing Limited, 1-7 Material Walk, Hayes, London, UB3 1DP.
2. The information we collect
• Identity and contact details: name, date of birth, address, email, phone number and emergency contact.
• Account and booking information: registration details, bookings, passes, memberships, visit history andinduction records.
• Payment information: payments are handled by Stripe. We see confirmation of payment and limited card details (such as the last four digits) but never store full card numbers.
• Health information: anything you tell usabout medical conditions or injuries that may affect your safety when climbing, and details of any accident or incident.
• Information about children: details provided by a parent, guardian or a programme partner when a young person registers or attends a session.
• CCTV images: recorded in and around thegym for safety and security.
• Photos and video: taken in the gym for marketing, as described in our Terms and Conditions.
• Website and device data: IP address, browser type and how you use our site, collected through cookies (see our Cookie Policy).
• Communications: emails, messages, feedback and reviews you send us.
• Business contacts: details of people we deal with at employers, schools, suppliers and partners.
3. How we use it and our legal basis
Managing your registration, bookings, memberships and payments
Legal basis: Contract
Keeping you safe: inductions, acknowledgement of risk, supervising children, responding to incidents
Legal basis: Contract and legitimate interests; vital interests in an emergency
Recording accidents and reporting serious incidents
Legal basis: Legal obligation
Keeping financial records and accounts
Legal basis: Legal obligation
Sending service messages (booking confirmations, changes, closures)
Legal basis: Contract
Sending news and offers by email
Legal basis: Consent, or legitimate interests for existing customers (you can unsubscribe at any time)
Improving our website and services, and measuring advertising
Legal basis: Consent (for non-essential cookies) and legitimate interests
Using CCTV to protect people and property
Legal basis: Legitimate interests
Using photos and video for marketing
Legal basis: Legitimate interests or consent (always consent for children)
Handling enquiries, feedback and complaints
Legal basis: Legitimate interests
Dealing with legal claims and insurers
Legal basis: Legitimate interests and legal obligation
4. Health information
Health information is special category data and gets extra protection. We only collect what we need to keep you and others safe, we rely on your explicit consent (or, in an emergency, the need to protect someone's vital interests), and we restrict access to staff who need it. You can choose not to share health information, but we may then be unableto let you climb safely.
5. Children
We collect information about children from their parent or guardian, or from programme partners such as local authorities running holiday activity programmes. We use it only to run sessions safely and meet our safeguarding duties. We never use children's information for marketing.
6. Who we share it with
We do not sell your personal data. We shareit only where needed with:
• service providers acting on ourbehalf, including Clava (bookings and memberships), Stripe (payments), Webflow(website hosting), Microsoft (email), Xero (accounting) and Google (analytics and advertising, with your consent) Sendgrid (email marketing, with yourconsent);
• other companies in the Heligo Group, for management and reporting;
• our insurers, professional advisers and auditors;
• local authorities and partners for programmes they fund, where required by that programme;
• emergency services, the policeor regulators where the law requires or someone's safety is at risk;
• a buyer of our business, if it is sold, subject to confidentiality.
7. International Transfers
Some of our service providers process data outside the UK, for example in the United States. Where they do, we make sure appropriate safeguards are in place, such as UK adequacy regulations orapproved contract clauses.
8. How long we keep it
Customer account and registration
How long we keep it: While you are active, then [3] years after your last visit
Records relating to children
How long we keep it: Until the child turns [21], or [3] years after the last visit if later
Accident and incident records
How long we keep it: At least [3] years; longer if a claim is possible or the person is a child
Financial and transaction records
How long we keep it: 6 years from the end of the financial year
CCTV
How long we keep it: 2 months, unless needed for an incident
Marketing preferences
How long we keep it: Until you unsubscribe, then a suppression record so we don’t contact you again
Enquiries and complaints
How long we keep it: [2] years after closure
9. Your rights
You have the right to access your personaldata, to correct it, and in some cases to have it deleted, to restrict orobject to how we use it, and to receive a copy in a portable format. Where werely on consent, you can withdraw it at any time. To use any of these rights,email enquiries@thenestclimbing.co.uk. We will respond within one month, and wemay need to confirm your identity first.
10. Keeping your data secure
We use appropriate technical and organisational measures to protect your data, including access controls, secureproviders and staff training. No system is completely secure, so please tell us straight away if you think your account has been compromised.
11. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at enquiries@thenestclimbing.co.uk. We will acknowledge your complaint within 30 days and aim to resolve itpromptly. If you are still not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
12. Changes to this policy
We may update this policy from time totime. The date at the top shows when it was last changed, and we will tell youdirectly about significant changes.
