An inquiry about the floor is kept 24 months, and none of it is sold.

When this notice took effect

This version took effect on September 29, 2026 and was last updated on the same day. Every earlier version is replaced by it. If we change it, the date at the top of this page moves, and the change is described in the section on changes further down.

Who runs this site

The site and the bookings desk behind it are operated by Brooklynboulders, trading at brooklynboulders.us as Brooklyn Boulders Studio. We decide why your details are taken and how they are handled, which makes us the controller of that data.

Postal address: 575 DEGRAW ST, BROOKLYN, NY 11217, BROOKLYN, NY, United States. Email: [email protected]. Phone: (215) 479-5335.

What we collect

Less than most sites. There is no account, no password and no payment on brooklynboulders.us. Nothing is sold here and no card number is ever asked for.

From the inquiry form

When you send the form on the contact page or the short form on the home page, bisiad8.php writes down: your name, phone, email, the address or city the production is based in, the kind of inquiry (photo, film, portraits, event), your message, the specification you asked for, and whether you ticked the consent box.

With it, automatically: your IP address, the browser's user-agent string, the page that referred you, the moment the form was rendered and the moment it was sent. The two timestamps are how we tell a person from a script that fills a form in 0.3 seconds.

From the support chat

If you open the chat, joja1c6.php keeps the conversation and any name, phone or email you type into it. A token is stored in your browser so you can come back to the same thread.

From cookies and the click that brought you

Your consent choice is stored in your browser under site_consent_v2. If you allow storage, advertising and analytics cookies set by Google, Microsoft and Meta can be read. If you arrived from an ad, the link carries a click identifier: gclid, msclkid or fbclid. The cookie ledger lists every one of these by name.

What each piece is used for

• Form and chat details are used to answer you: to check whether the wall can do what the shot list asks, to arrange a recce, and to send a written quote and booking confirmation.
• IP, user-agent and timestamps are used to block spam and abuse of the form, and to trace a fault when a message fails to arrive.
• The consent record is used to remember your choice so the banner does not ask again on every page.
• Click identifiers and ad cookies are used, only with your permission, to count which campaign produced an inquiry and to stop paying for ads that bring nobody.
• Analytics cookies are used, only with your permission, to see which pages crews actually read before they write.

We do not use any of it to build a profile of you, and we do not sell a mailing list. Your email is not added to a newsletter because we do not send one.

The legal basis for each use

For visitors covered by the GDPR, each use needs a lawful basis. These are ours, stated plainly.

The advertising platforms that send people here

We pay for ads. Crews searching for a bouldering gym film location in NYC or a climbing wall location rental in NYC find us through them, and that is how this page reached some of you.

• Google Ads sends traffic here and attaches gclid to the link you click.
• Microsoft Advertising sends traffic here and attaches msclkid to the link you click.
• Meta Ads sends traffic here where a campaign runs there, and attaches fbclid to the link.

The identifier arrives in the address bar whether or not you consent; that is how the platforms build their links. What changes with your choice is whether anything on this site stores it or reports the visit back. Without consent, nothing does.

Consent Mode v2, and what it holds back

The site uses Google's Consent Mode v2. Before the page does anything else, four signals are set to denied: ad_storage, ad_user_data, ad_personalization and analytics_storage. They stay denied until you press Allow on the banner.

If you press Decline, or later withdraw from the Cookie settings link in the footer, all four are set back to denied at that moment. In the denied state no advertising or analytics cookie is written, and no user data is sent for ad personalization.

Who else receives data

Named one by one. Nobody else is given your details, and nobody buys them.

• Google Ireland Ltd / Google LLC, for Google Ads. Receives the consent signals, and with consent, the gclid and ad measurement data. Its policy: policies.google.com/privacy.
• Microsoft Ireland Operations Ltd, for Microsoft Advertising. With consent, receives the msclkid and visit data. Its handling is covered by the Microsoft privacy statement at privacy.microsoft.com/privacystatement.
• Meta Platforms Ireland Ltd, for Meta Ads, where a campaign runs there. With consent, receives the fbclid and visit data.
• Our hosting provider, which serves this site and stores the inquiry database and chat transcripts on its servers under contract with us.
• Our mail provider, which carries the notification of your inquiry to the bookings inbox.

Data that crosses a border

The studio is in the United States and the data is handled here. If you write from Europe, your inquiry travels to the US to reach us. Google, Microsoft and Meta process data in the US and elsewhere. Those transfers rest on the EU–US Data Privacy Framework where the recipient is certified under it, and on the European Commission's standard contractual clauses where it is not.

How long each thing is kept

Real periods, counted from the day the record was made. When the clock runs out the record is deleted, not archived.

Twenty-four months covers the usual gap between a crew asking in one season and coming back for the next campaign. After that we would rather ask again than keep old numbers.

How it is protected

The whole site runs over HTTPS. The inquiry database and chat transcripts sit behind a login used only by the bookings desk, and that login is not linked from any public page. Access logs rotate out after 30 days. The form carries two hidden honeypot fields and a render timestamp so bots are dropped before a record is written. No system is perfect; if we ever learn of a breach that affects your details, we tell you by email without delay.

Your rights under the GDPR

If you reach this site from the European Economic Area or the UK, the GDPR gives you these rights over what we hold about you:

• Access: a copy of your data and how we use it.
• Rectification: correction of anything wrong.
• Erasure: deletion, where we have no overriding reason to keep it.
• Restriction: we keep it but stop using it while a question is settled.
• Portability: your form and chat data in a common machine-readable file.
• Objection: to any use based on legitimate interest.
• Withdrawing consent: at any time, with no effect on what was lawful before. For cookies, use Cookie settings in the footer.

Your rights under US state law

US state privacy law applies to us. In California, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and why, to delete it, to correct it, to opt out of its sale or sharing for cross-context behavioral advertising, to limit use of sensitive information, and not to be treated differently for using any of these rights. Residents of other states with privacy laws in force, including Virginia, Colorado, Connecticut, Utah, Texas and Oregon, hold similar rights, and we honor them on the same terms.

We do not sell personal information for money. Allowing ad cookies can count as "sharing" under California law. To opt out, press Decline on the banner or reopen it from Cookie settings, and the ad signals go back to denied.

Global Privacy Control is honored

If your browser or an extension sends the Global Privacy Control signal (the Sec-GPC header), we treat it as an opt-out of sale and sharing without asking you again. The four Consent Mode signals stay denied and the banner does not try to talk you out of it.

Children

This site is for producers, photographers, brands and athletes' teams booking a location. It is not meant for children and we do not knowingly take data from anyone under 16. A shoot that involves minors on the wall is arranged with a parent or guardian and the production, never through a child's own inquiry. If you think a child has sent us details, write to us and we delete them.

Complaining about us

Write to us first; most things get fixed in a reply. You do not have to. You can complain to the Attorney General of your state, and in California to the California Privacy Protection Agency. From Europe or the UK you can complain to the data protection authority where you live or work.

When this notice changes

We change the date at the top of the page and add a short line under it saying what moved. If a change would use your existing data in a new way, we email the people whose inquiries are still inside their 24 months before it takes effect, and ask again for consent where consent is the basis.

Reaching a person about privacy

The bookings desk answers privacy questions too. Email [email protected], call (215) 479-5335, or write to 575 DEGRAW ST, BROOKLYN, NY 11217, BROOKLYN, NY, United States. The same terms that govern a booking are on the terms page.