Privacy Policy – Equesty

PRIVACY POLICY — “EQUESTY” APP AND WEBSITE

Courtesy translation. The Polish version is the sole binding version and prevails on any discrepancy.

§1. Data controller

The controller of your personal data is Jakub Mikołajczyk, a sole proprietor (jednoosobowa działalność gospodarcza) trading as JM SOLUTIONS JAKUB MIKOŁAJCZYK, NIP 9681001932, REGON 389583483, address ul. Wiśniowa 8, 62-820 Stawiszyn, Poland, email contact@equesty.app (the “Controller”). This Policy covers the “Equesty” mobile application (the “App”) and the equesty.app website (the “Website”; see §10a). Capitalized terms — Service, User, Account, Organizer, Staff, Rider, Client, Content — have the meaning given to them in the Terms of Service; an Organizer is a stable or another entrepreneur that offers rides through the App.

§2. Data Protection Officer (DPO)

The Controller has not appointed a DPO, as the conditions of Art. 37 GDPR are not met (the business does not consist in large-scale processing of special categories of data or in regular and systematic monitoring of individuals on a large scale). For all matters concerning your data, contact contact@equesty.app.

§3. Purposes and legal bases of processing

We process your data for the purposes listed in the table. For each purpose we give the legal basis (Art. 6(1) GDPR; for a legitimate interest, what that interest is), the categories of data and the retention period; the rules common to the periods are set out in §7.

Purpose	Data categories	Legal basis (GDPR)	Retention period
Account and sign-in — creating and running the Account, signing in, App settings	Account data: first name and surname, email address, phone number, password as a cryptographic hash, avatar, settings (including language and favourite Organizers)	Art. 6(1)(b) (performance of the contract)	until the Account is deleted; permanent erasure within 30 days (§7)
Confirming the email address and the phone number, resetting the password, the “one number — one Account” rule, and protecting the App and the Website against fake accounts, fake bookings and abuse (limits on attempts and sends)	email address, phone number, one-time codes, counters of attempts and sends, App installation identifier, IP address (in counters, also as a hash)	Art. 6(1)(f) (legitimate interest: protecting Users and Organizers against fake accounts and bookings, and the security of the Service)	codes — until used or expired, at most 1 hour; counters — at most 24 hours; phone number — as Account data, cleared the moment the Account is deleted
Searching for Organizers, including near you, and the map	the query text; approximate device location (see §4)	Art. 6(1)(b) (a function you start on request)	while the query is served; we do not store location
Bookings — single, group and recurring rides, their changes and cancellations, ride history, karnets and the status of payments made outside the App	booking and ride data (date and time, Organizer, horse, person leading the ride, ride outcome), karnet data, payment status	Art. 6(1)(b) (performance of the contract)	as Account data
Organizer tools — records of horses, Staff, availability, Clients (including people without an Account), karnets, payment status and the Organizer's own rules	data entered by the Organizer and its Staff: Client data (first name and surname, phone, email, notes, internal skill level), horses and their photos, availability, karnets, the Organizer's own rules	Art. 6(1)(b) towards the Organizer and Users; (f) towards people without an Account (legitimate interest: providing the Service to the Organizer that runs activities for them)	until the Organizer deletes the data or the Organizer is removed from the App
Making your first name and surname, confirmed phone number and bookings available to the Organizer you are linked with	as in the purpose	Art. 6(1)(b) (the Organizer contacting you about your rides)	until the link ends or the Account is deleted
Linking the Account with a Client record kept by an Organizer — by a confirmed email address or phone number, or by invitation, link or code	email address, phone number, invitation identifier	Art. 6(1)(f) (legitimate interest: a consistent history of your rides with the Organizer)	as Account data
The Organizer's profile in the App and, once the Organizer turns it on, also on the Website, including determining the coordinates of its address	profile data (name, address and its coordinates, phone, email, description, logo and photos, price list, offer), first names and photos of Staff members named in the profile	Art. 6(1)(b) towards the Organizer; (f) towards Staff members (legitimate interest: presenting the offer of the Organizer that named them)	until the profile is turned off or the Organizer is deleted
Notifications — by email, in the App and push: bookings, changes, cancellations, reminders, invitations, codes, documents sent after sign-up, changes to the Terms and the Policy, confirmations that a termination was filed or withdrawn	email address, first name, push token, device name and platform, notification content (Rider's first name, Organizer's name, first name of the person leading the ride, date and type of event), information that a message was not delivered	Art. 6(1)(b); notices of changes to the Terms and the Policy — (f) (legitimate interest: informing you of the change), and towards Organizers — (c) (statutory duty to give notice); push notifications — only after you allow them in your device's operating system settings	in-app notifications — 90 days; push delivery receipts — 30 days; push token — until sign-out, Account deletion or invalidation of the token by the device's system
Recording acceptance of the Terms, confirmation of having read the Policy, notices of changes to these documents and terminations filed in the App	Account identifier, cryptographic hash of the email address, document type and version number, date and time of acceptance or confirmation; for each notice: recipient (email address, first name), document version, date and time sent, the message identifier assigned by the email provider, information that it was not delivered; for a termination: date filed, the Organizers it covers, the Account closing date, date withdrawn	Art. 6(1)(f) (legitimate interest: demonstrating which version of the documents the User accepted or received and when, and establishing, pursuing or defending claims); handling a termination — also (b)	while you hold the Account and, after it is deleted, in pseudonymized form until the end of the sixth calendar year (§7)
Messages to us — through the form on the Website or by email — including questions about the App, partnership proposals and enquiries from Organizers who want to join	first name, email address, message content, Website language; in an email — the data you provide	Art. 6(1)(f) (legitimate interest: replying to the person who writes to us); (b) where the message concerns concluding or performing a contract	12 months from the last message in the matter, unless the matter concerns a complaint or claims (row below)
Complaints, notices about Content and appeals against decisions on them (Terms §8 and §10a), and establishing, pursuing or defending claims	contact data, content of the notice or appeal, the Content the notice concerns	Art. 6(1)(f) (legitimate interest: handling the matter and establishing, pursuing or defending claims) and (c) (obligations under the laws on consumer rights and on digital services)	until the limitation period for claims expires
Analytics and error reports — only with your consent (see below)	data on your use of the App (e.g. screens opened and functions used), error reports (device model, system and App version, error description), random installation identifier	Art. 6(1)(a) (consent); Art. 399(1) of the Polish Electronic Communications Law	no longer than 12 months from collection; after consent is withdrawn — data linked to the Account deleted within 30 days
Legal obligations (e.g. replying to requests from competent authorities)	data necessary in the matter	Art. 6(1)(c) (legal obligation)	for the period the law requires

The processing of Website visitors' data is described in §10a.

Analytics and error reports — only with your consent. We collect data on how you use the App (e.g. screens opened and functions used) and App error reports (device model, system and App version, error description) only if you consent to it in the App. Consent to analytics and consent to error reports are separate. Until you give it, the App stores no information on your device for these purposes and sends us none of these data. We use them only to find out which functions are used and to detect and fix errors; we do not use them for advertising. They are processed on our behalf by a product analytics and error reporting provider with servers in the EEA. The basis is your consent (Art. 6(1)(a) GDPR, Art. 399(1) of the Polish Electronic Communications Law). You withdraw consent at any time in the App settings, as easily as you gave it; from the moment of withdrawal we stop collecting these data, and we delete the data linked to your Account within 30 days. We keep data collected with consent for no longer than 12 months from collection.

We send commercial information only with your prior consent. We do not use your data for advertising purposes.

§4. Data categories

Account data (first name and surname, email address, confirmed phone number, password as a cryptographic hash, avatar, settings); Organizer profile data (name, address and its coordinates, phone, email, description, logo and photos, price list, offer) and first names and photos of Staff members named in the profile; Client data entered by the Organizer (first name and surname, phone, email, notes, internal skill level) — including data of people who have no Account; booking, ride and karnet data; horse data and photos; the Organizer's own rules; push token, device name, platform and notification content; approximate device location (not stored); one-time codes, counters, installation identifier and IP address (briefly, see §3); records of accepting the Terms and confirming having read the Policy, the log of notices of changes to these documents, and terminations filed in the App; messages sent to us; with your consent — data on your use of the App and error reports; technical connection data (see §5 and §10a).

Phone number. Every Account has an email address confirmed by a code and a phone number confirmed by a code sent in a text message (SMS). You can confirm a number on only one Account. We send a confirmation code to the number; the number is not used for signing in or for resetting the password. Your confirmed number is visible to the Organizer you are linked with (see §3 and §5).

Organizer profile visibility. An Organizer's profile is visible to signed-in Users in search and on the map and, once the Organizer turns this on, also to Website visitors. The Organizer hides its profile in its settings; a hidden profile is found, and rides with that Organizer are booked, only by its Clients.

Location. We use location only when you allow it in your device's operating system settings (only while the App is in use) and start a nearby search or the map. Coordinates are rounded on your device to about 1 km, sent to our server solely to calculate distances to Organizers, and are not stored or logged — including in server logs. Without permission you search for Organizers by name or town.

IP addresses. The Controller does not store IP addresses in its database. An IP address is used briefly for the counters that protect against abuse (see §3; at most 24 hours, and on the Website a hash of the address kept in server memory for 10 minutes, see §10a), and is processed at network level by the hosting, CDN and network proxy providers when they handle connections (see §5 and §10a).

§5. Recipients and categories of recipients (entrustment, Art. 28 GDPR)

The Controller entrusts the processing of data to the following categories of recipients — processors with which it concludes data processing agreements (Art. 28 GDPR). For each category we state what the recipient does, which data it receives and where it processes them:

database and application hosting provider (App server, database, cache) — storing and processing the data described in §3 and §4, except files and photos; servers in the EU;
email service provider — sending messages from us (codes, invitations, documents and notices of their changes, replies) and receiving messages sent to us (the form on the Website, the contact@equesty.app address); scope: email address, first name, message content and attachments, information that a message was not delivered; processing in the US (see §6);
file storage and delivery provider (CDN) — files uploaded to the App: photos of horses, Organizers' logos and photos, avatars, Organizers' own rules; device IP addresses at network level; servers in the EU;
CDN and network proxy provider in front of the Website and the App server — delivering the Website and protecting the Website and the App server against abuse; scope: IP address, technical connection data and — in transit, for the time of transmission — the content of requests sent to the App server, including messages from the form; servers worldwide, including in the EU and the US — the connection is handled by the server nearest to you (see §6);
SMS delivery provider — delivering the code that confirms the phone number; scope: phone number and the content of the message with the code; processing in the EEA;
mobile app build and push notification delivery provider — App technical data, push token and notification content; processing in the US (see §6);
geocoding provider — the Organizer's address typed in by Staff and the coordinates set on the map; servers in the EU; your device's location is not passed to this provider;
product analytics and error reporting provider — only after you give your consent (see §3); scope: data on your use of the App, error reports, random installation identifier; servers in the EEA.

In addition, data are received by:

the operator of your device's operating system and app store — Apple or Google, depending on the device — distributing the App, delivering push notifications through the system service, displaying the map (see §10); processing in the US, on the terms set by that operator, which is a separate controller;
the Organizers you are linked with — your first name and surname, confirmed phone number, bookings and ride history with that Organizer, to the extent needed to run your rides. Access is held by that Organizer's Staff in the roles the Organizer has given them. Ask that Organizer how it uses these data outside the App.

We do not sell personal data or share them for advertising purposes.

A change of provider within a category — with the same purpose, scope of data and place of processing — does not change this Policy. We announce a new category of recipients, a new purpose of processing, or the first processing of data outside the EEA by an existing category, under §13. We keep the named list of the entities to which we entrust data in the Record of Processing Activities and provide it at your request (Art. 15 GDPR) sent to contact@equesty.app.

§6. Transfers outside the European Economic Area

We store data on servers in the EU. Outside the EEA — in the US — data are processed when passed to the email service provider, the mobile app build and push notification delivery provider, and the operating system operator (Apple or Google) when it distributes the App and delivers push notifications. The CDN and network proxy provider operates a global network of servers, so connections to the Website and to the App server are handled by the server nearest to you, also outside the EEA, including in the US. Some of the providers that store data in the EU belong to groups headquartered in the US and, as part of technical support, have access to the data from the US as well.

Each such transfer relies on: (a) Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection under the EU-US Data Privacy Framework — for certified recipients (Art. 45 GDPR), or (b) the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards at contact@equesty.app.

§7. Retention periods

The period for each purpose is given in the table in §3. Common rules:

Account data — Account deletion takes effect immediately (the Account becomes inactive and inaccessible, and the phone number is cleared at the same moment), and permanent erasure of the data follows within 30 days.
An Account whose email address has not been confirmed — we delete it 30 days after it was created, unless the Account has a role at an Organizer; the rules for Account data then apply.
One-time codes — until used or expired, at most 1 hour; counters of attempts and sends — at most 24 hours.
In-app notifications — 90 days; push delivery receipts — 30 days; push token — until sign-out, Account deletion or invalidation of the token by the device's system.
Device location — not stored (used only while the query is served).
Records of accepting the Terms and confirming having read the Policy, the log of notices of changes to these documents, and terminations filed in the App — while you hold the Account. After the Account is deleted (including an Account deleted because its email address was never confirmed), we keep these records in pseudonymized form: we remove the Account identifier, the email address and the first name, and keep a cryptographic hash of the email address, which lets only someone who already knows that address link a record to it. We delete these pseudonymized records at the end of the sixth calendar year after the year in which the Account's data were permanently erased, i.e. once the limitation period for claims has expired (Art. 118 of the Polish Civil Code).
Messages to us — 12 months from the last message in the matter; where the matter concerns a complaint or claims, until the limitation period for claims expires.
Data collected with consent (analytics, error reports) — no longer than 12 months from collection; after consent is withdrawn or the Account is deleted, deletion within 30 days.
Data needed to establish, pursue or defend claims — until the limitation period for claims expires; data whose retention the law requires — for the period those provisions require.
Website — connection data: see §10a(3); messages from the form: as for “Messages to us”.

§8. Rights of data subjects

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (to processing based on Art. 6(1)(f)), and, where processing is based on consent, the right to withdraw that consent at any time, without affecting the lawfulness of processing before the withdrawal. You withdraw consent to analytics and consent to error reports in the App settings (see §3). You change the location and push notification permissions in your device's operating system settings; you also choose notification types in the App. You delete the Account in the App (see §7). Send requests to contact@equesty.app; we reply without undue delay and at the latest within one month (Art. 12(3) GDPR). If the data concern you as a Client entered by an Organizer, contact the Controller or that Organizer.

§9. Right to lodge a complaint

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

§10. Information on your device, permissions and data from the system operator

The App uses no browser-type cookies (for the Website, see §10a). Under Art. 399 of the Polish Act of 12 July 2024 — Electronic Communications Law (Prawo komunikacji elektronicznej), we inform you of the purposes for which the App stores information on your device or accesses it:

without separate consent — where this is strictly necessary to provide the Service you request: authentication tokens (keeping you signed in); App settings (e.g. the selected Organizer, recent searches); the App installation identifier (random, separate from the analytics identifier), which protects against abuse when the phone number is confirmed (see §3) — until the App is uninstalled; the push token (after you allow notifications in the system settings); approximate location (after you allow it in the system settings, only during a nearby search or while the map is in use); camera and photos (only when you add a photo);
with your consent: If you consent to analytics or error reports, the App stores on your device a random installation identifier and the events and reports waiting to be sent. They are received only by the product analytics and error reporting provider acting on our behalf (see §5). After you withdraw consent, the App deletes them from the device; uninstalling the App deletes them too.

For other purposes the App stores information on your device only with your consent (see §3, analytics and error reports).

You set the conditions for storing and accessing this information in your device's operating system settings (location, notifications, camera, photos), and the consents to analytics and error reports in the App settings.

Map. The map in the App is displayed by the map service of your device's system operator (Apple or Google) — your device downloads the map data directly from that operator, which processes them under its own privacy policy.

Data from the system operator. If you agree in your device settings to share analytics data with app developers, the system operator (Apple or Google) passes us aggregate crash reports and App usage statistics on its own terms. You change this choice in your device's operating system settings.

§10a. The equesty.app website

This Policy also covers the Website. The controller of the data of Website visitors is the Controller named in §1. Using the Website requires no account and no personal data; you provide data only when you write to us through the form.
On the Website we use no cookies or other technologies that store information on your device, unless we first ask for your consent and you give it.
Displaying the Website. The Website is delivered by a CDN provider, from the server nearest to the visitor (see §5 and §6). With each request to the Website (e.g. opening a page) your browser sends that provider your IP address and basic technical request data (e.g. the page address, browser type, the referring page, date and time). We process these data only to deliver the Website and to keep it secure and protected against abuse (e.g. attacks on its availability), under Art. 6(1)(f) GDPR; our legitimate interest is providing the Website to those who request it and protecting it. The Controller keeps no logs of its own of visits to the Website; the provider keeps connection data only as long as needed to serve and secure the traffic, under its data processing agreement. The provider's dashboard shows us only aggregate traffic data (e.g. the number of requests), which do not identify visitors, and we use them only to maintain and secure the Website. Every version of the Terms of Service and the Privacy Policy is available on the Website as a page and as a PDF file; links to them in the App open them in the device's browser, and the connection data are processed as described in this paragraph.
Contact form and email. If you write to us through the form on the Website or to contact@equesty.app, we process your first name, email address, message content and the Website language in order to reply — under Art. 6(1)(f) GDPR (legitimate interest: replying to the person who writes to us) and, where the matter concerns concluding or performing a contract, also (b) — for 12 months from the last message in the matter, unless the matter concerns a complaint or claims (then as set out in §7). Sending the form requires neither consent nor an account. Your browser passes the form content to the App server through the network proxy (see §5); the server forwards it in a single email to our mailbox at the email service provider (see §5 and §6) and does not save it in a database. We reply from the contact@equesty.app mailbox to the address you give. To protect the form against abuse, the server keeps a hash of your IP address for 10 minutes, in memory only, as a counter of submissions; it does not save it in a database or in logs. The Website sets no cookie in the process, and the page showing the result of sending contains none of your data.
External links. The button leading to the app store opens a service of Apple or Google; the Website passes them no data about you in doing so, and your further use of those services is governed by their own rules.

§11. Age

The App is intended only for adults who have reached the age of 18. The Controller does not direct the Services to persons under 18 and does not knowingly process their data. When entering Client data, an Organizer must not enter data of persons under 18. Sending a message through the form on the Website is not based on consent (see §10a(4)), so Art. 8 GDPR does not apply to it.

§12. Security

We store passwords and refresh tokens as a cryptographic hash; transmission is encrypted (HTTPS); access to data is restricted by roles. One-time codes are random, valid for a short time and usable only once; the text message with a code contains no other data. We do not record phone numbers or the content of messages sent to us in server logs. We limit the content of push notifications to what is necessary — it does not include text typed by Staff (e.g. a ride cancellation reason, which is visible only in the App). The Controller applies organizational and technical measures appropriate to the risk (Art. 32 GDPR).

§13. Changes to the Policy

Each version of the Policy has an effective date; all versions, with a summary of changes, are available at equesty.app/pl/privacy-policy/versions. We inform you of a material change by email sent to the address assigned to the Account and by a message in the App at least 15 days before it takes effect, and we do not pursue a new purpose of processing before that day. A material change is: a new purpose of processing or a new legal basis for an existing purpose; a new category of recipients; transfer of data outside the EEA by a category of recipients that until then processed them only in the EEA; an extension of a retention period; a change of controller; a change in how you exercise your rights; extending processing to a new group of people. We publish other changes with a date and a summary of changes. A change that the law requires within a time that does not allow 15 days, or that is necessary to counter an urgent cybersecurity threat, we make without delay, stating its reason.

§14. Contact, versions and binding version

Contact: contact@equesty.app and the form on the Website. The version of the Policy in force is available at equesty.app/pl/privacy-policy; every version, including announced and archived ones, has its own unchangeable page with a PDF file at an address ending in the version number (e.g. equesty.app/pl/privacy-policy/v1), and the version history is at equesty.app/pl/privacy-policy/versions. The English version is available at the same addresses with /en/ in place of /pl/. The binding version is the Polish one; the English version is auxiliary.