Your data
Privacy notice
How we look after what you tell us when you enquire or book, and how we count visits to this website.
Last updated 29 September 2026.
Who we are
Camps by Epsom College Malaysia runs residential camps on the campus of Epsom College Malaysia in Bandar Enstek, Negeri Sembilan, and is the data controller: we are responsible for the information described here.
What we collect and why
When you enquire, we keep your name, your email, your phone number if you give it, how you would like us to reach you, and your question, so that we can answer you.
When you book, we also collect your child's details: date of birth, passport details for travel, medical, dietary and support needs, and emergency contacts. We need these to run camp safely and to look after your child. We also keep a record of your payments. Information about a child's health or welfare is seen only by the staff who need it.
We send you news about other camps only if you said yes, and you can ask us to stop at any time.
Where it is stored
Our database is hosted in Singapore. This means your information is stored outside Malaysia and outside your own country. It is sent there securely when you enquire or book, because that is where our booking system runs. Some of the services that run the camp for us are companies in other countries, and your information can be handled there too: each one is named, with its country, in the table under Who we share it with. Only staff whose role needs it can see it.
How long we keep it
We keep information only as long as it is needed for the camp, for safeguarding, and for our legal and financial records, and then we delete or anonymise it. Booking and payment records are kept for seven years, as tax law requires. A child's medical and safeguarding records are kept until the child turns 25. Visit counts are deleted after 13 months. When we delete a record, its copy in our staff spreadsheets is deleted too.
Who we share it with
Only what is needed to run the camp: Epsom College Malaysia, whose campus and medical team look after your child; the payment provider you choose to pay with, and the banks that handle the payment; airlines and insurers when we arrange travel; a booking agency, if one acts for you; and the services in the table below, which work for us under contract and only on our instructions. We never sell your information, and we never share it with advertisers.
The services that handle your information for us
Railway
- Country
- Singapore
- What for
- Our database, where your information is kept
- What it receives
- Everything described on this page
Vercel
- Country
- Singapore and the United States
- What for
- Runs this website and our booking system, and stores some uploaded files
- What it receives
- What you send us while it is handled, and some uploaded photos
Cloudflare
- Country
- United States
- What for
- Stores camp photos, and keeps passport and ID scans in a private store
- What it receives
- Photos of your child, and passport and ID scans
Amazon Web Services
- Country
- Singapore
- What for
- Face matching, reading passport pages, and translating messages
- What it receives
- Face measurements (see Photos and face matching), passport details, and messages you write to us
Google
- Country
- United States
- What for
- Staff spreadsheets and calendars, shared only with our camp medical and boarding staff
- What it receives
- Your child's name, room, class, allergies and medical room visits, and appointment times with your name and email
Resend
- Country
- United States
- What for
- Sends our emails
- What it receives
- Your name, your email address and what we write to you
Stripe
- Country
- United States
- What for
- Card payments
- What it receives
- Your name, email, the amount, and your card details, which we never see in full
Extra consents for families in Korea and China
The laws of Korea and China ask us for your separate agreement before your information leaves your country, and before we handle your child's health information. If your address or your child's nationality is in Korea or mainland China, checkout shows the two boxes below, unticked, and we keep a record of what you agreed to, the words you saw and when. You can withdraw either agreement by emailing us.
- I agree that my and my child's information may be sent outside my country to Camps by Epsom College Malaysia, in Malaysia, and to the services named in its privacy notice, in the countries and for the purposes listed there.
- I agree that Camps by Epsom College Malaysia may collect and use my child's health information, such as medical conditions, allergies, medication and medical room visits, which the law treats as sensitive, to keep my child safe at camp.
Photos and face matching
We photograph and film camp life. Your child's photos are shared with you in the private gallery in your account and, unless you switch photo sharing off there, may appear in Epsom College Malaysia publications, websites and social media.
We use face matching to sort the gallery, only if a parent agrees. From a reference photo of your child, which you add in your account, our staff take at camp, or, only if you agree, comes from their passport, our face-matching service in Singapore keeps measurements of your child's face. They are used only to find your child in camp photos. Naming your child from their face at a gate or till, if a badge will not scan, needs a separate agreement. Faces in camp photos that match no child are kept unnamed, deleted with the photo or 14 days after the camp ends, and never kept from a camp where a family opted out. None of it is shared.
The measurements are kept until you turn face matching off in your account, or ask us by email to delete them, and are then deleted. If you switch photo sharing off, your child is also left out of shared and published photos from then on.
Face measurements are biometric information, which the law treats as sensitive. We use them only with your agreement, asked for separately from the booking, and you can withdraw it at any time.
When the service looks for children in a camp photo, it also measures the other faces in it. A face that matches no child is kept without a name, so that a child whose parent adds a reference photo later can still be found in earlier photos. These unnamed faces are never used to identify anyone. They are deleted when the photo is deleted, or 14 days after that camp ends, and none are kept from a camp where a family has opted out.
How we measure visits
Our own servers count which pages of this website are visited, for how long, from which country, on what kind of device, in which language, and from which source, such as a search engine or a link in a message.
To tell a returning visitor from a new one, we set a first-party cookie holding a random number. It lasts up to 13 months and is never extended. We do not record your name or your IP address, and no advertising or analytics company sees any of it. Nothing is sold or shared.
If you go on to book or enquire, we note which page and which source brought you, alongside that booking or enquiry.
Visitors from some countries are counted without any cookie at all, and so is anyone whose browser sends a Global Privacy Control signal. You can switch counting off below.
Your choices
You can switch visit counting off for this device with one click. We then remove our visit cookie, delete the visits already recorded from this browser, and set a small cookie that remembers your choice for a year. It does not affect your bookings or your account. If you clear your cookies, press the button again.
Your rights
You can ask to see the information we hold about you or your child, to correct it, or to delete it, and you can withdraw a consent you gave us. Email admissions@thegep.com from the address on your booking and we aim to reply within 21 days. Some records must be kept where the law requires it, and we will tell you if that applies.
How to contact us
Write to us at admissions@thegep.com, or by post to Camps by Epsom College Malaysia, Persiaran Kolej, 71760 Bandar Enstek, Negeri Sembilan, Malaysia.