Who the controller is
For the data a user enters about themselves and for the operation of the service, the controller is Developti Studio d.o.o. Where a club keeps data in the app about its members, horses and activities, the club is an independent controller of that data, and the operator of the service acts as its processor, processing the data on its instructions and within the scope of these terms. The club must inform its members about the processing and have a legal basis for it.
What data we process
- Account data: first name, surname, email, phone, address, postcode, town, country, role, profile picture; optionally body weight (for calculating calories).
- Usage data: clubs and memberships, lessons, bookings, horses and their care, documents, expenses, ride and training diaries, posts, messages, photos.
- Location data and GPS tracks: see chapter 12 for details.
- Health and exercise data: see chapter 13 for details.
- Payment data: card details are processed and stored exclusively by Stripe; the operator only sees the payment status, the subscription period and the invoices issued.
- Technical data: tokens for login and push notifications, device and app version, IP address, basic operational logs for security and troubleshooting.
Purposes and legal bases
- Performance of a contract (Art. 6(1)(b) GDPR): providing the service, bookings, communication, settlements, support.
- Legal obligations (Art. 6(1)(c)): issuing and retaining invoices, tax obligations, responding to requests from competent authorities.
- Legitimate interest (Art. 6(1)(f)): security of the service, preventing misuse and fraud, basic operational analytics, pursuing legal claims.
- Consent (Art. 6(1)(a)): push notifications, optional data (e.g. body weight, photos), GPS recording, reading data from Apple Health or Health Connect, receiving newsletters. Consent can be withdrawn at any time, which does not affect the lawfulness of processing before the withdrawal.
Processors and transfers
We entrust data only to the contracted processors we need in order to run the service: Stripe (payments), Expo and Apple/Google (delivery of push notifications), the server hosting provider, the e-invoicing system provider, the email delivery provider. We have data processing agreements with all of them. We do not sell data and we do not pass it to third parties for their marketing purposes. Where a processor processes data outside the EU/EEA, the transfers are governed by the European Commission's standard contractual clauses.
Retention
We keep data until the account is deleted, or for as long as it is needed for the purposes for which it was collected. Operational logs are kept for up to 12 months, and issued invoices and accounting records in line with statutory periods (as a rule 10 years). Details on deletion are in chapter 9.
Automated decision-making
The service does not carry out automated decision-making or profiling with legal effects for the individual.
Rights of the individual
The user has the right of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent. We accept requests at [email protected] and answer them without undue delay, and no later than within one month. The user also has the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (Dunajska cesta 22, 1000 Ljubljana, [email protected]).