Privacy Policy

This notice explains how Camp Willingness collects and uses personal data, in line with the General Data Protection Regulation (GDPR) and Maltese data protection law. It is provided to you under Articles 13 and 14 of the GDPR. It is written in plain language so that parents, guardians, and staff can understand what we do with the information we hold.

Who we are

Camp Willingness is a platform operated by Willingness Malta ("Willingness", "we", "us") to run psychosocial summer camps and related programmes for children at our camp locations in Malta and Gozo, including Ħaż-Żebbuġ, Pietà, and Nadur. The service is available at camp.willingness.com.mt.

Willingness Malta is the data controller responsible for the personal data described here. For any data protection matter, including the requests described below, contact us at camp@willingness.com.mt.

What personal data we collect, and from whom

Most of the data we hold is provided by camp staff and by parents or guardians, and relates to the children enrolled in our programmes. We collect and process the following.

• Account data: the email address, password (stored only in hashed form by our authentication provider), role, and two-factor authentication setup of each parent, guardian, and member of staff.
• Children's identifying data: name, date of birth, home address, the camp location and group a child is assigned to, and attendance at each session.
• Guardian and contact data: guardian name, relationship to the child, email address, phone number, emergency contacts, and the people a guardian has authorised to collect the child.
• Special-category data (Article 9 of the GDPR): a child's medical conditions and allergies, psychological reports uploaded in support of an enrolment, and safeguarding or risk flags and alerts raised by staff.
• Assessment data: parent questionnaires completed at the start, middle, and end of a programme; weekly check-in scores and notes recorded by camp staff; and weekly feedback provided by parents.
• Consent records: each photography and medical consent you give or withdraw, captured with the date and time, the IP address, and the browser used, and kept as an immutable record.

Children's data is special-category and sensitive. We treat it with heightened care throughout, in how it is stored, who can access it, and how it is shared.

Why we use it, and our lawful basis

We rely on the following lawful bases under the GDPR.

• Performance of the camp service: we process account, enrolment, attendance, and assessment data to register a child, run the programme safely, monitor progress, and communicate with guardians.
• Explicit consent (Article 9): special-category data, such as medical information and psychological reports, and photography of your child, are processed on the basis of your explicit consent. You can withdraw consent at any time, as described below.
• Legal obligation: where the law requires it, for example in connection with child safeguarding, we process and retain certain records to meet our obligations.
• Legitimate interests: we process limited data to keep the platform secure, to maintain audit logs, and to safeguard the welfare of children attending our programmes, balanced against the rights of the people concerned.

How progress reports are prepared

Our staff, with the help of secure systems, prepare a first draft of each child's weekly progress report from the assessment data that staff and parents have recorded. Every draft is reviewed, edited where needed, and approved by senior staff before it is sent to a parent. No report reaches a parent without this human review.

We do not make decisions that produce legal effects, or similarly significant effects, on you or your child by solely automated means. There is always a person in the loop. This means the safeguard against solely automated decision-making in Article 22 of the GDPR is respected.

Who can see the data, and who we share it with

Access inside the platform is restricted on a need-to-know basis.

• Camp staff can see the children in the location or group they are assigned to.
• Heads of school can see data for the camp locations they are responsible for.
• Administrators can oversee the platform as needed to operate the service.

We do not sell personal data. We share it only with the service providers (processors) we need to run the platform, each bound by a data processing agreement.

• Supabase: our database, authentication, and file storage, hosted in the European Union.
• Vercel: hosting of the application.
• Brevo: sending transactional email, such as account and notification messages.
• Google: secure cloud services that support the preparation of progress reports, which are always reviewed by senior staff before release.

International transfers

Google is established outside the European Economic Area. Where personal data is processed by Google for the report preparation described above, the transfer is protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses, so that your data continues to receive a level of protection consistent with the GDPR.

How we protect your data

We apply technical and organisational measures appropriate to the sensitivity of the data we hold.

• Encryption of data at rest, including psychological reports, which are kept in a non-public storage bucket and reached only through short-lived signed links.
• Row-level security in the database and server-side authorisation checks, so requests are validated before any data is returned.
• Mandatory two-factor authentication for all staff accounts.
• Role-based access, so staff only see the data relevant to their role and camp location.
• Audit logging of access to sensitive records, consent changes, verifications, and guardian links.
• Data minimisation, so we collect and keep only what we need.

How long we keep it

We keep personal data only for as long as it is necessary for the purposes set out above. Routine assessment and report data is anonymised three years after a child's last camp activity. Some safeguarding records may be kept for longer where we have a legal obligation to retain them. When data is no longer needed it is securely deleted or anonymised.

Children's data

This platform exists to support children, and most of the data it holds is about children. We treat all of it as special-category data and apply heightened care to how it is stored, accessed, and shared. Consent to process a child's special-category data, and consent for photography, is given by the child's parent or guardian, who also exercises the rights below on the child's behalf.

Your rights

Under the GDPR you have the following rights in relation to your own data and, as a parent or guardian, the data of the child in your care.

• Access: ask for a copy of the personal data we hold.
• Rectification: ask us to correct data that is inaccurate or incomplete.
• Erasure: ask us to delete data, where there is no overriding legal reason to keep it.
• Restriction: ask us to limit how we use your data in certain circumstances.
• Portability: receive certain data in a structured, commonly used, machine-readable format.
• Objection: object to processing we carry out on the basis of legitimate interests.
• Withdraw consent: where we rely on your consent, withdraw it at any time. Withdrawal does not affect any processing carried out before you withdrew.

To exercise any of these rights, contact us at camp@willingness.com.mt. We will respond within the timeframes set by the GDPR.

You also have the right to lodge a complaint with the Maltese supervisory authority, the Information and Data Protection Commissioner (IDPC), at idpc.org.mt, if you believe your data has not been handled properly.

Changes to this notice

We may update this notice from time to time. Where changes are material we will make the updated notice available and, where appropriate, ask you to review it again.

Contact

For any question about this notice or about your data, contact us at camp@willingness.com.mt.

Last updated 11 June 2026.