01Who we are

Horse Flow Academy (“Horse Flow Academy”, “we”, “us”, “our”) runs the website at horseflowacademy.com, the Horse Flow Compass assessment tools, our online courses, clinics, webinars, farriery and training services.

For the purposes of POPIA we are the responsible party for the personal information described in this policy. That means we decide why and how it is processed, and we are accountable for it.

Horse Flow Academy is owned and operated by Rynhardt Erasmus and trades from Wilderness, Garden Route, Western Cape. Our full registered business details, and our physical address for the service of legal documents, are available on request — email us and we will send them to you.

Our Information Officer is responsible for how we handle personal information and for answering any request or complaint you send us. Please address privacy queries to the email above and mark them “For the Information Officer”.

02What this policy covers

This policy applies whenever you:

• visit or use horseflowacademy.com;
• create an account, buy a Compass, a course, a clinic ticket or a webinar place;
• use the Horse Flow Compass assessment tool and save records for your horses;
• book farriery, training, transport or a private session with us;
• message us by email, WhatsApp, a contact form or social media;
• subscribe to our mailing list or respond to one of our adverts.

It does not cover other companies’ websites we link to, or platforms we do not control — for example Amazon, where our book is sold, or Facebook and Instagram, where we post. Those services have their own privacy policies and you should read them.

03The information we collect

We only collect what we actually need. Depending on how you deal with us, that may include:

Special personal information

We do not deliberately collect “special personal information” as POPIA defines it — such as your religion, race, health, political views, trade-union membership, sex life, biometric data or criminal record. Please do not send it to us. If you voluntarily tell us about a medical condition or injury so that we can run a clinic safely, we will use that only for that purpose, keep it strictly confidential and delete it after the event.

04Where we get it from

• Directly from you — when you fill in a form, create an account, buy something, book a clinic, use the Compass, or message us.
• Automatically — through cookies and similar technology when you use the site (see section 07).
• From our payment provider — confirmation that a payment succeeded or failed, and limited card details as described above.
• From advertising and analytics platforms — aggregated statistics about how our adverts and pages perform.
• From someone who books on your behalf — for example if a yard owner books a clinic place or a farriery visit for you. If you give us somebody else’s details, please make sure they are happy for you to do so.

05Why we use it, and our legal grounds

POPIA requires us to have a lawful ground for every use of your information. Ours are set out below.

Where we rely on your consent, you may withdraw it at any time — see section 13. Withdrawing consent does not make anything we did beforehand unlawful, and it does not affect processing we do on another ground, such as keeping tax records.

We do not use your personal information to make automated decisions that have a legal effect on you or that significantly affect you.

06Your horse records in the Compass

The Horse Flow Compass saves what you rate so that your work is not lost between sessions. Specifically, we store the rider name you enter, each horse’s name, every rating you give, your scores, and a short history of previous readings, against your user account on our website.

• Your Compass records are private to your account. Other members cannot see them.
• Ray and our administrators can see members’ scores through an internal dashboard. We use this only to support you — so that when you ask a question we can look at the actual reading and give you a useful answer.
• If you ask us to email a summary to yourself, that summary is sent through our email provider to the address you give.
• We may look at Compass results in an anonymous, aggregated form — for example how many riders struggle with backing up — to improve our teaching. Nothing in that analysis identifies you or your horse.
• We do not sell, licence or hand your Compass records to anybody else.

If you would like your horse records deleted, ask us and we will remove them (see section 13).

07Cookies and tracking

A cookie is a small file placed on your device. We use cookies and similar technologies (pixels, tags and local storage) in four groups:

We ask for your choice on non-essential cookies the first time you visit, and you can change it at any time from the cookie notice. You can also block or delete cookies in your browser settings — but if you block the strictly necessary ones, you will not be able to log in or check out.

The advertising and analytics platforms named above set their own cookies and act as separate responsible parties for that data. You can manage advertising preferences directly with them — for example through your Meta ad settings, your Google ad settings, or your device’s advertising controls.

08Who we share information with

We do not sell your personal information, and we never rent or trade our mailing list. We share it only with the following, and only as far as necessary:

• Website hosting and technical suppliers — the company that hosts horseflowacademy.com and the developers who maintain it.
• Payment providers — the gateway that processes your card or EFT payment. They receive your payment details directly and are separate responsible parties under their own policies.
• Email delivery — the service that sends your receipts, account emails, Compass summaries and newsletters.
• Ticketing and event tools — the plugin that issues your clinic or webinar ticket and scans it at the gate.
• Video platforms — where a webinar runs on Zoom or Google Meet, that platform receives the name and email you join with.
• Analytics and advertising platforms — as described in section 07.
• Messaging platforms — if you contact us on WhatsApp, that conversation sits on WhatsApp’s infrastructure under Meta’s policies.
• Professional advisers — our accountant, bookkeeper, insurers or attorneys, where they genuinely need it.
• Authorities — where the law, a court order or a regulator requires it, or to protect somebody’s safety.
• A buyer — if the business, or part of it, is ever sold or transferred, in which case we will tell you and the buyer will be bound by this policy.

Everyone who processes personal information on our behalf is an operator under POPIA. They must act only on our instructions, keep the information confidential, and protect it properly.

09Sending information out of South Africa

Some of the services we rely on — hosting, email, video, analytics and advertising — store or process data on servers outside South Africa, typically in the European Union or the United States.

Where that happens, section 72 of POPIA allows it only if at least one of the following is true, and we make sure one of them is:

• the recipient is subject to a law, binding corporate rules or a binding agreement that gives your information a level of protection substantially similar to POPIA;
• the transfer is necessary to perform our contract with you, or to conclude one in your interest; or
• you have consented to it.

10How long we keep it

We keep personal information only for as long as we need it, or for as long as the law requires. As a guide:

When a period ends, we securely delete the information or strip it of anything that identifies you.

11How we protect it

We take the security measures POPIA requires, which include:

• the whole website served over an encrypted HTTPS connection;
• passwords stored only as one-way hashes, never in readable form;
• card details handled entirely by the payment provider, never by our website;
• access to accounts, orders and the Compass dashboard limited to people who need it, protected by strong passwords;
• software, plugins and the platform kept up to date, with regular backups;
• agreements with our suppliers requiring them to protect the information they hold for us.

No system is perfectly secure. If a breach ever puts your personal information at real risk of harm, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires.

Please help us: use a password you do not use anywhere else, and do not share your login. Your Compass account is personal to you.

12Children

Our website, shop and online tools are meant for adults. We do not knowingly collect personal information from anyone under 18 without the consent of a parent or guardian.

Young riders are welcome at our clinics and lessons, but the booking, the payment and the consent must come from a parent or legal guardian, who must also sign the indemnity. If you believe a child has given us personal information without that consent, tell us and we will delete it.

13Your rights

Under POPIA you have the right to:

• be told whether we hold personal information about you, and to ask for a copy of it (sections 23 and 24, read with the Promotion of Access to Information Act);
• have it corrected or updated if it is wrong;
• have it deleted or destroyed where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, obtained unlawfully, or where we no longer have a reason to keep it;
• object to us processing it on the grounds of legitimate interest, on reasonable grounds relating to your situation (section 11(3));
• withdraw your consent at any time, where consent is what we relied on;
• tell us to stop sending you direct marketing (section 69);
• complain to the Information Regulator (section 16 below);
• not be subject to a decision based solely on automated processing — we do not do this.

How to exercise them

Email horseflowacademy@gmail.com and tell us what you want. Please give us enough detail to find your records, and be aware that we may need to verify your identity first so that we do not hand your information to somebody else.

We will respond as quickly as we reasonably can, and in any event within 30 days. Formal access requests are handled under the Promotion of Access to Information Act on the prescribed form (Form 2), and a prescribed fee may apply. Requests to correct or delete are made on Form 2, and objections on Form 1; we will send you the right form if you ask. Our PAIA manual is available free of charge on request.

You will not be charged for asking us to correct something, to stop marketing to you, or to delete your Compass records.

14Marketing and how to stop it

We will only send you marketing by email or message if you have asked for it, or if you have bought something from us and we are telling you about our own similar products — which section 69 of POPIA and section 11 of the Consumer Protection Act allow, as long as you can always opt out.

Every marketing email has an unsubscribe link at the bottom. One click and you are off the list. You can also reply STOP to a marketing WhatsApp, or simply email us. We act on opt-outs immediately and in any event within a few days.

Opting out of marketing does not stop the emails we have to send you about something you bought — your receipt, your ticket, your login details, or a change to a booking.

You may also register on the national opt-out register once it is operational, and we will honour that.

15If you are in the EU or the UK

We sell to customers outside South Africa. If you are in the European Union or the United Kingdom, the GDPR or UK GDPR may also apply to you, and you additionally have the right to data portability, the right to restrict processing, and the right to lodge a complaint with your national data protection authority — in the UK, the Information Commissioner’s Office.

The legal grounds we rely on map across: “performance of our contract” is Article 6(1)(b), “legal obligation” is 6(1)(c), “legitimate interests” is 6(1)(f), and “consent” is 6(1)(a). Where we transfer your data to South Africa, we do so on the basis of your contract with us or appropriate safeguards.

To exercise any of these rights, use the same contact details in section 18.

16Complaints

If you are unhappy with how we have handled your personal information, please tell us first — most things are a misunderstanding and we would rather fix it. Email horseflowacademy@gmail.com, marked for the Information Officer.

If we cannot resolve it, you may complain to the Information Regulator:

Complaints are lodged on Form 5 through the Regulator’s online portal.

17Changes to this policy

We will update this policy when our services, our suppliers or the law change. The version number and the “last updated” date at the top of the page always tell you which version you are reading.

If a change materially affects your rights, we will tell you directly — by email or a notice on the site — before it takes effect. Continuing to use the website after a change means you accept the updated policy.

18How to reach us

Any question about privacy, any request about your information, or anything in this policy you do not understand — just ask. A real person reads it.

Helping People, Helping Horses.