Version 1.5 · Effective date: 8 September 2026
Platform: World Camps Operator: World Schools Sàrl, Route de la Bernadaz 5A, 1094 Paudex, Switzerland Version: 1.5 | September 2026 Effective Date: 8 September 2026 Data Protection Contact: privacy@world-camps.org
Material changes are notified to users in accordance with the Privacy Policy.
1.1 This Cookie Policy ("Policy") explains how World Schools Sàrl ("World Camps", "we", "us", "our") uses cookies, local storage, pixels, and other similar tracking and storage technologies on the World Camps platform ("Platform").
1.2 This Policy supplements the World Camps Privacy Policy and forms part of the legal framework governing your use of the Platform together with the Customer Terms and Conditions and the Provider Terms and Conditions. Capitalised terms not defined here have the meaning given in those documents.
1.3 Who this Policy covers. This Policy applies to:
1.4 Children and Minors. The Platform is contracted with adult Customers, not directly with Children or Minors. We do not seek to identify whether a session belongs to a Minor; instead, advertising and behavioural-tracking technologies are off by default for every visitor and load only on the consent of the account-holding adult. Specific safeguards are set out in Section 7.
1.5 Jurisdiction. World Schools Sàrl is incorporated in Switzerland. This Policy is designed to comply with the Swiss Federal Act on Data Protection ("FADP"), the EU General Data Protection Regulation ("GDPR") and the ePrivacy Directive (2002/58/EC), the UK GDPR and the Privacy and Electronic Communications Regulations 2003 ("PECR"), the US Children's Online Privacy Protection Act ("COPPA"), and applicable international data protection and electronic communications standards. Jurisdiction-specific supplements are set out in Section 11.
1.6 Self-hosted consent infrastructure. Our cookie consent banner and Cookie Preference Centre are built and operated by World Camps. We do not currently use a third-party consent management platform. Should that position change, we will update this Policy and disclose the relevant sub-processor in advance.
1.7 Consent-based model. The Platform operates a consent-based model for Cookies and similar technologies. Strictly Necessary and, where you enable them, Functional first-party technologies support the operation of the Platform. Non-essential categories — including analytics and marketing — do not load until you have given consent to the relevant category. In particular, Google Analytics 4 loads only where you have consented to the Analytics category, and our Google Ads conversion tag loads only where you have consented to the Marketing category. Consent is collected, and may be withdrawn, through the consent banner and the Cookie Preference Centre described in Section 8, and every decision is recorded as described in Sections 5 and 8.
"Cookie" means a small text file placed on your device by a website or application, which may be used to store information about your visit and to recognise your device on subsequent visits.
"Cookie Preference Centre" means the in-Platform interface that allows you to view, set, and update your cookie preferences by category.
"Essential Cookie" means a Cookie or similar technology that is strictly necessary to provide a service you have requested, including authentication, security, fraud prevention, load balancing, and basic functionality of the Platform.
"Local Storage" means browser-based persistent storage mechanisms (including HTML5 localStorage and sessionStorage) that store information on your device outside of traditional Cookies.
"Non-essential Cookie" means any Cookie or similar technology that is not an Essential Cookie, including functional, analytics, marketing, and personalisation Cookies.
"Pixel" means a small image, beacon, or script embedded in a webpage or email that enables the recording of certain user actions or device characteristics.
"Storage Technology" means any client-side storage mechanism, including Cookies, Local Storage, IndexedDB, and similar technologies.
"Tracker" means any technology used to collect information about your interactions with the Platform, including Cookies, Pixels, Local Storage, scripts, and software development kits ("SDKs").
Other capitalised terms (including "Booking", "Child", "Customer", "Minor", "Personal Data", "Platform", "Provider", and "User Account") have the meaning given in the Privacy Policy and the Customer Terms and Conditions.
3.1 Purposes. We use Cookies and other Storage Technologies to:
3.2 Legal basis. Where Cookies or similar technologies process Personal Data, the applicable legal basis is:
3.3 Consent gating. Non-essential Cookies and Trackers do not load until you have provided consent to the relevant category through the consent banner or the Cookie Preference Centre. Rejecting a category prevents the corresponding Cookies and Trackers from being set or executed.
3.4 Storage Technologies treated as equivalent to Cookies. Where the law applicable to your session treats Local Storage, Pixels, or other Storage Technologies in the same way as Cookies, we apply the same consent and disclosure standards described in this Policy to those technologies.
We classify the Cookies and Trackers used on the Platform into the following categories. Each category corresponds to a toggle in the Cookie Preference Centre, except for Strictly Necessary, which is always on and cannot be disabled.
Cookies and Storage Technologies in this category are essential to operate the Platform. They cannot be disabled. They include authentication and session management, security and fraud prevention, load balancing, basic site functionality, payment processing through our payment processor, the record of your cookie-consent decision, and a language preference cookie that is set only when you expressly select a language (a user-requested functionality exempt from consent).
Cookies and Storage Technologies in this category remember your choices and improve your experience. They include currency, region, accessibility, onboarding progress, and interface preferences, and features such as your saved wishlist and recent searches. They are not loaded until you accept this category. A language cookie that is set only in response to an explicit user selection is not treated as a consent-gated preference under this category; it is treated as strictly necessary (user-requested) — see Section 4.1.
Cookies and Storage Technologies in this category help us understand how Users interact with the Platform, on an aggregated and de-identified basis where reasonably possible, in order to improve performance, identify defects, and prioritise development. This category includes Google Analytics 4. They are not loaded until you accept this category.
Cookies, Pixels, and Storage Technologies in this category measure the performance of our marketing activities and support advertising on third-party platforms. This category includes our Google Ads conversion tag. They may be set by our marketing partners on our instruction. They are not loaded until you accept this category, and, consistent with Section 7, we do not use a Child's personal data for advertising or behavioural profiling.
Cookies and Storage Technologies in this category support personalised Programme recommendations, the AI-assisted knowledge base, and related AI-driven Platform features, including the storage that supports the AI travel advisor. They are not loaded until you accept this category. This device-level control is distinct from the account-level "AI personalisation" setting in your account: the account-level setting governs personalisation drawn from the data you have saved to your account and operates as a separate withdrawal control (defaulting on), whereas this Cookie category governs personalisation signals held in guest or browser storage and, like every other non-essential category, defaults off. Disabling either control removes the corresponding personalisation. The two controls are described in Section 9.6 of the Privacy Policy.
Where the Platform embeds content hosted by third parties (for example, maps, video players, fonts loaded from third-party content delivery networks, or social-media widgets), those third parties may set their own Cookies or Storage Technologies. Embedded third-party content is loaded only after you accept the category that corresponds to the function of the embed (typically Functional or Marketing). Where the embedded content is essential to a function you have requested (for example, a map you have explicitly opened), it loads under the Strictly Necessary category for the duration of that interaction.
5.1 The following table sets out the principal Cookies and Trackers used on the Platform as at the effective date of this Policy. The Cookie Preference Centre displays the current inventory at all times, which prevails over this table if the two differ. This live inventory display is in operation in the Cookie Preference Centre.
| Name / pattern | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
sb-*-auth-token (and related sb-*) | World Camps via Supabase (first-party) | Strictly Necessary | Maintains your authenticated session. A specific database-project reference is present in the live cookie name; the wildcard pattern is retained here because that reference changes if the database project migrates | Session / persistent per auth config |
wc_consent (and associated consent id) | World Camps (first-party) | Strictly Necessary (consent record) | Stores your cookie-consent decision and the identifier linking it to the server-side consent record | 12 months |
NEXT_LOCALE | World Camps (first-party) | Strictly Necessary (user-requested) | Stores the language you explicitly selected | 12 months |
sidebar_state | World Camps (first-party) | Functional / Preference | Remembers UI layout preferences (e.g. sidebar open/closed) | Persistent until cleared |
wc_wishlist | World Camps (first-party, localStorage) | Functional / Preference | Remembers Programmes you have saved to your wishlist | Persistent until cleared |
wc_recent_searches | World Camps (first-party, localStorage) | Functional / Preference | Remembers your recent searches | Persistent until cleared |
wc_advisor_profile, wc_advisor_messages | World Camps (first-party, local/session storage) | AI and Personalisation | Supports the AI travel advisor, retaining your advisor profile and conversation for the session | Session / persistent until cleared |
__stripe_mid, __stripe_sid | Stripe, Inc. | Strictly Necessary (at checkout) | Payment processing and fraud prevention | Session to 12 months |
_ga, _ga_* | Google (Google Analytics 4, ID G-M521X20E00) | Analytics (consent-gated) | Measures and analyses Platform usage; loads only with Analytics consent | Up to 24 months |
Google Ads conversion cookies (e.g. _gcl_*) | Google (Google Ads conversion tag, ID AW-3404138292) | Marketing and Advertising (consent-gated) | Measures advertising conversions; loads only with Marketing consent | Up to 24 months |
| Vercel Speed Insights beacon | Vercel Inc. | Performance (cookieless) | Cookieless performance-measurement beacon; sets no cookie and loads under legitimate interest without consent | No cookie stored |
This inventory reflects the live cookie and storage technologies in use on the Platform. Any cookie or tracker not listed here, and not shown in the Cookie Preference Centre, is not knowingly set by the Platform.
5.2 Updates to the inventory. We may add, remove, or replace Cookies and Trackers from time to time. Material additions to the inventory are notified through the Cookie Preference Centre and will, where appropriate, trigger a re-prompt for consent.
5.3 Apple and Google sign-in. Where you choose to sign in through Apple or Google, those providers may set Cookies in their own domains as part of the authentication flow. Those Cookies are governed by the privacy notices of the relevant provider.
5.4 Third-party subscription billing (Provider-facing). Where a Provider purchases or manages a paid subscription or licence, the subscription checkout and billing portal are operated by the Platform's third-party subscription-billing provider on that provider's own hosted domain. Any Cookies or similar technologies set during that checkout or billing-management process are set in the context of, and governed by, that provider's own cookie and privacy notices, and not by this Policy. The redirect to that provider's domain sets no additional Cookies on the World Camps (world-camps.org) domain. This is a Provider-facing billing flow only.
6.1 Certain Cookies and Trackers are operated by third parties located outside Switzerland, the European Economic Area, or the United Kingdom (including in the United States). Where such Cookies or Trackers involve the transfer of Personal Data, those transfers are conducted in accordance with Section 6 of the Privacy Policy, including (as applicable) Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Agreement or addendum, and the safeguards required under the FADP.
6.2 A list of third-party providers whose Cookies or Trackers are loaded on the Platform, together with the relevant transfer mechanism, is maintained in the Cookie Preference Centre and in the Privacy Policy sub-processor disclosures.
7.1 No advertising or behavioural tracking of Minors. Accounts on the Platform are contracted with adults, and we do not seek to identify whether a given session belongs to a Minor. Our safeguard here is structural rather than detection-based: Marketing and Advertising Cookies, and behavioural-tracking technologies, are off by default for every visitor and load only where the account-holding adult has given consent to the relevant category. We do not use a Child's personal data for advertising or behavioural profiling (see Section 10 of the Privacy Policy), and the account-level safeguards in Section 7.2 apply to any Child profile an adult Customer creates.
7.2 Account-level safeguards. Customer accounts are contracted with adults. Where a Customer creates a Child profile, our systems apply the safeguards in Section 10 of the Privacy Policy and in the UK Age Appropriate Design Code supplement (Section 11.2 below), including high-privacy defaults and no nudge techniques in any cookie-related interface that could be encountered by a Child.
7.3 No knowing collection from under-13s in the United States. Consistent with the Privacy Policy COPPA supplement, we do not knowingly use Cookies or Trackers to collect Personal Data directly from children under 13 in the United States.
8.1.1 When you first access the Platform, a consent banner is presented offering three options of equal visual prominence: Accept All, Reject All, and Manage Preferences. All Non-essential categories are set off by default and load only where you take an affirmative action to enable them. Rejecting all Non-essential categories does not impair access to the Platform or to any service that does not depend on a Non-essential Cookie. Each consent decision is recorded in a server-side consent record — one row per decision, stamped with the version of this Policy in force at the time — so that the decision can be evidenced and honoured.
8.1.2 The Cookie Preference Centre allows you to set granular preferences for each category described in Section 4. Strictly Necessary cannot be disabled. All other categories default to off and require an affirmative opt-in.
8.1.3 A persistent "Cookie Preferences" link is available in the footer of every page of the Platform. Selecting that link opens the Cookie Preference Centre and allows you to change your preferences at any time.
8.2.1 Most web browsers allow you to control Cookies through their settings, including by blocking Cookies, deleting Cookies, or being notified when a Cookie is set. Disabling Cookies through your browser may impair the Platform's functionality.
8.2.2 Where your browser sends a Global Privacy Control ("GPC") or equivalent opt-out signal, we honour that signal and treat it as a rejection of Non-essential categories for the relevant session.
8.3.1 You may withdraw consent to any Non-essential category at any time through the Cookie Preference Centre. Withdrawal takes effect from the time it is recorded and does not affect the lawfulness of processing based on consent before its withdrawal.
8.3.2 Once a category is disabled, the corresponding Cookies and Trackers cease to be set, and Cookies and stored data already held on your device that fall within the disabled category are cleared or expired in accordance with our cookie management process. You may also delete Cookies manually through your browser.
8.4.1 We may re-prompt you for cookie consent following a material change to the cookie inventory, on expiry of the consent record, or where required by applicable law.
9.1 We may update this Policy from time to time to reflect changes in our practices, applicable law, or the cookie inventory. Material changes will be notified to registered Users by email or in-platform notification with reasonable advance notice, and will trigger a re-prompt for consent where appropriate.
9.2 The current version of this Policy is always available on the World Camps website and is identified by the version number and effective date at the top of this document.
9.3 Continued use of the Platform following the effective date of any updated Policy constitutes your acknowledgement of the changes. Where the updated Policy materially changes how Non-essential Cookies are used, your continued use does not constitute consent to Non-essential categories; affirmative re-consent is collected through the Cookie Preference Centre.
World Schools Sàrl Route de la Bernadaz 5A 1094 Paudex Switzerland Email: privacy@world-camps.org
We aim to acknowledge cookie-related enquiries within 5 business days and provide a substantive response within 30 days.
The following supplements apply in addition to the main body of this Policy for users in the specified jurisdictions. In the event of conflict between a supplement and the main Policy, the supplement prevails for users in the relevant jurisdiction.
Legal framework. Use of Cookies and similar technologies in respect of EU Users is governed by Article 5(3) of the ePrivacy Directive (2002/58/EC, as amended) as transposed in the relevant Member State, and, where Cookies involve the processing of Personal Data, by the GDPR.
Consent standard. Consent for Non-essential Cookies is collected in accordance with Article 4(11) and Article 7 GDPR and the European Data Protection Board Guidelines 05/2020. Consent is freely given, specific, informed, and unambiguous, given by a clear affirmative action, and may be withdrawn as easily as it is given.
No cookie walls. Access to the Platform is not conditional on consent to Non-essential Cookies.
International transfers. Transfers of Personal Data outside the EEA arising from Cookies and Trackers are conducted under Standard Contractual Clauses or other lawful transfer mechanisms, as described in Section 6 of the Privacy Policy.
Supervisory authority. EU Users have the right to lodge complaints with their national supervisory authority. World Schools Sàrl is established in Switzerland and does not have a main establishment in the EU; the GDPR "one-stop-shop" lead-supervisory-authority mechanism therefore does not apply, and each national supervisory authority within the EU may exercise its competence directly in respect of data subjects resident in its territory.
Legal framework. Use of Cookies and similar technologies in respect of UK Users is governed by Regulation 6 of PECR and, where Personal Data is involved, by the UK GDPR and the Data Protection Act 2018.
Consent standard. PECR-compliant consent is collected through the consent banner and Cookie Preference Centre. Strictly Necessary Cookies are loaded without consent in reliance on the PECR Regulation 6(4) exemption.
Age Appropriate Design Code. Where the Platform is accessible to users in the United Kingdom, we apply the standards of the ICO's Age Appropriate Design Code, including high-privacy defaults for child-facing features, no geolocation tracking of children, no nudge techniques in cookie-related interfaces directed at or reachable by children, and no profiling of children for marketing purposes.
International transfers. Transfers of Personal Data from the UK arising from Cookies and Trackers are conducted under the UK International Data Transfer Agreement, or an addendum to EU SCCs, as appropriate.
Supervisory authority. UK Users may lodge complaints with the Information Commissioner's Office (ICO): www.ico.org.uk.
COPPA. Consistent with Section 17.3 of the Privacy Policy, we do not knowingly use Cookies or Trackers to collect personal information from children under 13 in the United States. The Platform is designed for use by parents and guardians.
Behavioural advertising to under-13s. We do not use personal information of children under 13 for targeted advertising or behavioural profiling.
CCPA / CPRA and other US state privacy laws. Where you are a resident of California or another US state whose privacy law applies, you have the right to opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising (or the analogous concept under your state's law). You may exercise this right through the Cookie Preference Centre or by enabling the Global Privacy Control signal in your browser. We honour validated GPC signals as an opt-out of sale and sharing as required by applicable law.
Disclosures. California Users may request the categories of personal information collected through Cookies and Trackers, and the categories of third parties to whom such information is disclosed, by contacting privacy@world-camps.org.
Applicable law. World Camps is incorporated in Switzerland. Our use of Cookies and similar technologies is carried out in accordance with the revised FADP (in force 1 September 2023) and the principles of transparency, proportionality, and purpose limitation.
Consent. Where Cookies process Personal Data and consent is required under the FADP or applicable EEA standards relevant to the relevant session, consent is collected through the Cookie Preference Centre on the same basis as set out in Section 8.
Cross-border transfers. Transfers of Personal Data from Switzerland arising from Cookies and Trackers are conducted in accordance with the FADP's transfer requirements, including contractual safeguards where the recipient country does not offer an adequate level of protection.
Supervisory authority. Swiss residents may lodge complaints with the Federal Data Protection and Information Commissioner (FDPIC): www.edoeb.admin.ch.
This Cookie Policy was last updated in September 2026 with an Effective Date of 8 September 2026 and supersedes all prior versions.
