Privacy Notice

Last updated: 2026-10-02. This notice explains what personal data the Spiritual Warrior Project collects through this platform, why we collect it, and what we do with it. It covers the public site (the landing page, intro film and application form), the applicant portal, and the members and staff areas.

Who we are

The Spiritual Warrior Project is the data controller for the personal data described here. We run retreat camps for men, and this platform exists to take applications, manage bookings and payments, and host the participant community.

You can reach us about anything in this notice by messaging our WhatsApp line on +44 7507 548712 or by emailing any @swproject.co.uk address you have for us. We would rather answer a question than have you guess.

What we collect, and why

Applications. The application form collects your full name, date of birth, address, email, WhatsApp number, social media profiles, who referred you, your camp history, dietary requirements, medical and psychological disclosures (including prescribed medication), emergency contact, your answers about your physical readiness and personal challenges, and your guardian’s name. It also requires uploads of your passport (or photo ID) and CV. We collect this to assess whether the camp is safe and right for you, to plan welfare and catering, and to meet our obligations to the venue and insurers. Medical and dietary information is special-category data: we only process it because you give it to us voluntarily and explicitly as part of applying, and it is handled confidentially by the welfare team.

Consent records. When you submit an application you accept our Code of Conduct and Waiver and the current booking terms. We keep a record of exactly which version you saw and when you accepted it, because the proof has to match the wording you were actually shown.

Travel and insurance details. Once you are accepted, we ask for your travel insurance policy and your flight details (arrival date, flight number and airport) so we can arrange airport transfers and confirm you are insured for the activities.

Payments. Payments are processed by Fiserv through their hosted checkout. When you pay, you are redirected to Fiserv’s own page, your card details are entered there, and Fiserv sends us the result. Your full card number never reaches our servers. We keep the payment references, amounts and statuses we need to reconcile your booking and handle refunds.

Community content. If you join the members area you can write posts and upload photos and videos. That content is visible to other members and is stored so the community can use it.

Accounts and credentials. Members and staff sign in with an email address and a password, and staff accounts are protected by two-factor authentication. Your password is stored only as a strong one-way hash — nobody, including us, can read it back.

Reports and blocks. If you report a problem, a post, a comment or a person, we keep what you told us, who and what it was about, and, for a problem report, the page and the browser or device you were using, so we can fix it. Reports are seen only by our moderators, and the person reported is never told who reported them. If you block someone, we record that so the block can work.

Emails. We send transactional emails through our mail provider (a Proton mailbox): application confirmations, status updates, acceptance and payment messages. We do not run a marketing programme beyond the optional mailing-list tickbox on the application form, which is yours to take or leave.

Our legal reasons for using your data

• To deliver what you asked for (contract): assessing your application, booking your place, taking payment, running your account and the members area.
• Your explicit consent: the medical, psychological and dietary information you choose to give us, and the optional mailing list.
• Legal obligations: keeping financial records, and disclosing data where the law requires it.
• Legitimate interests: keeping the platform secure, preventing fraud and abuse, and moderating the community so it stays safe.
• Vital interests: sharing medical details with emergency services if your life or health is at risk at camp.

Participants under 18

Where the booking terms allow a participant under 18, a parent or legal guardian must give consent, and we collect the guardian’s details as part of the application. The members area is not intended for children under 13.

Where your data is stored

Application data lives in a PostgreSQL database on our hosting server, and uploaded documents (passports, CVs, insurance policies, community photos and videos) are stored as files on that same server. Access is limited to the staff who need it to run the camp, and staff accounts carry role-based permissions rather than a single shared login.

Who we share it with

We do not sell personal data, and we do not share it for advertising. We share only what is needed to run the camp:

• Fiserv, which processes your card payment on their hosted checkout.
• Our email provider, which delivers the messages we send you.
• Camp staff and leaders, who need application and medical details to keep participants safe.

We may also disclose data where the law requires us to. Some of these providers may process data outside the UK. Where they do, we rely on the safeguards UK data protection law requires, such as UK adequacy regulations or the standard contractual clauses.

How long we keep it

We keep application data, documents and booking records only as long as needed to run the camp and to meet our legal and accounting obligations, and we delete or anonymise them when they are no longer needed. We do not publish fixed retention periods here because they depend on the camp cycle and the obligations that apply to it — if you want to know what applies to your data specifically, ask us and we will tell you.

Security

We take sensible measures to protect your data, including:

• Passwords stored as Argon2id hashes, never in plain text.
• Two-factor authentication on staff accounts, with TOTP secrets encrypted at rest.
• Session cookies that are HttpOnly and SameSite, and marked Secure when the site is served over HTTPS.
• Role-based access, so staff only see what their job needs.
• Uploaded files stored under generated names with type and size limits, and served only through controlled routes.
• Encrypted connections (TLS) between your browser, our server and our email provider.

These are measures we commit to, not a guarantee: no system is perfectly secure. If we ever become aware of a breach affecting your data, we will tell you plainly and as quickly as we can.

Your rights

You can ask us to:

• Show you the personal data we hold about you.
• Correct anything that is wrong or out of date.
• Delete your data where we have no ongoing need or obligation to keep it.
• Withdraw a consent you have given (for example the mailing list).
• Object to, or restrict, how we use your data.
• Give you your data in a portable format.

You can delete your own account at any time from Account settings → Privacy. Our data deletion page explains exactly what is removed and what the law requires us to keep.

To exercise any of these, message us on WhatsApp at +44 7507 548712 or email any @swproject.co.uk address you have for us. We will verify that you are who you say you are before handing anything over, and we will not drag our feet: we reply within one month.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We would appreciate the chance to put it right first.

Cookies

We do not use analytics or third-party tracking cookies. The only cookie the platform sets is the session cookie that keeps you signed in. The public pages (landing, film and application form) set no cookies at all. Our Cookie Policy lists every cookie by name.

Changes to this notice

When this notice changes, the date at the top changes with it. If a change materially affects data we already hold about you, we will do our best to tell you directly.