§ 01
Who we are
For the personal data described in these Terms, the Company acts as the data controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR") and Czech Act No. 110/2019 Coll. on the processing of personal data.
We take your privacy seriously. We process only the personal data we genuinely need to operate the Services, and every processing activity is tied to a specific legal basis listed below.
If you have any questions about this document or wish to exercise any of your rights under the GDPR, please contact us in the manner described in Section 14 below.
§ 02
What personal data we collect and why
We collect the following personal data ("Personal Data") depending on how and to what extent you use our Application and Services.
2.1 Data necessary for registration and access to the Application
For the purpose of registering in our Application and subsequently logging in and accessing personalized services, we process the following Personal Data: (i) username, (ii) password (stored as a bcrypt hash, never in plain text), (iii) optionally an email address, (iv) the chosen role and (v) language preference.
Processing this data is necessary for the performance of a contract to which you are a party. The legal basis for processing this information is Article 6(1)(b) GDPR.
2.2 Data necessary for providing the Services
For the purpose of providing our Services (stable management, horse records, training plans, competition entries and other operational features), we process the operational data you enter: (i) information about your horses, (ii) feeding logs, (iii) health and farrier records, (iv) training plans and videos, (v) competition entries, (vi) photographs and (vii) course diagrams. You decide what you record in the Application.
Processing this data is necessary for the performance of a contract to which you are a party. The legal basis for processing this information is Article 6(1)(b) GDPR.
2.3 Data collected for marketing purposes
For the purpose of sending our newsletter and information about news, discounts, improvements and offers by email, we process: (i) your email address, (ii) optionally your name and (iii) language preference.
We process this Personal Data on the basis of your explicit consent. The legal basis for processing this information is Article 6(1)(a) GDPR.
If you decide that you no longer wish to receive such messages, you have the right to withdraw your consent at any time by clicking the unsubscribe link in the footer of any email. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
2.4 Data collected when you use the Application
Traffic measurement runs in two independent layers with separate legal bases, which we never join.
(A) Cookieless server-side counter — always on, no consent banner. Each article view is logged on the server in a form that cannot be linked to a specific person. From your IP and User-Agent the server computes an HMAC-SHA256 using a secret daily salt: the salt is replaced every midnight UTC and the previous one is overwritten in place, so after 24 hours the resulting hash becomes cryptographically unreversible. We store only this hash, the article slug + language, the country code (from the Cloudflare header) and the referer host — never your raw IP, User-Agent, or any identifier on your device. Legal basis: Article 6(1)(f) GDPR (legitimate interest), aligned with EDPB Guidelines 1/2024 and CJEU C-621/22 (October 2024) on legitimate interest for cookieless analytics. You may object to this processing at any time under Article 21 GDPR (contact in Section 14).
(B) Optional behaviour telemetry — consent only. If you accept analytics cookies, our self-hosted JS script additionally measures scroll depth, time on page, CTA clicks, and client errors on top of (A). The script sets the sgt_anon_id cookie on your device (1 year) and uses the open-source rrweb library (see Section 2.7). Legal basis: Article 6(1)(a) GDPR (consent). You can withdraw consent at any time in Cookie Settings; the script then stops running and the cookie is deleted.
Both layers are retained for at most 13 months (the regulator's statistical-analytics cap) and live exclusively on our EU servers. No third party has access. Datasets (A) and (B) are never joined — the different legal bases preclude it.
2.5 Data collected when you communicate with us
For the purpose of communicating with us for any reason (support, bug reports, questions about Services, problem resolution), we process: (i) your name, (ii) email address, (iii) the content of the communication, (iv) metadata associated with the communication and (v) any other data you choose to include.
Processing this data is necessary for the performance of a contract or for taking steps prior to entering into a contract. The legal basis for processing this information is Article 6(1)(b) GDPR.
2.6 Data necessary for payment processing
If you purchase a paid service or subscription within the Application, we process the following data for the purpose of completing the payment: (i) first and last name, (ii) billing address, (iii) email and (iv) data necessary for invoicing. We never process or store actual payment details (card number, expiry date, CVV) — these are processed directly by the payment service provider (see Sections 4 and 11).
Processing this data is necessary for the performance of a contract. The legal basis for processing this information is Article 6(1)(b) GDPR. Data arising from accounting and tax obligations is also processed under Article 6(1)(c) GDPR.
2.7 Self-hosted session recordings (rrweb) — no third party
To understand where users get stuck on our public pages, we run the open-source rrweb library on our own infrastructure. Form inputs are masked, no audio or video is captured, and recordings are automatically deleted after 7 days by a daily cleanup job. No data ever leaves our servers — no third party is involved.
The recorder does not start until you accept analytics in the cookie banner. The legal basis is Article 6(1)(a) GDPR (consent).
§ 03
On what other grounds may we process your Personal Data
In addition to the above, we have the right to process your Personal Data for the purpose of complying with our legal obligations under Article 6(1)(c) GDPR (in particular accounting and tax law) or to protect our legitimate interests under Article 6(1)(f) GDPR — typically fraud prevention, network and information security, the establishment, exercise and defence of legal claims, and direct marketing to the extent permitted by Recital 47 GDPR.
We will process your Personal Data in accordance with applicable law and will protect it against misuse and unlawful disclosure.
§ 05
Do we transfer your Personal Data to third countries
Your account and operational data is stored on our own servers in the Czech Republic and never leaves the European Economic Area (EEA).
A small number of our processors (Google Analytics, Meta Pixel, Google Ads) are operated by parent companies in the United States. Transfers of Personal Data to these providers rely on the European Commission's adequacy decision under the EU–US Data Privacy Framework adopted on 10 July 2023, supplemented by Standard Contractual Clauses (SCCs) where required. These services run only after you have given consent in the cookie banner.
The current list of countries with an adequate level of protection is published by the Czech Office for Personal Data Protection at uoou.cz.
§ 06
How long we keep your Personal Data
We keep Personal Data only for as long as we need it for the purpose for which it was collected:
- Account and operational data — for the lifetime of your account. Permanently deleted within 30 days of account deletion.
- Newsletter contacts — until you unsubscribe, then anonymized.
- Self-hosted session recordings (rrweb) — 7 days, then automatically deleted by a daily cleanup job.
- Google Analytics 4 data — 14 months (Google's default retention).
- Server access logs — 30 days, kept for security and abuse investigation.
- Support communication — until your request is resolved, then up to 12 months for service-quality evidence.
- Invoices and accounting records — as required by Czech accounting law (typically 5 to 10 years).
§ 07
How you can withdraw your consent
You can withdraw your consent to the processing of personal data at any time. Specifically:
• You can withdraw newsletter consent by clicking the unsubscribe link in the footer of any email. • You can withdraw analytics and marketing cookie consent in the cookie banner, which you can reopen from the footer of any page. • To withdraw any other consent or for general questions, contact us at office@stablegt.com.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
§ 08
What rights you have
Under the GDPR you have the following rights with respect to the Personal Data we process about you:
- Right of access (Art. 15) — obtain confirmation as to whether we process your Personal Data and, if so, a copy together with information about the purposes, categories, recipients and retention period.
- Right to rectification (Art. 16) — correct inaccurate or complete incomplete Personal Data.
- Right to erasure (Art. 17) — request deletion ("right to be forgotten") if the data is no longer necessary, consent has been withdrawn, or processing was unlawful.
- Right to restriction of processing (Art. 18) — restrict how we process your data, particularly while accuracy is being verified or an objection is pending.
- Right to data portability (Art. 20) — receive your data in a structured, commonly used and machine-readable format and transmit it to another controller.
- Right to object (Art. 21) — object to processing based on legitimate interest or to direct marketing.
- Right to withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of prior processing.
- Right to lodge a complaint with a supervisory authority — in the Czech Republic this is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, uoou.cz.
You can exercise most of these rights directly inside the Application — edit or delete your account, your horses and your records at any time. For anything that requires our involvement, write to office@stablegt.com; we respond without undue delay and at the latest within 30 days as required by Article 12(3) GDPR.
§ 09
Do we use automated decision-making and profiling
When providing our Services, we do not use automated decision-making or profiling within the meaning of Article 22 GDPR — that is, decisions which produce legal effects concerning you or similarly significantly affect you and are based solely on automated processing without human involvement.
We do not use machine-learning algorithms to profile users or to personalize prices or feature availability. The recommendation logic in the Application (such as training or exercise suggestions) is based solely on parameters you have entered and does not process your personal characteristics.
§ 10
Do we process the personal data of children
We consider the protection of children's privacy particularly important. We do not knowingly collect any Personal Data from persons under 16 years of age. If you are under 16, please do not send us any of your Personal Data and do not create an account in the Application without your legal guardian's consent.
If we discover that any Personal Data we process relates to a person under 16 for whom no legal guardian's consent has been given, we will delete such data without delay. If you suspect that we may be processing information about persons under 16, please contact us at office@stablegt.com.
§ 11
How we cooperate with third-party websites
The Application and our website may contain hyperlinks to third-party websites and services (such as video hosts, social networks, partner stores). We have no control over the content of these sites and bear no responsibility for their personal data practices. We recommend that you carefully read the privacy policies of any such third parties before providing them with any personal data.
§ 13
How we update these Terms
We reserve the right to change these Terms. For material changes, we update the version number and date at the top of this page, and for changes that affect how we process your Personal Data we will notify logged-in users via an in-app banner before the change takes effect.
It is important that you review these Terms from time to time so that you are aware of any changes. Older versions of these Terms are available on request.
§ 14
Have other questions? Contact us
If you have any question about the processing of your Personal Data, wish to exercise any of your rights under the GDPR, or wish to lodge a complaint about how we handle your data, please contact us by email or in writing at the following address: