BUILT BY PEOPLE, FOR PEOPLE TEAMS.

LONDON, UK

Privacy policy

Last updated: 8-8-2026 · Bundle 8-8-2026

Issued by: Common Ground Studios Ltd
Company Number: 16987282
Registered Address: Wool House, 74 Back Church Lane, London, E1 1AB
Email: support@camp-site.co.uk
Website: www.camp-site.co.uk

Last Updated: 9 August 2026

CONTENTS

  1. Introduction & Scope
  2. Our Role: Controller vs Processor
  3. Information We Collect
  4. Legal Basis for Processing
  5. How We Use Your Information
  6. Scout  AI Employment Intelligence Tool
  7. Disclosing & Sharing Information
  8. Third-Party Services & Sub-Processors
  9. International Data Transfers
  10. Data Retention
  11. Data Security
  12. Your Rights Under UK GDPR
  13. Cookies & Tracking
  14. Children
  15. Changes to This Policy
  16. Governing Law & Jurisdiction
  17. Contact Us

1. Introduction & Scope

1.1 This Privacy Policy explains how Common Ground Studios Ltd ("Campsite", "we", "us", "our"), registered in England and Wales under company number 16987282, collects, uses, and protects personal information in connection with the Campsite platform, website, and related services.

1.2 This policy is intended to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

1.3 This policy applies to: (a) visitors to camp-site.co.uk; (b) prospective Member Organisations engaging with our sales and demo process; (c) Authorised Users of the Campsite platform; and (d) employees of Member Organisations whose HR data is processed within the platform.

1.4 This policy should be read alongside our Terms and Conditions and, where applicable, our Data Processing Agreement (DPA) with each Member Organisation.

2. Our Role: Controller vs Processor

2.1 Campsite acts in two distinct capacities depending on the data in question, and it's important you understand which applies to you.

2.2 Where we act as Data Controller  We determine the purpose and means of processing for:

  • Website visitor data (analytics, cookies)
  • Sales and marketing contacts (prospective Member Organisations, demo sign-ups)
  • Account administrator login credentials and billing contacts
  • Communications you send us directly (support queries, feature requests)

Sections 3–13 of this policy apply in full where we act as Controller.

2.3 Where we act as Data Processor  For HR data entered into the Campsite platform by a Member Organisation about its employees (e.g. contracts, payroll, right-to-work documents, disciplinary records, rota and attendance data), the Member Organisation is the Data Controller and Campsite is the Data Processor. We process this data strictly on the Member Organisation's documented instructions, as set out in our Data Processing Agreement.

2.4 If you are an employee of a Member Organisation and have questions about how your HR data is used, please contact your employer (the Member Organisation) directly in the first instance, as they control that data. We will support your employer in responding to any request you make, in accordance with our DPA.

3. Information We Collect

3.1 As Data Controller, we may collect:

  • Identifiers: name, email address, phone number, job title
  • Account Details: username, password (encrypted), organisation name, membership tier
  • Communications: support queries, feature requests, sales enquiries, and any correspondence with us
  • Device and Usage Data: IP address, browser type, operating system, device identifiers, and cookies
  • Marketing Data: contact details collected through outreach campaigns, LinkedIn, or web forms, and your preferences regarding communications from us
  • Billing Information: invoicing contact details (we do not collect or store payment card data  see Section 8)

3.2 As Data Processor, the categories of employee data we process on behalf of Member Organisations include, but are not limited to: names, contact details, right-to-work documentation, employment contracts, payroll data, rota and attendance records, leave records, and disciplinary or grievance records. The specific categories are determined by the Member Organisation and set out in the DPA.

4. Legal Basis for Processing

4.1 Where we act as Controller, we rely on the following legal bases:

Operating the website and platform login - Contractual necessity

Responding to enquiries and support requests - Contractual necessity / Legitimate interest

Sales and marketing outreach - Legitimate interest (B2B marketing)

Improving our services - Legitimate interest

Complying with legal obligations - Legal obligation

4.1 Where we act as Controller, we rely on the following legal bases:4.2 Where we act as Processor, the Member Organisation is responsible for establishing its own legal basis (e.g. contractual necessity for employment, legal obligation for right-to-work checks). We process data only on their documented instructions.

5. How We Use Your Information

5.1 We use Controller-role data to: operate and maintain the platform and website; respond to support and sales enquiries; send service updates and, where you've consented or where permitted under B2B marketing rules, promotional communications; improve our product; and detect and prevent misuse.

5.2 We do not use employee HR data (Processor-role data) for our own purposes, including marketing, analytics, or product development, except in anonymised or aggregated form that cannot identify any individual, and only where permitted under the DPA.

6. Scout  AI Employment Intelligence Tool

6.1 Scout is an AI-powered feature of the Campsite platform that monitors UK employment law sources and cross-references them against a Member Organisation's own uploaded policies to generate compliance reports and recommendations.

6.2 In generating Scout Outputs, Scout may process personal data contained within a Member Organisation's uploaded policy documents and employment contracts (for example, names or role details referenced within those documents), strictly for the purpose of producing compliance analysis for that Member Organisation.

6.3 Scout does not use Member Organisation data to train underlying AI models, and data processed by Scout is not shared between Member Organisations.

6.4 Scout Outputs are generated using AI and are provided for informational and operational purposes only. They do not constitute formal legal advice, and Member Organisations are encouraged to seek independent legal counsel for complex or high-value decisions. Full terms governing Scout's use and limitations are set out in our Terms and Conditions.

6.5 Where Scout processes personal data, it does so as part of our Processor role  i.e., on the instructions of, and for the benefit of, the relevant Member Organisation.

7. Disclosing & Sharing Information

7.1 As Controller, we may share your information with:

  • Service providers who help us operate our business (hosting, analytics, email, invoicing)
  • Legal or regulatory authorities where required to comply with the law
  • Advisors, in connection with enforcing our rights or defending claims
  • A successor entity in the event of a merger, acquisition, or restructuring

7.2 As Processor, we only disclose employee HR data as instructed by the relevant Member Organisation, to sub-processors bound by data processing agreements (see Section 8), or where required by law.

7.3 We do not sell personal information.

8. Third-Party Services & Sub-Processors

8.1 Campsite uses the following sub-processors, each bound by a data processing agreement:

  • Supabase (via AWS)  United States, United Kingdom and Germany database hosting and infrastructure
  • GoCardless  for invoicing and any payment processing

8.2 A current, maintained list of sub-processors is available on request or published in our sub-processor register.

9. International Data Transfers

9.1 Campsite's data is currently hosted on AWS infrastructure via Supabase, based in the United States, United Kingdom and Germany (multiple back-ups).

9.2 Where required, equivalent safeguards are applied for any Member Organisation or data subject located in the EEA.

10. Data Retention

10.1 As Controller, we retain:

  • Website and marketing contact data until you ask us to stop, or after a period of inactivity (to be confirmed)
  • Account holder data for the duration of the membership and a defined period afterward for legal/audit purposes
  • Support communications for as long as reasonably necessary to resolve and record the query

10.2 As Processor, HR data is retained for the duration of the Membership Term and handled on deletion in accordance with the DPA and the Member Organisation's instructions  typically returned or securely deleted within an agreed period following termination, subject to any statutory retention requirements (e.g. payroll records retained for tax purposes).

11. Data Security

11.1 We implement administrative, technical, and physical safeguards including encryption of data in transit and at rest, access controls, and regular security review.

11.2 No system can be guaranteed 100% secure. In the event of a personal data breach posing a risk to your rights and freedoms, we will notify the ICO within 72 hours where required, and notify affected individuals or Member Organisations without undue delay where the breach poses a high risk.

12. Your Rights Under UK GDPR

12.1 Where we act as Controller, you have the right to: access your data; request correction; request erasure; request restriction of processing; object to processing based on legitimate interest; withdraw consent where relevant; and request data portability.

12.2 Where we act as Processor, please direct requests about your employment data to your employer (the Member Organisation). We will assist them in fulfilling your request.

12.3 To exercise your rights, contact support@camp-site.co.uk. We will respond within one month.

12.4 You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by telephone on 0303 123 1113.

13. Cookies & Tracking

13.1 Our website uses cookies to keep you signed in, understand usage, and improve performance. Non-essential cookies require your consent via our cookie banner.

14. Children

14.1 Campsite is a B2B platform intended for use by working-age individuals in an employment context. We do not knowingly collect data from children.

15. Changes to This Policy

15.1 We may update this policy periodically. Material changes will be communicated to Member Organisations via email or in-platform notification before taking effect.

16. Governing Law & Jurisdiction

16.1 This policy is governed by the laws of England and Wales, and any disputes are subject to the exclusive jurisdiction of the courts of England and Wales.

17. Contact Us

Email: support@camp-site.co.uk Postal address: Common Ground Studios Ltd, Wool House, 74 Back Church Lane, London, E1 1AB

Cookies and optional analytics

Campsite uses strictly necessary cookies for security, session, and remembering your cookie choice.

Analytics cookies are optional. We only set them after you accept Analytics in our cookie banner (UK PECR / UK GDPR opt-in). You can reject Analytics and still use Campsite, and you can change your choice later from cookie preferences.

If you accept Analytics, we may use:

  • Google Analytics and Vercel Web Analytics for aggregated site and product usage.
  • PostHog (EU cloud) for product analytics. Depending on configuration this may include pageviews, limited autocapture (clicks and form submits), and session recordings. Recordings mask form inputs and do not record request or response bodies. We do not sell this data or use it for third-party advertising.

Analytics tools may set their own cookies or similar identifiers on your device after you opt in. Details appear in the cookie preferences panel under Analytics.

← Home