# Privacy Policy Last updated: 10 November 2026 ## Data Controller The controller of your personal data is Horseback Sp. z o.o., ul. Piastowska 1, 42-400 Zawiercie, Poland, e-mail: [\[email protected\]](https://horseback.pl/cdn-cgi/l/email-protection), e-Delivery address: AE:PL-23014-83592-GDTWB-12. ## What data we process - Data you provide in forms on the site (e.g. name, e-mail address, phone number) - including the "Let's stay in touch" sign-up and your inquiries. - Google account data (e-mail address, name) - if you sign in to fill in a participant card online. - Participant and guardian data provided in a class or camp participant card and, where necessary, the PESEL number and health data (special-category data) - processed on the basis of explicit consent; details are provided when filling in the card. - Data about your use of the site collected automatically (e.g. cookies, analytics data). - The image of persons on the grounds of the Hucisko Centre, recorded by video monitoring - details in the section "Video monitoring at the Centre". Providing data is voluntary but necessary to receive a reply, sign up for classes or a camp, or complete a participant card - without it we cannot carry out these actions. ## Purposes and legal bases We process your data in order to: - handle inquiries and sign-ups for classes and camps (performance of a contract or steps at your request), - contact you and send information about our offer - if you consent to it (consent), - operate, secure and improve the site (our legitimate interest), - comply with legal obligations (legal obligation). Special-category data (health data) is processed solely on the basis of explicit consent. ## Online payments Payments for purchases made on the website are handled by Stripe Payments Europe, Ltd., registered in Dublin (Ireland). We provide this entity with the data necessary to process the payment: first name and surname, e-mail address, amount and subject of the purchase, and in the case of purchases made on behalf of a business also the tax identification number (NIP) and billing address. We do not receive or store payment card data - it is provided directly to the payment provider. Stripe processes some data as an independent controller, in particular to prevent fraud and to fulfil obligations under the laws on payment services and anti-money laundering. In this respect, processing is governed by the Stripe privacy policy, available at . Data may be transferred outside the European Economic Area on the basis of standard contractual clauses approved by the European Commission. If, when making a purchase, you choose a deferred payment or payment in instalments offered by Klarna Bank AB (publ), that entity processes your data as an independent controller for the purpose of concluding and performing the deferred payment agreement, including creditworthiness assessment. Processing is governed by Klarna's privacy policy. The deferred payment agreement is concluded between you and Klarna; we do not receive from Klarna any data about your financial situation. We store purchase data for the period required by tax and accounting regulations and for the limitation period of claims. ## Health data of participants Data on the health of a participant, in particular information about illnesses, allergies, medication taken and contraindications to physical activity, is a special category of personal data. We process it only on the basis of explicit consent (Article 9(2)(a) GDPR), to the extent necessary to run the classes safely and to look after the participant, and only for as long as necessary for that purpose. Consent may be withdrawn at any time; however, withdrawing consent may mean that the classes cannot be carried out safely. We do not collect health data in the payment process. You provide it in the participant card, outside the purchase form, and it is not passed to the payment provider. ## Data of minor participants The data of a minor participant is provided by their parent or legal guardian, who concludes the agreement, makes the declarations concerning the child's health and indicates the persons authorised to pick the child up. We limit the scope of data to what is necessary: first name and surname, age, information relevant to the safety of the classes and the guardian's contact details. ## Video monitoring at the Centre The grounds of the Horseback Horse Riding and Outdoor Activity Centre, ul. Orle Gniazdo 20, 42-421 Hucisko, Poland, used by Horseback, are covered by video monitoring (without audio recording). The monitored area is marked with information signs. Monitoring does not cover toilets or changing rooms. The controller of the recordings is Horseback Sp. z o.o. (contact details - section "Data Controller"). The recordings include the image and behaviour of persons in the monitored area, including participants, accompanying persons and visitors. We operate monitoring to ensure the safety of people and animals, to protect property, to establish the course of events (in particular accidents) and to establish, exercise or defend legal claims. The legal basis is our legitimate interest in pursuing these purposes (Article 6(1)(f) GDPR). We keep recordings for no longer than 3 months from the date of recording, after which they are automatically overwritten. If a recording constitutes evidence in proceedings conducted under the law, or Horseback has learned that it may constitute such evidence, we keep it until the proceedings are finally concluded. Recordings may be received by providers of IT services and maintenance of the monitoring system, only to the extent necessary for its operation, and - at their request or for the purpose of pursuing claims - by authorities and entities entitled under the law (e.g. the Police, a court) and by an insurer in connection with handling a claim. You have the right to access recordings in which you appear, to have them erased, to restrict processing and to object to processing on grounds relating to your particular situation (Article 21 GDPR). When providing a recording, we protect the rights of other persons recorded on it, e.g. by blurring their image. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland. For monitoring matters, write to [\[email protected\]](https://horseback.pl/cdn-cgi/l/email-protection). ## Plugin for AI assistants (horseback.pl/mcp) We provide a public server at https://horseback.pl/mcp, used by AI assistants (e.g. ChatGPT, Claude) when you ask them about a trip, outing or team-building event at our centre. The server gives the assistant only public information about our offer - the same as on horseback.pl. It does not accept bookings, inquiries or payments; you book directly with us. The assistant may send the server the parameters of your request: type of group, number and age of participants, preferred date, budget and notes. We do not ask for your name, phone number, e-mail address or health information, and we ask you not to include them in the notes. We use the parameters to prepare the response to the request. Your conversation with the assistant is processed by its provider (e.g. OpenAI, Anthropic) as a separate controller, under its own privacy policy. We have no access to that conversation or to your account data with the assistant's provider. The server and its hosting infrastructure record data about server calls in technical logs, including the IP address of the connection - usually this is the address of the assistant provider's server, not your device. We process the logs on the basis of our legitimate interest (Article 6(1)(f) GDPR), to keep the server running and secure, and keep them for 30 days. ## Who we share data with We use providers that process data on our behalf, to the extent necessary to run the site: providers of hosting and cloud services, login authentication, analytics, and site delivery and protection. We do not sell your data. Some of our providers may process data outside the European Economic Area. Such transfers rely on a European Commission adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses; a copy of the safeguards is available at [\[email protected\]](https://horseback.pl/cdn-cgi/l/email-protection). ## Cookies We use necessary cookies (authentication, session, security) - they are required for the site to work and cannot be disabled - and, with your consent, analytics cookies (Google Analytics) and marketing cookies (Meta Pixel). Meta Pixel is a tool of Meta Platforms Ireland Limited. If you consent, it sends Meta information about your visit to our site (including the pages you viewed and your IP address), which lets us target our Facebook and Instagram ads to people who have already visited us. You can withdraw your consent at any time in the cookie settings - we then stop collecting this data. ## Data retention We keep your data for as long as needed for the purposes above: until the matter is handled, the account is kept or consent is withdrawn, and, where required by law, for the period resulting from those regulations. After that, we delete the data. ## Your rights Under the GDPR you have the right to: access your data, rectify it, erase it, restrict processing, data portability, object to processing, and withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). You also have the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (UODO) in Poland. ## Contact For privacy matters and to exercise your rights, write to: [\[email protected\]](https://horseback.pl/cdn-cgi/l/email-protection). ## Changes to this policy We may update this policy from time to time. We will announce material changes on the site. In case of any discrepancy, the Polish version prevails.