Data Processing Agreement

1. Parties and how this is agreed

Between the club using the platform (the Controller) and , (the Processor).

The club decides what personal data to record about its clients and why. We hold and process that data solely to provide the platform. This document sets out the terms Article 28(3) GDPR requires. Where it conflicts with the Terms of Use on data protection, this document prevails.

2. Subject matter and duration

Subject matter: providing the Horsika platform — scheduling, client records, bookings, memberships, financial records and notifications.

Duration: for as long as the club has an account, plus the deletion period in section 9.

The nature and purpose of processing, and the categories of data and data subjects, are in Annex A.

3. Processing on documented instructions

We process personal data only on the club's documented instructions, which consist of:

• this agreement and the Terms of Use;
• the club's use of the platform's features and settings;
• any further written instruction the club gives us.

We do not use club client data for our own purposes — not to build profiles, not to train models, not to advertise to your clients.

Where the law requires us to process data beyond your instructions, we tell you before doing so, unless that law forbids telling you. If we believe an instruction breaches data protection law, we say so; we are not obliged to carry out an instruction we consider unlawful.

4. Confidentiality

Everyone we authorise to process personal data is bound by a duty of confidentiality that survives the end of their engagement. Access is granted on a need-to-know basis and is withdrawn when no longer needed.

5. Security measures

We implement appropriate technical and organisational measures under Article 32 GDPR, taking account of the state of the art, the cost of implementation, and the risk to data subjects. They are described in Annex B. We may change them, provided the level of protection does not fall.

6. Sub-processors

The club gives general authorisation for us to engage sub-processors. The current list is published at https://horsika.com/subprocessors, with what each one does and where it is located.

We give at least 30 days' notice before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period. If we cannot resolve your objection, you may terminate the affected part of the service and receive a refund of the unused prepaid period.

Every sub-processor is bound by obligations no less protective than these, and we remain fully liable to you for their performance.

7. Helping you meet your obligations

Taking account of the nature of the processing, we assist you with:

• Data subject requests (Art. 12–23). The platform lets you find, correct and delete client records yourself. For an export, or where a request needs more than that, ask us and we prepare it by hand. If a client contacts us directly, we do not answer for you — we pass the request on without undue delay.
• Security (Art. 32), through the measures in Annex B.
• Breach notification (Art. 33–34), as in section 8.
• Impact assessments and prior consultation (Art. 35–36), by supplying the information we hold.

8. Personal data breaches

We notify you without undue delay after becoming aware of a personal data breach affecting your data, and in any event in time for you to meet your own 72-hour deadline. The notification describes the nature of the breach, the categories and approximate number of records concerned, the likely consequences, and the measures taken or proposed.

Where we do not have all of that at first, we send what we have and follow up as we learn more.

9. Return and deletion

On termination, you choose whether we return or delete the personal data. Ask us at privacy@horsika.com and we prepare the export by hand, within one month. That option stays open for 90 days after termination.

After that period we delete it, including from backups as they cycle out on their normal schedule, unless the law requires us to keep it — in which case we tell you what and why.

10. Audits

We make available the information needed to demonstrate compliance with Article 28, and allow audits by you or an auditor you appoint. Audits take place at most once a year, on 30 days' notice, during business hours, without disrupting the service, and under confidentiality. Where a current third-party report or certification answers your questions, we may provide that instead. You bear the cost of an audit unless it uncovers a material breach on our side.

11. International transfers

Personal data may be processed outside the EEA — see the sub-processors page for where. For any transfer to a country without an adequacy decision, we rely on the Standard Contractual Clauses (Implementing Decision (EU) 2021/914), module three (processor to processor) or module four as applicable, which are incorporated here by reference. A copy is available on request.

12. Liability

Each party is liable for its own breaches of the GDPR. The limitations in the Terms of Use apply to this agreement, except where the GDPR provides otherwise — Article 82 rights of data subjects and supervisory authority powers are unaffected by anything agreed between us.

Annex A — Details of processing

Categories of data subject: the club's clients (riders and their guardians), the club's staff, and horse owners.

Categories of personal data:

• Identity and contact: first and last name, phone number, email address, date of birth.
• Booking records: lessons booked, attended and cancelled; services and trainers chosen; participant numbers.
• Commercial: memberships, session balances, discounts, prices, payment status, stabling invoices.
• Free text written by club staff: client notes, internal notes on bookings, and any blacklist flag.
• Communications: SMS and push notifications sent, with delivery status and message text.
• Horse-related: ownership links and veterinary details, which may identify a veterinarian.
• Technical: IP address and user agent recorded for security purposes.

Special categories: the platform is not designed for health or other special category data about people. Free-text fields could contain it if staff type it there. Please do not — and if you must, you are responsible for having an Article 9 condition for it.

Nature and purpose: collection, storage, organisation, retrieval, use, disclosure to the club's authorised staff, erasure — all to provide the platform.

Frequency: continuous, for as long as the account is active.

Annex B — Security measures

• Encryption in transit: TLS on all connections.
• Access control: role-based, scoped per organisation; a trainer sees their own sessions, a club sees only its own data.
• Authentication: passwords stored as bcrypt hashes; optional phone verification.
• Logging: administrative and booking actions recorded with actor and timestamp.
• Segregation: organisation scoping enforced at the query layer, not only in the interface.
• Backups: taken regularly and restore-tested.
• Retention limits: automated deletion of logs and expired records on the schedule published in the Privacy Policy.
• Sub-processor control: contractual obligations no less protective than these.
• Staff: confidentiality obligations and need-to-know access.