Privacy policy

This website is run by Charis Tribe Global Church, the organiser of Charis Camp Meeting 2026. We decide how your personal data is used, which makes us the “data controller” under the NDPA.

• Data protection contact: charistribeglobal@gmail.com

Write to our data protection contact with any question about your data, or to use any of the rights described below.

We only ask for what we need to run the camp. On each form we collect:

• Camp registration: your first and last name, email address and phone number; optionally your gender, age range, location, church, how you heard about the camp and any notes; which days you plan to attend, whether this is your first time, whether you need accommodation and whether you want email updates. If you are under 18, also a parent's or guardian's name and phone number and their agreement. At the venue we also record when your ticket is checked in each day.
• Charis Kids (childcare): the parent or guardian's name, email address and phone number; an emergency contact's name and phone number; the days you need childcare; and for each child their name, age, gender (optional), allergies and medical notes. We create a pickup code so only the right person can collect the children.
• Sunday service booking: your name, email address, phone number, the service you chose and your party size.
• Shuttle bus: your name, email address and phone number, whether you are an attendee or a worker, your route, pickup stop and travel days.
• Volunteering: your name, email address, phone number, the team you want to serve in, any relevant experience and when you are available.
• Contact form: your name, email address, phone number (optional), subject and message.

Technical data. IP addresses are used briefly to stop abuse, stored only as a keyed one-way code and deleted within two days; sign-in sessions do not record them. Our hosting provider also keeps short-term server logs for security.

Families may share an email address; each person is registered separately under their own name. Registering children twice with the same email and names re-sends the existing ticket instead of creating a new one.

Cookies. The public website does not use advertising or tracking cookies. Team members who sign in to the admin area get a secure session cookie, which is needed for the sign-in to work.

• To register you, send your ticket and confirmation emails, and check you in at the venue. We do this because you asked to attend (NDPA section 25: contract and consent).
• To plan seating, childcare, shuttle buses, volunteers and Sunday services for the number of people coming.
• To keep children safe: we use allergy and medical notes only to care for the child during the camp.
• To answer your messages, and to send camp updates if you ticked the box for them. You can stop updates at any time.
• To protect the website from spam and misuse (our legitimate interests).

Sensitive data. Registering for a church camp shows your religious belief, and children’s allergy and medical notes are health information. The NDPA treats both as sensitive personal data, so we process them only with your explicit consent (NDPA section 30): you give it by ticking the consent box on the form, and you can withdraw it at any time (see “Your rights”).

We never sell your data and we do not use it for advertising.

We delete registrations, childcare details, Sunday bookings, shuttle bookings, volunteer applications and check-in records 6 months after the camp ends, on 13 June 2027. Contact messages are deleted 6 months after they reach us. Deletion happens automatically on those dates; nobody has to remember to do it.

We may keep simple totals (for example, how many people attended) to plan future camps. These cannot identify anyone.

We use trusted service providers who process data only on our instructions and are bound to keep it secure:

• Vercel hosts this website and runs its server code.
• Neon hosts our database, where form submissions are stored.
• Resend delivers our emails, such as tickets and confirmations.
• Cloudflare stores images used on the site and runs Turnstile, a check that helps tell people from spam bots on our forms.

Some of these providers store or process data outside Nigeria. When that happens we rely on the safeguards the NDPA allows for such transfers, such as the providers’ contractual data protection commitments.

The map on our Venue section is provided by Google and only loads if you press “Load map”. Links to YouTube, Instagram and other social sites take you to services with their own privacy policies.

Within our team, access is limited by role. Only admins can see children’s pickup codes and health notes; registrars handle registrations; content editors cannot see registrations; ushers can check tickets in but cannot export data.

• All traffic to this website is encrypted (HTTPS).
• Your ticket page can only be opened with the long, unguessable link we email you.
• Team accounts are invite-only. Everyone who can see registrations or change the site signs in with a second step (a code from their phone). Ushers at the gate sign in with a password only, and from the day before the camp to its last day they can look up names and ticket codes to check people in. Important actions are logged.

If a data breach puts your rights at risk, we will report it to the Nigeria Data Protection Commission within 72 hours as the NDPA requires, and tell you if you are affected.

Under the NDPA a child is anyone under 18. We only collect young children’s details from their parent or guardian, through the Charis Kids form, and only to look after them during the camp.

Under-18s who register themselves for the main camp must give a parent’s or guardian’s name and phone number and tick that the parent or guardian agrees. We keep that consent with the time it was given, and we may call the parent or guardian to check (NDPA section 31).

Under the NDPA you have the right to:

• know what personal data we hold about you and get a copy of it;
• have it corrected if it is wrong or incomplete;
• have it deleted, or its use restricted;
• object to how we use it, and withdraw consent at any time;
• receive it in a common, machine-readable format.

To use any of these rights, contact charistribeglobal@gmail.com. We may need to confirm who you are first, and we aim to reply within 30 days. If you are not happy with our answer you can complain to the Nigeria Data Protection Commission.

If we change how we use your data, we will update this page and the date at the top. For big changes we will also email people who have registered.