Privacy Policy
Last updated: 19 August 2026
This policy explains what personal data Forbesy Hub (the website you are on now, including the parent pages at /parent) collects, why, and what your rights are under UK GDPR. It does not cover the separate booking system, iPAL — see Camp bookings & children's data below.
Who we are
Forbesy Hub is operated by Forbesy Camps for parents and guardians booking children's holiday camps and parties in Great Dunmow, Essex. For any question about this policy or your data, contact us at admin@forbesycamps.com.
Forbesy Camps is registered with the Information Commissioner's Office (ICO), the UK's data protection regulator, under reference ZB829495. You can look our entry up on the ICO public register at any time.
Registered with the ICOData protection register · ZB829495Check us on the public register →
What we collect, and why
You do not need an account or a login to use this app. You can read every parent page without giving us anything. We only collect the data below, and only when you choose to do one of these things:
| What | Why / legal basis |
|---|---|
| Party enquiry form: birthday child's first name and turning age, party date, preferred start time, location, approximate number of children, theme and add-ons chosen, and your mobile number and/or email address | Sent to admin@forbesycamps.com to arrange your party — legal basis: taking steps at your request to enter a contract, and your consent to submit the form |
| Booking a camp day: each child's first name and age band, the days and session you choose, and your name and email address | To hold the place and create the booking — legal basis: performance of a contract with you. We ask for a first name and an age band only; we do not ask for a surname, a date of birth, or an address at checkout. |
| Paying for a booking: the amount, your email address, and a reference we generate for the payment | Sent to PonchoPay, our payment provider, to take the payment and to match it back to your booking — legal basis: performance of a contract. Payment is taken on PonchoPay's own pages. We never see or store your card, Tax-Free Childcare or voucher details. |
| A one-way scrambled (hashed) form of your IP address when you start a checkout | To stop automated abuse taking camp places off sale — legal basis: our legitimate interest in protecting availability for real families. The address itself is never stored, the hash cannot be turned back into it, it counts only against a ten-minute window, and it is cleared automatically once that window has passed. |
| Usage data (pages visited, general device/browser type) — only if you accept analytics cookies | To understand how the site is used and improve it — legal basis: your consent. See our Cookie Policy |
| Technical error data (e.g. the page you were on, browser/device type, and what went wrong) if something breaks | To find and fix bugs — legal basis: our legitimate interest in keeping the site working |
| A record of the booking and what has been paid on it, kept in our own system | So our team knows who is coming on the day and whether the day is paid for — legal basis: performance of a contract, and our legal obligation to keep business and accounting records. |
We do not sell your data, and we don't use it for advertising.
Camp bookings & your child's information
You can now book and pay for camp days directly in this app. Some bookings are still made through iPAL, a separate booking system operated by Complete Education Solutions under Forbesy Camps' own arrangement with them. iPAL has its own privacy policy — please read it too if you book that way. Wherever a booking starts, the details below end up in the private staff area of this app so our team can look after your child on the day.
To run each camp day, Forbesy staff use a private, password-protected area of this app that is not open to the public. For each child booked on a day, that staff area holds:
- your child's first name and surname, their age band and their school year group, and the session they are booked into
- your name, your email address, and whether the day has been paid for
- their attendance on the day — check-in and dismissal times, any late-stay change, and any note staff need to leave about the day
- allergy, dietary and permission details you gave when booking — including whether you have given permission for photographs, social media, suncream, face painting, plasters, first aid and whether your child is toilet-trained
Health information. Allergy and dietary details are special-category health data under UK GDPR. We hold them so the staff supervising your child know how to keep them safe, and our lawful basis for doing so is your explicit consent, given when you booked (UK GDPR Article 9(2)(a)). You can withdraw that consent, or correct anything in it, at any time by emailing the office — we will delete your child's record from the staff register when you do.
What this app does not hold. We do not store your child's date of birth (it is used once, at import, to work out their school year group, and then discarded), we do not store emergency-contact details or medical histories, and we never see or store your card, Tax-Free Childcare or voucher details — those stay with our payment provider.
How long we keep it. Allergy and permission details are deleted at the end of each camp season — the booking system keeps the original. Attendance records are kept for two years, as childcare law requires. Booking and payment records are kept for as long as our business and accounting obligations require, then deleted.
This information is only ever seen by Forbesy staff and is never shown publicly. This app is intended for use by parents and guardians, not children. We don't knowingly collect data directly from children, and no part of this app lets a child create an account.
Cookies & analytics
We use essential cookies to make the site work, and — only with your consent — optional analytics cookies (PostHog, processed on PostHog's EU cloud) to see how the site is used. That includes a session replay of how pages were used, with all on-screen text and form input masked in your browser before it is sent, and with the pages that show children's or family information excluded from recording altogether. For signed-in staff, this usage data is linked to a staff account number rather than a name or email address. Full details, including how to change your choice, are in our Cookie Policy.
Who we share data with
- formsubmit.co — delivers your party enquiry form to admin@forbesycamps.com by email
- PostHog — analytics, only if you accept cookies (EU-hosted)
- Sentry — error monitoring, when enabled
- PonchoPay — takes your payment when you book a camp day, and tells us it succeeded so we can confirm the place
- Vercel — hosts this website
- iPAL / Complete Education Solutions — the booking system some camp places are still booked through, under Forbesy Camps' own arrangement (see above)
We don't share your data with anyone else, and we don't sell it.
Data retention
We keep party enquiry details only for as long as needed to arrange and deliver your party, plus a reasonable period afterwards for our business records, then delete them. Booking, payment and attendance records are kept as set out under Camp bookings & your child's information above. Analytics data is retained according to PostHog's standard settings for our account.
Your rights
Under UK GDPR, you have the right to: access the personal data we hold about you; have inaccurate data corrected; ask us to delete your data; restrict or object to how we use it; receive a copy of it in a portable format; and withdraw consent at any time (for example, by rejecting analytics cookies). To use any of these rights, email admin@forbesycamps.com.
Changes to this policy
We may update this policy as the app changes. The "Last updated" date at the top shows when it last changed.
Contact & complaints
Questions or concerns about your data? Email admin@forbesycamps.com. If you're not happy with our response, you can complain to the UK's data protection regulator, the Information Commissioner's Office (ICO). Our registration reference is ZB829495.