Terms & Conditions

These Terms & Conditions ("Terms") govern your access to and use of the CampVesta platform ("Service"). By signing in or registering an account you agree to these Terms on behalf of yourself and the organisation you represent ("Operator").

CampVesta is an operational platform for holiday and summer camp providers. It supports site, camp, staff, module and child-registration management. CampVesta is a data processor acting on the Operator's instructions; the Operator is the data controller for all child, parent and staff records uploaded to the platform.

• Maintain a lawful basis (consent, contract or legitimate interest) for every record entered.
• Hold and demonstrate parental consent before storing any child's data.
• Perform DBS / background checks on staff in line with local safeguarding law.
• Keep account credentials secure and assign roles on a least-privilege basis.
• Notify CampVesta of suspected unauthorised access within 24 hours.

You may not use CampVesta to store data unrelated to the lawful operation of a camp, to harass any individual, to attempt to bypass access controls, to reverse-engineer the platform, or to upload malicious content.

Medical notes, consent notes and safeguarding fields are treated as sensitive personal data. Access is restricted to users with the Super Admin or Site Manager role. Operators must minimise the data collected, retain it only for the duration required, and delete it at the end of the camp season unless legally required to keep it longer.

• UK & EU (UK GDPR / EU GDPR): lawful basis, data-subject rights, breach notification within 72 hours, and data-processing records are supported by Operator workflows on the platform.
• United States (COPPA / state laws): Operators must obtain verifiable parental consent before collecting data from under-13s; CampVesta provides consent-note fields for this evidence.
• Canada (PIPEDA / Law 25 in Quebec): Operators must provide clear notice and purpose limitation; data export tooling is available on request.
• Australia (Privacy Act / APPs): APP 1, 5 and 11 obligations are supported via role-based access and audit-friendly logs.
• UAE (PDPL Federal Decree 45/2021): data-subject access, correction and deletion can be actioned through Operator admin tools.
• Other jurisdictions: Operators remain responsible for compliance with local children's privacy and education-sector regulations.

CampVesta and all related trademarks, software and documentation are the property of the CampVesta provider. Operators retain ownership of the data they upload.

CampVesta aims for high availability but does not guarantee uninterrupted access. Planned maintenance will be communicated where reasonably practicable.

To the maximum extent permitted by law, CampVesta is not liable for indirect or consequential losses, including loss of profits, goodwill, data or business opportunity. Nothing in these Terms limits liability for death, personal injury, fraud or any liability that cannot lawfully be excluded.

Either party may terminate access for material breach. On termination, Operator data will be exportable for 30 days and then permanently deleted unless legally required to be retained.

Material changes will be notified by email or in-app at least 14 days before they take effect.

For questions about these Terms, contact your Operator administrator, who can reach the CampVesta team through the platform support channel.