Privacy Policy

1. Data controller

PaddockAI is operated by LP Media ApS (CVR no. 43476467), Arnbjerg Alle 5, DK-8800 Viborg, Denmark, which is the data controller in respect of personal data collected in connection with the creation and use of the service, including the PaddockAI apps for iOS and Android. Enquiries concerning the processing of personal data shall be directed in writing to privacy@paddockai.net.

2. Categories of personal data

The following categories of ordinary personal data are processed, cf. Article 6 of the Regulation:

• Identification and contact data (name, e-mail address and, where applicable, a profile picture).
• Data concerning the user's use of the service (lists created, riders and entries followed, and profiles the user has created or subscribes to).
• Data entered in connection with PaddockAI Shows (rider and horse names, class selections and add-ons for an entry; show details and invoice details for an organiser, i.e. sender name, address, CVR number and bank and MobilePay details).
• Messages exchanged with the show office via PaddockAI Shows (visible to the participant and the show's organisers).
• Subscription and payment-related references, including purchase status and transaction references for subscriptions bought through the Apple App Store or Google Play. Card data is not processed by PaddockAI but exclusively by the payment service provider or the app store.
• Device data for push notifications (a notification token, platform and app version), where the user enables notifications.
• Technical error reports, to the extent consent has been given, cf. section 8.

3. Purposes and legal basis

• Creation and administration of the user account and provision of the service's functions: Article 6(1)(b) of the Regulation (performance of a contract).
• Delivery of the notifications the user has switched on: Article 6(1)(b) (performance of a contract).
• Administration of subscriptions, including compliance with statutory bookkeeping obligations: Article 6(1)(b) and (c).
• Technical error diagnostics via a third party: Article 6(1)(a) (consent).
• Safeguarding the operation and integrity of the service and preventing misuse: Article 6(1)(f) (legitimate interest in operating a secure and functional service).

4. Recipients of personal data

Personal data is disclosed to data processors assisting with the operation of the service, which process such data solely on documented instructions. The following categories of data processors are engaged: providers of hosting and data-storage infrastructure, a provider of transactional e-mail delivery, a payment service provider, a provider of push-notification delivery, a provider of subscription management for in-app purchases, a provider of app-update delivery and — to the extent consent has been given — a provider of technical error diagnostics.

For the mobile apps specifically: push notifications are delivered via Google Firebase Cloud Messaging (Google Ireland Ltd.), including to Apple devices via Apple Push Notification service; Google may process the notification token and message content on servers globally. Subscriptions bought in the apps are handled by RevenueCat, Inc., which receives the account's internal identifier and purchase status. App updates are delivered by Capgo, which receives technical device data (a random installation identifier, app version and platform) but no account data.

Apple (App Store) and Google (Google Play) sell in-app subscriptions as merchant of record and process the purchase as independent data controllers under their own privacy policies. For PaddockAI Shows, the show organiser receives the entry data needed to run the show and is an independent data controller for it; entry fees are processed by Stripe on the organiser's behalf.

Where third-party sign-in (Apple, Google or Facebook) is used, only such data as the sign-in provider makes available upon authentication is transferred. Personal data is not disclosed to third parties for marketing purposes.

5. Transfers to third countries

Certain data processors are established in, or may process data from, countries outside the EU/EEA. Any such transfer takes place on the basis of an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework, or the European Commission's Standard Contractual Clauses, cf. Chapter V of the Regulation. Documentation of the transfer basis may be requested via the contact details in section 1.

6. Retention and erasure

• Account data and user-generated content is retained until the user deletes their account, whereupon the data is erased without undue delay, subject to the exceptions below.
• Shows the user has organised and entries made to PaddockAI Shows form part of the organiser's and the payment's accounting trail and are retained after the account is deleted. Erasure of such data may be requested via the contact details in section 1 and will be carried out to the extent no statutory retention obligation applies.
• Accounting records are retained for the current and five subsequent financial years pursuant to applicable bookkeeping legislation.
• Push-notification tokens are erased when the user signs out, deletes the account, or the device has not used the app for 60 days.
• Technical error reports are retained for a limited period and thereafter erased automatically.

7. Data collected from publicly accessible sources

The service reproduces start lists, results and scheduling information concerning riders and combinations. Such data originates from publicly accessible sources, cf. Article 14(2)(f) of the Regulation, having previously been published by event organisers through their event-administration platforms. No data concerning riders is processed beyond what has thus already been made public. The processing is based on Article 6(1)(f).

8. Cookies and local storage

The service employs strictly necessary browser storage for authentication and for preserving the user's settings, in accordance with the exemption for necessary storage under the applicable rules implementing the ePrivacy Directive. In addition — and solely subject to prior consent — storage is employed in connection with technical error reporting. Consent may be withdrawn at any time with effect for the future via the cookie settings below. No storage is employed for marketing or analytics purposes. In the iOS and Android apps, the same necessary storage is kept on the device to keep the user signed in. The apps do not track users across other companies' apps or websites.

9. Rights of data subjects

Pursuant to Chapter III of the Regulation — subject to the conditions and limitations set out therein — the data subject has the following rights:

• The right of access, cf. Article 15.
• The right to rectification, cf. Article 16.
• The right to erasure, cf. Article 17.
• The right to restriction of processing, cf. Article 18.
• The right to data portability, cf. Article 20.
• The right to object, cf. Article 21, in respect of processing based on Article 6(1)(f).
• The right to withdraw consent, cf. Article 7(3), without affecting the lawfulness of processing carried out prior to such withdrawal.

Requests shall be submitted via privacy@paddockai.net and will be answered without undue delay and in any event within one month of receipt, cf. Article 12(3).

10. Right to lodge a complaint

The data subject may lodge a complaint concerning the processing of personal data with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, DK-2500 Valby, cf. Article 77 of the Regulation. Further information is available at www.datatilsynet.dk.

11. Amendments

This policy is revised on an ongoing basis in accordance with changes to the service or to applicable law. The version in force at any given time is available on this page, stating the date of the most recent update.