Privacy Policy

Last updated: DD Month YYYY

1. Who is responsible for your data?

The data controller is:
Company / organisation name
Street and number
Postal code, City, Country
VAT: BE 0000.000.000
E-mail: privacy@yourcompany.com

2. What data we collect and why

Account & profile

• E-mail address, first name, last name, phone number
• Password (stored as a one-way hash — we never see the plain-text password)
• Account role (user / editor / admin)

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — we need this to create and manage your account.

Horses

• Name, weight, age, condition score and workload of horses you register

Legal basis: performance of a contract — this data is the core service (personalised nutrition calculations).

Product reviews

• Star rating and written comment linked to your account

Legal basis: consent (Art. 6(1)(a)) — you voluntarily submit a review.

Contact messages

• Name, e-mail address, subject and message text you enter in the contact form

Legal basis: legitimate interest (Art. 6(1)(f)) — responding to your enquiry. Messages are emailed to our team and are not stored in the database.

Usage analytics

• Event type (e.g. page view, product view), anonymised session ID, approximate country and a one-way hash of your IP address

Legal basis: legitimate interest — understanding how the app is used in aggregate to improve the service. Your IP address is hashed and cannot be reversed.

3. How long we keep your data

• Account & profile data: for as long as your account exists, plus 30 days after deletion for backup purposes.
• Horse data & reviews: deleted immediately when you delete your account.
• Analytics events: 24 months, then automatically purged.
• Contact messages: kept in our inbox for 12 months, then deleted.

4. Who has access to your data?

Your data is processed only by Company name staff and, where necessary, by the following processors who are bound by a Data Processing Agreement:

• Hosting provider: Provider name, Country
• E-mail delivery (SMTP): Provider name, Country

We do not sell, rent or share your data with any third party for marketing purposes.

5. Your rights under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15): request a copy of all data we hold about you.
• Right to rectification (Art. 16): correct inaccurate data via your profile page.
• Right to erasure (Art. 17): delete your account and all associated data.
• Right to data portability (Art. 20): download your data as a JSON file.
• Right to restrict processing (Art. 18): request we pause processing your data.
• Right to object (Art. 21): object to processing based on legitimate interest.

You can exercise the access, portability and erasure rights directly from your Profile page. For all other requests, contact us at privacy@yourcompany.com. We will respond within 30 days.

6. Cookies and local storage

This app does not use tracking cookies. We store your login token in your browser's localStorage solely to keep you signed in. This data never leaves your device except as part of authenticated API requests to our own server.

7. Security

Passwords are stored using bcrypt (one-way hashing). All communication between your browser and our server uses HTTPS. Access to personal data is restricted to authorised staff only.

8. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page will always reflect the most recent version. For significant changes we will notify registered users by e-mail.

9. Complaints

If you believe we are not handling your data correctly you have the right to lodge a complaint with the Belgian supervisory authority:

Gegevensbeschermingsautoriteit (GBA)
Drukpersstraat 35, 1000 Brussel
www.gegevensbeschermingsautoriteit.be