Privacy Policy — New Zealand

1. Introduction

Horsify Pty Ltd (ACN 693 058 383, ABN 63 693 058 383), a company incorporated in Australia with its registered address at 3711 Goodwood Road, Elliott QLD 4670, Australia ("we", "our", or "us"), operates the websites https://www.horsify.co.nz and https://www.horsify.com.au and the Horsify mobile applications for iOS and Android (together, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our mobile applications, or use our services. References to the "Service" in this Privacy Policy apply equally to the website and the mobile applications unless stated otherwise.

This is the New Zealand version of our Privacy Policy, for people who use the Service in New Zealand. If you use the Service in Australia, our Australian Privacy Policy applies to you instead.

We are committed to protecting your privacy in accordance with the Privacy Act 2020 (NZ) and the Information Privacy Principles (IPPs). Although we are an Australian company, the Privacy Act 2020 applies to personal information we collect in the course of carrying on business in New Zealand, and we handle that information accordingly.

2. Information We Collect

2.1 Personal Information You Provide

We may collect the following personal information when you use our Service:

• Name and contact details (email address, phone number)
• Account credentials (username and password, or social media authentication tokens)
• Payment and billing information (processed and stored by Stripe)
• Horse and rider information (names, registration numbers, competition history)
• Linked rider information (when you register a minor in your care, or an adult who has consented to being managed by your account): name, date of birth, relationship to you, the type of link, and any relevant medical notes or disability information you choose to provide
• Horse nomination details for event entries, including name, breed, and sex of horses you nominate (including horses not already registered on your profile)
• Horse health and movement declaration details, where you complete one for an event. This may include horse identification (name, breed, colour, sex, age, microchip number, registration number); the name, phone number, email, and address of the person responsible for the horse; origin and destination property details and Property Identification Codes (PICs); movement purpose, dates, transport details, and recent movement history; Hendra virus vaccination status; cattle tick treatment details; your responses to event-day health questions; the legal name you sign with; and a record of the date, IP address, and browser/device (user agent) used at the time of signing, kept as an audit trail of the declaration
• Organisation and venue details for event organisers
• Bank account details for event organisers who choose to accept bank transfer payments (account name, account number, bank name, and — for Australian accounts — BSB; stored in encrypted form)
• Communications and correspondence with us (email, SMS, support tickets)
• Verification codes for email and mobile phone verification
• Profile information when using Facebook Login

2.2 Information Collected Automatically

When you access our Service, we may automatically collect:

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, time spent, links clicked, features used)
• Authentication cookies for session management
• JWT tokens stored in secure HTTP-only cookies
• Anonymous cart session identifiers (X-Session-Id) to preserve your shopping cart before login
• Location data (with your consent) via Google Places API
• Session identifiers for security and fraud prevention
• Chat interactions when using our support chat widget
• Mobile device information when you use our mobile apps (device model, operating system version, app version)
• Push notification device tokens (only if you enable push notifications — see section 12)

2.3 Information from Third-Party Sources

We aggregate publicly available event information from:

• Event organiser websites and calendars
• Public event listings and notices
• Equestrian association publications
• Other publicly accessible sources

We also receive information from third-party services:

• Facebook: Profile information (name, email) when you use Facebook Login
• Google: Location and address information via Google Places API
• Stripe: Payment processing status and transaction metadata

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing and maintaining our Service
• Processing event registrations and payments via Stripe
• Sending verification emails and SMS codes via Azure Communication Services
• Sending notifications about events, registrations, and account updates (including push notifications on mobile devices and web browsers, where you have opted in)
• Verifying your email address and mobile phone number
• Processing location searches and venue information via Google Places API
• Improving and personalising your experience
• Communicating with you about our services
• Complying with legal obligations and regulatory requirements
• Detecting and preventing fraud or security issues
• Aggregating and analyzing usage patterns to improve the Service
• Storing documents and images in Azure Blob Storage for processing
• Authenticating users through Facebook Login
• Processing documents and extracting information using Azure Document Intelligence and Azure OpenAI
• Providing real-time customer support through Microsoft Customer Connect chat widget
• Managing support tickets through Zammad knowledge base
• Generating digital wallet passes for event registrations (Apple Wallet and Google Wallet)
• Recording horse health and movement declarations, generating Horse Movement Records for your own biosecurity record-keeping, and sharing declaration details with the relevant event organiser for event administration and safety

4. Disclosure of Your Information

We may share your information with:

4.1 Event Organisers

When you register for an event, we share your registration details with the relevant event organiser.

4.2 Service Providers

We work with third-party service providers who assist us with:

• Payment processing: Stripe (payment gateway and Stripe Connect)
• Email communications: Azure Communication Services
• SMS notifications: Azure Communication Services
• Cloud hosting and data storage: Microsoft Azure (including Azure SQL Database and Azure Blob Storage)
• Location services: Google Places API and Google Maps
• Authentication: Facebook Login (optional)
• Document processing: Azure Document Intelligence and Azure OpenAI for text extraction and processing
• Analytics and performance monitoring: Azure Application Insights
• Customer support: Microsoft Customer Connect chat widget for real-time support
• Support ticket management: Zammad knowledge base system for managing support requests
• Internal notifications: Microsoft Teams webhooks for operational notifications (does not include personal user data)
• Mobile wallet integration: Apple Wallet and Google Wallet for event registration passes
• Push notifications: Azure Notification Hubs, which delivers notifications via Apple Push Notification service (APNs) on iOS and Firebase Cloud Messaging (FCM, operated by Google) on Android
• App distribution: Apple App Store and Google Play, which process app download and crash/diagnostic data under their own privacy policies

4.3 Where Your Information Is Held and Sent (Overseas Disclosure — IPP 12)

Your information is not stored in New Zealand. Our primary data storage is in the Microsoft Azure Australia East region, in Australia, and we are an Australian company. Some of our service providers are located in other countries, including the United States.

Under Information Privacy Principle 12 of the Privacy Act 2020, we may only disclose your personal information to an agency outside New Zealand in limited circumstances, including where we believe on reasonable grounds that the receiving agency is subject to privacy laws that, overall, provide comparable safeguards to the New Zealand Act, or is required to protect the information in a comparable way (for example by contract), or where you authorise the disclosure after being expressly told that the receiver may not be required to protect the information in a way that provides comparable safeguards. Australia's Privacy Act 1988 (Cth) and Australian Privacy Principles apply to the information we hold in Australia. Where we use providers in other countries, we rely on their contractual data-protection commitments.

Specifically, data may be held in or transferred to:

• Australia: Primary data storage in the Microsoft Azure Australia East region, operated by us as an Australian company subject to the Privacy Act 1988 (Cth)
• United States: Stripe (payment processing), Google (location services and Firebase Cloud Messaging push delivery), Facebook (authentication), Apple (push notification delivery via APNs, Apple Wallet), Microsoft (chat support, Teams notifications, document processing)
• Europe: Microsoft Azure data centers and Microsoft Customer Connect services

4.4 Legal Requirements

We may disclose your information when required by law or to:

• Comply with legal processes or government requests
• Respond to a lawful request from a biosecurity, animal-health, or other regulatory authority, including the production of horse health or movement information where required under the Biosecurity Act 1993 (NZ) or, for Australian events, Australian biosecurity legislation
• Enforce our Terms of Service
• Protect our rights, property, or safety
• Prevent fraud or security threats
• Respond to court orders or subpoenas

5. Data Security

We implement appropriate technical and organisational security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit (HTTPS/TLS) and at rest (Azure Storage encryption)
• Encryption of sensitive organisation financial details (bank account name, account number, and — for Australian accounts — BSB) using ASP.NET Core Data Protection before storage in the database
• Secure storage of secrets in Azure Key Vault
• JWT-based authentication with secure HTTP-only cookies
• Regular security assessments and updates
• Access controls and role-based permissions
• Managed Identity authentication for Azure services
• Payment data security managed by Stripe (PCI-DSS Level 1 certified)
• Secure cloud infrastructure with Microsoft Azure

However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security. We are not liable for security breaches caused by third-party service providers.

5.1 Notifiable Privacy Breaches

We are subject to the notifiable privacy breach regime in Part 6 of the Privacy Act 2020 (NZ). If we suspect a privacy breach has occurred, we will assess it promptly. If we believe a breach has caused, or is likely to cause, serious harm to any individual whose personal information is involved, we will notify the Office of the Privacy Commissioner and the affected individuals as soon as practicable, and tell you what happened, what information was involved, and what you should do in response. Because we also operate in Australia, the same incident may additionally be notified under Australia's Notifiable Data Breaches scheme.

Where the breach affects personal information we hold on behalf of a club, riding school or other organisation, we will also notify that organisation without undue delay so that it can meet its own obligations, and will give it the information it reasonably needs to do so.

5A. Automated Processing and Artificial Intelligence

Some features of the Service use automated processing, including artificial intelligence, on information you provide:

• Document processing: documents you upload (such as entry forms, results sheets and schedules) are processed by Azure Document Intelligence and Azure OpenAI to extract text and structured details, as described in section 11.7
• Drafting and suggestions: features that draft or summarise text, or that suggest feed, care or training plans, generate their output using an AI model
• Operational automation: routine, rules-based automation such as sending reminders, allocating bridle numbers, generating draws and running orders, and matching duplicate records

We do not use automated processing to make decisions that produce legal effects for you or that similarly significantly affect you. Decisions about your entries, memberships, eligibility, refunds and payments are made by people — by us, or by the organisation you are dealing with. Output from an AI feature is a suggestion that a person reviews; it is not advice and does not replace a qualified professional.

Information processed by these features is handled in accordance with this Privacy Policy and is not used to train publicly available AI models.

6. Data Retention

We retain your personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Account information: Retained while your account is active and for a reasonable period after closure
• Transaction records: Retained for at least 7 years for tax and financial compliance (as required by Australian tax law and, for New Zealand organisations, the record-keeping requirements of the Tax Administration Act 1994 (NZ) and Goods and Services Tax Act 1985 (NZ))
• Event registrations: Retained for historical records and organiser reference
• Horse health and movement declarations: Retained for at least 2 years, and may be retained longer for organiser records, dispute resolution, and legal compliance (including any record-keeping requirement applying to you or the organiser under the Biosecurity Act 1993 (NZ) or, for Australian events, Australian biosecurity legislation)
• Communications logs: Retained for customer support and dispute resolution purposes
• Email verification tokens: Expired and deleted after 30 minutes
• SMS verification codes: Expired and deleted after 10 minutes
• Payment events: Retained indefinitely for audit and reconciliation purposes
• Anonymized analytics data: Retained indefinitely for service improvement

When your information is no longer needed, we will securely delete or anonymize it, unless retention is required by law.

7. Your Rights Under the Privacy Act 2020

Under the Privacy Act 2020 (NZ) and the Information Privacy Principles, you have the right to:

• Access (IPP 6): Request confirmation that we hold personal information about you and access to it. We will respond as soon as reasonably practicable, and in any case within 20 working days
• Correction (IPP 7): Request correction of inaccurate, out-of-date, incomplete, or misleading information — and, if we do not make the correction, ask that a statement of the correction you sought be attached to the information
• Complaint: Complain to us, and to the Office of the Privacy Commissioner, about how we handle your personal information (see section 14)
• Opt-out: Unsubscribe from marketing communications at any time

In addition, although these are not rights the Act itself confers, we also offer you:

• Deletion: Request deletion of your personal information (subject to legal requirements and legitimate business needs)
• Data Portability: Request a copy of your data in a structured format (where technically feasible)

To exercise these rights, please contact us at privacy@horsify.com.au.

Account Deletion: You can permanently delete your account at any time from within the app by going to Account → Delete Account, or by visiting https://www.horsify.co.nz/Account/DeleteAccount. Deletion takes effect immediately. Please note that some information may be retained for legal, tax, or legitimate business purposes as outlined in our data retention policy.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience, analyse usage, and maintain session security. The specific cookies we use include:

• Essential Cookies: Authentication cookies containing JWT tokens (HTTP-only, secure) for maintaining your logged-in session
• Session Cookies: Temporary identifiers for fraud prevention and security
• Preference Cookies: Settings and preferences you configure (e.g., saved filters, postcode preferences)
• Analytics Cookies: Azure Application Insights for monitoring application performance and usage patterns

You can control cookies through your browser settings, but disabling essential cookies may affect your ability to use certain features of our Service, particularly authentication and session management.

Third-Party Cookies: When you use Facebook Login or interact with Google Maps, those services may set their own cookies subject to their respective privacy policies.

Mobile Applications: Our iOS and Android apps use equivalent local storage technologies (such as secure cookies, local storage, and on-device caches) for the same purposes described above. See section 12 for details about data stored on your device.

9. Third-Party Links

Our Service may contain links to third-party websites, including event organiser websites and external event sources. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

Third-Party Services We Use:

• Stripe: Stripe Privacy Policy
• Google: Google Privacy Policy
• Facebook: Facebook Privacy Policy
• Microsoft Azure: Microsoft Privacy Statement
• Apple: Apple Privacy Policy
• Google Wallet: Google Wallet Terms of Service

10. Children and Families

Many of the riders Horsify holds information about are children: a riding school's pupils, a club's junior members, and the children a parent enters in events. This section says what we hold about a child, who holds it, who may see it, how it is used and how long it is kept. For a New Zealand organisation it applies the Privacy Act 2020 and the Health Information Privacy Code 2020, under which a child's health information is held to a higher standard, and the Office of the Privacy Commissioner's guidance that a young person's capacity to make their own privacy decisions is judged by their maturity rather than a fixed age.

10.1 Accounts are for people aged 15 and over

A Horsify account can be created only by a person who is 15 or older, which is the age from which we treat a person as able to make their own privacy decisions. The person confirms this when they create the account, and we record that confirmation with the date. A younger rider does not have an account of their own: a parent or guardian adds them to their own account (section 10.2). A club or school that invites its clients to create accounts invites the parent, not the child.

A person aged 15 to 17 who holds their own account may still be a child in the care of a parent, and a parent may still manage them from the parent's account. We do not send marketing to anyone we know to be under 18 (section 10.5).

10.2 A child on a parent's account (the family list)

A parent or guardian adds a child to their own account so they can enter, book and pay for them. For each child on the family list we hold: first name and surname; date of birth (to apply age rules, and to know when the child turns 18); the relationship to the account holder and whether they are the primary contact, may collect the child and may authorise medical treatment; and, only if the parent chooses to provide them, medical notes, disability details, an emergency contact and a contact phone number. Health information is held only once the parent has ticked that they agree to us holding it, and we record who agreed and when.

The parent sees and can correct everything on the family list from their profile, and can remove a child from it at any time. More than one parent or guardian may manage the same child, each from their own account. On the child's 18th birthday the parent's authority to consent for them ends: the link becomes a "managed adult" link (the parent can still book and pay, the rider signs their own waivers and consents), we tell the parent once by email, and the rider may claim their own login using the email address their club or school holds for them, which ends the parent's management of them.

10.3 A child's record at a club or riding school

A club or riding school keeps its own record of each child it teaches or has as a member: name, date of birth, the parent or guardian and how to reach them, lesson and entry history, waivers a parent signed, and, for a riding school, weight (for horse allocation), medical conditions, dietary requirements, special needs and any incident report. The club or school collects this information and is responsible for it; Horsify holds and processes it on the organisation's behalf under our Terms of Service, and does not use it for any purpose of its own. A request to see or correct a child's record at a club or school goes to that organisation, which can do so on the child's card; a request about the family list goes to us (section 7).

Staff record a child's health information only after confirming that the parent or guardian agreed to it, and the record keeps who confirmed it and when. Within an organisation a child's health information is shown only to staff the organisation has given access to its clients (the "Manage" level), to the coach teaching the child's lesson, and to Horsify's own administrators for support; office staff with lesser access see the child's record without it. Every reading of a child's medical notes or incident report is logged. Health information is not sent to any third party except where required for safety or by law.

10.4 Who is told what, and how

Messages about a child go to the parent or guardian, never to the child: lesson reminders and confirmations, waiver requests, results, payment requests and texts. Where a text cannot reach a parent's own mobile it is not sent, and the parent is emailed instead. A child's own address is never used for marketing (section 10.5), and an enquiry a child sends about themselves is answered but not followed up.

10.5 No marketing to children

We do not use a child's information for direct marketing, and a club's or school's campaigns through Horsify exclude anyone the organisation records as under 18, at every channel. Marketing about a child's activities (for example a school's newsletter) goes to the parent, who may opt out at any time.

10.6 Results, running orders and photographs

Competition results, standings and running orders are public in equestrian sport and name each rider, children included, with their horse; on Horsify's public pages and exports a rider is named by first name and initial only. Photographs of children appear on a club's site only where the club has published them; a club should hold a parent's consent before doing so, and anyone may ask a club to take a photograph down through the request link on its gallery. Horsify does not collect or record photo consent for clubs today; this is on our roadmap.

10.7 How long a child's information is kept

A child on a parent's family list stays there until the parent removes them or deletes their account. When a parent deletes their account, a child who has no record with any club or school is deleted with it. A child a club or school has on its books stays on that organisation's books, because the organisation's records of lessons, entries, waivers and incidents are records it is obliged to keep (including records relevant to child safety); the health notes, emergency contact and phone number the parent entered on the family list are removed. A club's own records are kept for as long as the club needs them under the law that applies to it, and the club can end a client relationship on the client's card. We are documenting a retention schedule for each record type with our legal advisers.

10.8 Managed adults

An account holder may also manage an adult who has no login of their own (for example a spouse) under a "managed adult" link. The adult remains responsible for their own waivers and consents; the account holder must not provide the adult's health information unless the adult has agreed; and the adult may withdraw consent to being managed, or ask us directly for access to, correction of or deletion of the information held about them, without going through the account holder. A guardian link over an adult is available only where the account holder declares that they hold legal guardianship over that adult.

11. Specific Data Processing Activities

11.1 Payment Processing (Stripe)

When you make a payment, we use Stripe to process your payment information. Stripe collects and stores your payment card details, billing address, and transaction information. We receive only:

• Last 4 digits of your card number
• Card brand (Visa, Mastercard, etc.)
• Payment status and transaction ID
• Billing email address

Full payment card details are stored securely by Stripe and are never stored on our servers.

11.2 Email Communications (Azure Communication Services)

We use Azure Communication Services to send transactional emails, including:

• Email verification links
• Event registration confirmations
• Payment receipts
• Account notifications

Your email address and the content of these communications are processed by Microsoft Azure servers.

11.3 SMS Notifications (Azure Communication Services)

If you opt-in to SMS notifications or request mobile verification, we use Azure Communication Services to send text messages. Your phone number and message content are processed by Microsoft Azure and telecommunications carriers. Standard SMS rates may apply.

11.4 Location Services (Google Places API)

When you search for events or venues, we use Google Places API to:

• Geocode addresses to coordinates
• Provide address autocomplete suggestions
• Calculate distances between locations
• Display maps and venue locations

Your search queries and location data may be sent to Google servers subject to Google's Privacy Policy.

11.5 Facebook Login

If you choose to authenticate using Facebook Login, we receive from Facebook:

• Your name
• Your email address
• Your Facebook user ID
• Your profile picture (optional)

We do not access or store your Facebook password or other Facebook account information beyond what is necessary for authentication.

11.6 Document Storage (Azure Blob Storage)

Documents and images you upload (such as entry forms or verification documents) are stored in Azure Blob Storage. These files are:

• Encrypted at rest using Azure Storage encryption
• Accessed only by authorized personnel and automated processing systems
• Retained according to our data retention policy
• Stored in Australian or Asia-Pacific Azure data centers where possible

11.7 Document Processing (Azure Document Intelligence and Azure OpenAI)

When you upload documents for processing (such as entry forms), we use Azure Document Intelligence and Azure OpenAI services to:

• Extract text and data from uploaded documents
• Automatically populate registration forms
• Process and validate document information

Uploaded documents are processed securely and are not retained by Microsoft Azure AI services beyond the processing period.

11.8 Customer Support Chat (Microsoft Customer Connect)

When you use the chat widget for customer support, we use Microsoft Customer Connect to provide real-time assistance. Information collected includes:

• Your chat messages and conversation history
• Your name and email address (if you choose to provide them)
• Session identifiers for tracking support conversations
• Device and browser information for technical troubleshooting

Chat conversations are stored for support quality purposes and may be reviewed by our support team. Microsoft processes this data in accordance with their privacy statement.

11.9 Support Ticket Management (Zammad)

When you submit a support request through our support form, we use Zammad knowledge base to manage support tickets. Information collected includes:

• Your name and email address
• Subject and description of your support request
• Any attachments or files you provide
• Support ticket history and responses

Support tickets are stored on our Zammad instance hosted at kb.horsify.com.au and are retained for customer service and dispute resolution purposes.

11.10 Digital Wallet Passes (Apple Wallet and Google Wallet)

If you choose to add your event registration to Apple Wallet or Google Wallet, we generate digital passes containing:

• Event name, date, and venue information
• Your registration details and QR code
• Event organiser information

Wallet passes are generated on-demand and transmitted directly to your device. We do not store copies of wallet passes, and Apple/Google handle the storage and management of passes according to their respective privacy policies.

11.11 Linked Rider Profiles (Dependants and Managed Adults)

When you use the linked rider management feature to create a profile for a minor in your care or for an adult who has consented to being managed by your account, the following information is stored in our database:

• First name, surname, and date of birth of the linked rider
• The type of link (guardian or managed adult), any declaration of legal guardianship over an adult, and — for a managed adult — the date and time you confirmed that they consented to being managed
• Your relationship to the linked rider (e.g., Parent, Guardian, Carer, Spouse)
• Any medical notes or disability information you voluntarily provide for riding safety and inclusive participation purposes
• Organisation membership details where applicable (membership number, status, expiry)

This information is used solely to facilitate event registrations, manage memberships, and administer riding activities on behalf of the linked rider. Medical notes and disability information, if provided, are health information and are treated with a higher standard of care (see section 10.1); they are accessible only to you and authorised organisation administrators. Where the linked rider is a managed adult, you must not provide their health information unless they have agreed, and they may contact us directly to access, correct, or delete the information held about them.

11.12 Horse Nominations for Events

When you enter a horse for an event and the horse is not already registered on your profile (nominated as "Other"), we collect the following horse details:

• Horse name
• Breed
• Sex

This information is used solely to identify the horse for the specific event entry and to provide event organisers with accurate participant records. It is shared with the relevant event organiser as part of your registration details.

11.13 Organisation Bank Account Details

Event organisers who choose to accept bank transfer payments may provide their organisation's bank account details through the platform. Information collected includes:

• Bank account name
• BSB (Bank-State-Branch) number, for Australian accounts
• Bank account number
• Bank name
• Suggested payment reference text

Bank account details are encrypted using ASP.NET Core Data Protection before being stored in our database. This information is used to display payment instructions to event participants who select bank transfer as their payment method. Bank account details are only visible to participants of the relevant event and to authorised organisation administrators. We do not use this information to initiate or process any financial transactions.

11.14 Horse Health and Movement Declarations

If you complete a horse health and movement declaration for an event, we collect and store information to support event administration and biosecurity record-keeping, including:

• Horse identification details (name, breed, colour, sex, age, microchip number, registration number)
• Details of the person responsible for the horse (name, phone number, email address, and address)
• Origin and destination property details, Property Identification Codes (PICs), movement purpose, dates, transport details, and recent movement history
• Hendra virus vaccination status and cattle tick treatment details
• Your responses to event-day health questions and any health concern notes you provide
• The legal name you sign with and an audit record of the date, IP address, and browser/device (user agent) used at the time of signing

This information is used to record the declaration, to generate a Horse Movement Record that you can download for your own biosecurity record-keeping, and to share declaration details with the relevant event organiser and their authorised administrators for event administration, safety, and welfare purposes. The IP address and user agent are retained only as an audit trail evidencing who completed the declaration and when.

We provide these tools as a convenience for record-keeping. We do not verify, certify, or lodge declarations or movement records with any authority on your behalf. You remain responsible for the accuracy of the information you provide and for meeting your own obligations under the Biosecurity Act 1993 (NZ) — or, for Australian events, Australian biosecurity legislation — including any requirement to keep and produce records on request. Some declaration fields (such as Property Identification Codes, Hendra virus vaccination, and cattle tick treatment) reflect Australian biosecurity concepts; a New Zealand organiser decides which of them, if any, it requires. We may disclose this information to a biosecurity or other regulatory authority where required by law (see section 4.4) and retain it in accordance with our data retention policy (see section 6).

12. Mobile Applications (iOS and Android)

The Horsify mobile app is available for iOS via the Apple App Store and for Android via Google Play. The app provides access to the same Service described in this Privacy Policy, and all sections of this policy apply equally when you use the app. This section describes the additional data practices specific to the mobile app.

12.1 Device Permissions

The app may request the following device permissions. All permissions are optional, are requested only when you use the relevant feature, and can be granted or revoked at any time through your device settings (Settings > Horsify on iOS, or Settings > Apps > Horsify on Android). Declining a permission only affects the feature that needs it — the rest of the app continues to work.

• Camera: Used so you can take photos and videos of your horses for profiles and records, and capture documents (such as paper score sheets) for processing. Images are captured only when you initiate them.
• Microphone: Used only to record audio when you capture videos within the app.
• Photo library: Used so you can choose existing photos to upload, and to save photos or videos to your library when you request it.
• Location (approximate, while using the app): Used to show horse events near you. We request only approximate, foreground location — the app never accesses your location in the background, and we do not store a history of your movements.
• Notifications: Used to deliver push notifications you have opted in to (see section 12.2).

12.2 Push Notifications

If you enable push notifications, we collect a push notification device token issued by your device's operating system and store it against your account so we can send you notifications about events, registrations, payments, and account activity. Notifications are delivered through Azure Notification Hubs using the Apple Push Notification service (APNs) on iOS and Firebase Cloud Messaging (FCM) on Android. The device token identifies your device for delivery purposes only — it does not give us access to any other data on your device.

You can stop push notifications at any time by disabling them in your device settings or in your Horsify notification preferences. Device tokens are removed when you disable notifications in your Horsify notification preferences or delete your account, and expired or invalid tokens are removed automatically. Disabling notifications in your device settings stops delivery immediately, although the token may remain stored until it expires or you disable notifications in your Horsify preferences.

12.3 App Tracking Transparency (iOS)

On iOS, in accordance with Apple's App Tracking Transparency framework, the app will ask for your permission before any activity that Apple defines as tracking. We use this only to measure how the app is used so we can improve it. We do not sell your personal information, and we do not share it with third parties for their own advertising purposes. If you decline, the app remains fully functional.

12.4 Data Stored on Your Device

The app stores limited data locally on your device, including authentication session data, cached content, and your preferences, so that the app loads quickly and certain features can work with an unreliable connection. Locally stored data is removed when you uninstall the app. The app also monitors your device's network connectivity status (online/offline) to manage this behaviour; connectivity status is used on-device only and is not collected by us.

12.5 Account Deletion from the App

You can permanently delete your Horsify account and associated personal information at any time, whether or not you still have the app installed, from within the app at Account → Delete Account or by visiting https://www.horsify.co.nz/Account/DeleteAccount. Deletion is self-service and takes effect immediately; you may also contact privacy@horsify.com.au for assistance. See sections 6 and 7 for details of retention and your rights.

12.6 App Store Data

When you download the app, Apple or Google may collect data such as download statistics and crash or diagnostic reports under their own privacy policies. We do not receive personal information from the app stores beyond aggregated statistics.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy.

14. Complaints and Disputes

If you have a complaint about how we handle your personal information, please contact us first at privacy@horsify.com.au. We will investigate and respond to your complaint within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner (New Zealand):

• Website: www.privacy.org.nz
• Phone: 0800 803 909 (Monday to Friday, within New Zealand)
• Post: Office of the Privacy Commissioner, PO Box 10094, Wellington 6143, New Zealand

If the Privacy Commissioner cannot resolve your complaint, you may be able to take it to the Human Rights Review Tribunal.

15. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

• Company Name: Horsify Pty Ltd (a company incorporated in Australia)
• ACN: 693 058 383
• ABN: 63 693 058 383
• Registered address: 3711 Goodwood Road, Elliott QLD 4670, Australia
• Email: privacy@horsify.com.au
• General inquiries: hello@horsify.com.au
• Websites: https://www.horsify.co.nz and https://www.horsify.com.au

If you use the Service in Australia, our Australian Privacy Policy applies to you instead of this document.

The Horsify logo is a registered trade mark of Horsify Pty Ltd (Australian trade mark no. 2604905). The Horsify name and other Horsify marks are trade marks of Horsify Pty Ltd.