Privacy Policy

• •Parent/guardian information: name, email address, phone number, and home address.
• •Child information: name, date of birth, school year, gender, medical conditions, allergies, dietary requirements, SEND needs, doctor/surgery details, photo permissions, and emergency contact details.
• •Booking and payment information: camp selections, dates, payment method, and transaction records.
• •We only collect what is necessary to safely run our camps and fulfil bookings.

• •To process bookings and manage camp attendance (contract performance — UK GDPR Art. 6(1)(b)).
• •To safeguard children during camp, including medical and emergency care and trip organisation (legal obligation and legitimate interests — Art. 6(1)(c) and (f)).
• •To communicate with you about bookings, announcements, and updates (legitimate interests — Art. 6(1)(f)).
• •Where we rely on consent (e.g. marketing communications or photo permissions), you can withdraw it at any time (Art. 6(1)(a)).

• •All Star Activities does not sell, rent, or pass your personal data — or your child's data — to any third-party marketers, data brokers, or advertisers.
• •Child data is only used internally for trip organisation and medical/safety purposes, and is kept to the absolute minimum required to keep children safe at camp.
• •The only external party that processes your data is our platform provider, Base44, Inc., who acts as our data processor (see below).

• •This website and booking system are built and hosted on the Base44 platform, operated by Base44, Inc. Base44 is our data processor and stores and processes personal data on our behalf.
• •Because Base44, Inc. is based outside the United Kingdom, your personal data is transferred outside the UK for processing and storage. This means your data — and your child's data — may be sent to servers located in countries outside the UK.
• •To protect your data during these international transfers, All Star Activities has put in place an International Data Transfer Agreement (IDTA) with Base44, as required under Part 2 of the Data Protection Act 2018 and UK GDPR. The IDTA ensures appropriate safeguards are in place so your data receives a comparable level of protection when transferred outside the UK.
• You can read Base44's own Privacy Policy, which describes how they handle data as a processor, here: Base44 Privacy Policy ↗
• •If you have questions about international transfers, please contact us using the details below.

• •We retain booking and payment records for as long as legally required for accounting and tax purposes (typically 6–7 years).
• •Child medical and emergency data is kept for the duration of camp attendance and reviewed annually; it is removed when no longer needed unless there is a legal reason to retain it.
• •Marketing consent data is removed if you withdraw consent or after 2 years of inactivity.

• •You have the right to: access your personal data, rectify inaccurate data, erase your data, restrict processing, data portability, and object to processing.
• •You also have the right to withdraw consent at any time where processing is based on consent.
• •If you wish to exercise any of these rights, contact us using the details below.
• •If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

If you have any questions about this Privacy Policy, the data we hold, or wish to exercise your rights, please contact us through the details on our contact section.

For information about cookies used on this site, please see our Cookie Policy.