Privacy Policy

This policy explains what personal data the Horsika platform collects, why, and what you can require us to do about it. It is written to be read, not filed: where a legal term is unavoidable we say what it means in practice.

1. Who we are

The platform at https://horsika.com is operated by , , registered at (“Horsika”, “we”, “us”).

2. Our two roles: controller and processor

Horsika handles personal data in two different capacities, and which one applies changes who you should talk to.

We are the controller when

• you create an account with us, as a club owner, an administrator, a trainer or a rider;
• you contact us, request early access, or use our marketing website;
• we bill a club for its subscription.

Here we decide what is collected and why, and this policy governs it.

Riders, read this part. When you register on Horsika, search for a club, save a favourite, or place a booking through our site, you are our own user and we are the controller of that data — not merely a supplier working for a club. You did not sign up with the club; you signed up with us, and we decided what to ask you for. So for your account, your search and booking history on the platform, the notifications we send you and the security logs we keep, this policy applies in full and the rights in section 9 are exercised against us directly, at privacy@horsika.com.

One booking can therefore sit under both roles at once: we are the controller of the account you booked from, and the club is the controller of the client record it keeps about you afterwards. Neither of us can decide the other's half, which is why a deletion request sometimes has to go to both.

We are a processor when

An equestrian club uses Horsika to run its business. The client records, appointments, notes, memberships and payment history it keeps in our system belong to the club: the club decides what to record and why, and we only act on its instructions. In data protection terms the club is the controller and we are the processor.

If you are a client of a club and want your record corrected or deleted, the club is the right place to ask. Write to us instead and we will pass the request on, but we cannot decide it ourselves. The terms of that relationship are set out in our Data Processing Agreement, which every club accepts.

3. What we collect

3.1 Account data

Name, email address, password (stored only as a bcrypt hash, never in readable form), phone number and whether it has been verified, profile photo, a short biography if you write one, the identifier issued by Google or Apple if you sign in that way, and the time of your last sign-in.

3.2 Club client records

Where a club keeps records about its riders: first and last name, phone number, email address, date of birth, any note the club's staff writes about the client, any discount applied, and whether the club has flagged the client as barred from online booking. We hold this for the club, under section 2 above.

3.3 Bookings

The date and time of a lesson, the service and trainer chosen, the number of participants, the price, the payment status, the comment left when booking, and any internal note the club's staff adds afterwards. A booking also stores a copy of the client's name, phone and email as they were at the time.

3.4 Horses and stabling

Where a horse is owned by a private individual, the record links to that person. Veterinary details kept against a horse — allergies, chronic conditions, current medication, the practice or vet's contact details — may amount to personal data about the vet as well as information about the animal.

3.5 Messages we send

For every SMS we log the recipient's number, the full text of the message, and whether it was delivered. Phone verification stores the number, the one-time code, the IP address the request came from, and how many attempts have been made. Push notifications store the device token, the platform and the device name.

3.6 Technical and usage data

IP address, browser user agent, and the pages you visit. Early access requests store the IP and user agent to catch automated submissions. Administrative actions are written to an audit log so a club can see who changed what.

3.7 Payment data

We never see or store card numbers. Payment is handled by , and we keep only the amount, the currency, the status, and the reference the provider returns.

3.8 Cookies

What each cookie does is set out in section 4 below.

4. Cookies and similar technologies

A few cookies are needed to keep you signed in and to protect forms from abuse. Those are set whatever you decide. Everything else — analytics and advertising measurement — stays switched off until you turn it on, and can be switched off again at any time.

Open cookie settings

Your choice is stored in a cookie called horsika_consent for 180 days. After that we ask again. We also ask again if we add a service that was not covered by your earlier answer — an old choice cannot stand in for one you were never offered.

4.1 Strictly necessary

Always set. No consent is required for these, and they cannot be turned off.

4.2 Analytics — only after you agree

Google Analytics runs in Consent Mode: before you agree, its tag does not write cookies or identify you. Smartlook stores its data in the EU, and we have configured it not to capture form input, numbers, email addresses or IP addresses.

4.3 Marketing — only after you agree

Meta measurement has a second, server-side half: when you consent to marketing, we may also report an event to Meta directly from our servers, including your IP address and browser user agent, and your email or phone number in hashed form. Refusing marketing switches off both halves. This matters, because a browser extension that blocks the pixel would not otherwise stop the server-side report.

4.4 Where we deliberately do not track

No analytics or marketing tags run inside the club management area or the trainer dashboard, whatever your cookie choice. Those screens display a club's own client records, and we act there as a processor for the club rather than for ourselves. Sending those screens to a third party would mean handing over other people's data on the strength of a staff member's consent, which is not consent they are able to give. For the same reason, session recording does not run on the booking flow.

4.5 Changing your mind

Use cookie settings, linked from the footer of every page. Withdrawing consent takes effect immediately: we tell the relevant service to stop, delete the cookies it set, and reload the page so nothing keeps running from before your decision. Refusing is as easy as accepting — a single button, on the same screen, with the same weight.

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies will stop you from signing in, and clearing cookies erases your consent choice too, so the banner will appear again on your next visit.

5. Why we use it, and on what legal basis

Where we rely on legitimate interests, we have weighed those interests against your rights and concluded they do not override them. You can ask us to explain that assessment, and you can object to the processing — see section 8.

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not profile you.

6. Who else sees it

We do not sell personal data and we do not share it for anyone else's marketing. We do use service providers who process data on our behalf, under contract and only on our instructions. They are listed, with what each one receives, on our sub-processors page, which we keep current.

Beyond those providers, we disclose personal data only:

• to the club whose service you booked, so it can deliver that service;
• where the law requires it, or to establish, exercise or defend legal claims;
• to a buyer or successor if the business is sold or reorganised — you would be told first.

7. Sending data outside the EEA

We are established in , and some of our providers operate outside the European Economic Area. That means personal data is transferred to a third country.

Where the European Commission has not decided that the destination country offers adequate protection, we rely on Standard Contractual Clauses adopted by the Commission (Implementing Decision (EU) 2021/914), together with an assessment of whether local law in that country would undermine them and any additional safeguards needed. You may request a copy of the clauses that apply to a particular transfer by writing to privacy@horsika.com.

8. How long we keep it

These periods are enforced by an automated cleanup process, not applied by hand:

9. Your rights

Under the GDPR you may ask us to:

• Give you a copy of the personal data we hold about you (Art. 15).
• Correct anything inaccurate or incomplete (Art. 16).
• Delete it where we no longer have grounds to keep it (Art. 17).
• Pause processing while a dispute about accuracy or grounds is resolved (Art. 18).
• Hand it over in a machine-readable format, to you or another provider (Art. 20).
• Stop processing based on legitimate interests, by objecting (Art. 21).
• Withdraw consent at any time, without affecting what was lawful beforehand (Art. 7(3)).

Write to privacy@horsika.com. We answer within one month; if a request is complex we may take up to two months more and will tell you why within the first month. There is no charge unless a request is manifestly unfounded or excessive.

For cookies specifically, the fastest route is cookie settings — changes take effect immediately.

Complaints. You have the right to complain to a data protection supervisory authority, in the EU member state where you live, where you work, or where you think the problem happened. You do not need to contact us first, though we would rather have the chance to put it right.

10. How we protect it

• All traffic is encrypted in transit with TLS.
• Passwords are stored as bcrypt hashes and are never recoverable, by us or anyone else.
• Access is scoped by role and by organisation: a trainer sees their own sessions, a club sees only its own data.
• Administrative actions are recorded in an audit log.
• Our providers are bound by contract to equivalent standards.

No system is perfectly secure, and we would rather say so than imply otherwise. If you spot a vulnerability, please tell us at privacy@horsika.com.

11. If something goes wrong

If personal data is breached and it is likely to put people's rights at risk, we notify the competent supervisory authority within 72 hours of becoming aware of it (Art. 33). Where the risk is high, we tell the people affected directly and without undue delay (Art. 34). Where we act as a processor for a club, we notify the club without undue delay so it can meet its own obligations.

12. Children

Accounts are for people aged 16 and over. Riding lessons are often booked for children — in that case the account belongs to the parent or guardian, who provides the child's details and is responsible for them. If you believe a child has created an account directly, tell us and we will remove it.

13. Changes to this policy

When we change this policy we publish the new version here with a new version number and effective date. For changes that materially affect you we give notice by email or in the application before they take effect. We do not treat silence as agreement: where a change requires consent, we ask for it.

14. How to reach us

Privacy: privacy@horsika.com
Support: support@horsika.com