Privacy Notice

Kamparoo Activity Camps Ltd ("Kamparoo", "we", "us") runs Kamparoo Activity Camps, holiday activity camps for children aged 5–13. This notice explains how we use personal information when you visit our website, contact us, join our mailing list, book a camp, or apply to work with us.

Last updated: 27 September 2026

1. Who we are and how to contact us

• Company: Kamparoo Activity Camps Ltd, company number 17082099
• Address: 7 Sanders Close, Stansted Mountfitchet, Essex, CM24 8GY
• ICO registration reference: ZC239112
• Privacy questions and complaints: hector@kamparoo.co.uk

2. Our website

Vercel hosts our website. When you visit, Vercel processes the technical information needed to deliver pages and keep the site secure, such as your IP address, your browser's details (its "user agent"), the page you requested and the time of the request. We use this information because we have a legitimate interest in running a secure, working website. Vercel's privacy notice explains how it handles service data: https://vercel.com/legal/privacy-policy

The website has no sign-in or accounts. We don't use analytics, advertising or tracking tools, and the website itself doesn't set cookies or use similar storage. Our Cookie Policy has more detail.

The map on our homepage comes from OpenStreetMap. When it loads, your browser connects to the OpenStreetMap Foundation's servers, which receive technical information such as your IP address. The OpenStreetMap Foundation's privacy policy applies: https://osmfoundation.org/wiki/Privacy_Policy

Our website links to Pembee (bookings), MailerLite (our mailing-list form), Instagram, Facebook, WhatsApp, Google Maps and OpenStreetMap. Each has its own privacy policy.

3. Booking a camp

Bookings are made through Pembee (kamparoo.pembee.app), not on our website. The details you give when booking are collected through Pembee. That includes your details, your child's details, and health, additional-needs and other information the booking form asks for. Pembee processes this information on our behalf under its data processing agreement, and sends booking confirmations and reminders. Pembee's privacy policy: https://www.pembee.app/privacy-policy

If your employer offers childcare through Bright Horizons, Bright Horizons may send us your booking information. We decide whether we can accept the booking, then contact you directly to complete our booking form. We don't routinely report attendance or send invoices back to Bright Horizons.

When you pay with Tax-Free Childcare or childcare vouchers, we receive the payment with its reference and match it to your booking. We don't routinely share your or your child's details with those providers.

Camps run at Howe Green House School, which provides the venue only. We don't routinely share parent or child details with the school.

We use booking information for these purposes:

• To take and manage your booking and payments. This is necessary for our contract with you, as the parent or carer who books.
• To keep the records we must keep as an Ofsted-registered childcare provider, such as your child's name, home address, date of birth and attendance, and your name, address and phone number. The law requires this (the Childcare (General Childcare Register) Regulations 2008).
• To look after your child safely at camp, using the information you give us about them. We have a legitimate interest in providing safe care for the children booked with us.
• To protect a child from harm (safeguarding). We rely on the lawful basis that UK data protection law provides for safeguarding vulnerable individuals.
• To protect your child's vital interests in an emergency.

Some booking information is required so that we can accept a booking and care for your child safely. If it isn't provided, we may not be able to accept the booking.

Booking information includes health and additional-needs information, which UK data protection law treats as special category information. We use it only to care for your child safely, and with your explicit consent, which you give by ticking the consent box on the booking form. You can withdraw your consent at any time by emailing hector@kamparoo.co.uk. If you do, we'll talk to you about whether we can still care for your child safely. Records the law requires us to keep, such as a record of medicines given, are kept even if consent is withdrawn. In an emergency, we may also use it to protect your child's vital interests. Where we need to protect a child from harm, we may use it under the safeguarding condition in the Data Protection Act 2018.

Photos and filming: the Pembee booking form includes a box that says "My child's photo cannot be taken." If you tick it, we won't photograph or film your child. If it isn't ticked, we may use photos and videos of your child on Instagram and Facebook, our website, our marketing emails and printed flyers. Children whose parents have ticked the box are kept out of the shot. You can change your preference at any time by emailing hector@kamparoo.co.uk. We use photos and videos in this way because we have a legitimate interest in showing families what our camps are like. You can object at any time, by ticking the box or by emailing us. We'll then stop using your child's photos in new material, and remove them from our website and social media within 5 working days.

4. Our mailing list

You can join our mailing list by ticking the optional marketing checkbox when you book through Pembee, or by using the signup form linked from our website. That form is hosted by MailerLite and asks only for your name and email address. No MailerLite code runs on our website.

We send marketing emails only with your consent. We use MailerLite to hold our mailing list and send those emails, and MailerLite processes your details on our behalf under its data processing agreement. Every marketing email includes an unsubscribe link. We don't share your personal data with other organisations for their own marketing.

You stay on our active mailing list until you unsubscribe. When you unsubscribe, we stop sending you marketing emails. MailerLite keeps your email address marked as unsubscribed so that you aren't emailed again. You can also ask us to erase your details by emailing hector@kamparoo.co.uk. If we erase them, we may keep only your email address and a note that you don't want marketing from us, so that we don't contact you again by mistake.

5. Contacting us and applying to work with us

If you contact us by email, phone or WhatsApp, we use what you send to reply, because we have a legitimate interest in answering enquiries, or to take steps you ask for before a booking. WhatsApp messages are also handled by WhatsApp (Meta) under its own terms.

To apply to work with us, email hector@kamparoo.co.uk or call 07917 404055. There is no application form on our website. We use what you send to consider your application and decide whether to offer you a job. This is necessary to take steps, at your request, before entering into a contract with you. Before anyone starts work, we carry out the checks the law requires for people working with children and in the UK, including right-to-work and suitability checks. This is necessary to meet our legal obligations.

DBS checks involve criminal-record information, which UK data protection law protects specially. We use it only to decide whether someone can safely work with children, as our Safe Recruitment Policy describes, and under the conditions the Data Protection Act 2018 sets for employment and safeguarding.

6. Who we share information with

• Our service providers, who process information on our behalf: Vercel (website hosting), Pembee (bookings, booking confirmations and reminders), MailerLite (mailing list and marketing emails), Care Check (DBS checks for people applying to work with us) and our business email service (Microsoft 365, currently managed through GoDaddy).
• Other organisations, only where it is necessary and the law allows it: for example the emergency services in an emergency, or Ofsted, the Local Authority Designated Officer (LADO) or children's social care where safeguarding or the law requires it. We don't share information with them routinely.
• We don't sell personal information.

7. Transfers outside the UK

• Vercel may process website data in the United States. Vercel's data processing terms use the EU standard contractual clauses together with the UK International Data Transfer Addendum.
• MailerLite stores our mailing list on servers in the Netherlands. The UK recognises the European Economic Area as providing adequate protection for personal data. MailerLite's data processing terms also use standard contractual clauses with the UK Addendum for transfers elsewhere, for example to MailerLite, Inc. in the United States and to its service providers.
• Pembee's data processing terms provide for standard contractual clauses with the UK Addendum where personal data is transferred outside the UK.
• Microsoft provides our business email (Microsoft 365, currently managed through GoDaddy). Our subscriptions are subject to Microsoft's customer agreement, whose data protection terms use the EU standard contractual clauses together with the UK International Data Transfer Addendum for transfers out of the UK.

To find out more about these safeguards, email hector@kamparoo.co.uk.

8. How long we keep information

• Booking and payment records (who booked, which children were booked for which dates, prices and discounts, payments, refunds and credits, and invoices or receipts): we keep these for 6 years after the end of the financial year in which the booking is completed. Our financial year ends on 31 March. A booking is completed on its last camp day, or on the final payment or refund if later. For example, a booking completed in October 2026 falls in the year ending 31 March 2027, so its records are kept until 31 March 2033 and then deleted within one month. This period doesn't apply to medical or additional-needs information, photos or safeguarding records.
• Records we must keep as an Ofsted-registered childcare provider: registers and attendance records (with the contact details kept for them) are kept for 2 years and then deleted. Records of medicines given and of accidents are kept until the child's 21st birthday, because a personal injury claim can be made on a child's behalf until then. Complaints records are kept for at least 3 years.
• Health and additional-needs information: kept with your child's booking details while your child continues to book with us, so that we can care for them safely, and reviewed when they stop attending. Information that also forms part of a required record (for example, a medicine given) is kept at least as long as that record.
• Safeguarding records: kept until the child's 25th birthday, or longer where there is a continuing reason (for example, where a concern relates to an adult working with children). The booking and payment period above doesn't apply to them.
• Photos: see section 3. We keep a photo only while it is relevant to promoting our current camps. We remove a child's photos from the channels we control (our website and social media accounts) within 5 working days when a parent withdraws permission or objects, and we don't use them in new marketing emails or flyers.
• Enquiries: routine enquiries are deleted no later than 12 months after our last contact with you. Enquiries that lead to a booking become part of the booking record. Complaints are kept as complaints records (above). Safeguarding matters are kept as safeguarding records (above).
• Job applications: if you aren't offered a job, we keep your application for 6 months after our decision. If you join us, it becomes part of your staff record. For DBS checks, we keep the certificate number, the date and the outcome while you work with us and for 6 years after you leave. We don't keep copies of DBS certificates.
• Website hosting data: Vercel keeps request logs for up to 30 days.
• Mailing list: see section 4.

9. Your rights

Depending on the circumstances and the lawful basis we rely on, you may have the right to:

• access your personal information;
• have it corrected or deleted;
• restrict or object to its use;
• have it transferred;
• withdraw consent where we rely on consent.

Email hector@kamparoo.co.uk. We'll respond within one month (longer in some cases, and we'll tell you if so).

10. Complaints

If you're unhappy with how we've handled your information, you can complain to us by emailing hector@kamparoo.co.uk. In line with our Complaints Policy, we will initially address your complaint within 24 hours. We will investigate it, keep you informed and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/

11. Automated decisions

We don't make decisions about you using solely automated processing.

12. Changes to this notice

We'll update this notice when how we handle information changes.