Privacy
What we ask you for, why we ask, who else ever sees it and how to get it back or have it deleted. Written for a person rather than for a regulator.
Last updated
Who is responsible
The Paddocks Riding Centre, Woodside Road, Sandyford, Dublin 18, Ireland, is the data controller for everything described here. Email info@paddocks.ie or ring +353 87 223 7981.
We are a small family yard, so there is no separate data protection officer. That email address reaches the people who can actually do something about it.
What we collect, and why
- Your name, email address and phone number
- So we can confirm the booking, send you the details and reach you if a horse goes lame the morning of your ride.
- The name, age and riding experience of every rider
- So the group is put together sensibly and the instructor knows who is in front of them before the session starts.
- Each rider’s height and weight
- This is the one that surprises people, so here is the plain reason. Horses are matched to riders by size and by weight: a child of 40 kg and an adult of 90 kg do not ride the same horse, and putting the wrong rider on the wrong animal hurts the horse and can hurt the rider. We use it to pick a horse and to tack it up. We use it for nothing else, and it never leaves the yard.
- An emergency contact
- A name and a number we can ring if somebody is hurt while they are with us.
- Anything you type into the notes
- An old injury, an allergy, a nervous child, a birthday. Tell us what keeps the ride safe and nothing more than that.
- Your booking history
- So the yard can see you have ridden with us before and at what level, and so the accounts add up at the end of the year.
- Payment information
- We never see or store your card. Card, Apple Pay, Google Pay and Revolut Pay are handled from end to end by Stripe. What comes back to us is the amount, the currency, the last four digits and whether it worked.
- The newsletter
- Your email address, and only if you tick the box. One click unsubscribes.
- Ordinary server logs
- Our host records requests, including IP addresses, so the site can be kept running and the booking form cannot be hammered by a script.
If you tell us about an injury, a condition or a disability so we can keep somebody safe, that is health information and we treat it with more care than the rest. It goes to the instructor who needs it, it goes nowhere else, and it is deleted once the ride has happened.
Our lawful bases
- Performing a contract
- Taking the booking, taking the payment, sending the confirmation, running the ride and issuing gift vouchers.
- Legal obligation
- Keeping the accounting and tax records that Irish law requires us to keep.
- Legitimate interests
- Keeping riders and horses safe, keeping a record of who rode what, answering enquiries and stopping abuse of the booking form. We have weighed that against your privacy and think it is what anybody would expect a riding centre to do.
- Consent
- The newsletter, and any photograph of you used in our marketing. You can take that consent back at any time, and doing so does not undo what was lawful before.
- Explicit consent, and vital interests
- Health information you give us for safety rests on your explicit consent. In an emergency on the yard we would also rely on protecting somebody’s vital interests.
Children
Most of our riders are children. A parent or guardian makes the booking, gives us the child’s details and exercises the rights below on the child’s behalf. We do not market to children.
Who else sees it
- Stripe
- Takes card, Apple Pay, Google Pay and Revolut Pay payments, and is responsible for the card data itself under its own privacy notice.
- Our email provider
- Sends the confirmations, the reminders and our replies. It handles the message and the address it is going to.
- Our hosting provider
- Runs this site and stores the booking diary behind it.
- Meta
- Only if the WhatsApp or Facebook features are switched on, and only for the message you choose to send through them. If they are off, nothing goes to Meta.
- Our accountant, and the Revenue Commissioners
- For the records we are obliged to keep and to file.
We do not sell your information and we do not share it for anybody else’s marketing. There is no exception to that.
Cookies and measurement
As this site is built today it sets no advertising cookies and no analytics cookies, and there is no tracking pixel on it. That is why you were not shown a consent banner. If we ever add measurement, we will ask you first.
Stripe sets its own cookies on its payment pages, which are needed to take a payment securely and to spot fraud. Where content is loaded from Meta, it can set cookies of its own, and it is only loaded when you ask for it.
Sending data outside the EEA
Stripe and Meta are global companies, and some of their processing happens outside the European Economic Area. Where it does, it is covered by the European Commission’s standard contractual clauses. We ask our own suppliers to keep the booking records inside the European Union.
How long we keep it
- Bookings, rider details and payment records
- Six years, which is how long Irish tax and accounting records must be kept.
- Health and medical notes
- Deleted once the ride has happened, unless there was an incident.
- Incident and accident records
- Longer, because a claim can be brought years afterwards. We keep them for as long as our insurer and our solicitor advise.
- Emails and enquiries that did not become a booking
- Two years, then deleted.
- Newsletter subscription
- Until you unsubscribe.
- Server logs
- A few months.
Your rights
Under the GDPR you can ask us to:
- give you a copy of everything we hold about you;
- correct anything that is wrong;
- delete it, where we are not obliged to keep it;
- stop or limit what we do with it;
- send it to you, or to another business, in a file that can be read;
- and take back any consent you have given, at any time.
Ask by email at info@paddocks.ie. We answer within one month and we do not charge. We may ask you to confirm who you are first, so that nobody else can ask for your file.
Automated decisions
There are none. No profiling, no automated scoring, no algorithm deciding whether you may ride. A person at the yard reads every booking and makes the call.
If you are not happy
Tell us first — it is usually quicker. If we do not put it right, you have the right to complain to the Data Protection Commission: dataprotection.ie, 21 Fitzwilliam Square South, Dublin 2, D02 RD28. Complaining to them takes nothing away from coming back to us.
Changes to this notice
When this notice changes, the date at the top changes with it. Anything material will be put in front of you the next time you book rather than left here to be found.