Privacy policy

This policy explains which personal data OOSTING HORSE RIDING processes, why we do so, how long we keep it and what rights you have. It is provided under article 13 of the General Data Protection Regulation (GDPR).

Who is responsible for your data

Data controller: OOSTING HORSE RIDING, an SCI under French law
Address: 6 chemin le Syndic, 81210 Lacrouzette, France
SIRET: 901 829 697 00019
Contact for privacy matters: info@oosting-horseriding.com or +33 6 60 98 26 98

We have not appointed a data protection officer; that is not required for a company of our size carrying out this type of processing. You can raise any question with us at the address above.

Our processing activities

1. Your enquiry through the quotation form

Purpose: Answering your enquiry, preparing a quotation and, if you book, preparing and delivering your stay.
Legal basis: Performance of the contract or steps taken at your request prior to entering into it (article 6(1)(b) GDPR). For administrative and tax retention: legal obligation (article 6(1)(c) GDPR).
Data concerned: Name, email address, telephone number, country, preferred dates, number of people, type of stay, riding ability and whatever else you enter in the comments field. This first form deliberately does not ask for your date of birth, home address or medical details.
Retention period: Enquiries that do not lead to a booking: 12 months after the last contact. Bookings: up to 3 years after the end of your stay for the customer relationship. Invoices and accounting records are kept for 10 years, as French law requires.
Recipients and processors: Netlify, Inc., 512 2nd Street, Fourth Floor, San Francisco, CA 94107, United States. Netlify hosts this website and processes form submissions (Netlify Forms). In addition ILC Europe B.V., Science Park Eindhoven 5051, 5692 EB Son, the Netherlands, our IT partner that manages the info@oosting-horseriding.com mailbox, and, where relevant, our accountant. For sending the confirmation email: Sendinblue SAS, trading as Brevo, 106 boulevard Haussmann, 75008 Paris, France. In doing so Brevo processes your name, your email address and the content of your message. Brevo is established in the European Union and processes this data on servers within the European Union, so no transfer to a third country takes place.
Transfers outside the EEA: Netlify is based in the United States. Netlify, Inc. has certified to the U.S. Department of Commerce under the EU-US Data Privacy Framework and additionally applies the standard contractual clauses set out in Implementing Decision (EU) 2021/914.

2. Contact by email, telephone or WhatsApp

Purpose: Answering your question and, if a booking follows, handling the communication about your stay.
Legal basis: Performance of the contract or pre-contractual steps (article 6(1)(b) GDPR), and for other questions our legitimate interest in being reachable and handling correspondence (article 6(1)(f) GDPR).
Data concerned: Your name, email address or telephone number and the content of your message.
Retention period: Correspondence without a booking: 12 months. Correspondence about a booking: as set out under processing 1 above.
Recipients: ILC Europe B.V., Science Park Eindhoven 5051, 5692 EB Son, the Netherlands, our IT partner that manages the info@oosting-horseriding.com mailbox.

3. Health information you give us before arrival

Purpose: Assessing whether and how you can take part in the rides safely, and choosing the right horse for you.
Legal basis: Your explicit consent (article 9(2)(a) GDPR). You provide this information voluntarily; if you do not, we cannot assess the safety of your participation and participation may be refused.
Data concerned: Only what you report yourself and what is relevant to riding safely, such as back or joint problems, pregnancy, or medication that affects reaction time.
Retention period: No longer than 3 months after the end of your stay, after which we delete it.
Recipients: Only Jacqueline Oosting, who leads the rides. We do not share this data with third parties.

4. Website statistics through Google Analytics 4

Purpose: Measuring how many visitors the website has, which pages are read and where visitors come from, so that we can improve the site.
Legal basis: Your consent (article 6(1)(a) GDPR and article 82 of the French Informatique et Libertés act). Without your consent Google Analytics is not loaded and no measurement takes place at all. You can withdraw your consent at any time through the "Cookie preferences" link at the bottom of every page.
Data concerned: A randomly generated device identifier stored in a cookie, pages visited, time and duration of the visit, referring website, approximate location based on a truncated IP address, language, browser and device type.
Retention period: In Google Analytics, the retention period for user and event data is set to 14 months, the shortest setting available other than 2 months. Google Signals is switched off, so data is not linked to Google accounts and no advertising personalisation takes place. Cookie lifetimes are listed in our cookie policy.
Recipients and processors: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States, as sub-processor.
Transfers outside the EEA: Data may be processed in the United States. Google LLC is certified under the EU-US Data Privacy Framework, and the European Commission's standard contractual clauses apply in addition.

5. Google Maps and the reviews on our website

Purpose: Showing the map with our location and displaying the reviews visitors have left about us on Google.
Legal basis: Your consent (article 6(1)(a) GDPR). As long as you have not given consent, we do not load the map or the reviews and no request is sent to Google. You will see a placeholder with a button to load the content if you wish.
Data concerned: Once the content loads, Google receives your IP address, information about your browser and device, and the page on which you are viewing the map. Google may set cookies or store data in your browser in the process.
Retention period: Determined by Google. See the retention periods in our cookie policy and Google's own privacy policy.
Recipients: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC in the United States.
Transfers outside the EEA: As described above for Google Analytics: EU-US Data Privacy Framework and standard contractual clauses.

6. Technically necessary processing when you visit the website

Purpose: Providing the website securely and without disruption, preventing abuse and attacks, and remembering your cookie choice.
Legal basis: Our legitimate interest in a working and secure website (article 6(1)(f) GDPR). Storing your cookie choice is strictly necessary in order to give effect to that choice and to be able to demonstrate that it was made.
Data concerned: IP address, time of the request, page requested, status code, browser and device information in our host's server logs. In addition your own cookie choice, which is stored only in your browser and is not sent to us or to any third party.
Retention period: Server logs: in line with our host's standard period, in principle no more than 30 days. Your cookie choice: 6 months, after which we ask again.
Recipients: Netlify, Inc., United States, as our host and processor.

7. The experience you send us through the experience form

Purpose: Reading what you thought of your stay and learning from it, and, only if you give separate permission for this, placing your experience on this website so that others can read it.
Legal basis: For reading and answering your message: our legitimate interest in improving our service (Article 6(1)(f) GDPR). For placing your experience on the website: your consent (Article 6(1)(a) GDPR). You give that consent with the tick box in the form; if you leave it empty, we place nothing.
Which data: Your first name, email address, the text of your experience, your rating, and optionally your surname, town, the period of your stay and the type of arrangement. If you give permission for publication, only your first name, your town, the period, your rating and your text appear on the website. We never publish your surname or your email address.
Retention period: Without permission to publish: 24 months, after which we delete your submission. With permission: for as long as your experience is on the website, and no longer than 12 months after that. We record your consent itself for as long as we need it to be able to demonstrate that you gave it.
Withdrawal: You can withdraw your consent at any time by emailing info@oosting-horseriding.com. We will then remove your experience from the website as quickly as possible. Withdrawal does not affect the lawfulness of the publication in the period before it.
Recipients and processors: Netlify, Inc., 512 2nd Street, Fourth Floor, San Francisco, CA 94107, United States, which hosts this website and processes the form submissions, and ILC Europe B.V., Science Park Eindhoven 5051, 5692 EB Son, which manages the email account info@oosting-horseriding.com. For sending the confirmation email: Sendinblue SAS, trading as Brevo, 106 boulevard Haussmann, 75008 Paris, France. In doing so Brevo processes your name, your email address and the content of your message. Brevo is established in the European Union and processes this data on servers within the European Union, so no transfer to a third country takes place.
Transfer outside the EEA: Netlify is established in the United States. Netlify, Inc. is certified with the US Department of Commerce under the EU-US Data Privacy Framework and additionally applies the standard contractual clauses from implementing decision (EU) 2021/914.

What we do not do

We do not sell or rent your data to third parties.
We do not take decisions about you based solely on automated processing, and we do not carry out profiling.
We do not collect data at the enquiry stage that is not needed for it, such as your date of birth, home address or payment details.
We do not send you a commercial newsletter unless you have signed up for it yourself through a separate, unticked option.

Your rights

Under the GDPR you have the following rights:

Access: to find out what data we process about you and to receive a copy of it.
Rectification: to have inaccurate data corrected or completed.
Erasure: to have your data deleted, insofar as we are not legally required to keep it.
Restriction: to have processing suspended temporarily, for instance while a correction is being assessed.
Objection: to object to processing based on our legitimate interest.
Portability: to receive the data you provided yourself in a commonly used file format.
Withdrawal of consent: to withdraw consent at any time, without affecting the lawfulness of processing before that point. For cookies, the quickest route is the "Cookie preferences" link at the bottom of every page.
Instructions after death: under French law you may lay down directions about what happens to your data after your death.

To make a request, email info@oosting-horseriding.com. We respond within one month. If your request is complex we may extend that by two months, in which case we will let you know within the first month. To avoid disclosing data to the wrong person, we may ask you to establish your identity.

Making a complaint

If you are unhappy with the way we handle your data, please tell us first; we would like to resolve it with you. You also always have the right to lodge a complaint with a supervisory authority:

CNIL (Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. This is the authority of the country in which we are established.
Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ The Hague, the Netherlands, if you live in the Netherlands.
If you live in another EU member state, you can approach the supervisory authority of your own country.

Security

This website is served exclusively over an encrypted connection (HTTPS). Access to booking and contact details is limited to those who need it for their work. If you suspect there is a problem with the security of your data, please report it immediately using the email address above.

Changes

We update this policy whenever our processing changes, for example when we start using a new service. The current version is always on this page.

Version 1.0. Adopted on 3 August 2026.