Privacy Policy

This notice explains how Camp Willingness collects and uses personal data, in line with the General Data Protection Regulation (GDPR) and Maltese data protection law. It is provided to you under Articles 13 and 14 of the GDPR. It is written in plain language so that parents, guardians, and staff can understand what we do with the information we hold.

Who we are

Camp Willingness is a platform operated by Willingness Malta ("Willingness", "we", "us"), registration number P1900, VAT number MT26805030, registered address Willingness Hub, Qolla Street, Żebbuġ, Malta. We use it to run psychosocial camps and related programmes for children, including our summer camps and the Saturday programme, at our locations in Malta and Gozo, including Ħaż-Żebbuġ, Pietà, and Nadur. The service is available at camp.willingness.com.mt.

Willingness Malta is the data controller responsible for the personal data described here. For any data protection matter, including the requests described below, contact us at info@willingness.com.mt.

What personal data we collect, and from whom

Most of the data we hold is provided by camp staff and by parents or guardians, and relates to the children enrolled in our programmes. We collect and process the following.

• Account data: the email address, password (stored only in hashed form by our authentication provider), role, and two-factor authentication setup of each parent, guardian, and member of staff.
• Children's identifying data: name, date of birth, home address, an optional profile picture a guardian may upload, the camp location and group a child is assigned to, and attendance at each session.
• Guardian and contact data: guardian name, relationship to the child, email address, phone number, identity card number, emergency contacts, and the people a guardian has authorised to collect the child, including their names, phone numbers, and identity card numbers, which our staff use to verify identity at pick-up.
• Special-category data (Article 9 of the GDPR): a child's medical conditions and allergies, psychological reports uploaded in support of an enrolment, safeguarding or risk flags and alerts raised by staff, and records of any incident or injury during camp and the care given.
• Assessment data: parent questionnaires completed at the start, middle, and end of a programme, where the camp includes them; check-in scores and notes recorded by camp staff; feedback provided by parents; and, where you have given consent for it, structured wellbeing questionnaires your child completes with the support of our staff.
• Payment and order data: the bookings made through the platform, such as optional camp weeks or Saturday programme sessions, with the child and dates they are for, the amount and date of each payment, and its status and payment reference. Card details are entered on our payment provider's secure page and never reach our systems.
• Lunch orders, where a camp offers lunches: the lunches you choose for your child, the days and how many a day, which lunch was picked for each of them, that you ticked to confirm the refund rule and when, and any refund owed or made.
• Consent records: each photography and medical consent you give or withdraw, captured with the date and time, the IP address, and the browser used, and kept as an immutable record.
• Email preferences and email activity: which of our optional email lists you have joined (new camp announcements, and news and updates) and when you changed that, whether you have stopped our emails about lunches, and, for the emails we send you, whether each one was delivered, opened, bounced or reported as spam, and which links in it were clicked.
• Website usage data, only if you accept optional cookies: the pages you visit on camp.willingness.com.mt, how you arrived (for example from one of our adverts), your device and browser type, and your approximate location worked out from your IP address, and, when you open a camp's booking page, set up an account or pay for a booking, that this happened (the camp, and for a paid booking the amount). In the parent area this is linked to a random reference number for your account, never to your name, your email address, or your child's name or details, although the page addresses recorded can include internal reference numbers.
• Advert click reference, only if you accept optional cookies: if you reach camp.willingness.com.mt from one of our Google adverts, the reference Google adds to the advert's link (a click identifier such as a gclid) and when you clicked. We keep it in your browser for up to 90 days, copy it to your account if you sign up, and attach it to a booking you pay for within those 90 days in a browser where you have said yes.

Children's data is special-category and sensitive. We treat it with heightened care throughout, in how it is stored, who can access it, and how it is shared.

Why we use it, and our lawful basis

We rely on the following lawful bases under the GDPR.

• Performance of the camp service: we process account, enrolment, attendance, assessment, payment, and lunch order data to register a child, take and manage bookings and lunch orders, run the programme safely, monitor progress, and communicate with guardians.
• Explicit consent (Article 9): special-category data, such as medical information and psychological reports, and photography of your child, are processed on the basis of your explicit consent. You can withdraw consent at any time, as described below.
• Legal obligation: where the law requires it, for example in connection with child safeguarding or the keeping of financial and tax records, we process and retain certain records to meet our obligations.
• Legitimate interests: we process limited data to keep the platform secure, to maintain audit logs, to safeguard the welfare of children attending our programmes, to send you one reminder about a booking you started and did not finish, and to email the parents of children booked on a camp about adding lunches for that camp, balanced against the rights of the people concerned.
• Consent (Article 6(1)(a)): our news and new camp emails, which we send only if you ask for them, and optional measurement cookies, the website usage data they collect and the advert click reference. You choose the emails in your profile or when you ask to hear about new camps, and the cookies on our cookie message. You can change either choice at any time, as explained below and in our Cookie Policy.

Booking reminders

If you start booking a camp and the payment isn't completed, we may email you once, usually within a few hours, to say that the booking isn't confirmed and to link you back to the camp's booking page. We send it at most once for each camp, with no prices or offers, and never about a camp that is full or has no dates left to book. Every reminder has a "Stop booking reminders" link; using it stops them for good and does not affect the other emails about your child's camps.

News and new camp emails

You can ask us to email you when a new camp opens for booking, and you can ask for occasional news from Willingness about our camps and our work with children and families. We send these only to people who have asked for them. Each list is separate, and you can join or leave either one in your profile.

Every one of these emails has a link to stop that list. Using it stops those emails for good, and you can also ask us at info@willingness.com.mt. You can object to these emails at any time, and when you do, we stop. Stopping them does not affect the emails about your child's camps, such as progress reports, notices and receipts.

We choose who receives an email by the list you joined and, where it is relevant, by the camps your family has booked (for example, families from past camps, or families of one camp). Our marketing team writes and sends these emails. They see how many people an email will reach, never your name, your email address or anything about your child.

Like our other emails, these are sent through Brevo, which records whether each email was delivered and opened (using a small image in the email) and which links in it were clicked. We use this to see how our emails are received, looking at it in totals, and to stop sending these emails to an address that has recently bounced or has reported one of our emails as spam.

Lunches

Some camps offer lunches prepared by Maypole, which you can add to your child's camp days after booking. Each lunch is picked at random from the ones you chose, and our camp staff see which lunch each child gets each day, so that they can hand out the right one.

We tell Maypole only how many of each lunch to prepare for each camp on each day, and our team collects them. We never give Maypole your name, your child's name or anything else about you or your child. Our accounts team receives the daily totals and their value, also without names. Maypole is responsible for the food, the menu and its allergen information; our camp team hands the lunches out.

When a camp offers lunches, our camp team may add an "Add lunches" button to the notices it sends to the families of that camp, and our marketing team may email the parents of children booked on that camp who can still add lunches, whether or not you joined one of our email lists. The marketing team's lunch emails are only about lunches for your child's camp. Each one has a "Stop lunch emails" link; using it stops the marketing team's emails about lunches for good, free of charge. It does not affect the notices our camp team sends to the families of your child's camp, which still reach you as they are written, including any "Add lunches" button. You can also ask us to stop the marketing team's lunch emails at info@willingness.com.mt.

How progress reports are prepared

Our staff, with the help of secure systems, prepare a first draft of each child's progress report from the assessment data that staff and parents have recorded. How often a report is prepared follows the child's attendance during the programme. Every draft is reviewed, edited where needed, and approved by senior staff before it is sent to a parent. No report reaches a parent without this human review.

We do not make decisions that produce legal effects, or similarly significant effects, on you or your child by solely automated means. There is always a person in the loop. This means the safeguard against solely automated decision-making in Article 22 of the GDPR is respected.

Who can see the data, and who we share it with

Access inside the platform is restricted on a need-to-know basis.

• Camp staff can see the children in the location or group they are assigned to.
• Heads of school can see data for the camp locations they are responsible for.
• Our marketing team can send news and new camp emails to the parents who asked for them, and emails about lunches to the parents of children booked on a camp that offers them, unless they have stopped lunch emails. They see how many people an email will reach, never names, email addresses or anything about a child.
• Administrators can oversee the platform as needed to operate the service.

We do not sell personal data. We share it only with the service providers (processors) we need to run the platform, each bound by a data processing agreement.

• Supabase: our database, authentication, and file storage, hosted in the European Union.
• Vercel: hosting of the application.
• Brevo: sending our email, such as account and notification messages, receipts, booking reminders, emails about lunches, and the news and new camp emails you have asked for. Brevo records whether each email is delivered and opened and which links are clicked.
• Google: secure cloud services that support the preparation of progress reports, running on Google Cloud infrastructure within the European Union; every report is reviewed by senior staff before release.
• Revolut: processing of card payments for bookings and lunches. Card details are entered on Revolut's secure payment page and are never stored on our systems.

With your consent only, we also use Google Analytics, a measurement tool provided by Google Ireland Limited, on our public pages and in the parent area. It shows us how families find and use the site and which of our adverts lead to a booking, and it lets us show our adverts to people who have visited or used the site. When an account is set up or a booking is paid, Google Analytics records it and we pass this to Google Ads so that we can see which adverts worked. Lunch payments are not recorded as bookings and are not passed to Google Ads. If you came from one of our Google adverts and said yes, we also send Google Ads the advert click reference of a booking you paid for, with the date and amount of the booking and nothing else about you or your child. For advertising, Google acts as a separate controller and may also use this data for its own purposes, as Google explains at policies.google.com/technologies/partner-sites. We do not load any advertising tag or pixel on the site (Google Analytics is the only Google code), and no measurement runs in staff areas. Until you say yes, Google Analytics is not loaded, no advert click reference is kept, and nothing is sent to Google. Our Cookie Policy gives the detail.

International transfers

The report preparation described above runs on Google Cloud infrastructure located within the European Union, so in the ordinary course this processing does not leave the EU. Google is a company headquartered outside the European Economic Area; if any personal data is nevertheless transferred outside the EEA, for example in limited support situations, the transfer is protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses, so that your data continues to receive a level of protection consistent with the GDPR.

Website usage data from Google's measurement tools may be processed outside the EEA, including in the United States. Google LLC is certified under the EU-US Data Privacy Framework, and Standard Contractual Clauses apply where that framework does not.

How we protect your data

We apply technical and organisational measures appropriate to the sensitivity of the data we hold.

• Encryption of data at rest, including psychological reports, which are kept in a non-public storage bucket and reached only through short-lived signed links.
• Row-level security in the database and server-side authorisation checks, so requests are validated before any data is returned.
• Support for two-factor authentication on staff accounts.
• Role-based access, so staff only see the data relevant to their role and camp location.
• Audit logging of access to sensitive records, consent changes, verifications, and guardian links.
• Data minimisation, so we collect and keep only what we need.

How long we keep it

We keep personal data only for as long as it is necessary for the purposes set out above. Routine assessment and report data is reviewed three years after a child's last camp activity and anonymised or deleted unless there is a specific reason to keep it. Some safeguarding records may be kept for longer where we have a legal obligation to retain them, and financial records connected to payments are kept for as long as Maltese tax and accounting law requires. When data is no longer needed it is securely deleted or anonymised. Website usage data collected with your consent is kept in Google Analytics for no longer than 14 months, and the lists we use to show our adverts to people who have visited or used our site keep a person for no longer than 18 months. An advert click reference is kept in your browser for no longer than 90 days, and on your account and on a booking for no longer than 90 days after the click, after which we delete it. Your email preferences are kept with your account, together with a record of when you changed them, so that we can show what you chose. Lunch orders are kept with the payment they belong to, as part of those financial records.

Children's data

This platform exists to support children, and most of the data it holds is about children. We treat all of it as special-category data and apply heightened care to how it is stored, accessed, and shared. Consent to process a child's special-category data, and consent for photography, is given by the child's parent or guardian, who also exercises the rights below on the child's behalf.

Your rights

Under the GDPR you have the following rights in relation to your own data and, as a parent or guardian, the data of the child in your care.

• Access: ask for a copy of the personal data we hold.
• Rectification: ask us to correct data that is inaccurate or incomplete.
• Erasure: ask us to delete data, where there is no overriding legal reason to keep it.
• Restriction: ask us to limit how we use your data in certain circumstances.
• Portability: receive certain data in a structured, commonly used, machine-readable format.
• Objection: object to processing we carry out on the basis of legitimate interests, and object at any time to our news and new camp emails and our marketing team's emails about lunches. When you object to those emails, we stop sending them. Notices from our camp team to the families of your child's camp are not affected.
• Withdraw consent: where we rely on your consent, withdraw it at any time. Withdrawal does not affect any processing carried out before you withdrew.

To exercise any of these rights, contact us at info@willingness.com.mt. We will respond within the timeframes set by the GDPR.

You also have the right to lodge a complaint with the Maltese supervisory authority, the Information and Data Protection Commissioner (IDPC), Level 2, Airways House, High Street, Sliema SLM 1549, Malta, at idpc.org.mt, if you believe your data has not been handled properly.

Changes to this notice

We may update this notice from time to time. Where changes are material we will make the updated notice available and, where appropriate, ask you to review it again.

Contact

For any question about this notice or about your data, contact us at info@willingness.com.mt.

Last updated 23 October 2026.