Privacy Policy - CampOrganizer Counselor App

Effective date: 16 October 2026
Applies to: CampOrganizer: Counselor mobile application and relevant staff-facing CampOrganizer services.

This notice supplements the CampOrganizer General Privacy Policy.

1. About Counselor

CampOrganizer: Counselor is intended for authorized adult staff members serving camps, educational programs and youth activities. Depending on a staff member’s assignment and the functions enabled by the organization, the app may show rosters, schedules, activities, attendance, communications, operational forms and other information required for the program.

CampOrganizer APP GmbH
Diesterweggasse 1/1A, 1140 Vienna, Austria
Privacy: gdpr@camporganizer.app
Support: support@camporganizer.app

2. Controller and processor roles

The organization employing or engaging counselors ordinarily acts as data controller for staff, participant and program records. It decides why information is processed, the lawful basis, who may access it, the relevant permissions and retention rules. CampOrganizer ordinarily acts as its data processor. CampOrganizer may separately be a controller for its own business correspondence, direct service support, certain security processing and legal duties.

Staff members should also refer to their organization’s data protection, safeguarding and confidentiality instructions.

3. Categories of data

According to the staff member’s role, assignment and enabled functions, Counselor may process:

• Staff identity and authorization: name, contact details, profile photo if supplied, account identifiers, organization, assigned programs, roles and relevant security credentials or events.
• Participant data needed for duties: names, teams, attendance, activity assignments, events, operational instructions and permitted family contact information.
• Special-category information where authorized: relevant health, allergy, medication, accessibility or safeguarding details needed for a lawful operational purpose. Access is restricted and not automatically provided to all counselors.
• Communications and materials: permitted messages, group-context communications, photos, files, operational notes or report details submitted or read in authorized workflows.
• Technical data: IP address, device/OS/app characteristics, authentication logs, installation and push tokens, error and performance diagnostics, security events and support requests.

Some fields contain data about children of any age. A child’s eligibility for an Explorer account does not affect an organization’s ability to maintain properly authorized care or safety records in adult-facing services.

4. Purposes and lawful basis

Counselor processing is used to authenticate staff and enforce permissions; provide approved schedules and rosters; manage attendance and relevant assignments; support permitted communications; administer events and operational tasks; handle authorized safeguarding or support matters; deliver notifications; and maintain security and reliability.

The organization determines the legal basis under Article 6 GDPR and, where special-category data is required, an applicable Article 9 condition. Relevant grounds depend on circumstances and may include applicable contract, legal obligation, legitimate interests or valid consent. CampOrganizer uses appropriate grounds for its separate controller activities. Accepting Terms of Use is not blanket consent to all processing.

5. Access restrictions and child safety

Access is based on the organization, session, assigned role, team, participant relationship and applicable information classification. An ordinary staff role does not grant unrestricted access to all child records. Separate authorization may be required for more sensitive fields, incident records or direct communication with children.

The platform’s relevant chat controls restrict participant-to-participant direct messages and staff-to-child contact to authorized relationships or assigned roles. Communications may be available to permitted program administrators or safeguarding reviewers where necessary and lawful. Users must not copy or distribute participant records outside authorized duties. Suspected abuse or privacy violations should be reported through the program’s designated safeguarding process or to support@camporganizer.app.

Counselor is designed for staff, not for children. Organizations are responsible for assigning accounts and roles to appropriately authorized personnel.

6. Technical services and data recipients

Primary program information uses Hetzner-hosted EU infrastructure and self-hosted MongoDB. The Counselor app or its connected services may use:

Service	Purpose
Firebase Cloud Messaging	Push notifications, app installation and device/push identifiers
Sentry	Crash reports, errors and performance diagnostics
Google reCAPTCHA Enterprise	Device/request protection for applicable sign-in and authentication requests
Google or Apple identity providers	Optional sign-in when selected
Cloudflare	Network and security handling
MailerSend	Transactional service email
YouTube / Vimeo	External instructional videos where enabled
Stripe	Payments if relevant to a separately enabled workflow

Support and safety reports may be handled in CampOrganizer-operated, self-hosted support and internal reporting systems.

Some technical services initialize or collect technical information before sign-in. The app may request camera, files, photos, microphone or notification permissions for enabled functions; the availability of a permission does not mean that the function is always used.

Counselor does not use mobile behavioral-advertising or advertising-attribution SDKs. We do not use participant records for third-party targeted advertising. Primary stored program data is hosted in the EU, but limited processing by supporting providers may take place outside the EEA under applicable transfer safeguards. More information is in the General Privacy Policy.

7. Security

CampOrganizer uses authenticated access, scoped authorization, protected communications, selected encryption controls for classified information, relevant audit/security events and support processes. The company operates an ISO/IEC 27001:2022-certified information security management system; details and scope: https://camporganizer.app/platform/trust/.

Security controls reduce risks but do not mean every user can see every record or that any system can guarantee complete security.

8. Retention and account deletion

Staff accounts and organization-controlled program records are retained according to the applicable business purpose, the responsible organization’s instructions, session or contractual retention rules and legal obligations. Revoking a staff login does not in itself erase the participant and program records that the organization remains entitled or required to hold.

Participant-related datasets are reviewed for deletion or anonymization under the applicable post-session retention arrangements. Certain steps may require manual processing. Accounting, consent, legally required safeguarding, security and backup records can follow separate lawful retention criteria.

To request deletion of your account or personal information, use an in-app request option where available, or visit https://camporganizer.app/legal/how-to-delete/. You can submit a request by emailing support@camporganizer.app or gdpr@camporganizer.app without using the app. Requests are reviewed and may require identity checks and coordination with the relevant organization. A request is not itself immediate removal of every organization-controlled record.

9. Your rights and contact

Subject to applicable law, you may request access, correction, erasure, restriction, portability, objection and withdrawal of consent where relevant. Contact the organization about program records under its control; contact gdpr@camporganizer.app for separate CampOrganizer-controlled records or help with routing the request. You may complain to a competent supervisory authority, including https://www.dsb.gv.at in Austria.

We may update this notice to reflect changes to functions, providers and privacy practices, providing further notice where required.

CampOrganizer APP GmbH — gdpr@camporganizer.app · support@camporganizer.app