Privacy policy

1.1  Site owners and their staff (our customers): we are the controller of your account details and how you use the system.

1.2  Guests using an app: the camping site named in the app is the controller of personal details you choose to give it through the app, such as joining its mailing list, sending in photos or suggesting an event. We process those details for the site, on its instructions, as its processor. For the app itself, including anonymous usage counts and keeping the app working, we are the controller.

1.3  Sites listed on clbooking.co.uk: CL Booking Limited, a company registered in England and Wales with company number 15232804, whose registered office is at 2 Chalkhill Cottages, Little Somborne, Stockbridge, Hampshire, SO20 6QU (CL Booking), which runs clbooking.co.uk, holds the site information used in those sites’ apps, such as the site’s details, photos, prices, availability, reviews and the owner’s contact details. CL Booking and we are joint controllers of that information for making and running those apps: CL Booking is responsible for collecting it on clbooking.co.uk, and we are responsible for how it is used in the apps. You can contact either company about it. CL Booking’s own privacy policy on clbooking.co.uk explains how it handles your data there.

1.4  If you have a question about details you gave to a site, you can ask the site or us, and we will help or pass your request on.

Guests using an app

• Nothing to use the app. You don’t need an account, and the app doesn’t ask for your name, location or contact details to work.
• Anonymous usage counts: how often the app is opened, which screens are viewed and which links are tapped, sent only as daily totals with no names, contact details or identifiers that follow you. These help the site and us improve the app (legitimate interests). You can switch them off at any time in the app’s Settings.
• If you join a site’s mailing list: your name, email address and (if you give it) phone number, so the site can send you its news (your consent, which you can withdraw at any time).
• If you send in photos: the photos, and your name and email address if you give them, so the site can see and use them as described when you send them (your consent).
• If you suggest an event: the event details, and your name and email if you give them, so the site can check and publish it (legitimate interests of the site in keeping its What’s On up to date).
• Technical data: like every website, our server receives your device’s IP address and browser type when the app loads. We use this only to deliver the app, keep it secure and fix faults (legitimate interests), and keep server logs for a short time.

Site owners and their staff

• Account details: name, email address, password (stored only in scrambled form, which we can’t read), your role and which sites you manage, to provide your account and the Service (contract).
• Business and billing details: your business name, address and contact details, plan, payments and invoices, to provide the Service, take payment and keep accounts (contract and legal obligation).
• Security records: sign-in times, failed sign-in attempts and the IP address they came from, to protect accounts from misuse (legitimate interests).
• Messages you send us, to answer them and improve our support (legitimate interests).

Information about local places

2.1  Apps show public information about local businesses, venues and events, gathered from OpenStreetMap, CL Booking and the places’ own public websites. This is information about businesses, not private individuals. If you are a sole trader or event organiser and want something about you corrected or removed, contact us and we will deal with it promptly.

3.1  Apps store some information on your phone so they work well and work offline: your layout and maps choices, the pages you’ve opened (so they show without a signal), where you were on a page, and the anonymous usage totals waiting to be sent. This is needed for the features you use, except the usage totals, which you can switch off in Settings. Apps do not use advertising or tracking cookies.

3.2  The site owners’ system uses one essential cookie to keep you signed in.

4.1  We never sell personal data or use it for advertising. We share it only with the site concerned (for guest details given to it) and with these service providers, who act for us under contracts that protect the data:

• Hetzner Online GmbH (Germany): hosts our servers, database and backups.
• Resend (USA): sends emails, such as sign-in links and photos sent in to a site.
• Anthropic (USA): our automated reader of public web pages, used to describe sites and find local events. We send it public web page text, not guests’ personal data.
• Our payment provider: takes customers’ payments. We do not see or store full card details.
• CL Booking Limited (UK): our joint controller for apps for sites listed on clbooking.co.uk. We share information about those sites and their apps with each other to make and run them.

4.2  When an app shows a map, a photo or a typeface, your device fetches it directly from the provider, which receives your IP address in the normal way: OpenStreetMap (map images), Unsplash (some photos), Google Fonts (the app’s typeface), unpkg (map software) and CL Booking (some site photos and details). Directions open in the maps app you choose, under that provider’s own privacy policy.

4.3  We may also share data if the law requires it, to protect people’s safety or our legal rights, or with a buyer if our business is sold (who would have to protect it in the same way).

5.1  Our servers are in Germany, which the UK recognises as protecting personal data properly. Where a provider handles data in the USA or elsewhere outside the UK and European Economic Area, we rely on UK adequacy regulations (such as the UK-US data bridge, for certified companies) or the UK International Data Transfer Agreement or Addendum, so that your data stays protected.

• Guest details given to a site (mailing list, photos, suggested events): until the site deletes them, or until 30 days after the site's app ends.
• Anonymous usage counts: kept as totals; they contain no personal data.
• Customer accounts: while the account is open, then deleted within 30 days of it closing.
• Billing and accounting records: 6 years after the end of the financial year they relate to, as the law requires.
• Security records of sign-in attempts: no longer than 90 days.
• Server logs: a few weeks at most.
• Backups: kept for 14 days, then deleted automatically.

7.1  Everything is sent over encrypted connections. Passwords are stored scrambled. Access to data is limited to the people who need it, our servers are kept up to date and backed up daily, and each site’s owners can see only their own site’s data.

8.1  You have the right to: ask for a copy of your data; have it corrected; have it deleted; restrict or object to how it is used (including at any time to direct marketing); take it with you in a common format; and withdraw consent at any time, without affecting what was done before. Some rights have legal limits.

8.2  To use your rights, contact us at Our App Limited, Dovehouse Shott, Smiths End Lane, Royston, Hertfordshire, SG8 8LL, or the site concerned. We will reply within one month. There is no charge.

8.3  If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).

9.1  Apps are for guests of all ages to look at, but mailing lists and sending in photos are for adults. Children under 13 should not send their details through an app.

10.1  We may update this policy. The date at the top shows when it last changed, and we will tell customers about significant changes. Please also see our terms and conditions and data protection terms.