The GDPR annex to your contract : you are the controller of your riders' data, we are the processor – with precise commitments.
This text is a courtesy translation. In the event of any discrepancy, the French version prevails.
This data processing agreement (the « DPA ») forms the GDPR annex to the Terms of service and applies as of right to any Client of the Equimondo Service. It gives effect to the obligations laid down in article 28 of Regulation (EU) 2016/679 (the « GDPR »).
For personal data entered into or imported into the Service by the Client (riders and their legal representatives, horse owners, team members, suppliers), the Client is the controller and EQUIMONDO is the processor, acting only on documented instructions from the Client, the first instruction being the contract itself.
EQUIMONDO hosts, stores, organises, structures, consults for support purposes, backs up, returns and deletes the data on behalf of the Client, for the sole purpose of providing the features of the Service : management of the horses and their care, timetable and bookings, teaching records, communication with riders, invoicing and payments, the Client's website. The duration of the processing is that of the contract, extended by the reversibility periods provided for.
The Service is designed for the management of under-age riders by professional establishments. The Client warrants that data on minors is collected from their legal representatives or with their agreement, and that it provides them with the information required by articles 12 to 14 GDPR.
The Service is not intended for the storage of so-called sensitive data (article 9 GDPR), in particular human health data. The Client undertakes not to record such data in it, with the exception of information strictly necessary for the safety of activities (emergency contact, mention of a contraindication communicated by the family), which it processes under its sole responsibility and on a minimised basis. Data relating to horses (care, breeding register) are not personal data, except where they relate to an identifiable person.
The Client gives general authorisation for the use of the sub-processors listed in the Privacy policy (in particular OVH, Stancer, Brevo, Spot-Hit, Mistral AI, Yousign, and Google for optional calendar synchronisation only). EQUIMONDO informs the Client of any intended addition or replacement at least thirty (30) days in advance ; the Client may raise legitimate objections and, failing agreement, terminate without penalty. EQUIMONDO enters into a contract with each sub-processor imposing obligations equivalent to this DPA and remains fully liable to the Client for their performance.
Technical and organisational measures implemented : TLS encryption of all communications ; multi-tenant architecture with strict separation of each establishment's data ; individual user authentication and fine-grained permission management by the Client ; prepared and parameterised database queries ; restricted administrator access (key-based SSH, IP filtering) ; logging ; daily encrypted backups on dedicated servers in France with restricted access ; vulnerability and incident management procedure.
Client Data is hosted and backed up exclusively within the European Union (France). No transfer of personal data outside the EU is carried out under this DPA, with two exceptions : (i) Google Calendar synchronisation, if and only if the Client or its user activates it, framed by the Data Privacy Framework and the standard contractual clauses ; (ii) improvement processing carried out exclusively on anonymiseddata, which is no longer personal data.
The Client may, at most once a year and subject to thirty (30) days' notice, verify compliance with this DPA on the basis of the compliance file provided by EQUIMONDO (description of measures, certificates, list of sub-processors). An on-site audit, carried out by an independent non-competing third party bound by confidentiality, is possible where the file is demonstrably insufficient, at the Client's expense and without disrupting security or the service owed to other clients.
At the end of the contract, the Client exports all of its data itself, free of charge, in standard formats, for sixty (60) days. Thereafter, EQUIMONDO deletes the data from the live systems and purges the backups by rotation within three (3) months, save where retention is required by law (accounting records : 10 years). A certificate of deletion is issued on written request.
Each party is liable for damage caused by processing that breaches its own obligations under the GDPR. The liability caps of the terms of service apply to this DPA, unless mandatory law provides otherwise. In the event of any conflict between the DPA and the terms of service on a data protection matter, the DPA prevails.