Privacy policy

Horse Monkey UK Privacy Policy

Effective date: 26.09.01

1. Introduction

(a) Welcome to Horse Monkey. Horse Monkey enables people to plan, manage, promote and sell tickets, entries and services for equestrian events ("Events"). We provide our services through our website and related online services (the "Service").

(b) This privacy policy explains how Horse Monkey Limited collects and uses personal data, the circumstances in which we share it, how long we keep it and the rights available to you. It applies when Horse Monkey acts as a controller and decides why and how personal data is used.

(c) An Event organiser (an "Organiser") normally acts as a separate controller for information it collects or uses to organise and run its Event, decide eligibility, communicate with entrants, publish results or conduct its own marketing. Where Horse Monkey handles Event information solely on an Organiser's documented instructions, Horse Monkey acts as that Organiser's processor. You should also read the relevant Organiser's privacy notice, which should be available on its Organiser or Event page.

(d) Some Event information may be shared with Organisers or relevant sport governing bodies. Rider names, horse names, times and results may also be published by an Organiser as part of an Event's start lists, running orders or results. Clause 6 explains this in more detail. We do not make all account information public by default.

2. About us and how to contact us

(a) Horse Monkey Limited is a company incorporated in England and Wales under company number 08227088. Our registered office is 1 Gleneagles Drive, Brockhall Village, Old Langho, Lancashire, BB6 8BF. Our main trading address is Mere Court Stud, Mythop Road, Weeton, Lancashire, FY4 4XB. Our VAT registration number is 151 6571 17.

(b) For privacy questions, rights requests or complaints, contact us:

• by email at hello@horsemonkey.com;
• by telephone on 0333 050 7420; or
• by post at Mere Court Stud, Mythop Road, Weeton, Lancashire, FY4 4XB.

3. The personal data we collect

3.1 Information you provide

(a) When you create or manage a Horse Monkey account, we may collect your name, contact details, account credentials, organisation or membership details, preferences, and information about horses, athletes or other people you are authorised to manage.

(b) When you register for an Event, the relevant Organiser may ask for information needed to administer the Event. This may include entry details, age or date-of-birth information, membership and eligibility information, emergency contacts, accessibility information, results and other Event-specific information.

(c) When you purchase merchandise, we collect the information needed to take and fulfil the order, including your name, email address and delivery address. Card details are collected through Stripe Checkout and are not received or stored by Horse Monkey.

(d) When you contact us, we collect the information in your enquiry and our response. If you use the Intercom support function, Intercom processes the information needed to provide that support.

(e) You must provide information marked as required if you wish to create an account, complete a booking or use the relevant feature. If you do not provide it, we may be unable to provide that part of the Service or the Organiser may be unable to accept your entry.

3.2 Information created when you use the Service

(a) We collect booking, transaction and Event history, your interactions with features and communications, device and browser information, IP address, log and security data, and cookie or similar-technology data.

(b) If you choose to search for Events by distance and permit access to your location, we use latitude and longitude information to perform that search. Your browser controls whether location access is allowed. We do not use precise locations for advertising.

(c) We use Google Analytics only where the required analytics choice has been made. Our Cookie Notice, available through the cookie settings link on the Service, explains the technologies used, their purposes, duration and available controls.

3.3 Information from other people and organisations

(a) Organisers may give us information about entrants, account managers, athletes, riders, members, horses, ponies, results and Event administration. An Organiser may create a limited Event record or add an account manager for the purpose of administering an Event.

(b) Where an Organiser adds an account manager using an email address, Horse Monkey sends an automated notification to that address. The notification does not mean that the recipient requested or consented to the record, agreed to act as an account manager or accepted Horse Monkey's terms.

(c) An adult account holder may provide information about a child, another athlete, an emergency contact or another person. The account holder must be authorised to provide and manage that information.

(d) Relevant sport associations or governing bodies may provide or confirm membership, registration or eligibility information where the applicable integration and Event rules permit it.

(e) You may contact us using clause 2(b) to request correction of information or review of your association with an account. Where the Organiser controls the information, we may refer the request to that Organiser or assist it in responding.

3.4 Special category data

(a) Information about health, disability, race or ethnicity, religion or other matters protected as "special category data" may be requested by an Organiser where genuinely needed for an Event, for example to make accessibility or safety arrangements. The Organiser normally determines why this Event-specific information is needed and acts as controller. Horse Monkey processes it on the Organiser's documented instructions where we act as its processor.

(b) We do not use Event health or accessibility information for advertising or general analytics. If Horse Monkey must use special category data for its own legal claims, we rely on the legal-claims condition. In an emergency where the person cannot consent, processing may be necessary to protect vital interests. We use another condition only where it applies and provide any additional information required by law.

3.5 Children's data

(a) People under 18 may not create their own Horse Monkey account. An adult may use an account to enter or manage a child in an Event. We may therefore hold a child's identity, age, membership or eligibility details, Event entries, times, results and information needed for safety or accessibility.

(b) The adult providing a child's information must have appropriate authority to do so and should explain the relevant processing to the child in a way the child can understand. We and Organisers should collect only information reasonably needed for the Event.

(c) Children have their own data protection rights. A child or a person acting on the child's behalf may contact us using clause 2(b). Where an Organiser controls the information, we may direct the request to that Organiser or assist it in responding.

4. How we use personal data and our lawful bases

(a) We use personal data only where we have a lawful basis. The basis depends on the purpose and context.

(b) Our legitimate interests include providing and improving the Service, administering Events, supporting users and Organisers, protecting systems and users, preventing fraud and enforcing legal rights. We consider the impact on affected people before relying on legitimate interests. You may object to processing based on legitimate interests as explained in clause 11.

(c) We do not currently make decisions about you based solely on automated processing that produce legal or similarly significant effects. If this changes, we will provide the information and safeguards required by law.

5. Marketing and preferences

(a) We may send electronic marketing where you have consented or where the law permits us to use the soft opt-in for our own similar products or services. We do not use the soft opt-in for third-party marketing.

(b) You can opt out at any time using the unsubscribe link in a message, changing available account preferences or contacting us. Opting out of marketing does not stop operational communications about your account, booking, event or transaction.

(c) An Organiser is responsible for its own marketing and must explain its use of your information in its privacy notice. Horse Monkey's provision of event data does not give an Organiser unrestricted permission to use it for marketing.

6. Event information and public results

(a) The relevant Organiser determines the information needed to administer its Event and normally decides whether to publish start lists, running orders, times and results. Depending on the Event, published information may include rider name, horse or pony name, class, start time, competition time, score, placing and result.

(b) Public Event information may be visible without an account and may remain available as part of the Organiser's sporting or historical record. The Organiser should explain its purpose, lawful basis and retention period in its privacy notice. Horse Monkey hosts and displays the information on the Organiser's instructions where we act as processor.

(c) Event information that is not intended for publication, such as contact details, account credentials, emergency contacts and health or accessibility details, is not included in public results through the ordinary operation of the Service.

(d) If published information is inaccurate or you have a concern about publication, contact the Organiser or Horse Monkey. We may refer the matter to the Organiser and assist it in addressing correction, objection, safeguarding or association-removal requests. Rights are not absolute, and the Organiser may have a lawful reason to retain an accurate sporting record.

7. Sharing personal data

(a) We may share personal data with:

• the Organiser responsible for an Event you enter and relevant sport associations or governing bodies where needed to administer or validate the Event;
• Stripe, which provides payment and fraud-prevention services under its own terms and privacy information;
• delivery providers where you order merchandise;
• hosting, communications, customer-support, security, analytics, address-search and IT suppliers, including Google service providers, Intercom, Mailchimp, Mailgun, Cloudflare, What3Words and operational alert providers where their relevant services are used;
• professional advisers, auditors, insurers, banks and organisations supporting our business;
• regulators, courts, law-enforcement bodies, tax authorities and other public authorities where disclosure is required or permitted by law; and
• a buyer, seller or adviser involved in a proposed or completed corporate transaction, subject to appropriate confidentiality and data-protection measures.

(b) Organisers can access information relating to their Events. They must use Event information only for lawful, disclosed purposes and must not search for or use a person's profile information without appropriate authority.

(c) We require processors to protect personal data and use it only on documented instructions. Some recipients, including Organisers, Stripe, governing bodies and professional advisers, may act as separate controllers for their own processing.

8. International transfers

(a) Some suppliers or recipients may process or access personal data outside the United Kingdom. Before making a restricted transfer, we use a mechanism permitted by UK data protection law. Depending on the recipient and country, this may be UK adequacy regulations or an appropriate safeguard such as the UK International Data Transfer Agreement or UK Addendum, together with the required data protection test and supplementary measures. We use an exception only where its legal conditions are met.

(b) You may contact us for more information about a relevant transfer mechanism or to request a copy of applicable safeguards, subject to necessary redactions.

9. Security

(a) We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure or access. Access is limited to people who need it for their role and who are subject to confidentiality obligations. No online service can guarantee absolute security.

(b) We maintain procedures for suspected personal data breaches and notify affected people and the Information Commission where the law requires us to do so.

10. Retention

(a) We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting, tax, insurance and reporting requirements and to establish or defend legal claims.

(b) Account information is normally retained while an account is active and for a reasonable closure period. Core contracts, bookings and transaction records may be retained for up to six years after the relevant transaction or account closure. Security logs, support records, marketing preferences, incomplete bookings and backups have shorter or different periods based on security, support and operational need. Backup copies are protected and deleted or overwritten through scheduled cycles.

(c) Event entry and results information may be retained for longer where the relevant Organiser has a lawful historical, sporting or record-keeping purpose. The Organiser's privacy notice should explain that retention. Where Horse Monkey determines the retention of identified results for its own purpose, we periodically review whether continued identification remains necessary and lawful.

(d) Location information retained on the device for Event search is kept only for the period stated in the Cookie Notice. Optional analytics data is subject to the configured analytics retention period.

(e) We may retain limited information needed to record an objection, cookie choice or marketing opt-out. We may anonymise information so that it can no longer identify anyone and use that anonymous information for statistical or analytical purposes.

11. Your rights

(a) Depending on the circumstances and our lawful basis, you may have the right to:

• ask for access to your personal data and information about its use;
• ask us to correct inaccurate or incomplete data;
• ask us to erase personal data;
• ask us to restrict processing;
• object to processing based on legitimate interests;
• object at any time to processing for direct marketing;
• receive personal data you provided in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller where the portability right applies; and
• withdraw consent at any time, without affecting processing carried out before withdrawal.

(b) These rights are not absolute. We will explain if an exemption or restriction applies. To exercise a right, contact us using clause 2(b). You do not have to use a particular form.

(c) We may ask for information reasonably needed to confirm your identity or clarify the request. We normally respond without undue delay and within one month. Where the law permits an extension because a request is complex or there are multiple requests, we will tell you within the initial response period. We charge a reasonable fee or refuse to act only where the law permits.

12. Privacy complaints

(a) You may complain to us if you believe our use of your personal data infringes data protection law. Use any contact route in clause 2(b). We will acknowledge a privacy complaint within 30 days, take appropriate steps to investigate it without undue delay and tell you the outcome.

(b) You also have the right to complain to the Information Commission, the UK data protection regulator. Current complaint details are available at ico.org.uk/make-a-complaint. You do not have to complain to us before contacting the regulator, although raising the issue with us first may allow us to resolve it more quickly.

13. Cookies and similar technologies

(a) We use necessary technologies to provide requested features, protect accounts and process payments. We use optional analytics only where the required choice has been made. We do not use Hotjar.

(b) Our Cookie Notice explains each technology, its provider, purpose, duration and available controls. You can open cookie settings from the Service at any time to change your analytics choice or object to preference technologies where applicable.

14. Changes to this policy

(a) We may update this policy to reflect changes to the Service, our processing or the law. We will publish the updated version and its effective date and, where a change materially affects you, take reasonable steps to bring it to your attention.

V26.09.01