EQUISS Privacy Policy

‍

 Last updated: 09/09/2026

‍

1. Introduction

EQUISS CIC values your privacy and is committed to protecting your personal information. We are an independent organisation working to support people across the equestrian community, including those at risk of harm or abuse, and to improve safeguarding, accountability and standards across the sector.

‍

EQUISS CIC is a not-for-profit Community Interest Company registered in England and Wales. Company No. 16627362.

‍

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, EQUISS CIC is the Data Controller responsible for the personal information we collect and process.

‍

This Privacy Policy explains how we collect, use, disclose, store and protect your personal data when you engage with us, including through our website, services, support line, advocacy work, EQUISS Supporter programme, donations, events or other interactions.

‍

We recognise that some people who engage with EQUISS may be sharing sensitive or personal experiences. We take this responsibility seriously and aim to ensure your information is handled in a safe, respectful and transparent way.

‍

2. What is “personal information”?

“Personal information” (or “personal data”) is any information that identifies you, or by which you can be identified directly or indirectly.

‍

This may include your name, contact details such as email address, postal address and telephone number, your IP address, job title, company affiliation, account information, service usage information, or other information which can identify you or your device.

‍

We may also, in certain circumstances, process “special category” information (sensitive personal data). Due to the nature of our work, this may include information relating to health, experiences of harm or abuse, racial or ethnic origin, religion or belief, sexual orientation or other information that requires additional protection.

‍

3. Special category (sensitive) data

Some categories of personal information are more sensitive. These are known as special category data and can include information about a person’s health or wellbeing, racial or ethnic origin, sexual orientation, religion or belief, or other personal characteristics.

‍

Due to the nature of our work, you may choose to share this type of information with us when accessing our support, advocacy or services. You are not required to provide more information than you feel comfortable sharing. We are not looking to collect sensitive personal information beyond what is necessary, and in many cases you can access our support without identifying yourself.

‍

If you provide any special category data to us, we will only use this information for the purposes outlined in this policy, including providing support, fulfilling our safeguarding responsibilities and improving our services.

‍

Where we process this type of data, we ensure that it is protected through appropriate technical and organisational measures, including secure systems, restricted access and clear internal processes. This information is only accessed by those who need it to carry out their role.

All special category data is processed in accordance with our obligations under UK data protection law, including the additional safeguards required for handling sensitive personal information.

‍

4. How we collect and use your personal information

How we collect and use your personal data depends on how you interact with us. The sections below explain how your data is used in different situations.

‍

5. If you are browsing our website

Purpose:
To provide a better user experience, monitor website performance and improve our services.

Type of data used:
IP address; Browser type and version; Device information; Usage data.

Legal basis:
Consent (for non-essential cookies); Legitimate interests (for essential functionality).

How long we keep your data:
In line with our Cookies Policy.

‍

6. If you contact the EQUISS support line or request support

Purpose:

• To provide support, respond to your enquiry, understand your needs and improve our services
• To monitor demand and usage of the service
• To maintain appropriate safeguarding records where necessary

Type of data used:

• Name (or name you choose to give)
• General location (e.g. region)
• Information about your situation or experiences
• Optional demographic information
• Technical data such as call duration or system information

Legal basis:

• Legitimate interests (providing support and improving services)
• Vital interests (where necessary to protect you or another person from serious harm)
• Explicit consent (where appropriate)

How long we keep your data:

• Identifiable information retained only as long as necessary for support and safeguarding purposes
• Anonymised data may be retained for longer periods to support insight, service improvement and campaigning
• Technical data is retained only for as long as necessary for system management and troubleshooting

Additional information:

Information may be recorded within our secure case management system to manage interactions and ensure continuity of support.

‍

We do not require you to identify yourself to access support. The amount of information recorded will depend on what you choose to share.

‍

We may collect limited technical data (such as call duration or system data) to enable the service to operate effectively.

‍

We will usually seek your consent before sharing information with another organisation. However, there may be circumstances where we need to share information without your consent where we believe this is necessary to protect a child, vulnerable adult or another person from serious harm, where required by law, or where safeguarding concerns outweigh an individual's right to confidentiality.

‍

Where possible, we will explain this to you and discuss any proposed information sharing.

‍

7. If you receive advocacy or casework support

Purpose:

• To provide advocacy and casework support
• To support you through reporting processes and engagement with relevant organisations
• To ensure safe and consistent handling of safeguarding concerns

Type of data used:

• Contact details (if provided)
• Information about your situation or experiences
• Records of communications and actions taken
• Any information necessary to support your case

Legal basis:

• Legitimate interests (providing advocacy support)
• Vital interests (where there is a risk of serious harm)
• Substantial public interest (safeguarding individuals at risk)
• Explicit consent (where required)

How long we keep your data:
Information is retained in line with safeguarding, legal and operational requirements, for the duration of the case and for an appropriate period afterwards.

‍

Additional information:

Information is managed within secure systems to ensure safe and accountable case management.

‍

Case records may be retained for extended periods where necessary to meet safeguarding, legal, regulatory or operational requirements. Retention periods are determined in accordance with our internal data retention schedule.

‍

8. If you engage with our training or events

Purpose:

• To manage bookings and participation
• To deliver training or events
• To communicate relevant information

Type of data used:
Name; Contact details; Organisation and job title.

Legal basis:
Performance of a contract; Legitimate interests.

How long we keep your data:
Retained only for as long as necessary to deliver the training or event and meet legal or regulatory requirements.

9. If you receive marketing communications

Purpose:
To send updates about our work, services, activities and ways to get involved.

Type of data used:
Name; Email address; Communication preferences.

Legal basis:
Consent; Legitimate interests where appropriate and permitted by law.

How long we keep your data:
Until you unsubscribe or withdraw consent, or we otherwise determine that the information is no longer required.

You can unsubscribe from marketing communications at any time using the unsubscribe link provided in our emails or by contacting us.

‍

10. If you become an EQUISS Supporter

When you become an EQUISS Supporter, you make a regular financial contribution to EQUISS and receive access to the EQUISS Supporter Hub and associated benefits.

‍

Purpose:

• To create and manage your EQUISS Supporter account
• To process and administer your regular financial contribution
• To provide and manage access to the EQUISS Supporter Hub and supporter benefits
• To maintain supporter records
• To communicate with you about your account, contribution, supporter benefits and other information relating to the EQUISS Supporter programme
• To understand and improve our supporter programme and services
• To maintain appropriate financial and administrative records

Type of data used:
Name; Email address; Account and login information; Supporter and subscription information; Payment and transaction information; Communication preferences; Information relating to your use of the Supporter Hub where applicable.

Legal basis:
Performance of a contract; Legitimate interests; Legal obligation where applicable; Consent for marketing communications where required.

How long we keep your data:
We retain your account and supporter information for as long as you remain an EQUISS Supporter and afterwards for as long as necessary to meet our legal, financial and operational requirements. Financial records are retained in accordance with applicable legal and regulatory requirements.

Additional information:

We use trusted third-party service providers to help us administer the EQUISS Supporter programme. This includes services that enable us to manage supporter accounts and access to the Supporter Hub, securely process payments, maintain supporter records, connect our systems and send supporter communications.

‍

Relevant information may be securely transferred between these systems where necessary to administer your account and our relationship with you.

Payment information is processed securely by our payment provider. EQUISS does not store or have access to your full payment card details.

‍

Joining the EQUISS Supporter programme does not automatically mean that we will send you marketing communications where your consent is required. Where applicable, you will be given the opportunity to choose whether you would like to receive these communications.

‍

11. If you make a one-off donation or other financial contribution

Purpose:

• To process and administer your donation
• To maintain financial records and meet our legal and regulatory obligations
• To understand and recognise support for EQUISS, where appropriate
• To communicate with you about your donation where necessary

Type of data used:
Name; Contact details; Donation and transaction information; Communication preferences; Gift Aid information where applicable.

Legal basis:
Legitimate interests; Legal obligation; Consent where applicable.

How long we keep your data:
In accordance with applicable financial and regulatory requirements.

Additional information:

One-off donations to EQUISS may be made through Localgiving, a third-party donation platform.

‍

When you donate through Localgiving, Localgiving will collect and process the personal and payment information required to administer your donation in accordance with its own privacy policy.

‍

Depending on the choices you make when donating, Localgiving may share information about you and your donation with EQUISS. We may use this information to administer and record your donation, meet our financial and regulatory obligations and understand support for our work.

‍

Where you have provided the appropriate consent, or another lawful basis applies, we may also use your contact information to communicate with you about EQUISS and our work.

‍

If you choose to donate anonymously or restrict the sharing of your information through Localgiving, the information available to EQUISS may be limited accordingly.

EQUISS does not store or have access to your full payment card details.

‍

12. Legal basis for processing

We will only process your personal data where we have a lawful basis to do so under UK GDPR.

Depending on the circumstances, this may include:

• Performance of a contract
• Legitimate interests
• Legal obligation
• Consent
• Vital interests

Where we process special category data, we will also rely on an appropriate condition under UK data protection law. This may include explicit consent, safeguarding and substantial public interest, or vital interests where appropriate.

‍

Where we rely on legitimate interests, we consider and balance our interests against your rights and interests before processing your personal information.

‍

13. Sharing your information

We may share your personal information with trusted third parties where this is necessary to operate EQUISS, provide our services, administer our relationship with you or meet our legal and safeguarding responsibilities.

‍

These may include providers of:

• Website, account and membership services
• IT, hosting and cloud services
• Customer relationship management systems
• Email and communications services
• Payment and donation processing services
• System integration and automation services
• Case management systems
• Professional and technical services

Where a service provider processes personal information on our behalf, we require appropriate contractual and security arrangements to be in place.

‍

Some third-party organisations, such as donation or payment providers, may also process your personal information as an independent data controller for some of their activities. Where this applies, their own privacy policies will explain how they use your information.

‍

We may also share information with regulatory, governmental, safeguarding or law enforcement authorities where required by law or where necessary to protect an individual from harm.

In some circumstances, particularly where there is a risk of serious harm or where a child or vulnerable person may be at risk, we may need to share information without your consent.

‍

Where possible and appropriate, we will explain this to you. However, there may be situations where we are unable to inform you in advance or at the time the information is shared.

We do not sell your personal data.

‍

14. Data retention and storage

We retain personal information only for as long as necessary for the purposes for which it was collected and in accordance with applicable legal, financial, regulatory and safeguarding requirements.

‍

When determining retention periods, we consider the nature and sensitivity of the information, why it is being processed, the potential risk associated with retaining it and our legal and safeguarding responsibilities.

‍

Where possible, we minimise the amount of identifiable data retained and may retain anonymised information for longer periods to support insight, service improvement, research and campaigning.

‍

Further details of retention periods are maintained within our internal data retention schedule.

‍

15. Data minimisation and anonymity

We are committed to collecting only the information we need and allowing individuals to access support without identifying themselves where possible.

‍

We may use anonymised information to understand patterns, improve services, support research and inform our work. This information does not identify you.

‍

16. Children and young people

We recognise that some individuals who engage with our services may be under the age of 18, or that information shared with us may relate to children and young people.

‍

We take additional care when handling information relating to children and young people and process this information in accordance with safeguarding requirements and applicable data protection legislation.

‍

Where appropriate, we will consider the age, understanding and best interests of the child when processing personal information.

‍

17. Keeping your information safe

We take the security of your information seriously and have implemented appropriate technical and organisational measures to protect it.

‍

This includes secure systems, restricted access to data, appropriate contractual arrangements with service providers and staff training in confidentiality, data protection and safeguarding.

Only those who need access to your information to perform their role will be able to access it.

While we take appropriate steps to protect personal information, no system or transmission of information over the internet can be guaranteed to be completely secure.

‍

18. Data transfers outside the UK

Some of the third-party service providers we use may process or store personal information outside the UK.

‍

Where personal information is transferred outside the UK, we take steps to ensure that it continues to receive an appropriate level of protection in accordance with UK data protection law.

‍

This may include transferring information to countries covered by UK adequacy regulations or using approved contractual safeguards and other appropriate measures.

If you would like further information about the safeguards used when transferring your personal information outside the UK, please contact us.

‍

19. Your rights

Under UK data protection law, you may have the following rights in relation to your personal information:

• The right to request access to the personal information we hold about you
• The right to request correction of inaccurate or incomplete information
• The right to request deletion of your personal information in certain circumstances
• The right to restrict the processing of your personal information in certain circumstances
• The right to object to certain processing of your personal information
• The right to data portability in certain circumstances
• The right to withdraw consent at any time where processing is based on consent
• The right to lodge a complaint with the Information Commissioner’s Office (ICO)

These rights do not apply in every circumstance and there may be situations where we are legally permitted or required to continue processing information.

‍

To exercise any of these rights, please contact us. We may need to verify your identity before responding to your request.

‍

20. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our services, how we process personal information, or applicable law.

‍

The “Last updated” date at the top of this policy will indicate when it was most recently revised.

Where appropriate, we will take reasonable steps to bring significant changes to your attention.

‍

21. Contact us

If you have any questions, comments or concerns about this Privacy Policy or how we handle your personal information, please contact:

Data Protection Officer
DPO@equiss.org.uk

‍

EQUISS CIC
C/O Keysoe International
Church Road
Keysoe
Bedford
Bedfordshire
United Kingdom
MK44 2JP

‍

You also have the right to make a complaint to the Information Commissioner’s Office (ICO) if you are concerned about how we have handled your personal information.

‍

ICO telephone: 0303 123 1113

EQUISS ICO registration number: ZC060828