Privacy Policy
Version 1.5 · 2026-08-25 · Draft for professional review. Controller registration and postal-address evidence must be completed before live guest processing.
Who we are
CampsiteOS ("we") provides the online booking system used by the campground you are booking with. For your booking data, the campground is the data controller and CampsiteOS is its processor (see our Data Processing Agreement). For the account data of campground operators, CampsiteOS is the controller.
The controller of operator account data (GDPR Art. 13(1)(a)):
| Entity | CampsiteOS — Gergő Miklós, sole trader; registration details pending release evidence |
| Postal address | Not yet published. This draft is not approved for live guest-data processing until the registered address is inserted and professionally reviewed. |
| Contact | privacy@campsite-os.com |
| Data protection officer | Not appointed — none of the Art. 37(1) triggers apply. Privacy questions go to the contact above. |
The controller of GUEST data is the campground you booked with — its legal name, registered address and VAT number are on your booking confirmation and on its invoice. Ask them first; we will always help them answer.
What we process, why, and on what legal basis
| Data | Purpose | Legal basis |
| Name, email, phone, party composition | Creating and managing your booking | Contract performance (Art. 6(1)(b) GDPR) |
| Payment status and references (never card numbers — those go directly to the payment provider) | Collecting payment, deposits, refunds | Contract performance |
| Identity and travel-document data of your party (where collected) | Statutory guest registration with national/local authorities (e.g. Alloggiati Web in Italy, fiche de police in France, Meldeschein in Germany) | Legal obligation (Art. 6(1)(c)) |
| Invoicing data | Issuing legally required invoices and bookkeeping | Legal obligation |
| Email delivery logs | Making sure transactional messages (confirmation, payment, cancellation) arrive exactly once | Legitimate interest (Art. 6(1)(f)) |
| Vehicle plate (optional) | Barrier/gate automation at parks that use it | Contract performance |
| Marketing preference | Only if you opt in at checkout | Consent (Art. 6(1)(a)) — revocable anytime |
How long we keep it (retention schedule)
The campground approves a purpose-specific policy for each property and legal record. CampsiteOS stores the policy, deadline, reviewer and any legal hold with the retained object. Automated destruction runs only after that approved deadline and leaves a non-personal destruction receipt. A legal hold pauses destruction; it does not silently extend every record.
The period depends on the record, property and controlling law. The criteria used are:
| Data class | Retention |
| Guest-registration forms and filed payloads | The property-approved period for the exact register or authority workflow, anchored to the event required by that law. Examples include FR police forms for 183 days, AT register entries for 7 years and ES lodging records for 3 calendar years. Exact filed payloads and receipts can have different periods and are tracked separately. |
| Filing and authority artifacts | Until the approved workflow-specific deadline. They may contain identity data, appear in access exports and are destroyed byte-for-byte after the deadline unless a recorded legal hold applies. |
| Invoices and financial ledger | The applicable statutory bookkeeping period for the seller and document class. Issued documents and ledger events are immutable; lawful corrections use credit notes. They survive an erasure request where Art. 17(3)(b) or another retention duty applies. |
| Email delivery logs | 730 days |
| Booking and guest profile data | For the contract, support and limitation period approved by the campground; erased or anonymised when no legal basis remains. |
Your rights
Access, rectification, erasure, restriction, portability, objection — ask the campground you booked with, or us. Two are worth explaining honestly:
- Erasure: each object is assessed separately. Data with no remaining legal basis is erased; a statutory record is retained only until its approved deadline; a legal hold names its reason and owner. The response identifies what was erased, what remains, why and until when.
- Access (DSAR): you receive a machine-readable inventory and export, including retained filing payloads and receipts that contain your data.
You can complain to your supervisory authority.
Recipients
Payment providers (the campground's own Stripe or Mollie account — your money goes to the campground, not to us), email delivery (Resend), hosting (see the subprocessor page), and the authorities listed above where registration is a legal duty.
Transfers
The current development database is hosted by Neon in the United States (`aws-us-east-1`), and transactional email uses Resend, a US-based provider. Transfers rely on the providers' DPAs and the EU Standard Contractual Clauses. Application execution and email-sending regions must be recorded from the actual production deployment before this draft is approved; no future region is promised here as though it had already happened. The dated subprocessor list is the controlling inventory.