1. Controller
WakeMan Event GmbH
Oyter See 1, 28876 Oyten, Germany
Represented by the managing director Adrian Abeck
Phone: +49 (0)4207 9998776
Email: kontakt@wuw-camp.de
You can reach us using these contact details for any questions about data protection and to exercise your rights.
2. Overview
We only process personal data where it is needed to run this website, to handle registrations and to run the camp, or where you have given your consent. We do not sell data and do not use it for third-party advertising. Each section states which details are required and which are voluntary.
3. Hosting and server logs
The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When a page is requested, Vercel processes technically necessary data such as IP address, time, requested page and browser identifier in order to deliver the page and protect it against attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Logs are only kept for a short time. Vercel is certified under the EU-US Data Privacy Framework, and a data processing agreement is in place.
4. Database
We store registrations, waiting list entries, contact requests and the entries used to prevent misuse (section 9) in a database operated by Neon Inc., USA. The database is located in the Frankfurt am Main region (EU). A data processing agreement with Neon is in place.
5. Sending and receiving emails
We send emails to you, such as the acknowledgement of your registration, and to our team via Resend (Resend, Inc., USA). The recipient address, subject and content of the email are processed. Transfers to the USA are based on the European Commission's standard contractual clauses, and a data processing agreement with Resend is in place.
We are told about a new registration by a short email containing the reference, the child's first name, the weeks booked, the amount, how your child is getting to camp and the language of the registration, where relevant a note on an age exception with the child's age at the start of the week concerned, and whether any allergies or notes were entered. It does not contain the health details themselves or any contact, insurance or emergency details; only authorised members of our team see these, in the internal area of the website.
Emails to us, that is your messages to kontakt@wuw-camp.de and the emails the website sends to our team, arrive in our mailbox with our email provider, which stores them on our behalf. We deal with them there.
6. Cookies and browser storage
Without your consent, we only use what is technically necessary for the function you request (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR):
- Language: the cookie “NEXT_LOCALE” remembers the language you chose if it differs from your browser's language setting. It is deleted when you close your browser.
- Registration form: while you fill in the form, your browser keeps your progress in session storage, without consents and confirmations, together with a random identifier so that a registration does not arrive twice if the connection drops. After you submit, your contact details stay there so that you can register a brother or sister without typing everything again. Session storage is cleared when you close the tab.
- Cookie notice: your choice is kept in your browser's local storage until you change it or clear the storage. If you withdraw your consent via “Cookie settings”, the page reloads; a marker in session storage makes sure the notice appears again straight afterwards and is deleted when the page loads.
- Packing list: the items you tick on the packing list are kept in your browser's local storage, only on this device and without being sent to us, until you reset the list or clear the storage.
- Internal area: our team uses a session cookie that is valid for at most twelve hours. It is only set when someone signs in to the internal area.
7. Usage measurement
Only if you agree in the cookie notice do we use Vercel Web Analytics and Vercel Speed Insights (Vercel Inc., see section 3) to measure which pages are viewed and how quickly they load. The measurement works without cookies and does not build user profiles. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time via “Cookie settings” in the footer; measurement then stops the next time the page loads at the latest.
8. Registering for camp
Via the registration form we collect:
- about your child: first name and surname, date of birth (for the age limit), the information needed for room allocation, experience level, swimming badge and your confirmation of their swimming ability, type of health insurance and whether your child has been to camp before; voluntarily, the name of the health insurer, allergies and intolerances, notes, a room-mate request and height, weight, shoe size and wetsuit size for handing out equipment;
- about you: name, email address, phone number, postal address and how your child will arrive;
- voluntarily, a different emergency contact with name and phone number;
- about the booking: the weeks and extras you chose, voluntarily how you heard about us, and the time and version of the documents you confirmed.
The purpose is to perform the participation contract: allocating places, supervision, catering, room and equipment allocation, communication and invoicing (Art. 6(1)(b) GDPR). The details about swimming ability, health insurance and emergency contact are there for your child's safety. Without the required details we cannot process the registration; you can leave out the voluntary ones.
Allergies and intolerances are health data. We only process them with your explicit consent (Art. 9(2)(a) GDPR), which you give in the form, and only to adapt catering and supervision. You can withdraw your consent by email at any time, and we will then delete the details.
Only members of our team who need the details for their work have access; permissions are separated by role. Our kitchen team receives the allergies and intolerances.
9. Preventing misuse of the forms
To stop the registration, waiting list and contact forms and the sign-in to our internal area being misused on a large scale, we limit the number of attempts. For each attempt we store a check value (hash), created from your IP address (for the contact form, also from your email address) and a secret key, together with the time. We do not store the IP address itself. After 24 hours the entry is no longer needed, and our daily clean-up removes it after two days at the latest. The forms also check how quickly they were filled in; we do not store this duration. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).
10. Contact form
If you write to us using the contact form, we process your name, email address and message and, voluntarily, your phone number and preferred time for a call back. We store the request in our database so that our team can deal with it, and notify the team by email. We delete the request automatically after six months. The legal basis is Art. 6(1)(b) GDPR where your request concerns a registration, and otherwise our legitimate interest in answering your request (point (f)).
11. Waiting list
If a week is fully booked, you can join the waiting list. For this we store your name, email address, voluntarily your phone number, and the week you would like. The sole purpose is to let you know when a place becomes available (Art. 6(1)(a) GDPR). You can withdraw your consent by email at any time, and we will then delete the entry.
12. Emails to families
After you register we send an acknowledgement, after our check the booking confirmation and, 14 days before camp, an information email about arrival. These emails are part of performing the contract (Art. 6(1)(b) GDPR).
After camp we send one email asking for a review. The legal basis is our legitimate interest in feedback on our service (Art. 6(1)(f) GDPR, Section 7(3) UWG). You can object at any time without incurring any costs other than transmission costs at basic rates; a short reply to one of our emails is enough. We point out this right when you register and in the email itself.
13. Newsletter
We use email to tell people about our upcoming camps. You receive the newsletter if you have expressly agreed to it, for example by ticking the newsletter box on our previous website (Art. 6(1)(a) GDPR). You can withdraw this consent at any time with effect for the future.
You also receive it if you booked through our registration form, from the booking confirmation onwards and only if you left the box "I do not want to receive emails about future camps" unticked. In that case we only write about our own camps and offers. The legal basis is our legitimate interest in advertising our own similar services (Art. 6(1)(f) GDPR, Section 7(3) UWG). If the family does not book again, we stop four years after the last registration.
Every issue contains an unsubscribe link. You can also object with a short message to us; this costs you nothing beyond the transmission costs at basic rates. After you unsubscribe we keep only your email address and the date, so that you receive no further newsletters (Art. 6(1)(f) GDPR).
For this we store your email address, name, language, the legal basis with its date and origin and, where applicable, the registration reference. The newsletter is sent via Resend (section 5), where your email address, name and unsubscribe status are held as a contact.
Links in the newsletter pass briefly through our website on the way to their destination. We only count how often each link in an issue is clicked; we do not store who clicked. We do not measure whether you open an issue.
14. Invoicing with Lexware
We create invoices with Lexware Office, a service of Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany. Lexware processes the data on our behalf (Art. 28 GDPR). As soon as we confirm your registration, our website creates a draft invoice there; our team checks the invoice and sends it to you.
For this we transfer to Lexware your name, address and email address (as customer data), your child's name, the registration number and the booked weeks and extras with dates and prices. We do not transfer health information, phone numbers or emergency contacts. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legal obligation to issue and keep invoices (Art. 6(1)(c) GDPR, Section 14 UStG, Section 147 AO, Section 257 HGB).
15. Declaration of consent on paper
Your child brings the declaration of consent on arrival, completed and signed. Only our supervisors use the details on it, including those about health and medication, to look after your child at camp. For the health details, the legal basis is the explicit consent you give by signing (Art. 9(2)(a) GDPR); otherwise it is the contract (Art. 6(1)(b) GDPR). We destroy the declaration no later than 30 days after the end of the camp week.
16. Photos and videos
We take photos and videos at camp. We only publish pictures in which your child can be recognised on our website or on Instagram with your separate consent (Art. 6(1)(a) GDPR). We ask for it after registration, together with the invoice. The consent is voluntary and can be withdrawn at any time with effect for the future.
17. Map and route planning
The map on the contact page comes from OpenStreetMap (OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) and only loads when you click “Load map”. Only then is your IP address transmitted to OpenStreetMap. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR). The European Commission has issued an adequacy decision for the United Kingdom.
The “Plan your route” link on the contact page and in the footer of every page opens Google Maps. You only leave our site when you click it; Google's privacy policy applies there.
18. Instagram, fonts, search engines
Our Instagram profile is only linked; no plugin is embedded, and visiting this site does not transmit any data to Instagram. The fonts are hosted on our own server, so no connection to Google Fonts is made. For Google Search Console and Bing Webmaster Tools we only add a verification code; no visitor data is transmitted.
19. How long we keep data
- We delete allergies, intolerances and notes 30 days after the end of the last booked camp week.
- We delete the rest of the registration data three years after the end of the last booked camp week.
- We keep invoices and booking records for the periods required by German commercial and tax law (up to ten years, Section 147 AO, Section 257 HGB).
- We destroy the paper declaration of consent 30 days after the end of the camp week.
- We delete waiting list entries once the week in question has ended.
- Newsletter: without express consent until four years after the last registration, with consent until you withdraw it. After you unsubscribe we keep only the email address as a block entry.
- We delete contact requests after six months.
- We delete the entries used to prevent misuse after two days at the latest.
20. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)).
Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21). You can object to the review request without giving reasons.
You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is Die Landesbeauftragte für den Datenschutz Niedersachsen (the Data Protection Commissioner of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany, www.lfd.niedersachsen.de.
21. Encryption
For security reasons this website uses TLS encryption. You can recognise it by the padlock in the address bar and by “https://”.