Privacy policy

LOCKIN Camps, referred to as LOCKIN, we, us or our in this policy, organises focused building camps and operates the website at lockin.camp. LOCKIN is the controller of the personal information described in this policy.

Questions about privacy can be sent to apply@lockin.camp.

We may collect the following information:

• Your name, email address and any other contact details you give us.
• Your reservation details, including the camp and room category you choose, plus the onboarding information you provide after booking.
• Messages, reservation status and other correspondence between you and LOCKIN.
• If you book, payment and transaction records, billing information and information needed to organise your accommodation and participation. Our payment provider processes full card details. We do not keep them.
• Information you choose to provide about diet, accessibility, health, emergency contacts or other needs relevant to a safe camp.
• Basic technical information created when you use the site, such as internet protocol address, browser, device, timestamps, referring page and security logs.

We normally receive this information directly from you. We may also receive booking or payment confirmations from suppliers we use to run the camp.

UK data protection law requires us to have a lawful reason for each use.

Where we rely on legitimate interests, we consider the benefit to LOCKIN and participants, the likely effect on you and whether there is a less intrusive way to achieve the same result. You can object to this use by contacting us.

We do not use solely automated decisions that have a legal or similarly significant effect on you, and we do not sell personal information.

Health, accessibility, dietary or similar information can reveal sensitive details. We ask for it only when it is relevant to your safety or participation, restrict who can see it and normally rely on your explicit consent. In an emergency, we may use it to protect your vital interests. You can withdraw consent, although that may limit what we can safely provide.

We share information only where it is reasonably needed, including with:

• Supabase, which hosts our reservation and camp database.
• Resend, which sends reservation and other transactional emails.
• Stripe, which provides our secure payment checkout, and our booking and website service providers.
• Accommodation, workspace, catering, activity and emergency providers where they need details to deliver or safely support the camp.
• Professional advisers, insurers, regulators, courts or law enforcement where required.
• A buyer or successor if LOCKIN is reorganised or transferred, subject to appropriate confidentiality and data protection safeguards.

Suppliers acting for us may only use information under our instructions. Some camp suppliers act as separate controllers and will provide their own privacy information where relevant.

Camps take place outside the United Kingdom and some suppliers may process information in other countries. Where UK data protection law requires it, we use a recognised adequacy decision or approved contractual safeguards and assess whether the information will be protected in practice. Contact us if you would like more information about a particular transfer.

• Incomplete reservation records are normally kept for up to 18 months so we can answer questions, prevent duplicate bookings and support a later camp where you ask us to.
• Booking, contract and payment records are normally kept for seven years after the end of the camp for tax, accounting and legal purposes.
• Health, dietary and accessibility details are normally deleted within 90 days after the camp, unless an incident, insurance matter or legal duty requires longer retention.
• Marketing details are kept until you unsubscribe or we no longer need them. We may retain a minimal suppression record so we remember not to contact you.
• Security logs are kept only as long as reasonably needed to investigate and prevent abuse.

We may keep information for longer where a dispute, legal claim or regulatory requirement makes that necessary. We then restrict it to that purpose.

The current public site does not use advertising cookies or nonessential analytics cookies. Our hosting and security providers may process device and network information needed to deliver and protect the site. If we introduce nonessential cookies, we will explain them and ask for consent before they are used.

Depending on the circumstances, you can ask for access to your information, correction, deletion, restriction, transfer to another provider or an objection to how we use it. You can withdraw consent at any time. Withdrawing consent does not make earlier use unlawful.

Email apply@lockin.camp to exercise a right. We may need to confirm your identity. We normally respond within one month and do not charge unless a request is manifestly unfounded or excessive.

Start with us at apply@lockin.camp. We will take the issue seriously and try to resolve it promptly.

You can also complain to the UK Information Commissioner at ico.org.uk, or to the data protection authority where you live or work.

We may update this policy when our camps, suppliers or legal duties change. Material changes will be highlighted on this page and, where appropriate, sent directly to you.