Version 1.0
This Information Security Policy describes how CampMatrix Limited protects the confidentiality, integrity, and availability of information processed through the CampMatrix camp management platform.
Registration Number: 80034035814544
Mbuya, Robert Mugabe Road, Kampala Nakawa, Uganda
Security contact: ask@campmatrix.site · +256 751 077 218
1. Purpose and Scope
This Policy applies to the CampMatrix platform, related APIs and integrations, hosting environments, backups, logs, and all personnel or authorized third parties with access to CampMatrix systems or customer data.
It covers camp operations data including bookings, room allocations, staff and guest records, meals, maintenance, housekeeping, medical clearance, RFID access logs, documents, and reports.
2. Security Principles
- Confidentiality, integrity, and availability of information
- Least privilege and role-based access
- Defense in depth and secure-by-design development
- Accountability through logging and audit trails
3. Access Control and Authentication
CampMatrix enforces unique user accounts, strong passwords, secure password hashing, session management, and multi-factor authentication (MFA) where supported. Access is granted based on role and camp scope, reviewed periodically, and revoked when no longer required.
4. Application and Infrastructure Security
We protect the platform using controls including:
- HTTPS/TLS for data in transit
- Encryption at rest for sensitive data and backups where supported
- Input validation, CSRF protection, and authorization checks
- Secure file upload handling and restricted administrative access
- Firewalls, patching, and vulnerability management
- Regular backups and disaster recovery planning
5. Data Protection
Personal and operational data is processed only for legitimate platform purposes. Data is retained for at least six (6) months after a user has left the camp unless a longer period is required by law or contract. For privacy rights, see our Privacy Policy.
6. Logging, Monitoring, and Audit
We log security-relevant events such as authentication activity, administrative actions, access to sensitive records, RFID events, and significant configuration changes. Logs are protected and reviewed to detect and investigate incidents.
7. Security Incident Management
Suspected security incidents must be reported immediately to ask@campmatrix.site (subject: Security Incident) or +256 751 077 218.
CampMatrix follows identify → contain → investigate → eradicate → recover → review. Notifications to customers, data subjects, or regulators are made where required by law or contract.
8. Third-Party Security
Third-party providers (hosting, email, payments, analytics where consented) must implement appropriate security measures and process data only under contract and documented instructions.
9. Personnel and Acceptable Use
Personnel and authorized users must protect credentials, comply with this Policy, handle data only as authorized, and report suspected weaknesses or incidents. Prohibited activities include unauthorized access, credential sharing, and exfiltration of customer data.
10. Compliance and Review
This Policy supports compliance with the Uganda Data Protection and Privacy Act, 2019, GDPR where applicable, and customer contractual obligations. It is reviewed at least annually or after significant incidents or platform changes.