Privacy Notice

Last updated 28 December 2022

This privacy notice for The Western Equestrian Society ("Company", "we", "us" or "our") describes how and why we may collect, store, use and/or share ("process") your information when you use our services ("Services"), for example when you:

• visit our website at wes-uk.com, or any website of ours that links to this privacy notice
• engage with us in other related ways, including any sales, marketing or events

Questions or concerns? Reading this notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have questions or concerns, contact us through our contact page.

Summary of key points

This summary gives the key points of the notice. You can find more detail on each topic in the sections below.

• What personal information do we process? When you visit, use or navigate our Services, we may process personal information depending on how you interact with The Western Equestrian Society and the Services, the choices you make, and the products and features you use.
• Do we process any sensitive personal information? We do not process sensitive personal information.
• Do we receive any information from third parties? We do not receive any information from third parties.
• How do we process your information? We process your information to provide, improve and administer our Services, to communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so.
• In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties.
• What are your rights? Depending on where you are, the applicable privacy law may give you certain rights over your personal information.
• How do you exercise your rights? The easiest way is to fill in our data subject request form, or to contact us. We will consider and act on any request in line with applicable data protection laws.

What information do we collect?

Personal information you give us

In short: we collect personal information that you provide to us.

We collect personal information that you give us voluntarily when you express an interest in obtaining information about us or our products and Services, when you take part in activities on the Services, or otherwise when you contact us.

Personal information provided by you. The personal information we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. It may include:

• names
• phone numbers
• email addresses
• mailing addresses
• contact preferences

Sensitive information. We do not process sensitive information.

All personal information you give us must be true, complete and accurate, and you must tell us of any changes to it.

Information collected automatically

In short: some information, such as your Internet Protocol (IP) address and/or browser and device characteristics, is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use or navigate the Services. This information does not reveal your specific identity (such as your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. We mainly need this information to keep our Services secure and working, and for our internal analytics and reporting.

Like many organisations, we also collect information through cookies and similar technologies.

The information we collect includes:

• Log and usage data. Service-related, diagnostic, usage and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this may include your IP address, device information, browser type and settings, and information about your activity in the Services (such as the date and time stamps of your use, pages and files viewed, searches, and other actions such as which features you use), device event information (such as system activity, error reports, sometimes called "crash dumps", and hardware settings).
• Device data. Information about the computer, phone, tablet or other device you use to access the Services. Depending on the device, this may include your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, internet service provider and/or mobile carrier, operating system and system configuration.
• Location data. Information about your device's location, which can be precise or imprecise. How much we collect depends on the type and settings of your device. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out by refusing access to this information or by turning off the Location setting on your device. If you opt out, you may not be able to use certain parts of the Services.

How do we process your information?

In short: we process your information to provide, improve and administer our Services, to communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.

What legal bases do we rely on?

In short: we only process your personal information when we believe it is necessary and we have a valid legal reason (a legal basis) to do so under applicable law: with your consent, to comply with laws, to provide you with services, to enter into or fulfil our contractual obligations, to protect your rights, or to fulfil our legitimate business interests.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on to process your personal information. We may rely on the following:

• Consent. We may process your information if you have given us permission (consent) to use it for a specific purpose. You can withdraw your consent at any time. Read how to withdraw your consent.
• Legal obligations. We may process your information where we believe it is necessary to comply with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, to exercise or defend our legal rights, or to disclose your information as evidence in litigation in which we are involved.
• Vital interests. We may process your information where we believe it is necessary to protect your vital interests or those of a third party, such as where there is a potential threat to anyone's safety.

In legal terms, we are generally the "data controller" under European data protection laws of the personal information described in this notice, because we decide the means and/or purposes of the processing we carry out. This notice does not apply to personal information we process as a "data processor" on behalf of our customers. In those cases, the customer we provide services to, and with whom we have a data processing agreement, is the "data controller" responsible for your personal information, and we only process it on their behalf and in line with your instructions. To know more about our customers' privacy practices, read their privacy policies and send any questions to them.

When and with whom do we share your personal information?

In short: we may share information in the specific situations described here and/or with the following third parties.

We may need to share your personal information in these situations:

• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or part of our business by another company.
• When we use Google Maps Platform APIs. We may share your information with certain Google Maps Platform APIs (for example Google Maps API and Places API). To find out more, read Google's Privacy Policy.

Do we use cookies and other tracking technologies?

In short: we may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (such as web beacons and pixels) to access or store information. How we use these technologies, and how you can refuse certain cookies, is set out in our Cookie Notice.

How long do we keep your information?

In short: we keep your information for as long as necessary for the purposes in this notice, unless the law requires otherwise.

We only keep your personal information for as long as it is necessary for the purposes set out in this notice, unless a longer period is required or permitted by law (such as tax, accounting or other legal requirements).

When we have no ongoing legitimate business need to process your personal information, we will delete or anonymise it. If that is not possible (for example, because it is stored in backup archives), we will store it securely and isolate it from any further processing until it can be deleted.

Do we collect information from minors?

In short: we do not knowingly collect data from, or market to, children under 18 years of age.

We do not knowingly ask for data from, or market to, children under 18 years of age. By using the Services, you confirm that you are at least 18, or that you are the parent or guardian of such a minor and consent to that minor's use of the Services. If we learn that personal information from users under 18 has been collected, we will deactivate the account and take reasonable steps to delete that data from our records promptly. If you become aware of any data we may have collected from children under 18, please contact us through our contact page.

What are your privacy rights?

In short: in some regions, such as the European Economic Area (EEA) and the United Kingdom (UK), you have rights that give you greater access to and control over your personal information. You may review, change or end your account at any time.

In some regions (such as the EEA and UK), you have certain rights under applicable data protection laws. These may include the right (i) to ask for access to, and a copy of, your personal information; (ii) to ask for it to be corrected or erased; (iii) to restrict the processing of your personal information; and (iv) where applicable, to data portability. In certain circumstances you may also have the right to object to the processing of your personal information. You can make such a request by contacting us using the details in "How can you contact us about this notice?" below.

We will consider and act on any request in line with applicable data protection laws.

If you are in the EEA or UK and you believe we are processing your personal information unlawfully, you also have the right to complain to your local data protection supervisory authority. You can find their contact details at https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

If you are in Switzerland, the contact details for the data protection authorities are at https://www.edoeb.admin.ch/edoeb/en/home.html.

Withdrawing your consent. If we rely on your consent to process your personal information, you have the right to withdraw it at any time, by contacting us using the details in "How can you contact us about this notice?" below. This will not affect the lawfulness of processing before you withdrew it, nor processing carried out on other lawful grounds than consent.

Opting out of marketing and promotional messages. You can unsubscribe from our marketing and promotional messages at any time by using the unsubscribe link in the emails we send, or by contacting us using the details in "How can you contact us about this notice?" below. You will then be removed from the marketing lists. We may still contact you, for example to send service messages needed to run and use your account, to respond to service requests, or for other purposes that are not marketing.

Cookies and similar technologies. Most web browsers accept cookies by default. If you prefer, you can usually set your browser to remove and reject cookies. If you do, some features or services of our Services may be affected. To opt out of interest-based advertising by advertisers on our Services, visit https://www.aboutads.info/choices/.

If you have questions or comments about your privacy rights, contact us through our contact page.

Controls for do-not-track features

Most web browsers and some mobile operating systems and apps include a Do-Not-Track ("DNT") feature or setting you can turn on to signal that you do not want data about your online browsing to be monitored and collected. No uniform technology standard for recognising and acting on DNT signals has been finalised yet. So we do not currently respond to DNT browser signals, or any other mechanism that automatically tells us you do not want to be tracked online. If a standard for online tracking is adopted that we must follow in future, we will tell you about it in a revised version of this notice.

Do California residents have specific privacy rights?

In short: yes. If you are a resident of California, you have specific rights over access to your personal information.

California Civil Code Section 1798.83, also known as the "Shine The Light" law, lets our users who are California residents ask us, once a year and free of charge, for information about the categories of personal information (if any) we disclosed to third parties for direct marketing, and the names and addresses of all third parties we shared personal information with in the previous calendar year. If you are a California resident and want to make such a request, send it to us in writing using the contact details below.

If you are under 18 years of age, live in California and have a registered account with the Services, you have the right to ask for unwanted data that you post publicly on the Services to be removed. To ask, contact us using the details below, and include the email address linked to your account and a statement that you live in California. We will make sure the data is not shown publicly on the Services, but it may not be completely removed from all our systems (for example backups).

Do we update this notice?

In short: yes. We will update this notice as needed to stay compliant with relevant laws.

We may update this notice from time to time. An updated version will show an updated "Revised" date and takes effect as soon as it is available. If we make material changes, we may tell you by prominently posting a notice of the changes or by sending you a notification directly. Please review this notice often to stay informed about how we protect your information.

How can you contact us about this notice?

If you have questions or comments about this notice, contact us through our contact page.

If you live in the United Kingdom, the "data controller" of your personal information is The Western Equestrian Society. The Western Equestrian Society has appointed Dan Gwalter as its representative in the UK. You can contact him directly about how The Western Equestrian Society processes your information through our contact page.

How can you review, update or delete the data we collect from you?

Depending on the laws of your country, you may have the right to ask for access to the personal information we collect from you, to change it, or to delete it. To ask to review, update or delete your personal information, please send a request through our contact form.

Cookies

We only set analytics cookies if you say yes. They are Google Analytics 4 cookies, named _ga and _ga_ followed by a code, kept for up to 2 years, and they tell us which pages are visited and roughly where from. We remember your choice in your browser for a year, then ask again. You can change it any time from Cookie settings at the foot of every page; saying no deletes the analytics cookies. my.wes-uk.com, where members sign in, sets no analytics cookies.