Privacy Policy

Last update: May 17, 2026

RWY (hereinafter “RWY”), operating under the trade name Circle Climbing Routes, publishes and operates the website Circle Climbing Routes (hereinafter the “Site”), offering  professionals the possibility to purchase climbing route models designed by professional route setters from around the world and available for 3D preview.

RWY may process users’ personal data when they use the Site or place orders online through the Site.

This personal data protection policy (hereinafter the “Policy”) informs you about how we process, protect, and share your personal data collected in connection with your use of the Site.

It notably contains important information regarding your rights concerning your personal data.

Please read it carefully in order to understand our practices regarding the processing of personal data we implement.

Please note that this Policy may be modified or supplemented at any time, particularly to comply with any legislative or regulatory developments.

In such a case, the date of the update will be clearly identified at the top of the Policy. These modifications become binding upon users of the Site as soon as they are published online. You are therefore encouraged to regularly consult this Policy to stay informed of any updates.

You will also be informed of the adoption of each new version of the Policy by email sent to the email address provided when creating a customer account.

For any information regarding personal data protection, you may also visit the website of the French Data Protection Authority (CNIL): CNIL

1. Who is the data controller?

The data controller is the entity that determines the purposes (why personal data is processed) and the means (how personal data is processed) of a personal data processing operation (any collection, storage, transmission, deletion, and/or use of personal data).

RWY, a simplified joint-stock company (SAS) with share capital of €10,000, registered with the Chambéry Trade and Companies Register under number 921 702 262 (VAT number: FR63921702262), whose registered office is located at 42 B, route du Revard, Aix-les-Bains (73100), France, acts as the data controller for your personal data collected through the Site. 

2. What types of personal data does RWY collect?

Personal data refers to any information that allows a natural person to be identified, directly or indirectly, such as first and last name, postal address, telephone number, email address, or IP address.

As part of your use of the Site, RWY collects and processes different types of personal data.

2.1. Data you provide directly to us

  • When you create a customer account on the Site, which is optional but gives access to additional features, you provide us with:
    • Your title (Mr. or Ms.)*
    • Your first and last name*
    • A valid email address*
    • An encrypted password*
    • Your date of birth (optional)

The information marked with an asterisk is mandatory. Without it, you will not be able to create a customer account.

  • When placing an order after creating a customer account, you are required to provide a billing address. Without it, you will not be able to order products on our Site.
  • When placing an order as a guest on the Site, you provide us with:
    • Your title (Mr. or Ms.)*
    • Your first and last name*
    • A valid email address*
    • A billing address*
    • Your date of birth (optional)

The information marked with an asterisk is mandatory. Without it, you will not be able to order products on our Site.

  • When placing an order (through a customer account or as a guest), you also provide us with data related to your order (order details, date, amount, etc.).
  • When you contact RWY in any manner whatsoever, you provide us with data relating to that interaction (identification, orders, complaints, requests, etc.).
  • When you post a review on the Site regarding a purchased product (feature available only if you have a customer account).
  • When you add products to your wishlist (feature available only if you have a customer account).

Mandatory fields will be identified by an asterisk (*) at the time of collection.

2.2. Data collected during your use of the Site

When you use the Site, we collect technical information relating to your connection and browsing activity, such as: your internet browser, IP address, browsing history (date and time of your last connection), and screen resolution.

Various technologies may be used to collect this data, including cookies.

For further information regarding cookies, please refer to our Cookie Policy, accessible here and on our Site by clicking the “Cookie Policy” link available at the bottom of each page.

2.3. Rules applicable to banking data

Data relating to transactions resulting from your orders is collected by our payment service provider Payplug, whose privacy policy is available at the following link: https://www.payplug.com

Your banking data never passes through RWY’s IT systems.

3. For what purposes does RWY process your personal data?

We use your personal data for the following purposes:

  • Provision of products marketed on the Site;
  • Management of your product orders;
  • Management of billing operations;
  • Management of your customer account on the Site;
  • Management of your information requests;
  • Management of your rights requests;
  • Management of complaints;
  • Publication of customer reviews on purchased products on the Site;
  • Statistical studies;
  • Fraud prevention;
  • Site security;
  • Investigation and prosecution of illegal activities;
  • Dispute resolution.

4. On what legal grounds is your personal data processed?

The processing of your personal data is justified by different legal grounds depending on how we use such data.

Contract

Provision of products ordered on the Site in accordance with the Terms and Conditions of Sale.

Consent

The processing of certain data collected through cookies is based on your consent.

Legitimate interest

RWY has a legitimate interest in processing your data, which is justified, balanced, and does not infringe upon your privacy, in the following cases:

  • IP addresses are collected to secure our IT systems against fraud and cyberattacks;
  • To manage your information requests;
  • To publish your reviews on purchased products;
  • To produce performance statistics;
  • To measure audience traffic;
  • To combat fraud.

Legal obligation

RWY is legally required to process your data in the following cases:    

  • Management of billing operations;
  • Management of your rights requests and complaints.

5. Who are the recipients of your personal data?

Your personal data may be processed by authorized RWY personnel, partners, or service providers. The use of such partners or service providers is necessary for the proper execution of the contract between you and RWY.

The following may have access to your personal data:

  • RWY personnel who need access within the scope of their duties;
  • Third-party service providers hosting your data on servers located in France;
  • The payment service provider Payplug;
  • Successors to our business activities in the event of a transfer of business or assets;
  • Any competent authority responsible for control or inspection missions in accordance with applicable regulations.

RWY undertakes to impose on its processors the same contractual obligations regarding the processing of your personal data.

6. How long do we keep your personal data?

The retention period for your personal data varies depending on the purpose of processing and applicable legal and regulatory obligations.

PURPOSE RETENTION PERIOD
Product order management Duration of the contractual relationship
Customer account management Until account deletion or two (2) years after your last activity (purchase or login)
Information requests management Three (3) years from the last contact with RWY
Publication of customer reviews Three (3) years from publication
Billing operations management Ten (10) years following the end of the relevant accounting period, in accordance with legal obligations
Rights requests and complaints management Five (5) years following closure of your file
Statistical studies Three (3) years
Fraud prevention and detection Two (2) years

Your IP address and other technical data collected during your use of the Site are retained for a period proportionate to the purpose of processing, not exceeding 25 months.

7. What are your rights regarding your personal data?

7.1. In accordance with the GDPR and the French Data Protection Act, you benefit from the following rights:

7.1.1. Right of access and communication

You have the right to know whether personal data concerning you is being processed by RWY and, if so, to obtain a copy in an understandable format.

To process your request, we are legally required to verify your identity. We may ask you for additional information (such as a copy of your identity document).

7.1.2. Right to rectification and erasure

You have the right to obtain correction of inaccurate data and completion of incomplete data, as well as deletion of your personal data in accordance with applicable regulations.

7.1.3. Right to restriction of processing

You have the right to temporarily suspend the use, partially or fully, of your personal data.

This right allows you to request suspension of data processing while verification is carried out in the cases provided for by applicable regulations.

7.1.4. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on RWY’s legitimate interests, as well as the right to object to commercial prospecting.

7.1.5. Right to data portability

You also have the right to data portability, meaning the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller.

This right only applies to data collected on the basis of your consent or within the framework of a contract.

7.1.6. Right not to be subject to automated decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which significantly affects you, except in the cases provided for under Article 22 of the GDPR.

This right allows you to request human intervention.

7.2. Instructions in the event of death

You have the right to define general or specific instructions regarding the handling of your personal data after your death.

You may modify or revoke these instructions at any time.

7.3. Exercising your rights

You may exercise your rights by writing to RWY, 42 B, route du Revard, 73100 Aix-les-Bains, France, for the attention of the “complaints department” directly through the Contact us section of the Site.

Your request must be accompanied by valid proof of identity.

Once your request has been received, RWY will endeavor to provide a satisfactory response within one (1) month or, in the case of a complex request, within a reasonable period after informing you in advance.

RWY reserves the right to request additional information or clarification regarding your request, or to refuse the request for legitimate reasons, which will be communicated to you.

7.4. Referring the matter to the competent supervisory authority

If you believe that RWY is not complying with its obligations regarding the protection of your personal data, you may contact the competent supervisory authority. In France, this is the CNIL.

Complaints may be submitted directly via the CNIL website or by post at the following address:

  • CNIL – Service des Plaintes
  • 3 Place de Fontenoy
  • 75007 Paris
  • France

The CNIL will inform you about the progress and outcome of your complaint, including the possibility of judicial remedies.

For more information regarding your rights, please consult the CNIL website.

8. Is your personal data transferred outside the European Union?

Your personal data is stored and hosted within the territory of the European Union.

No transfer of this personal data to third countries or organizations will take place.

9. Security of your personal data

We undertake to implement all appropriate measures, considering the nature of the data and the risks presented by the processing, in order to preserve the security of your personal data and, in particular, prevent it from being distorted, damaged, or accessed by unauthorized third parties.

We notably implement physical, electronic, and administrative security measures.

Our protection measures notably include firewalls, physical access controls, and data access authorization controls.

10. Cookies

For more information, please consult our Cookie Policy, accessible here.