Privacy policy

Last updated: 28 August 2026  ·  Questions about your data? Email admin@forbesycamps.com.

1. Who we are

Forbesy Camps is a children's holiday camp provider based in Essex, England. We run an Ofsted-registered holiday camp in Great Dunmow, Essex for children aged 3–15.

For the purposes of UK data protection law, Forbesy Camps is the data controller responsible for the personal information we hold about you and your children.

You can contact us at: admin@forbesycamps.com

Forbesy Camps is registered with the Information Commissioner's Office (ICO), the UK's data protection regulator. Our entry on the public register is ZB829495 — you can look it up on the ICO register at any time.

Registered with the ICOData protection register · ZB829495Check us on the public register →

2. What information we collect

We only collect the personal information we genuinely need. This includes:

Website enquiries

When you get in touch by phone, WhatsApp, or email, we collect your name, contact details, and any message you choose to send us. We don't collect any more than we need to respond to you.

Booking and child data

When you book a camp place, your booking — and any information about your child required to provide care and activities safely — is collected and held within our own booking system on this website. Payment is taken securely by PonchoPay (our payment processor). This includes details such as your child's name, age, emergency contacts, and any relevant medical or dietary information you share with us at the time of booking.

Until 28 August 2026, bookings were taken through the iPAL platform, operated by Complete Education Solutions (CES), who acted as our data processor for that information. They had their own privacy practices; please refer to their documentation for full detail if you booked with us before that date. We shared only the minimum data necessary for them to provide the booking service. The booking and child records we needed were carried over into our own system, and iPAL is no longer used for new bookings.

Your account and your family's details (this website)

When you sign in to the parent area of this website and use My family, we hold a record for your family directly, so you do not have to re-enter it each time you book. This includes each child's name and the name you'd like staff to use, their date of birth, gender, school and school year, your relationship to them, whether English is their first language, any medical or additional needs you tell us, their standing permissions, and the emergency contacts you add (name, relationship, phone and address), along with your own contact details and address. You can view, correct or delete any of it yourself on that page at any time.

A photo of your child

We ask for one photo of each child, used only so our staff can identify your child at drop-off and collection — a safeguarding measure to make sure every child leaves with the right adult. It is shown only to Forbesy staff and to you on your own account; it is never shared, published or posted, and it is separate from any permission you give for activity or social-media photos. Our lawful basis is our safeguarding responsibility as an Ofsted-registered provider (legitimate interests). You can replace or remove it at any time, and we delete it when your child's record is deleted.

This family record and photo are held securely in the private, password-protected parent and staff area of this website. Special-category information (such as medical or dietary needs) is held on the basis of your explicit consent, which you can withdraw at any time by editing or deleting the record.

Party enquiries

If you build a party plan on our parties page and send it to us, the form passes on what you entered: your child's name and age, the date, time and location you picked, the number of children, your chosen slot, theme and add-ons, the estimated price, and your mobile number and email address so we can reply.

That form is delivered to our inbox by FormSubmit (formsubmit.co), a third-party form-relay service, which receives those details in order to pass them to us. We use it for this one form only. If you would rather not use it, please send the same details to us directly by phone, WhatsApp or email instead — see our contact page.

Communication preferences

Where you have given us your consent, we may hold your contact details to send you news about upcoming camps, new venues, or early-booking offers. You can withdraw that consent at any time by emailing us at admin@forbesycamps.com.

3. How we use your information and our lawful basis

We use the information we hold only for the purposes set out below:

• Responding to enquiries — so we can answer your questions and help you find the right camp. Lawful basis: legitimate interests (responding to direct contact from you).
• Providing camp places — to run your booking, check your child in, and look after them properly on the day. Lawful basis: performance of a contract (the booking you've made with us).
• Safeguarding and legal obligations — we are required by law and by our Ofsted registration to maintain certain records relating to children in our care. Lawful basis: legal obligation.
• Marketing communications — only if you have given us explicit consent to do so. Lawful basis: consent. You can withdraw consent at any time.

We will never use your personal data for any purpose incompatible with those listed above.

4. Who we share your information with

We do not sell, rent, or trade your personal data. We share data only where necessary:

• iPAL / Complete Education Solutions (until 28 August 2026) — our former booking processor, who managed registrations, payments and on-the-day records for bookings made before that date. Bookings made since are handled directly on this website; see our current payment processor below.
• Our website host and database (Vercel, and our database provider) — the technical infrastructure that serves this website and securely stores the family record and photo described above. They act as our processors and are bound by data processing agreements; the data stays within the UK/EU.
• Our payment provider (PonchoPay) — takes your payment when you book a camp day and confirms it succeeded. Your card, Tax-Free Childcare and voucher details go straight to them and are never seen or stored by this website.
• Our email provider — used to receive and respond to enquiries.
• FormSubmit (formsubmit.co) — relays the party enquiry form on our parties page to our inbox. It receives only what you type into that form, and we use no other form-relay service.
• Authorities if legally required — for example, if we have a safeguarding concern or are required to disclose information by law.

All third parties we work with are required to handle your data securely and lawfully.

5. How long we keep your data

We keep personal data only for as long as is necessary for the purpose it was collected, and in line with our legal obligations.

• Enquiry records — retained for a reasonable period after your enquiry is resolved. [Period to confirm]
• Booking and child records — retention periods are governed by our safeguarding obligations and applicable law. The transfer of booking and child records from iPAL into our own system was completed on 28 August 2026.
• Your family record and your child's photo (this website) — kept while your child attends our camps and deleted when you remove the record; you can edit or delete any of it yourself at any time.
• Marketing consent records — kept until you withdraw consent, then deleted promptly.

When data is no longer needed, we delete or securely destroy it.

6. Your rights

Under UK GDPR you have a number of rights in relation to the personal data we hold about you:

• Right of access — you can ask for a copy of the data we hold about you.
• Right to rectification — you can ask us to correct inaccurate data.
• Right to erasure — in certain circumstances, you can ask us to delete your data.
• Right to restrict processing — you can ask us to limit how we use your data.
• Right to data portability — where applicable, you can ask us to transfer your data to you or another provider.
• Right to object — you can object to processing based on legitimate interests or for direct marketing.
• Rights relating to automated decisions — we do not make automated decisions about you.

To exercise any of these rights, please contact us at admin@forbesycamps.com. We will respond within one month in line with UK GDPR requirements. We may need to verify your identity before we can action your request.

7. Cookies

This website itself uses only minimal, essential cookies required for the site to function (for example, to remember form state during your visit). We do not use tracking or advertising cookies on our own pages.

We also use Vercel Web Analytics and Vercel Speed Insights, run by our hosting provider, Vercel, to measure aggregate visit and performance metrics — these are cookieless and don't identify you.

If this site embeds any third-party content (such as social media feeds, maps, or video players), those third parties may set their own cookies, over which we have no control. Please check their privacy policies for details.

8. Complaints and the ICO

If you are unhappy about the way we have handled your personal data, please get in touch first — we'd genuinely like the chance to put things right. Email us at admin@forbesycamps.com.

You also have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

We are on the ICO's public register of fee payers under reference ZB829495, if you need it when you get in touch with them.