Data Processing Agreement (DPA)

1. Parties

This Data Processing Agreement is entered into between you, the camp operator ("Controller"), and TanSarK Ltd, trading as CampVesta™ ("Processor", company registered in England & Wales, ICO Registration Number ZB251076).

2. Subject matter & duration

The Processor processes personal data on behalf of the Controller for the duration of the active subscription to the CampVesta platform.

3. Nature & purpose

Processing is limited to: providing camp and after-school club management functionality, including staff scheduling, child registrations, attendance, financial tracking, communications and reporting.

4. Categories of data

• Staff: name, contact details, role, qualifications, availability, clock-in records.
• Children: name, age, parent contact, emergency contact, medical and consent notes.
• Operational data: sites, camps, sessions, attendance records.

5. Sub-processors

The Processor uses vetted infrastructure sub-processors (cloud hosting, database, email delivery). A current list is available on request from privacy@campvesta.com.

6. Security measures

The Processor maintains row-level security, encryption in transit (TLS), encryption at rest, role-based access control, audit logging, and regular backups.

7. Data subject rights & deletion

The Processor will assist the Controller in responding to data subject requests. Operator-initiated deletion within the platform removes records on the same day, subject to backup retention windows of up to 30 days.

8. International transfers

Where personal data is transferred outside the UK or EEA, the Processor relies on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses as appropriate.

9. Contact

To request a signed counterpart of this DPA, contact privacy@campvesta.com.