Your data, what we do with it, and above all what we will never do with it. In plain terms, in line with the GDPR.
This text is a courtesy translation. In the event of any discrepancy, the French version prevails.
The controller for the processing described in this policy is SARL EQUIMONDO (Caen Trade Register 824 571 145), 1 avenue des Essarts, 14470 Courseulles-sur-Mer, France, represented by its managing director Mr Sébastien Pesquerel – contact@equimondo.fr – +33 2 61 53 06 15.
Important : when your riding school, yard or equine professional uses the Equimondo software to manage your rider or owner data, it is they who are the controller ; EQUIMONDO then acts as processor, under theData processing agreement. To exercise your rights over that data, contact your establishment first.
| Processing | Data | Legal basis |
|---|---|---|
| Contact or demonstration request | Name of the establishment or identity, telephone, email, message, chosen time slot | Pre-contractual steps (art. 6(1)(b) GDPR) |
| Management of the client account and invoicing | Identity of the representative, contact details, invoicing and payment data | Performance of the contract ; statutory accounting obligations |
| Outreach to professionals | Business contact details | Legitimate interest (art. 6(1)(f)), with a right to object at any time |
| Audience measurement of the site | Anonymised browsing statistics | Legitimate interest – tool exempt from consent |
| « The manager's letter » newsletter | Email address, sign-up page | Consent (art. 6(1)(a) GDPR) – one-click unsubscribe in every message |
| Conversational assistant of the site | Content of the messages typed (no identification required) | Legitimate interest : answering your questions |
Mandatory fields are marked in the forms ; the others are optional. No decision producing legal effects is taken by fully automated means.
The data is intended solely for authorised EQUIMONDO teams and for the following providers, which act on instructions and offer guarantees compliant with article 28 GDPR :
| Provider | Role | Location |
|---|---|---|
| OVH SAS | Hosting of the servers, the database and the backups | France |
| Stancer | Payments : SEPA direct debits and bank cards | France / EU |
| Brevo | Sending transactional and communication emails | France / EU |
| Spot-Hit | Sending SMS and voice messages | France |
| Mistral AI | Conversational assistant and teaching suggestions | France / EU |
| Yousign | Electronic signature (eIDAS-qualified trust service provider) | France |
| Google Ireland Ltd | Google Calendar synchronisation, only if you activate it (see annex) | EU / United States* |
Data is never sold, rented or assigned to third parties for commercial purposes.
Personal data processed by Equimondo is hosted and processed within the European Union. Two clarifications :
| Data | Period |
|---|---|
| Prospects (contact, demonstration) | 3 years after the last exchange, then deletion |
| Client account | Term of the contract, then 60 days after closure (export window), then deletion |
| Invoices and accounting records | 10 years (legal obligation) |
| Messages of the site assistant | 12 months maximum, for the purpose of improving the answers |
Under the GDPR and the French Data Protection Act, you have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw your consent at any time, and the right to give instructions on what becomes of your data after your death.
These rights are exercised by email to contact@equimondo.fr or by post to the registered office. You will receive a reply within one month at most. If you are not satisfied, you may lodge a complaint with the French data protection authority (CNIL) : www.cnil.fr/fr/plaintes.
EQUIMONDO implements appropriate technical and organisational measures : encryption of all communications (HTTPS/TLS), strict separation of each establishment's data (multi-tenant architecture), prepared database queries against injection, control of administrator access by SSH key and IP filtering, daily backups on dedicated servers with restricted access. Any data breach likely to create a risk is notified to the French data protection authority (CNIL) and, where applicable, to the data subjects, under the conditions of articles 33 and 34 GDPR.
The site uses no advertising cookies, no social network pixels and no third-party trackers. Only cookies strictly necessary for operation are placed (display preferences, security), which are exempt from consent. Audience measurement relies on a tool configured in line with the French data protection authority's exemption (anonymous statistics, no cross-site tracking) : this is why no consent banner is needed.
The site assistant and the suggestion features (exercises, session ideas) rely on the models of Mistral AI, a French company whose processing is carried out in the EU. The content submitted is not used to train models. Internal improvement processing that uses other AI services covers only anonymised data (see section 4). The generated answers are indicative and constitute neither veterinary advice nor legal or accounting advice.
The Equimondo application offers an optional feature that synchronises the timetable to Google Calendar, activated only at the user's express request through the Google authorisation screen (OAuth 2.0). This annex describes, in accordance with the Google API Services User Data Policy and its Limited Use requirements (Limited Use), the Google data concerned, its use, its protection and its deletion.
Equimondo requests only the strictly necessary authorisation (principle of least privilege) : the calendar.eventsscope, allowing events to be created, modified and deleted in the main calendar of the connected account. The events concerned are exclusively those coming from the Equimondo timetable (dates, times, title, comment, Europe/Paris time zone). Only the indispensable technical elements are kept on the Equimondo side : access and refresh tokens, identifier of the destination calendar and the event mapping table.
Equimondo accesses no other data in the Google account : not Gmail, not Drive, not contacts, not photos, not location, not history, not the list of calendars, not profile data. Synchronisation is one-way : Equimondo writes to Google Calendar and neither reads nor stores pre-existing events.
This data is used solely to provide and improve the synchronisation feature visible to the user, and for technical support at their request. It is never used for advertising, profiling or resale, nor for training AI models. No human operator consults it, except with the user's express agreement for troubleshooting, for security reasons or under a legal obligation.
Equimondo does not sell, rent, assign or share Google data with third parties. The only exceptions : hosting at OVH (GDPR processor, servers in the EU) and the exchanges with Google's own servers required for synchronisation ; or a legal obligation.
HTTPS/TLS encryption of all exchanges with strict certificate verification ; OAuth tokens stored exclusively server-side, never exposed to the browser ; short-lived access token ; administrator access by SSH key and IP filtering ; multi-tenant separation ; prepared queries ; backups with restricted access.
The tokens and mappings are kept as long as the Google connection remains active and the contract is in force. Disconnecting from the configuration screen deletes these items immediately and permanently. The user may also revoke access from myaccount.google.com/permissions. At the end of the contract, deletion within 30 days ; purge of the backups by rotation within 3 months ; a request for permanent deletion can be sent to contact@equimondo.fr (handled within 30 days with confirmation). Events already created in the Google calendar remain the property of the user and are not deleted by disconnecting.
Equimondo's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. Any substantial change to this annex will be brought to users' attention.