Data Processing Agreement

This is the agreement required by Article 28 of the GDPR for the personal data we handle on your behalf. It forms part of our Terms of Service and applies automatically from the moment you start using Equipe. You do not need to sign it or ask us for a copy.

If your federation or your own legal team needs a signed version on their paper, email info@equipe.com and we will arrange it.

Who is who

You are the controller. You decide which shows to run, what data goes into them, and what gets published. We are the processor. We handle that data to provide Equipe to you, and for nothing else.

Once you publish results to online.equipe.com, we act as an independent controller of the public archive. That part is not covered by this agreement; it is covered by what becomes public.

What we process, and why

• Subject matter and purpose: providing show administration software — entries, start lists, scoring, results, documents, invoicing and the integrations you enable.
• Duration: for as long as you are a customer, plus the retention periods in our Privacy Policy.
• Categories of people: riders and drivers, horse owners and breeders, grooms, trainers, chefs d'equipe, officials and judges, your own staff and volunteers, and people who contact your show.
• Types of data: names and contact details, federation and license numbers, dates of birth, nationality, club and team, entries and starts, scores and results, payments and fees, and anything you add in custom fields.
• Special categories: we do not ask for them. Some disciplines make them unavoidable — a para dressage grade says something about a person's health. Where that is part of the sport, we process it because you have instructed us to and the rules of the sport require it.

What we promise

1. We only act on your instructions. Using Equipe as intended is your instruction. If the law forces us to do something else, we will tell you first unless we are forbidden from doing so.
2. We keep it confidential. Everyone at Equipe who can reach your data is bound to confidentiality, and access is limited to those who need it to support you.
3. We keep it secure. Encryption in transit, access control, separate database schemas per show, backups, and logging of who changed what.
4. We help you answer people. If a rider asks you for access, correction or deletion, we will give you what you need to respond, and do the work ourselves where it has to happen inside Equipe.
5. We tell you about breaches. Without undue delay after we become aware, with what we know and what we are doing about it, so that you can make your own notification within your 72 hours.
6. We help with your obligations. Impact assessments, prior consultation, and questions from your supervisory authority.
7. We return or delete it when you leave. Your choice. Published results and records we must keep by law are the exception.
8. We let you check. Ask and we will answer questions, provide documentation, and where that is genuinely not enough, allow an audit at a reasonable time and at your cost.

Subprocessors

You give us general authorisation to use the subprocessors listed on our subprocessors page. Each of them is bound by terms no weaker than these, and we remain responsible to you for what they do.

How we notify you. We post a new subprocessor on that page under the heading “Changes”, with the date it takes effect, before it starts handling your data. You agree that posting it there is how we notify you under Article 28(2). If you would rather be told than have to look, write to info@equipe.com and we will add you to the list that gets an email whenever that page changes.

If you object on reasonable data protection grounds, we will look for another way. If we cannot find one, you can stop using Equipe. There is nothing to unwind: you pay after a show rather than before it, so there is no commitment to get out of and nothing owing either way.

Extensions you install yourself are not our subprocessors. When you install one, you appoint that developer directly.

Transfers outside the EU

Your data is stored in the European Union. Where a subprocessor is established outside the EU and personal data reaches it, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision, together with an assessment of whether that is enough in practice.

Federations are not subprocessors

When entries or results go to the FEI or a national federation, they receive them as controllers in their own right, under their own rules. We are not instructing them and we cannot recall data on your behalf once it has been sent. FEI General Regulations Article 109.6 makes reporting results mandatory for international events.

If this conflicts with something else

Where this agreement and our Terms of Service disagree about personal data, this agreement wins. Where you have a signed data processing agreement with us or through your federation, that one wins.

Questions about any of this? Email info@equipe.com and a person will answer.