Privacy policy

This Privacy Notice explains:

• What personal data we collect
• Why we collect it
• Our lawful bases for using it
• How we store and protect it
• Who we share it with
• How long we keep it
• Your rights under UK GDPR and the Data Protection Act 2018

This notice covers all data collected through:

• Chamboree booking systems
• Staff and volunteer registration systems
• Participant medical and wellbeing forms
• Programme/activity registrations
• Photography, video and media collected during the event
• Contact via our website or email.

Chamboree complies with GDPR, DPA 2018 and PECR, and follows data‑handling expectations from Scouts UK and Girlguiding UK.

This may include:

2.1 Participant & Leader Information

• Name, date of birth, gender identity category (optional)
• Home Scouting or Girlguiding unit
• Contact details for adults
• Parent/carer contact details for under‑18s
• Emergency contact details
• Accessibility & inclusion information

2.2 Medical, Welfare & Dietary Information

(Special Category Data under GDPR)

• Medical conditions & treatment needs
• Allergies & dietary requirements
• Mental‑health or wellbeing considerations
• Additional needs / SEND information
• Medication management details
• Welfare or pastoral support notes

2.3 Safeguarding Information

• Any safeguarding disclosures or concerns
• Incident or behaviour logs
• Records shared with HQ safeguarding teams

2.4 Media Consent Information

• Photo/video consent status
• No‑photo indicators
• Specific promotional consent where required

2.5 Operational Data

• Booking information
• Payment records
• Subcamp allocation
• Programme reservations
• Activity participation
• Security/incident logs

2.6 Website & Communications

• IP addresses (via analytics)
• Cookies (see Section 13)
• Enquiries sent via the website or email

3.1 Consent

• Email marketing updates
• Media permissions (close‑ups and promotional use)
• Optional medical disclosures
• Staff/volunteer photographs (where required).

3.2 Contract

• Booking and delivering Chamboree as an event.

3.3 Legal Obligation

• Safeguarding records
• Health & safety compliance
• Sharing information with statutory agencies.

3.4 Vital Interests

• Medical emergencies
• Missing person incidents
• Welfare situations where a participant is at risk.

3.5 Legitimate Interests

• Event administration
• Communications essential to participation
• Large‑scale public‑area photography, as permitted by Scouts and Girlguiding UK
• Operational safety and security.

3.6 Public Task / Substantial Public Interest

For safeguarding purposes, under Schedule 1 DPA 2018.

• Administer group and staff registrations
• Deliver Chamboree programme and activities
• Provide medical & welfare support
• Ensure accessibility and inclusion
• Maintain safeguarding protections
• Organise transport, off‑site visits and logistics
• Communicate important event information
• Conduct emergency response
• Share updates post‑event
• Manage risk assessments
• Produce official event media
• Support investigations (if required).

At an event of this size, it is reasonable to expect photography/video in public areas, in line with Scouts and Girlguiding UK guidance.

• Scouts UK Safeguarding Team (safeguarding concerns)
• Girlguiding UK Safeguarding (for relevant members)
• Medical professionals (health emergencies)
• Emergency services (police, ambulance, fire)
• Third‑party activity or off‑site providers (where necessary)
• Cheshire Scouts (our parent data controller)
• Booking platform providers (EvBoo)
• IT, comms or security contractors.

We never sell personal data.

• Art. 9(2)(c) – Vital Interests
• Art. 9(2)(g) – Substantial Public Interest (Safeguarding)
• Art. 9(2)(a) – Explicit Consent (where specifically asked).

Safeguarding data may be shared with:

• Police
• Social care
• UKHQ safeguarding teams
• External agencies where required by law.

Retention periods follow Scouts and Girlguiding UK’s safeguarding retention schedule.

All transfers comply with:

• UK GDPR
• International Data Transfer Addendum
• Standard Contractual Clauses (SCCs).

Where applicable.

• Booking & registration data: up to 2 years post‑event
• Medical & welfare data: retained only as long as required for safety
• Safeguarding data: retained as required by Scouts/Girlguiding safeguarding policy
• Financial records: 7 years (legal requirement)
• Media content: for promotional/archival use, unless deletion is requested.

• Secure digital storage
• Encryption where appropriate
• Restricted access controls
• Role‑based permissions
• Staff/IST confidentiality and GDPR training
• Secure radio/comms logs
• No unnecessary data collection.

• Access your data
• Request correction
• Request deletion
• Request restriction
• Object to processing
• Withdraw consent
• Request a copy of your data
• Complain to the Information Commissioner’s Office (ICO)

Contact: [email protected]
ICO: ico.org.uk

We ensure:

• Additional security
• Parental responsibility for consent
• No unnecessary data collection
• No direct marketing to under‑16s
• Strong media protections per Scouts/Girlguiding rules.

Email: [email protected]
(Or via the Contact Us form on the website)

Safeguarding Team
[email protected]