Privacy Policy - CampOrganizer Family App

Effective date: 16 October 2026
Applies to: CampOrganizer: Family mobile app and the associated Family web experience.

This notice supplements the CampOrganizer General Privacy Policy.

1. About Family and who we are

CampOrganizer: Family helps authorized parents and guardians follow program information for children in their care. Depending on what a camp or other organization enables, Family may show enrollment, schedules, activities, relevant communications, photos or videos, forms and other program information.

Family is an adult-facing service for authorized parents and guardians, not an application for children to operate directly.

CampOrganizer APP GmbH
Diesterweggasse 1/1A, 1140 Vienna, Austria
Privacy: gdpr@camporganizer.app
Support: support@camporganizer.app
https://camporganizer.app

2. Who controls the information?

The camp, school or youth program operating the relevant session ordinarily acts as data controller for the family, participant and program records it manages. CampOrganizer provides the software as a data processor, subject to its contractual and legal obligations. For our own business enquiries, direct support records, certain security processing and legal obligations, CampOrganizer may act as an independent controller.

A participating organization determines the permitted use, access, legal basis and appropriate retention of its records. Contact the organization for questions about a child’s registration, program information or the people authorized to access it.

3. Information Family may process

Different organizations enable different functions. Relevant information may include:

• Parent or guardian account: name, email address, optional phone, language, profile photo, login and identity-provider identifiers, session memberships, access permissions and authorization status.
• Child and family relationships: child names, ages or dates of birth, guardian links, emergency contacts, enrollment and session details relevant to the authorized adult.
• Program information: schedules, events, teams, attendance or check-in information, permitted activities, forms, agreements, requested responses, invoices or booking references if applicable.
• Communications: authorized messages to staff or program administrators, replies, attachments and program notifications.
• Media: photographs, videos or documents the organization makes available to the authorized recipient. A parent who downloads or shares content outside CampOrganizer is responsible for doing so lawfully and respectfully.
• Sensitive participant information where specifically permitted: health, allergy, accessibility, medication or emergency details entered by or made available to an authorized parent or guardian. Access is limited by role and field-specific permissions.
• Technical information: IP address, device/app information, authentication and security events, installation and notification identifiers, crash information and performance diagnostics.

Some records are entered by the participating organization or another authorized adult, rather than collected directly from the child. We do not use children’s program information to create third-party advertising profiles.

4. Purposes and lawful bases

Family information is processed to authenticate authorized adults, link them to the appropriate participant and organization, display program information, communicate with permitted staff, support authorized forms or requests, notify families, provide technical support and protect the platform.

The responsible organization determines its Article 6 GDPR legal basis and, where relevant, the Article 9 condition for sensitive information. CampOrganizer’s own-controller processing may rely on contract, legal obligation, proportionate legitimate interests or consent for specific optional purposes. Agreement to Terms of Use does not automatically constitute consent for every kind of processing.

5. Access to a child’s information

A person is not entitled to every child record merely because they know the child’s name or are a platform user. Family access depends on the relevant guardian/participant relationship, membership, roles, permissions and organizational configuration. Certain information is restricted to program professionals or safeguarding personnel and may not be visible in Family.

An account that is no longer authorized should not continue to be used to view program records. Contact the organization if a guardian relationship is inaccurate or if you believe access is inappropriate.

6. Mobile SDKs, diagnostics and providers

Family uses CampOrganizer’s primary EU-hosted infrastructure, including Hetzner and self-hosted MongoDB. Depending on actual use and enabled features, supporting providers include:

• Google Firebase Cloud Messaging: push delivery, including installation identifiers and push notification tokens. Certain installation identifiers may be generated before login.
• Sentry: error, crash and performance diagnostics; the mobile integration may initialize before authentication.
• Google reCAPTCHA Enterprise: request/device signals for fraud and automated-login protection during relevant authentication actions.
• Google Sign-In / Sign in with Apple: identity information and authentication tokens if the user selects an offered provider.
• Cloudflare: network/security processing and request metadata.
• MailerSend: transactional account or service email.
• YouTube or Vimeo: limited connection and playback information where an authorized external video is opened.
• Stripe: payment processing if an enabled transaction uses it.

Family does not use mobile behavioral-advertising or advertising-attribution SDKs. We do not sell family or participant personal data.

Our primary stored program records are located in the EU. Some auxiliary service providers may process certain data elsewhere; where applicable, GDPR international-transfer safeguards are used. See the General Privacy Policy for more information.

App permissions may be requested for notifications, selecting images or files, camera or audio capabilities when relevant to an enabled function. Having a permission available does not mean it is always used. The Family web app may use necessary session storage and externally embedded media can process technical information.

7. Children and safety

Family may show records about children who are too young to use Explorer. This is a normal part of authorized adult administration of camps and is distinct from allowing a child to log in independently. Personal information about a child should be used only for the authorized program purpose.

If an activity, image or message creates a safeguarding concern, contact the responsible program’s safeguarding personnel. You may also contact support@camporganizer.app. A message sent or photo uploaded within the service may be visible to the authorized people involved, including staff managing relevant safety matters.

8. Security, retention and deletion

We use authenticated sessions, scoped access permissions, protected connections, controls over sensitive fields and relevant security monitoring. CampOrganizer operates an ISO/IEC 27001:2022-certified information security management system; certificate and scope details: https://camporganizer.app/platform/trust/.

The organization determines retention for its operational records according to purpose, contract and law. Records relating to enrollment, communication, media, health, financial matters and security may have different periods and starting points. There is no universal retention period for all Family information. Deletion or anonymization is assessed under the applicable procedures and may require verified manual steps. Some limited records and protected backup copies may be retained where legally justified and for an applicable period.

An authorized adult can request account deletion using the relevant in-app request option where offered, or by contacting support@camporganizer.app. Requests can also be initiated without an app through https://camporganizer.app/legal/how-to-delete/. Requesting deletion of an adult’s login is distinct from the legal status of a child’s program records held by the organization. An in-app request does not itself guarantee immediate erasure of all information.

9. Your privacy rights

Subject to applicable law, you may request access, correction, erasure, restriction, objection, portability or withdrawal of consent where relevant. You may exercise rights on behalf of a child when legally authorized, taking account of that child’s own rights. We may require proportionate verification of identity or guardian authority.

For organization-controlled records, contact the organization or ask us to route the request. For CampOrganizer-controlled information, email gdpr@camporganizer.app. You can complain to a competent supervisory authority, including the Austrian Data Protection Authority: https://www.dsb.gv.at.

10. Updates

We may update this notice as services or processing change and will provide additional notice where legally required. The effective date above identifies this version.

CampOrganizer APP GmbH — gdpr@camporganizer.app · support@camporganizer.app