Legal documents
Privacy policy
This document explains what personal data we process in connection with the Naszcamp platform, for what purpose, who we entrust it to and what rights you have. It covers the organiser panel, camp pages, browser enrollment and the mobile app.
1.Data controller and contact
The controller of personal data within the scope described in this policy is the operator of the Naszcamp platform: Sportally Sp. z o.o., ul. ks. Huberta Szymankiewicza 49, 43-190 Mikołów, Poland, VAT ID (NIP) 6351880136, company number (KRS) 0001236870, statistical number (REGON) 544570905 (hereinafter “Naszcamp”, “we”).
You can contact us on any matter concerning the protection of personal data:
- postal address: ul. ks. Huberta Szymankiewicza 49, 43-190 Mikołów, Poland,
- e-mail: kontakt@naszcamp.pl.
We have not appointed a data protection officer. All requests concerning personal data are handled at the e-mail address above.
Naszcamp is a controller only for user account data and for the platform's technical and billing data (section 4). For the data of camp participants, their guardians and anything entered by organisers, the controller is the organiser, that is the club or academy using the platform. Naszcamp then acts as a processor, on the organiser's instructions and under the terms of a data processing agreement. Informing participants and guardians is the organiser's responsibility.
2.Scope of this policy
The policy covers the whole Naszcamp platform, which runs on one shared backend:
- the organiser admin panel, admin.naszcamp.pl,
- the marketing site, naszcamp.pl,
- public camp pages together with browser enrollment, naszcamp.pl/d/<code>,
- the iOS and Android mobile app, bundle identifier pl.naszcamp.participant, described further in section 10,
- the internal, non-production web preview test.naszcamp.pl, available behind HTTP Basic authentication and not intended for processing production data.
3.Infrastructure and processing location
We process data on Supabase infrastructure, covering the PostgreSQL database, authentication, file storage, edge functions and the realtime channel, in the European Union region, AWS eu-central-1 (Frankfurt). Data at rest is encrypted and transmission uses the TLS protocol.
4.Data we process as a controller
4.1. Account and identity data
- e-mail address, hashed password (bcrypt hash, the plaintext password is never stored), last sign-in date, account creation date, first and last name, phone number, language preference,
- profile data: account type, e-mail address, first and last name, avatar path, language,
- organiser team member data: first and last name, phone, e-mail, role in the company, role in the app, status.
Sign-in with Google and Apple is currently disabled, so we collect no data from external identity providers.
4.2. Device and notification data
- push notification tokens (Expo identifier), platform type (iOS, Android, web), app version,
- a log of notification deliveries: recipient, channel, status, any error and the time of sending.
4.3. Platform billing data
Settlement between the organiser and Naszcamp: amounts, status, payment date and the organisation's camp credits. We do not process payment card data, as described in section 8.
4.4. IP address and user agent when documents are signed
When agreements and consents are signed electronically we record the IP address and user agent of the signing person, along with a checksum of the document content and a timestamp. This data serves as evidence that the agreement was concluded and constitutes personal data.
5.Purposes and legal bases
The table below covers processing in which Naszcamp acts as a controller.
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and maintaining an account, providing the platform services | art. 6(1)(b), contract |
| Sending technical and transactional notifications (e-mail, push) | art. 6(1)(b) and (f), legitimate interest |
| Security, abuse prevention, evidence that an agreement was concluded (IP and user agent) | art. 6(1)(f), legitimate interest |
| Settlements and the platform's accounting and tax obligations | art. 6(1)(c), legal obligation |
| Handling requests and fulfilling data subject rights | art. 6(1)(c), legal obligation |
| Optional consents, for example marketing, if introduced | art. 6(1)(a), consent |
6.Recipients and processors
We use providers that process data on our behalf or on behalf of the organiser. The current list is as follows.
| Service | Scope | Region |
|---|---|---|
| Supabase (AWS) | database, authentication, file storage, edge functions, realtime channel and the built-in e-mail service handling confirmation codes, password resets and invitations | European Union (eu-central-1) |
| Resend | transactional e-mail, that is notifications sent by the platform | United States |
| Cloudflare Turnstile | protects the browser enrollment form against automated abuse; the service receives the IP address and browser signals of the person filling in the form | United States |
| Expo (EAS and Expo Push) | building and distributing the app, relaying push notifications | United States |
| Apple APNs, Google FCM | transporting push notifications to the device | United States |
| seohost.pl | static site hosting, with no personal data at rest | Poland |
| GitHub and GitHub Actions | code repository and deployment pipelines | United States |
| Apple App Store, Google Play | distribution of the mobile app | United States |
| Google Fonts | fonts on the web pages; the service receives the visitor's IP address and user agent | United States |
| YouTube in nocookie mode, Vimeo | video embedded on a public camp page, only if the organiser adds it | United States |
| Google Maps | opening navigation to the camp address, only on an explicit user action | United States |
7.Transfers outside the EEA
- Supabase processes data in the European Union, so the platform's core data set does not leave the European Economic Area.
- Expo Push, Apple APNs and Google FCM: sending push notifications involves a transfer outside the EEA.
- Cloudflare Turnstile: the IP address of the person filling in the enrollment form is sent for verification outside the EEA.
- Resend: transactional e-mails are sent through a provider based in the United States.
- Google Fonts, Google Maps, YouTube and Vimeo: the transfer concerns visitors of the web pages and actions taken by the user.
Transfers to third countries rely on the standard contractual clauses provided for in Chapter V of the GDPR, included in the data processing agreements with our providers, and, for providers certified under the EU-U.S. Data Privacy Framework, on that certification.
8.Payments
The platform does not integrate an external payment gateway and does not store payment card data. Participant payments are recorded manually by the organiser, and the labels “bank transfer”, “BLIK”, “cash” and “card” are method labels only, not payment integrations.
9.Retention periods
| Data category | Retention period |
|---|---|
| User account and profile | for as long as the account exists, until it is deleted or anonymised |
| Participant and guardian data | as instructed by the organiser acting as controller; we delete it on their instruction and after the data processing agreement ends |
| Platform settlements and accounting documents | 5 years counted from the end of the financial year they concern (art. 74(2) of the Polish Accounting Act and art. 86 § 1 of the Tax Ordinance) |
| Agreements, consents and evidence metadata (IP address, user agent, checksum) | until claims become time-barred, as a rule 6 years |
| Notification delivery log | 12 months |
| Push notification tokens | until sign-out or app removal, and at the latest after 12 months of device inactivity |
| Short-lived technical tokens | public enrollment token 2 hours, signed document preview URL 300 seconds; both expire automatically |
Signed agreements and consents are immutable at the database level because they serve an evidentiary purpose. A participant account can be anonymised as a result of withdrawing from a camp or of the organiser erasing participant data; the details are set out in the organiser's own privacy notice.
10.Mobile app
The Naszcamp mobile app (pl.naszcamp.participant) uses the same backend as the web platform. We distribute it through the App Store and Google Play; direct store links will be added once the app is published.
10.1. Device permissions
- Camera: scanning the camp QR code and paper documents, for example agreements.
- Photo library: adding a photo to the camp timeline.
- Notifications: delivering push notifications.
- The app does not use location, contacts, calendar or the microphone; audio recording is explicitly disabled.
10.2. Data stored on the device
- the sign-in session in the secure system store, that is Keychain on iOS and Keystore on Android,
- a data cache, including participant data and enrollment drafts containing among others the national identification number (PESEL), address and child's details, in an encrypted store whose key is kept in the keychain; the cache is cleared on sign-out,
- the app language choice in local storage, with no personal data.
10.3. No tracking
The app contains no analytics, advertising or crash reporting tooling and uses no advertising identifiers. The data categories described above match the Apple App Privacy labels and the Google Play Data Safety form.
11.Cookies and technical storage
We do not use cookies for tracking or analytics. We do not use Google Analytics, Google Tag Manager, advertising pixels or profiling tools, which is why we do not display a cookie consent banner.
We only use first-party technical storage that is necessary for the service to work:
nc-lang: the chosen language of the web pages,naszcamp-authandnaszcamp-remember: the sign-in session in the organiser panel,- the mobile app session in Keychain or Keystore, described in section 10.2.
Opening our pages also triggers connections to the external services listed in section 6: Google Fonts on every visit, Cloudflare Turnstile on the enrollment page, and YouTube in nocookie mode or Vimeo if the organiser embedded a video on the camp page. Navigation to the camp address in Google Maps opens only after the user clicks it. These providers may receive the device's IP address and user agent.
12.Your rights
You have the right to access your data, to rectify it, to erase it, to restrict processing, to object, to data portability and to withdraw consent, whereby withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
- Access and a copy of a document: the app provides a “My documents” screen, and we make a copy of the agreement available on a durable medium, in line with art. 42(6) of the Polish Act on package travel.
- Rectification: the avatar, language and enrollment status are editable directly; other data is rectified through the organiser.
- Erasure: carried out by self-service withdrawal from a camp or by the organiser erasing participant data. Full deletion of an account across all organisations is performed manually, on a request sent to kontakt@naszcamp.pl.
Channel for exercising your rights: postal address ul. ks. Huberta Szymankiewicza 49, 43-190 Mikołów, Poland and e-mail kontakt@naszcamp.pl. If a request concerns camp participant data, we will pass it on to the organiser, who is the controller in that respect.
13.Changes to this policy
We update this policy as the system or the set of providers changes. The current version is always available at naszcamp.pl/en/privacy-policy, and the Polish version at naszcamp.pl/polityka-prywatnosci. In case of any discrepancy, the Polish version prevails.
Last updated: 12 August 2026.