Pre-launch privacy notice · English

Privacy Notice

This notice is deliberately not marked legally complete. The operator must fill every marked field, confirm the actual production data flows and obtain qualified legal review before launch.

Effective date: REQUIRED OPERATOR INPUT · Version: pre-launch 0.15.1

1. Who is responsible for personal data

YardMate operator/controller legal name: REQUIRED OPERATOR INPUT
Registered/business address: REQUIRED OPERATOR INPUT
Privacy contact: REQUIRED OPERATOR INPUT
Data Protection Officer or EU/UK representative, if legally required: REQUIRED OPERATOR INPUT / NOT APPLICABLE decision.

The controller/processor roles depend on the processing. The YardMate operator is normally a controller for its own account security, service administration, support and legal-compliance processing. A stable, stud, employer or other business using YardMate may be the controller for personal data it enters about its staff, riders, contractors or members, with YardMate acting as its processor. The exact allocation depends on the real arrangement and must be recorded in the Business Data Processing Addendum where required.

2. Who this notice covers

This notice may cover account holders, Stable Hands, stable owners/managers, horse owners, riders, contractors, support contacts and other identifiable people whose information is entered into YardMate. Horse information by itself is not personal data about a human, but a horse record can become personal data where it identifies or is linked to an owner, rider, worker or other person.

3. Personal data YardMate may process

• Account and membership data: name, account ID, stable membership, role, status and account lifecycle information.
• Authentication and security data: PIN verification material, session/security events, access/audit records and abuse-prevention information. YardMate does not store readable PINs.
• Stable-operation data: assignments, task history, rider names, staff actions, notes and records that may identify a person.
• Horse-linked data: ownership/rider associations, horse care, veterinary, breeding, feeding and training records where those records also identify a person.
• Photos/files: uploaded horse images and file metadata; images may incidentally contain people and should not be uploaded unless authorised.
• Ride data: rider, horse, dates, times, duration, distance and optional notes. Precise route points are collected only after the rider starts tracking and chooses to save a route.
• Support/compliance data: privacy requests, account-removal requests, correspondence and records needed to evidence how a request or incident was handled.
• Device preferences stored locally: language, selected YardMate view, selected stable, Stable Hand access code and a short-lived ride-recovery checkpoint. The ride checkpoint is limited to time/ride choices and excludes exact coordinates and notes.

The current product does not store payment-card data, does not use advertising trackers, does not use third-party behavioural analytics, and does not use customer personal data to train a general-purpose AI model. If those facts change, this notice and the applicable consent/lawful-basis assessment must be updated before the new processing begins.

4. Human sensitive data and minors

YardMate is designed for horse and stable records, not for storing human medical records, ethnicity, religion, criminal history, sexual-life information or other special/sensitive personal data. Do not put such human information into free-text horse or task notes unless the relevant controller has confirmed a lawful basis, any additional GDPR Article 9 condition, and any Qatar PDPPL approval or safeguard that may be required. Data about children/minors must not be entered merely for convenience; the stable/operator must first confirm the applicable guardian notice/consent, safeguarding and Qatar special-data requirements.

5. Why personal data is used and lawful bases

The lawful basis must be determined for each real processing activity. The expected framework is:

• Provide YardMate and manage accounts: performance of a contract or steps requested before a contract; for business users, some account administration may also rely on legitimate interests.
• Stable/customer records processed on behalf of a business: the business controller determines its lawful basis; YardMate processes the data on documented instructions under the DPA.
• Security, fraud/abuse prevention and audit: legitimate interests in protecting users, animals, records and the service, and legal obligations where applicable.
• Optional precise ride location: user-triggered processing only. For personal users consent may be appropriate. In an employment/staff context, the stable must determine a lawful basis and must not assume employee consent is automatically valid.
• Legal requests, disputes and compliance: legal obligation and/or legitimate interests in establishing, exercising or defending legal claims, as applicable.

REQUIRED OPERATOR INPUT: approve a record-of-processing/lawful-basis matrix before launch and document any legitimate-interest assessment.

Qatar-specific basis check: where the Qatar PDPPL applies, the controller must separately confirm the consent requirement or the specific statutory circumstance that permits processing without consent. A GDPR Article 6 lawful basis does not automatically answer the Qatar PDPPL question. For any special-nature data, complete the additional Qatar permission/safeguard analysis before processing.

6. Where data comes from

Personal data may come directly from the individual, from a Stable Owner/Manager or other authorised user, from device location only when Ride Tracking is deliberately started, and from security/audit events generated by use of the service. If a stable enters another person's data, that stable is responsible for having authority to do so and for providing any notice required by law.

7. Cookies and local device storage

YardMate currently uses one strictly necessary HttpOnly session cookie for sign-in and security. It also uses local device storage for language, appearance, selected stable, Stable Hand access-code convenience and bounded ride recovery. These items are used to deliver the requested service, not for advertising or cross-site tracking. If non-essential analytics, marketing pixels or similar technologies are added later, the operator must reassess cookie/ePrivacy/PECR consent requirements before enabling them.

8. Sharing, processors and international transfers

Personal data should be disclosed only to authorised users and the service providers needed to operate YardMate, such as hosting/database, private object storage, security/monitoring, support and—if a native app is later released—app-store infrastructure. Actual provider names, locations, subprocessor roles and transfer mechanisms: REQUIRED OPERATOR INPUT.

If GDPR-protected data is transferred outside the EEA/adequate jurisdictions, the controller must identify a valid transfer mechanism such as an adequacy decision or appropriate safeguards (for example applicable Standard Contractual Clauses) and complete any required transfer assessment. Qatar processing/transfer requirements must also be checked against the PDPPL and current NCSA guidance.

9. Precise location

Location is not requested at sign-in. The Ride Tracker asks for location only after the rider deliberately starts the feature. A rider can continue with time-only tracking if location is denied or unavailable. The web/PWA does not claim reliable locked-screen/background tracking. Exact route points are separated from ordinary ride records and are visible only through authorised access. Saving exact routes is optional.

10. How long data is kept

Production requires an operator-approved retention period for exact route points, activity/security history, task history, completed privacy requests and completed account-removal requests. YardMate refuses a production configuration that omits those periods. An audited retention job can report eligible records first and then purge only completed/aged records after explicit Platform Admin confirmation. Open privacy/removal requests are never age-purged. Stable-controlled horse/care/business records and backup expiry remain controller/operator policy decisions and are not silently auto-deleted by this job. Exact periods and backup expiry are REQUIRED OPERATOR INPUT.

The browser session cookie is configured for a 12-hour maximum session by default. An unfinished foreground ride checkpoint expires after 12 hours and does not contain exact route coordinates or notes. On a completed account-removal workflow, access credentials are disabled, exact route points associated with the requesting rider are deleted, and direct display-name fields that are reliably linked to the account are replaced with a non-identifying placeholder. Stable-owned/audit records may remain where there is a documented lawful retention reason; unrelated free-text that cannot be safely linked to one person is handled through the privacy-rights workflow rather than guessed.

11. Your data-protection rights

Depending on the law and the processing, you may have rights to be informed, access your personal data, correct inaccurate data, request erasure, restrict processing, object to certain processing, data portability (receive portable data), withdraw consent, and not be subject to certain solely automated decisions. YardMate does not currently make solely automated decisions about people that produce legal or similarly significant effects.

For GDPR requests, the controller should respond without undue delay and normally within one month; lawful extensions/exceptions may apply. Qatar PDPPL rights include protection/lawful processing, withdrawal of consent, objection in specified circumstances, erasure, correction, notification and access. Use the authenticated privacy-request mechanism in YardMate when available, the account-removal page for deletion/removal, or the privacy contact above. Identity checks must be proportionate; never send your PIN by email.

12. Complaints

You may complain first to the operator at the privacy contact above. Where GDPR applies, you may also complain to the competent EU/EEA supervisory authority, including the authority where you live, work or where the alleged infringement occurred. Where UK data-protection law applies, the Information Commissioner's Office may be the supervisory authority. In Qatar, the applicable complaint route/competent authority must be confirmed from current National Cyber Security Agency (NCSA) arrangements before launch: REQUIRED OPERATOR INPUT.

13. Security and personal-data breaches

Current application controls include stable/role scoping, hashed PIN verification, HttpOnly sessions, CSRF protection, private media delivery, no-store controls for private data, audit records and deployment security gates. Production must also have HTTPS, strong secrets, access control, backups/restore testing, monitoring and incident response. If a personal-data breach occurs, the operator/controller will assess risk and make any legally required regulator and individual notifications. Under GDPR, a controller notification to the competent authority may be required within 72 hours of awareness where the breach is likely to create risk; processors must notify their controller without undue delay. Qatar PDPPL has its own serious-harm notification duties.

14. Changes

Material changes to this notice will be posted with a new effective date and, where appropriate, brought to users' attention in the product. A new use of data that is incompatible with the stated purpose will not be hidden inside a routine policy update.