Last updated 14 July 2026. Notice version 2026-07-14.5.
This Privacy Notice explains how CampHQ collects, uses, stores, shares, and deletes personal information. CampHQ is operated by Merr Digital LTD, registered in England and Wales under company number 17320278. Our registered office is 66 Paul Street, London, England, United Kingdom, EC2A 4NA.
Contact us for our current ICO registration details. The registration number will also appear in the site footer when configured.
Who Controls Your Information
Responsibility depends on why the information is being used:
| Processing | Data protection role |
|---|---|
| Event bookings and operational event records | The event organiser is the controller. Merr Digital LTD acts as its processor and handles the information on its documented instructions. |
| An organiser's use of information shared from a staff profile | The organiser is a controller for its access and subsequent use. |
| An optional portable CampHQ staff profile and the staff member's sharing choices | Merr Digital LTD is the controller. |
| Website visits, enquiries, customer administration, support, general business correspondence, billing, service security, newsletters, and first-party analytics | Merr Digital LTD is the controller. |
Each booking form identifies the relevant event organiser and provides its privacy contact. Requests about organiser-controlled event information should normally be sent to that organiser. We will assist the organiser where required. Requests about the website, support service, or a portable staff profile can be sent to privacy@camphq.co.uk.
Information We Process
Depending on the service and event configuration, information may include:
- Contact and account information: names, email addresses, phone numbers, organisation details, account roles, password hashes, authentication and preference records.
- Participant and booking information: names, age or date of birth, group or district, booking selections, consent records, attendance, check-in and checkout activity, team labels, scores, reports, messages, and route cards.
- Health and other high-risk information: medical conditions, medication, allergies, accessibility requirements, dietary requirements, emergency contacts, and safeguarding free text. Health information is special category data. Dietary information may also reveal health information or religious or philosophical beliefs.
- Staff profile information: account details, roles, qualifications, first-aid information and, only where the staff member separately opts in, selected medical information.
- Location information: the latest precise team or device location submitted by an authorised adult or young adult where event tracking is enabled. Each update replaces the previous location; CampHQ does not retain a journey history.
- Support information: ticket subjects, categories, messages, replies, password reset records, complaint-handling dates, failed-login counters, and account lockout records.
- Transactional email information: recipient and sender names and email addresses, event or organisation names, booking, account, or ticket identifiers, ordinary service-message content, inbound support-reply or direct privacy-complaint content and headers, and delivery, bounce, spam, and suppression records. CampHQ does not use its transactional email provider for marketing email.
- General business mailbox information: sender and recipient details, message headers and bodies, signatures, mailbox folders and flags, and attachments in correspondence with staff. Incoming mail is stored in the locally operated mailbox service. Outgoing correspondence and its attachments pass through a separate Lettermint project for delivery.
- Website analytics: page paths, referrers, user agents, visit dates, and a daily visitor hash generated from an IP address and a daily salt. The analytics table does not store the raw IP address or use a persistent analytics cookie.
- Technical and security information: server logs, request metadata, essential session and CSRF cookies, rate-limiting records, audit events, error or security logs, and limited browser, device, connection, and interaction signals used by Cloudflare Turnstile to distinguish legitimate submissions from automated abuse.
- Business records: enquiries, customer contacts, contracts, invoices, payment status and accounting records. CampHQ does not receive or store payment-card details and currently records only offline payment status where needed.
Free-text fields and uploads can contain more information than an organiser intended. Organisers and users should enter only information that is necessary for the event.
Outbound transactional emails do not contain medical, medication, allergy, accessibility, dietary, emergency-contact, safeguarding, or precise-location information or attach sensitive booking records. They contain only booking, account, or ticket identifiers and ordinary administrative information. Sensitive event and support information can be viewed only by an authorised user after signing in to the relevant system.
A person may reply by email to a support-ticket update. Lettermint parses that inbound reply and sends it to CampHQ through a signed webhook. The reply text is added to the relevant support ticket only when the ticket-specific address is valid and the sender address matches the ticket. Email attachments, spam, invalid addresses, and unmatched messages are not imported into the ticket.
A person may also email privacy@camphq.co.uk directly. Where the dedicated inbound privacy route is enabled, Lettermint parses the message and sends it through the signed webhook to create a tracked privacy complaint. The sender, headers, subject, and plain-text complaint content necessarily pass through Lettermint. Attachments are not imported. The dedicated web form is the preferred route where a person wants to avoid putting complaint details into email.
Staff may use CampHQ mailboxes for ordinary business correspondence. Unlike automated transactional messages, a human email may include information and attachments supplied by either correspondent. Staff and correspondents should avoid sending unnecessary medical, safeguarding, payment-card, authentication, or other high-risk information by email.
Where Information Comes From
We receive information directly from parents, guardians, adult participants, staff members, customer representatives, support users, privacy complainants, inbound support-email senders, and devices used by authorised adults or young adults. We also receive limited operational information from event organisers and service providers such as hosting, security, and email providers.
Required And Optional Information
Fields marked as required on a booking form or account screen are needed to provide the requested event place, account, safety workflow, or service. If required information is not provided, the organiser or CampHQ may be unable to accept the booking, safely support participation, create the account, or respond to the request. Optional fields can be left blank.
Storing medical information in a portable staff profile is optional. Refusing or withdrawing that consent does not prevent a staff member from using ordinary event or account functions; they may provide necessary information separately to an organiser.
Purposes And Lawful Bases
| Purpose | Merr Digital LTD's role | Lawful basis |
|---|---|---|
| Enquiries, demos, customer administration, accounts, and service delivery | Controller | Steps requested before a contract, performance of a contract, and legitimate interests in administering customer relationships. |
| Billing, accounting, and statutory records | Controller | Contract and legal obligation. |
| Support, service communications, security, audit, fault diagnosis, and abuse prevention | Controller | Contract and legitimate interests in providing, securing, and improving the service. |
| General business correspondence and relationship administration | Controller | Steps requested before a contract, performance of a contract, legal obligation where applicable, and legitimate interests in communicating with customers, suppliers, partners, and other contacts. |
| First-party website analytics | Controller | Legitimate interests in understanding aggregate website use and improving the website. |
| Newsletter email | Controller | Consent. Every newsletter includes a simple unsubscribe method. |
| Optional portable staff profile | Controller | Consent under Article 6 and explicit consent under Article 9 for medical or other special category information. |
| Event booking, health, emergency, safeguarding, attendance, and location information | Processor | The event organiser selects and documents its Article 6 basis and, for special category information, its Article 9 condition. These are shown in the event-specific notice. |
A browser or device permission is a technical control and is not, by itself, the event organiser's UK GDPR lawful basis.
Portable Staff Profiles
An adult staff member may choose to store selected medical information in a portable CampHQ profile. Consent is separate, explicit, field-specific, and recorded with the notice version and time. It is never pre-ticked or bundled with general account terms.
The staff member can grant a named organiser revocable access to selected fields. Sharing provides scoped access to the central record and does not create an event copy. Withdrawing a sharing grant blocks the organiser's future access immediately. Withdrawal cannot undo an organiser's lawful use before withdrawal or information the organiser was independently required to record.
The staff member can withdraw consent and delete the medical values without losing ordinary account access. Minimal consent and withdrawal evidence may be retained where needed to demonstrate compliance or handle legal claims, but it does not contain the medical values.
Location Information
Where an organiser enables location reporting, an authorised adult or young adult may submit a precise team or device location. The latest location is visible only to authorised Event Control staff and is used only to manage the event, support safeguarding, and help coordinate a response during an emergency. Every new update overwrites the preceding coordinate, so CampHQ does not retain route or journey history.
Location sharing can be stopped at any time through the CampHQ Team App. CampHQ automatically stops location sharing at the end of each event day. Stopping location sharing prevents new updates but does not affect lawful use of a location submitted while sharing was active.
Sharing And Subprocessors
We do not sell personal information and do not use event data for third-party advertising or cross-service tracking. Information is shared only as needed with authorised organisers and staff, service providers, professional advisers, insurers, regulators, courts, law enforcement, or safeguarding leads.
Service providers acting for us are engaged under written contracts containing appropriate confidentiality, security, and data-protection obligations. Our current provider register is published on the Subprocessors page.
International Transfers
Most event information and live general business mailboxes are held on infrastructure operated by Merr Digital LTD. We also use Cloudflare for DNS, web proxy and security services, and encrypted R2 mailbox backups, and Lettermint B.V. for transactional service-email delivery, outbound general business correspondence, and inbound support replies. Cloudflare operates a global edge network. Lettermint states that its processing of email data takes place within the EU or EEA, with relevant service subprocessors in the Netherlands and France. The Subprocessors page identifies the services, information, locations, and transfer basis for each provider.
Where a provider processes personal information outside the UK or EEA, we use an applicable UK adequacy regulation or contractual safeguards such as the EU Standard Contractual Clauses with the UK Addendum. Transfers from the UK to Lettermint's stated EEA processing locations rely on the applicable UK adequacy regulations. We review provider contracts, locations, and safeguards and update the Subprocessors page before making a material provider change.
Cookies And Analytics
The website uses essential cookies for sessions, CSRF protection, login state, and security. First-party page-view analytics are recorded by the server using a daily visitor hash. They do not use a persistent analytics cookie, local storage, browser fingerprinting, third-party advertising, or cross-site tracking.
Public enquiry forms may use Cloudflare Turnstile to prevent spam and automated abuse. Turnstile receives limited browser, device, connection, and interaction signals solely to assess whether a submission is legitimate. We do not use those signals for marketing, and CampHQ does not retain the one-time challenge token.
If we later introduce device-based analytics, we will obtain consent or use a valid statutory exception. Where the statistical-purpose exception applies, we will provide clear information and a simple, free way to object.
Retention
| Information | Retention |
|---|---|
| Event medical, medication, allergy, accessibility, dietary, emergency-contact, safeguarding free text, and latest location | 30 days after the event by default. An organiser may select 0 to 90 days. A reason must be recorded for a period above 30 days. |
| Basic booking, attendance, and payload-free event audit records | 12 months after the event, then deleted or anonymised. |
| Deleted information in encrypted backups | Expires within a further 30 days. Backup copies are unavailable in ordinary operations. If disaster recovery requires a restore, deletion records are reapplied before ordinary access resumes. |
| Medical values in a portable staff profile | Until consent is withdrawn or the profile is deleted. Live values are then deleted and backup copies expire within 30 days. |
| Contact enquiries and closed support tickets | 24 months after the last interaction or ticket closure. |
| Transactional email content, inbound support replies or direct privacy complaints, and delivery metadata | 28 days with Lettermint, after which Lettermint states that email data is automatically and permanently deleted. Valid plain-text content imported into a support ticket or privacy case follows the 24-month support-ticket period above. CampHQ does not import inbound attachments. Suppression records needed to prevent repeated delivery or manage bounces may be retained longer. |
| General business mailbox correspondence and attachments | Live Inbox, Sent, Drafts, and Archive items remain until a mailbox user deletes them or the mailbox is manually retired and reviewed. Trash and Junk are automatically expunged after 30 days. Encrypted R2 backup snapshots expire after 30 days. Outbound copies processed by Lettermint follow its stated 28-day email-data period. |
| Raw website analytics | 30 days, after which only anonymous aggregate statistics may remain. |
| Routine security logs | 90 days, unless needed longer for a documented security incident or legal claim. |
| Closed website or support accounts | Deleted within 90 days, except information subject to another stated retention period. |
| Newsletter subscription | Until unsubscribe. A minimal suppression record is kept while we continue the relevant marketing activity. |
| Finance and statutory accounting records | Six years or a longer period where law requires it. |
Security
Medical and other designated sensitive fields are encrypted at application level. Data is also encrypted in storage and backups and protected in transit using TLS. General business mail is stored in the local mailbox service and copied to encrypted, access-controlled R2 backups. We use mandatory authenticator-app MFA for administrators, named app passwords for mail clients, role-based access, least privilege, tenant separation, privileged-account controls, audit logging that excludes message content and medical values, backup controls, and security review processes.
No service can guarantee absolute security. We review our measures against the sensitivity and risk of the information processed.
Your Rights
Depending on the processing and lawful basis, you may have rights to access, correct, erase, restrict, or receive personal information, and to object to processing. You can withdraw consent at any time without affecting processing that was lawful before withdrawal. The right to erasure, objection, or portability does not apply in every circumstance.
Requests about event data should normally be sent to the organiser identified on the booking form. Requests about CampHQ-controlled information can be sent to privacy@camphq.co.uk. We may need to verify identity and authority before responding.
We do not use personal information to make solely automated decisions that produce legal or similarly significant effects.
Children
Children do not create accounts or directly use CampHQ. Parents, guardians, adult participants, organisers, and authorised adult staff use the service. Organisers must collect only information necessary for their event and provide suitable privacy information to parents, guardians, and participants.
Data Protection Complaints
You can make a data-protection complaint by emailing privacy@camphq.co.uk or using the dedicated privacy-complaint form. The form creates a tracked case and sends an immediate automated acknowledgement. We will acknowledge every complaint within 30 days, investigate without undue delay, keep you informed, and communicate the outcome without undue delay.
Where a complaint concerns information controlled by an event organiser, we may refer it to that organiser and assist with its response. You may also complain to the Information Commissioner's Office. See our Data Protection Complaints page for the process.
Changes To This Notice
We will update the date and version when this notice changes. If a change materially affects how existing information is used, we will bring it to affected people or customer organisations rather than relying only on publication at this URL.
Contact
Email privacy@camphq.co.uk or use the dedicated privacy-complaint form. The form is preferred for complaint details because ordinary email passes through our transactional email provider.