Privacy policy

For any question about your data, write to info@crinhorses.com.

CRIN is the tool clubs use. When a club manages its members, pupils, horses, entries, payments or staff in CRIN, the club is the controller of those data, and CRIN processes them on its behalf as a processor (Article 28 GDPR), under the contract it signs with each club.

CRIN is the controller of your account’s data, of this website’s and of its relationship with the clubs that sign up to CRIN.

Your club can add you to CRIN (for example, with its list of members) and invite you with a link. If you create your account with that record’s email address, CRIN asks you whether it is you before joining it to your account, and you can start with a new record instead.

To exercise your rights over the data your club holds, you can contact the club or CRIN, which will pass your request on to the club.

Each club decides what each role among its people sees and does in CRIN (office, coaches and staff; management can do everything). The public page of its competitions shows the club’s name, address, phone number and email and the name of its contact person, unless the club chooses to show only its phone number and email.

• Identity and contact details: name, email address, phone number and, when needed, year of birth, federation licence, level (galope) and discipline.
• Minors: their rider details, as for any rider, and who their mother, father or guardian is, who follows them from their own account.
• Horses: name, passport, vaccinations, insurance, health (vet, farrier, physiotherapy), work plan and documents.
• Activity at the club: entries, bookings, requests, appointments, notices, incidents and the history of who did what and when.
• Payments: the amount, concept, status and reference of each payment. Card details are processed by Stripe; CRIN neither sees nor keeps them.
• Documents uploaded by you or your club (for example, passports or insurance), in a private store.
• Professionals: trading name, services, rates, work area and availability.
• Technical data: the IP address and the browsing data needed to serve the website and keep it secure.
• If you turn notifications on, each device’s delivery address in its browser’s notification service, which stops being used when you turn them off or sign out of your account on that device.
• If you accept the analytics cookies, on the public pages (the home page and the legal pages): how you use them (clicks, scrolling, mouse movements, device and browser, and the page you came from) and an approximate location from your IP address, with what you type and people’s data hidden.

CRIN isn’t designed to keep people’s medical records: of appointments with professionals for riders themselves it only keeps the service, the date and the place.

CRIN doesn’t take automated decisions with legal effects on you or build profiles. Reading the schedule with artificial intelligence only fills in the competition’s form, which the club reviews before publishing it, and Criny, the assistant, only looks up what you can see, answers and links to CRIN’s screens: it doesn’t do anything on your behalf. CRIN doesn’t keep conversations with Criny.

We don’t sell your data or use them for advertising.

CRIN uses these providers, which process data on CRIN’s behalf under a data processing agreement:

Some are US companies. International transfers rely on the EU-US Data Privacy Framework, when the provider has signed up to it, or on the standard contractual clauses approved by the European Commission.

Stripe also processes some data as a controller in its own right, to prevent fraud and meet its financial obligations, under its own privacy policy. Your club sees the data of the entries and payments for its activities, and each professional, those of the appointments they attend.

When you enter a competition run by a club that isn’t yours (or you have no club), the organising club receives your entry: your name, the club you compete for, the classes, the extras and the payment and, of the horse, its name, its UELN, its description (sex, year, breed, colour, discipline and level) and where it lives. While the competition is running and up to 30 days after it ends (to close results, payments and refunds), and if your entry hasn’t been cancelled or rejected, it also receives your email address, your phone number, your licence, your year of birth and, if you are a minor, your guardian’s name, and the horse’s papers for the competition (vaccination, passport and insurance); after that, the competition’s history only keeps your entry with your name and the horse’s name. It doesn’t receive the rest of your record (your level, your galope, your qualifications, your history, your coach, your clubs or your consents), nor the horse’s health, care, owner or history. If your coach approves the entry, the organiser sees their name.

A confirmed entry, or one on a class’s waiting list, appears on the list of who is going to that class, which anyone can see in the app and on the competition’s public page, as on the federations’ lists: your name, your horse, your club and whether you are confirmed or waiting; when the club publishes them, also your start order and time and your result (placing and prize). Anyone with a CRIN account can search for you by name and see your rider file: your club, the horses you have competed with and your competitions with those same classes and results. Never your contact details, your licence or your payment. If you are a minor, on the competition’s public page (the one anyone can see without an account and search engines can show) you always appear with your initials; for people with an account, with your name, unless your club decides to show your initials; and nobody outside your family finds you by your name or sees your file. If your father or mother has a record in CRIN, the competition’s notices (the start list, the results) reach them.

Push notifications arrive through your browser’s notification service (Google for Chrome and Android, Apple for Safari and the iPhone, Mozilla for Firefox, Microsoft for Edge). They travel end-to-end encrypted: only your device can read them, and that service only sees the delivery address and when each one arrives.

We only disclose data to the authorities when the law requires it.

• Your account’s emails (signing in, confirming your email, a new password and changes to its security) always reach you: without them you couldn’t use it.
• The email copy of your notices: in your profile, under “Email notices”, you choose by topic which ones reach you (bookings and payments, your horses, club activity and messages from the club). Each email has a link to stop getting those of its topic with one click, without signing in. The notices stay in the app.
• If an email bounces or you mark it as spam, Resend tells us and we stop sending notices to that address until you change it or tell us it works again (your account’s emails, such as a code to sign in, still go out). You can see it in your profile.
• What your club tells you comes from CRIN in its name (“your club via CRIN”) and, if you reply, your answer goes to your club.

We don’t send you advertising by email without your consent.

• Your account: while you keep it active.
• Entries, payments and transactions: as long as the law requires (six years for the accounts, and the tax limitation periods).
• The club’s history: while the club uses CRIN, so every payment and every decision can be checked.
• Sales enquiries: as long as needed to answer them.
• The public pages’ analytics, if you accept them: Microsoft keeps recordings of visits for 30 days (the ones we mark as favourites and a random sample, up to 9 months) and heatmaps, up to 9 months.

So the history can be relied on, CRIN doesn’t delete records: cancellations, rejections and refunds remain as states and new transactions. When the data are no longer needed, or when you exercise your right to erasure, your personal data are anonymised and only the records the law requires us to keep are kept, locked away (how, in “Deleting your data”).

You can delete your data yourself, whenever you like: at the end of your account page (“My account”) and at the end of your profile in the rider app or the professional app, under “Delete my data”. Before doing anything, CRIN explains what will happen and asks you to confirm twice: tick “I understand this can’t be undone” and type the word it shows you (DELETE). You can also ask for it by writing to the address in “Your rights”.

To do it, nothing can be left pending: payments to make or a held card, an entry in a competition that hasn’t ended yet, a lesson or appointment to come, an open request or a monthly service you’ve signed up to (also your children’s, if you pay for them). CRIN tells you what’s missing and where to sort it out. If you run a club’s management, someone else has to take it on first.

• Your record is anonymised: your name becomes “Anonymised person” and your email address, phone number, licence, level and discipline, year of birth, guardian, coach, qualifications, consents and notice preferences are removed. So are your billing details, the text of what your club noted about you, your documents (their record no longer opens the file), your devices with notifications and, if you are a professional, your directory profile. Only your language stays.
• Your clubs no longer have you as a member (recorded as a membership ended for data erasure), you leave their groups and stop riding their horses, and your children are no longer linked to your account: their records stay with their club.
• Your account is closed and your access is deleted: you can no longer sign in with it. Before forgetting your address, we send you one last email to confirm it.
• The records the law requires us to keep are kept, locked away: issued invoices, with the buyer’s details as they were (four to six years, under tax and commercial law), payments and their records (also VERI*FACTU’s) and the history of who did what, with a copy of what there was. Nobody uses them for anything else or sees them in CRIN: they would only be made available to judges, courts and authorities while liability can be claimed (Article 32 LOPDGDD).
• What other people need carries on, without your data: on a competition’s lists and results you appear as “Anonymised person” (and nobody finds you when searching for riders), and your horses stay with their club, without your owner details.
• It can’t be undone: if you come back to CRIN, you start with a new account and a new record.

Your club can’t delete your data: it can end your membership, but erasure is asked for by you, or by your family if you are a minor.

You can ask to access your data, rectify them, erase them, object to their processing, restrict it and take them with you (portability), and withdraw at any time any consent you have given. To erase them you don’t need to write to us: you can do it yourself under “Delete my data” (previous section).

Write to info@crinhorses.com saying which right you are exercising; we may ask you to prove your identity. We will answer within one month.

If you believe your rights haven’t been respected, you can complain to the Spanish Data Protection Agency, AEPD (www.aepd.es).

Minors have no account in CRIN and don’t use its apps. Their club may hold their record: their name, year of birth, level, licence, the name of their mother, father or guardian and, if given, the family’s email address.

Their mother, father or guardian follows them from their own account when they say they are their children (signing in for the first time with the email address the club has) or when they accept the club’s invitation for the family. They then give consent on their behalf (Article 7 LOPDGDD, for children under 14) and, from then on, see their lessons, horses, competitions, requests, papers and payments, book and pay for them and get their notices, also by email and on their phone. CRIN never writes to the minor.

Their data are seen by their family, their club and whoever works with them, as for any rider. The family can exercise the rights in this section on their behalf and withdraw consent whenever they like. To delete their data, their mother, father or guardian does it from the minor’s profile in their app (“Delete …’s data”), with the same two confirmations and the same things anonymised and kept; their own account stays as it is.

The data are stored in the European Union, travel encrypted (HTTPS) and each person only sees what their role at each club allows. Documents are kept in a private store and opened with temporary links. Every change is recorded with its author.

If this policy changes, we will publish the new version on this page with its date and, if the change is important, we will let you know.