How booking and account information is handled

The camp organiser is the controller for participant, family, emergency, health, accessibility and camp-delivery information. Its identity and contact details appear on the relevant camp page. It decides why that information is needed, who may see it and how long it should be kept.

Before a camp accepts live bookings, its page must identify the organiser's legal entity and geographic address and link to its organiser-specific privacy information. A display name, email address and this platform notice alone are not a substitute for those details.

FormSide (operator details pending), operating the FormSide service, is normally the organiser's processor for those booking records. FormSide is a separate controller for organiser and family accounts, authentication, platform security, abuse prevention, support, legal compliance and service administration. A role depends on what each party actually decides and does, not only the label used here.

Health, allergy and disability information is special-category data. The organiser must document both an Article 6 lawful basis and an Article 9 condition before requesting or using it. Emergency-treatment authorisation is not automatically the same thing as consent to process health data.

FormSide does not currently offer participant accounts. A booking must be made by an adult who has authority to provide the participant's details. The participant remains the person whose data rights are involved. Organisers should collect only what is necessary for the camp and give children age-appropriate information where they can understand it.

We do not profile children for advertising, sell their information, or make solely automated decisions that produce legal or similarly significant effects. FormSide and each organiser must assess whether the ICO Children's Code applies to their real service and complete a proportionate impact assessment where required.

Booking information is available only to the organiser and authorised team members whose role requires it. FormSide uses service providers for hosting and deployment, database and authentication, transactional email, bot protection and optional card processing. The current categories and purpose of each provider are listed on the subprocessors page.

Card details go directly to the payment provider. Transactional email jobs deliberately exclude participant medical notes, emergency contacts, consent answers and custom-form responses.

Some service providers may process information outside the UK. Where a restricted transfer occurs, the exporting controller must use an available UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard, and complete any required transfer risk assessment. Exact locations depend on the production accounts selected by the operator and organiser.

• Short-lived booking-abuse fingerprints are scheduled for removal after four days.
• Account and support information is kept while needed to provide the service and for an appropriate period after closure to resolve security, billing or legal issues.
• Booking, attendance, health and safeguarding records follow the organiser's documented retention schedule. FormSide currently does not impose one automatic period across every organiser.
• Payment, contract and tax records may be retained for the period required by law or needed to establish, exercise or defend legal claims.
• Where deletion is required, FormSide deletes or returns processor data on verified instruction, subject to legal holds and the lifecycle of protected backups.

Organisers must not keep medical or child information merely because storage is available. Contact the organiser first for a camp record, or FormSide where the request concerns a FormSide-controlled account or security record.

Depending on the purpose and lawful basis, you may have rights to access, correct, erase, restrict or receive personal information, object to processing, or withdraw consent. A child can exercise their own rights where they have sufficient understanding; a suitable adult may act for them where authorised.

For a camp record, contact the organiser shown on the camp page. For a FormSide account, security record or platform complaint, email privacy@formside.app. We may need proportionate information to verify identity and authority.

You can use our data protection complaint route. We will acknowledge a complaint within 30 days, investigate without undue delay, keep you appropriately informed and communicate the outcome. If another controller is responsible, we will explain that and help route the concern.

You may also complain to the Information Commissioner's Office. We ask that you contact the responsible organisation first where practical so it has an opportunity to investigate.

We review this notice when the service, providers or law changes. Material changes will be brought to affected users' attention before new processing begins where required. Booking and signup records store the notice version accepted at the time.