Privacy policy

1. Data controller

The controller of the personal data described in this policy is Maciej Jech, the publisher of Horseo (“we”). For matters concerning personal data, write to contact@horseo.pl.

The policy covers the website horseo.pl (the “website”) and the Horseo web application reached through the “Sign in” link (the “application”). The application is provided in early access.

We have not appointed a data protection officer.

2. What data we process

Visitors to the website. The website requires no sign-in and contains no forms and no analytics or advertising tools. With every connection the server receives the device’s IP address, the date and time of the request, the address of the page opened and information about the browser. They are needed to display the page and may end up in the server’s technical logs.

People who write to us. If you write to contact@horseo.pl, we process your e-mail address, your name if you give it, and the content of the message.

Users of the application. Sign-in goes through the Microsoft Entra External ID service: with an e-mail address and password or with a Google account. We do not store passwords. From the sign-in service we receive and store the account identifier, the e-mail address and the display name, if the provider passes it on. We also store the chosen language, stable membership, the role in the stable and the date the stable was last opened.

If a stable invites you to the application, the person inviting you gives your name and e-mail address. On that basis we create an account and send an invitation to the address given.

When someone creates a new stable, we receive an e-mail with the name of the stable and the name and e-mail address of the person who created it. To protect the application from abuse, we limit the number of requests from one IP address and from one account. A request rejected for this reason is recorded in a log together with the IP address or the account identifier.

When you create a stable, you accept the Terms. We then record the version of the Terms accepted, the date and time of acceptance and the account it was made from.

Data entered by the stable. The stable enters into the application the data of its horses, their owners and payers (name, telephone, e-mail address, address, notes), boarding agreements and fees, and its staff (name, e-mail address, role). The controller of this data is the stable. We process it solely on the stable’s behalf, so that the application works. If your data was entered by a stable, address your requests to that stable. A request that reaches us will be passed on to the stable.

We store horse photos only as processed copies from which we remove metadata, including location data. We do not keep the original file.

3. Purposes and legal bases

We do not use personal data for marketing purposes, we do not send commercial information and we do not profile. We do not make decisions based solely on automated processing.

4. Recipients of the data

We entrust data only to entities that help us run the website and the application:

• OVH: hosting. The website, the application and the database run on a server in the European Union, and the photos are stored there. OVH also handles our e-mail.
• Microsoft: the Microsoft Entra External ID sign-in service and, in the Azure service within the European Union, diagnostics of the application (records of requests and errors).
• Google: only when you sign in with a Google account. Google then confirms your identity and passes your e-mail address and name to the sign-in service.

We may also disclose data to public authorities when the law requires it.

If, in connection with the Microsoft or Google services, data is transferred outside the European Economic Area, this takes place on the basis of a European Commission adequacy decision or standard contractual clauses (Articles 45 and 46 GDPR).

In the application, each stable’s data is separated from the data of other stables and available only to its users, in line with the permissions they have been given.

5. Retention period

• Technical server logs: they have a limited size, and the oldest entries are overwritten by newer ones.
• Correspondence: up to 12 months from the end of the matter, and if it is needed to defend or pursue claims, until the limitation period for those claims expires.
• Account data: for as long as the account exists. We delete the account on a request sent to contact@horseo.pl.
• Data entered by the stable: until the stable deletes it or the stable is deleted at its request.

6. Cookies and browser storage

The website does not use cookies. If you change its look (light or dark), it saves that choice in browser storage; apart from that it saves nothing there.

The application does not use cookies. It uses browser storage only as far as it needs to work: it keeps the sign-in data until you sign out or close the tab, and the last stable chosen, the chosen look (light or dark), the state of the menu and the way lists are displayed.

The sign-in pages run by Microsoft, and by Google if you choose that method, may use their own cookies under the rules set by those companies.

7. Your rights

If we process your data as a controller, you have the right to:

• access the data (Article 15 GDPR),
• have the data rectified (Article 16 GDPR),
• have the data erased (Article 17 GDPR),
• restrict processing (Article 18 GDPR),
• port the data processed on the basis of an agreement (Article 20 GDPR),
• object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR).

We do not process data on the basis of consent. Send your requests to contact@horseo.pl. We reply without undue delay, within one month at the latest.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland).

8. Whether providing data is required

Providing data is voluntary. Without an e-mail address and signing in, however, the application cannot be used, and without an e-mail address we cannot reply to a message. The technical data of the connection, including the IP address, is sent by the browser automatically. It is needed to display the page.

9. Changes to the policy

We may change this policy, in particular when the law, the scope of the services or the recipients of the data change. The current version with its effective date is always available on this page. We will inform users of the application about significant changes by e-mail or in the application.

10. Contact

For matters concerning personal data, write to contact@horseo.pl.