Privacy Policy

1. Who is responsible for your data

This website and its member environment are operated by Aike Grange Stud (“the stable”, “we”).

The stable is the controller of your personal data: it decides which data is collected and why. The platform is provided by Equidentity, which processes the data only on the stable’s instructions, as a processor under a data processing agreement (GDPR article 28). Equidentity may not use your data for its own purposes.

This policy describes only the functions this stable actually uses. Sections for functions the stable has not enabled are not shown.

2. What data we process, why, and on what legal basis

Visiting this website

When you visit the website, our hosting and security providers process technical data such as your IP address, browser type and the pages you request, to deliver the pages and to protect the site against abuse and attacks.

Legal basis: our legitimate interest in a secure, working website (art. 6(1)(f) GDPR). Retention: server logs are kept for about 30 days.

Contact and inquiry forms

When you contact us through a form, we store what you enter — typically your name, email address, phone number (optional), your message and, where relevant, the horse you are asking about — to answer your question.

Legal basis: steps at your request before a possible agreement (art. 6(1)(b)) and our legitimate interest in answering questions (art. 6(1)(f)). Retention: deleted automatically 24 months after submission.

Breeding and insemination requests

For insemination inquiries and covering (breeding) records we process the mare owner’s name, contact details and address, the mare’s details and, where given, the name of the veterinarian involved.

Legal basis: performance of the breeding agreement (art. 6(1)(b)) and legal obligations for breeding documentation (art. 6(1)(c)). Retention: inquiries 24 months; covering records as long as required by studbook and legal rules.

Clinic and event registrations

When you register for a clinic or event we process your name, email address, phone number, billing details and the horse(s) you register, to organise the event and send you your ticket and invoice.

Legal basis: performance of the agreement (art. 6(1)(b)); invoices under our accounting obligations (art. 6(1)(c)). Retention: as long as needed for the event; invoices 7 years.

Member accounts

If the stable creates an account for you, we process your name, email address, phone number, your role (e.g. member, staff) and login data (account creation date, last sign-in). Passwords are stored only in hashed form by our authentication provider; nobody at the stable or at Equidentity can read them.

We also link you to the horses you own or care for, and keep a record of the services you use at the stable, as described below.

Legal basis: performance of your boarding, lesson or service agreement with the stable (art. 6(1)(b)). Retention: while your account is active. When your account is deleted, your profile, login, messages, reservations, waiting-list places, future bookings and notification tokens are removed. Records the stable must keep, such as past bookings, lesson cards and invoices, are kept with your name removed (see section 5).

Horse care and health records

Records about horses in the stable’s care — feeding, turn-out, training, care tasks, health treatments, vaccinations and farrier visits. These may contain the name of the owner, of the staff member who carried out a task, and of external professionals such as the veterinarian or farrier.

Legal basis: performance of the boarding agreement (art. 6(1)(b)), animal-health and traceability obligations (art. 6(1)(c)) and the stable’s legitimate interest in documenting the care it provides (art. 6(1)(f)). Retention: while the horse is at the stable. If an owner’s account is deleted, these records are kept for the horse but no longer linked to the person.

Riding lessons

Your lesson bookings, cancellations, attendance, waiting-list positions, lesson cards and credit balance, and — where the stable plans horses — which horse you rode.

Legal basis: performance of the lesson agreement (art. 6(1)(b)); paid bookings and credit movements under our accounting obligations (art. 6(1)(c)). Retention: booking and credit records 7 years (financial records).

Arena and paddock reservations

Your reservations: date, time, arena or paddock, and horse.

Legal basis: performance of the agreement (art. 6(1)(b)). Retention: removed when your account is deleted, and old reservations are periodically cleaned up (generally after about 18 months).

Horse leases

For a lease we process the lessee’s identity and contact details, the lease period, the agreed terms and the signed contract.

Legal basis: performance of the lease agreement (art. 6(1)(b)). Retention: for the duration of the lease; any related financial records 7 years.

Invoicing

To invoice you we process your name, billing address, company name and VAT number (if applicable), the invoiced services and payment status.

Legal basis: performance of the agreement (art. 6(1)(b)) and our legal accounting and tax obligations (art. 6(1)(c)). Retention: 7 years, as required by Belgian accounting law, then deleted automatically.

Horse documents

Documents uploaded for a horse, such as X-rays, export certificates, passports or boarding and training documents. These can contain the owner’s name and address.

Legal basis: performance of the sale, boarding or training agreement (art. 6(1)(b)). Retention: health and export documents are deleted automatically within 10 days after the horse is sold. Boarding and training documents are deleted when the horse is no longer in training with the stable.

Staff

For staff members: name, contact details, login data, assigned tasks and the tasks they completed (including time and any notes).

Legal basis: performance of the employment or service relationship (art. 6(1)(b)) and the stable’s legitimate interest in organising its work (art. 6(1)(f)). Retention: the account is removed when the person leaves. Task records, lesson slots and other work records stay with the stable, but the name on them is replaced with “Former staff member”.

Messages, announcements and notifications

Messages you send to the stable through the member environment, and a technical device token if you allow push notifications in the app. You can switch off notifications at any time in your device settings.

Legal basis: performance of the agreement (art. 6(1)(b)); push notifications only with your permission on the device (art. 6(1)(a)). Retention: messages until your account is deleted; device tokens until you sign out, uninstall the app or delete your account.

Horses for sale

Sale listings and photos are published on this website. Photos can show riders. If you appear in a photo and want it removed, contact us (see section 9).

Legal basis: the stable’s legitimate interest in selling horses (art. 6(1)(f)). Retention: listings of sold horses may be kept as part of the stable’s portfolio; you can ask for removal at any time.

Testimonials

Testimonials are published with the author’s name (and, where given, their horse’s name) only with the author’s permission.

Legal basis: consent (art. 6(1)(a)), which you can withdraw at any time. Retention: until withdrawn.

Automatic reading of horse passports

Stable staff can upload a photo of a horse passport so the horse’s details are filled in automatically. The image is processed by Google’s Vertex AI service in the EU (Belgium). It is not used to train AI models and is not kept by Google after processing. Owner details visible in the passport may be part of the image.

Legal basis: the stable’s legitimate interest in accurate horse records with less manual typing (art. 6(1)(f)).

Support assistant

The member environment has an AI support assistant that answers questions about using the platform. Your questions and the answers are processed by Google’s Vertex AI service in the EU (Belgium) and are not used to train AI models. If you ask to be contacted by a person, the assistant asks for your name and email address or phone number and passes them on to the stable.

If a stable administrator reports a technical problem through the assistant, the report — which can include the recent conversation — is filed in Equidentity’s issue tracker, hosted by GitHub (USA).

Legal basis: performance of the agreement (art. 6(1)(b)) and the legitimate interest in providing support (art. 6(1)(f)). Retention: conversations and contact requests are deleted automatically after 90 days.

We do not sell your data, do not use it for advertising, and do not take decisions about you based solely on automated processing, including profiling.

3. Who receives your data

Your data is visible only to authorised people at the stable, according to their role, and to Equidentity where necessary to operate, secure and support the platform. Each stable’s data is kept separate from every other stable’s.

We use the following service providers (sub-processors):

We may also disclose data when the law requires it, for example to the tax authorities or at the request of a court.

4. Transfers outside the European Union

Your data is stored in the EU, with one exception: uploaded files such as photos and horse documents are stored by Google in the United States. Some providers listed above are also based in, or can access data from, the United States. In those cases the transfer is protected by the EU–U.S. Data Privacy Framework or by the European Commission’s Standard Contractual Clauses, together with additional security measures such as encryption.

5. How long we keep your data

We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires. The retention period for each category is listed in section 2. In summary:

• Contact and inquiry messages: 24 months, then deleted automatically.
• Member account, messages, reservations and future bookings: until the account is deleted. Horses, care records, past bookings and maintenance requests stay with the stable but no longer show your name.
• Invoices, bookings and credit records: 7 years (Belgian accounting law).
• Horse health and export documents: within 10 days after a sale.
• Support assistant conversations and contact requests: 90 days.
• Server logs: about 30 days.

For disaster recovery, an offline backup of the database is kept for up to 5 days and deleted files can be recovered for up to 7 days. After that, deleted data is permanently erased. Backups are never used for any other purpose.

6. Children

Children under 13 do not get their own account. Their lessons are booked through the account of a parent or legal guardian, who acts on the child’s behalf and receives the communication. Riders aged 13 to 15 may have their own account; the stable makes sure a parent or legal guardian has agreed to their lessons. We only process the data of minors needed to organise their lessons and activities safely.

7. Cookies and local storage

This website does not use advertising, analytics or tracking cookies. It only uses storage that is strictly necessary for the site to work:

• Login session (stored in your browser’s local database) — only when you log in, to keep you signed in.
• Security — Google reCAPTCHA and Firebase App Check detect automated abuse of forms and logins. They load only on the login page, on shared document links, when you start filling in a form, and while you are signed in, never while you just read the website. To do this Google processes your IP address and browser information. Cloudflare may set a short-lived security cookie (__cf_bm) to tell people from bots.
• Preferences — your language, display settings and that you have seen the cookie notice.
• Offline cache — copies of the site’s own files so pages load faster and the app keeps working with a weak connection.

Videos (YouTube, Vimeo) and maps (Google Maps, OpenStreetMap) are only loaded after you click them. At that moment the provider receives your IP address and may set its own cookies under its own privacy policy.

8. Your rights

You have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict processing or object to processing based on legitimate interest;
• receive your data in a structured, machine-readable format (data portability);
• withdraw your consent at any time, where processing is based on consent.

Members can delete their own account at any time from the account page in the member environment. To correct your name, email address or phone number, contact the stable; it can update them for you.

We answer every request within one month. If your request is complex, we may extend this by two further months, and we will tell you why. We may ask you to confirm your identity first.

You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels — www.dataprotectionauthority.be — or with the authority in your own EU country.

9. Contact

For questions about this policy or to exercise your rights, contact the stable:

aikegrangestud@outlook.com