PRIVACY POLICY

Introduction

MKR Caucasian Camp is committed to protecting the privacy of its users. This privacy policy explains how we collect, use, and protect your personal data.

Data collected

We collect the following data via our forms:

• Last name, first name, date of birth
• Email address, phone number
• Country and departure city
• Sports information (discipline, level, experience, club, achievements, video link if provided)
• Health information relevant to sports practice (conditions, injuries, contraindications)
• Logistical preferences (registration tunnel, session, duration, desired dates)
• Family or group composition where applicable (e.g., age of children for the family tunnel)

When the registration form is submitted, we also record two technical metadata items for security purposes (automation detection, anti-spam, forensic traceability in case of incident):

• The IP address of the request (extracted from the X-Forwarded-For header)
• The browser identifier (User-Agent)

These two metadata items are stored with your application and kept under the same conditions and for the same duration as the other form data (see Retention section).

Use of data

Your data is used exclusively to:

• Process your camp application
• Contact you as part of the registration process
• Prepare your stay (logistical and medical information)
• Send you information about upcoming sessions (with your consent)
• Detect automated submissions and prevent form abuse (IP and User-Agent only)

Data retention

Your data is kept for the time needed to process your application, and at most 3 years after your last contact with MKR Caucasian Camp. After this period, it is deleted from our database. You can request early deletion at any time (see Your rights).

Hosting and subcontractors

To operate the registration form and the internal dashboard, we rely on the following subcontractors:

• Supabase (Supabase, Inc., United States): hosting of the PostgreSQL database of applications. Our data is stored on European infrastructure (region eu-central-1, Frankfurt, Germany). Any transfers to the United States are governed by the European Commission Standard Contractual Clauses (SCC). Policy: supabase.com/privacy
• Vercel (Vercel, Inc., United States): hosting of the web application and server routes. Policy: vercel.com/legal/privacy-policy

Data sharing

Your data is never sold to third parties. It may be shared with our logistical partners (on-site accommodation, transport) strictly within the framework of organizing your stay.

Your rights

In accordance with the GDPR, you have the following rights:

• Right of access to your data
• Right to rectification
• Right to erasure
• Right to portability
• Right to object to processing

To exercise these rights, write to us via the contact form.

Security

We implement appropriate technical and organizational measures to protect your data against any unauthorized access, modification, disclosure, or destruction.