Privacy Policy

CampVesta™ is a SaaS platform that helps holiday and summer camp operators manage staff, sites, modules and child registrations. For camp records entered by Operators, camp Operators are the data controllers and CampVesta is the data processor.

CampVesta™ is operated by Axis One Group Ltd, a company registered in England & Wales. Axis One Group Ltd is the controller for CampVesta website, account, support and cookie-consent processing. © 2026 Axis One Group Ltd. All Rights Reserved.

ICO Registration Number: ZC245952.

For privacy questions email privacy@campvesta.com.

• Operator & staff: name, email, phone, role, DBS / background-check status, availability, assignments.
• Children: name, age, parent contact, emergency contact, medical and consent notes.
• Operational: sites, camps, daily schedules, modules, attendance.
• Technical: IP address, browser/device, authentication tokens and security logs.

CampVesta uses two categories of cookies and local storage:

• Strictly necessary: authentication session, security tokens, your cookie-consent choice. These do not require consent under UK / EU PECR and GDPR.
• Optional analytics: aggregated usage to improve the product and measure public booking page performance. Only active after analytics permission.
• Optional marketing: supported advertising measurement on public booking pages where an Operator has configured it. Only active after marketing permission.

• Contract — to deliver the platform to the Operator.
• Legitimate interest — to secure accounts and prevent abuse.
• Consent — for optional analytics cookies and for parental consent recorded by Operators.
• Legal obligation — to retain records where required by safeguarding or tax law.

Depending on where you live you may have the right to access, correct, delete, restrict, port, or object to processing of your personal data, and to lodge a complaint with a supervisory authority. Requests should be sent to your camp Operator, who will work with CampVesta to fulfil them within statutory deadlines (typically 30 days in the UK/EU, 45 days in Canada, 30 days in the UAE).

• UK / EU: Article 8 GDPR — processing of a child's data requires parental consent for under-13s (UK) / under-16s (EU member-state dependent).
• United States: COPPA — verifiable parental consent is required for under-13s. Operators must record this consent before uploading data.
• Canada: PIPEDA & Quebec Law 25 — meaningful parental consent is required for minors.
• Australia: APPs apply; consent is generally required from a parent or guardian for under-15s in practice.
• UAE: PDPL Federal Decree-Law 45/2021 — explicit consent from a guardian for processing children's data.

Data is hosted in secure cloud infrastructure. Where data leaves the UK / EEA, CampVesta relies on Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum.

Operational data is retained while the camp season is active and for a defined safeguarding window thereafter (typically 12 months) unless Operators set a shorter period or local law requires longer. On request or on account closure, data is exported for 30 days then permanently deleted.

CampVesta enforces role-based access control, row-level security at the database tier, encrypted transport (TLS), and at-rest encryption of stored data. Sensitive medical and consent fields are restricted to Super Admin and Site Manager roles.

Where required, CampVesta will notify Operators without undue delay so they can meet their statutory breach-notification deadlines (72 hours under UK/EU GDPR, comparable timelines under PIPEDA, NDB scheme in Australia and UAE PDPL).

Material changes will be communicated by email or in-app at least 14 days before they take effect.

Privacy questions should be directed to your Operator administrator, who can escalate to the CampVesta team via the in-platform support channel.