EQUINET PRIVACY POLICY

Lawful bases and jurisdiction requirementsMustad's legal basis for collecting and processing the Personal Data as described in this Privacy Policy depends on the Personal Data we collect and the specific context in which we collect it.
In Australia, we assess collection, use, disclosure and overseas handling under the applicable Australian Privacy Principles, including whether a secondary use is permitted or needs consent. In New Zealand, we assess the applicable Information Privacy Principles, including limits on secondary use and overseas disclosure. In the United States, applicable federal and state requirements and rights are addressed in the US Supplement. Creating an anonymous output does not remove legal requirements applying to the Personal Data processing used to create it.
Where the GDPR applies, the lawful basis depends on the purpose and circumstances. The general grounds below do not replace the purpose-specific basis for EDI:
l  The performance of an agreement with you or to take measures before the conclusion of an agreement
l  Your informed consent
l  Legitimate interests, where necessary for a specified legitimate purpose and not overridden by the individual's interests or fundamental rights and freedoms
l  To comply with applicable law and legal obligations (including valid requests by public authorities for the disclosure of Personal Data)
Where the GDPR applies, Mustad relies on legitimate interests under Article 6(1)(f) for Personal Data processing for the Statistical Purpose: producing and commercialising privacy-preserving statistics about the equine care and services market. Before processing begins, Mustad must document the purpose, necessity and balancing assessment, including reasonable expectations, effects on individuals and safeguards, and a purpose-compatibility assessment for any reuse. This includes the applicable requirements of Articles 5(1)(b), 6(4) and 89(1); describing a use as statistical does not by itself authorise it. If the assessment does not support the proposed processing, the affected data is excluded until applicable legal requirements are met. Equivalent requirements are assessed under the UK GDPR where applicable; Swiss and other local requirements are assessed separately.
All Users. We use the contractual basis where processing is necessary to provide the Services you request. For the Statistical Purpose, the legitimate-interests assessment and safeguards above apply; acceptance of the Terms is not consent to EDI. Sponsored offers instead require the separate opt-in described below. Information entered or confirmed directly by any User is governed by v4.0 of the Terms of Use and this policy from the applicable notice and acceptance steps, with the simple prospective EDI opt-out and applicable right to object. The User entering information need not be the horse owner or service provider, and a record designation is not contractual acceptance, consent or retrospective authority to reuse information previously entered by another person. Historical customer and business information remains distinct from a User's later entries or confirmations. Registration, claiming or confirming a Horse Record, acceptance of the Terms, or an EDI preference does not retrospectively authorise historical processing or change its original lawful basis. Subsequent lawful use of historical facts remains subject to the Historical Professional Data rules and all applicable opt-outs.
Every User may opt out of EDI at any time, free of charge, through account settings or by emailing privacy@mustad.com, without giving a reason or losing access to the Services. This is a voluntary product commitment, not consent to EDI processing. An EDI opt-out or objection stops future processing within its scope from receipt, including new aggregation, EDI training and retraining, and reuse of existing training datasets and caches. The opt-out covers data recorded by or lawfully on behalf of that User and identifiable information about that User; an authorised business representative may communicate the represented controller's choice within their authority. A horse owner may additionally exclude all horse-level information about their horses, including service entries; a delegate may communicate that choice only with verified authority. Each applicable contributor, business, individual or horse-owner exclusion must be honoured; copying, confirming or relabelling data must not bypass it or let a User waive another person's rights. Where Article 21 GDPR applies, individuals also have the right to object on grounds relating to their particular situation to processing based on legitimate interests. Mustad honours EDI objections through the same prospective exclusion as the simple EDI opt-out, without requiring the individual to justify use of that product choice. This commitment does not limit statutory rights, including applicable restriction, erasure and complaint rights. A person whose information was entered by another User may exercise their rights by emailing privacy@mustad.com without registering. An opt-out or objection does not require withdrawal or deletion of genuinely anonymous aggregated outputs lawfully created before receipt. It does not authorise continued EDI use of identifiable or pseudonymous source data or training copies. Those remain subject to applicable lawful-basis, retention, restriction and deletion requirements. A model may continue to be used for EDI only if lawfully created and assessed as meeting the aggregation, identifiability and non-extraction safeguards; de-identification of training records does not by itself make a model anonymous.
Historical Professional Data notice"Historical Professional Data" means data recorded through EQUINET by or on behalf of Professionals, including farriers and other equine care and service providers, before the effective date of v4.0 of the Terms of Use and Privacy Policy. Historical Professional Data may be processed for the Statistical Purpose to the extent permitted by applicable law and the Privacy Policy. Eligible categories may include service activity and frequency, service mix, volumes, geography, historical prices and spend recorded by Professionals, horse and service information, and Professional business characteristics. Historical Professional prices are not categorically excluded; their use remains subject to the pricing safeguards and all other EDI controls.
Before any such reuse, Mustad must document the applicable lawful basis, legitimate-interests and purpose-compatibility assessments where relevant, source permissions, controller or processor responsibilities, required transparency and applicable objections and opt-outs. Professionals must receive clear notice before the new processing begins, and other affected individuals must receive information as required by applicable law, including Article 14 GDPR where applicable. Earlier Terms are not treated as automatically authorising every new EDI use. Silence, failure to object or continued use is not consent to EDI. Nothing in v4.0 retrospectively changes the lawful basis applicable when data was collected or cures prior unlawful processing.
Identities and contact details of customers or horse owners historically entered by Professionals are not used for EDI and are never disclosed through EDI to clients, research partners or sponsors. Eligible horse and service facts may contribute only where lawful to compliant anonymised and aggregated outputs, subject to applicable rights and exclusions. Removing names alone does not make those facts anonymous. Identifiers used solely to administer rights or exclusions are kept outside the analytical environment and are not used to produce EDI insights.
Geography defaults to state or region, with finer areas permitted only where every EDI threshold and disclosure control is met. Precise geolocation, bank details, direct identifiers and information about persons under 18 are excluded from EDI. App usage information contributes only to compliant anonymous aggregated outputs.
Historical prices and spend recorded by Professionals may contribute only after all pricing, data-age, dominance, aggregation, lawful-basis and exclusion requirements are met. A Professional's prices, invoices and private notes are not shared with other Users on a Horse Record without the Professional's sharing choice; separate eligibility for lawful Professional-side statistics does not permit other Users' access to those records.
Later registration, claiming or confirmation of information by any User does not override the conditions above. Every applicable contributor, business, individual and horse-owner exclusion applies to historical facts within its scope; one person's registration or choices cannot override another applicable exclusion.
Anonymised and aggregated data(a) We may create Anonymised and Aggregated Data from information processed through the Services, and produce statistical analyses, reports, indices, benchmarks and analytical services derived from it.
(b) The EDI Data Governance Standard must be implemented before relevant processing or release. It includes minimum contributor and cohort sizes, stricter pricing controls, contributor-dominance limits, minimum data age, geographic generalisation, small-cell and outlier suppression, and controls against differencing across repeated or overlapping queries. Meeting numerical thresholds alone is not proof of anonymity or compliance; outputs failing the identifiability or competition safeguards are withheld. Pricing outputs contain historical averages, never individual prices or forecasts of future market prices. State or region is the default geography; finer areas are used only where every applicable safeguard is met. Precise geolocation is excluded from EDI. We may update the internal standard without weakening these commitments and publish the methodology, but not numerical threshold values.
(c) We commit to maintaining Anonymised and Aggregated Data in anonymised and aggregated form, and we will not attempt to reidentify it, except solely to test the effectiveness of our own anonymisation measures.
(d) Where Anonymised and Aggregated Data, or analyses derived from it, are made available to third parties, we contractually require those parties to maintain the data in that form and not to attempt reidentification.
(e) No reconstruction or circumvention. We contractually prohibit recipients from reidentifying or reconstructing individual records, including by combining outputs with other data or by repeated, overlapping or combined queries, whether for that purpose or with that reasonably foreseeable effect. Credits, subscriptions and query allowances do not override thresholds or disclosure controls. We may refuse, suppress, generalise, delay or aggregate outputs and may suspend access immediately for breach. Credits and query allowances are allocated to and enforced per client organisation, never per individual user. Outputs withheld under disclosure controls consume no credits. We may log, review and rate-limit queries to detect differencing or reconstruction attempts.
(f) EDI never discloses, sells, licenses or otherwise provides Personal Data, information identifying or reasonably capable of identifying any individual, Owner, Professional, business, customer or horse, or individual horse-level, Professional-level or business-level records, whether identified or de-identified, to any EDI client, research partner, sponsor or other recipient of EDI outputs. Recipients receive only Anonymised and Aggregated Data and analytical outputs meeting the applicable aggregation thresholds, identifiability standard and disclosure controls. No consent, research arrangement, subscription or sponsored programme creates an exception to this restriction.
(g) Operational sharing of a Horse Record with authorised Users under Article 34 of the Terms of Use is a separate App function outside EDI. It does not authorise disclosure to EDI clients, research partners or sponsors.
(h) Only lawfully created, genuinely Anonymised and Aggregated Data falls outside Personal Data rights and may be retained and used indefinitely, subject to continued compliance with the disclosure safeguards. Identifiable source data, pseudonymous records and non-anonymous models remain subject to applicable rights.
(i) As set out in Article 22 of the Terms of Use, Mustad retains the intellectual property and database rights it lawfully acquires in Anonymised and Aggregated Data, compliant EDI Derived Data and related compilations, reports, analyses, indices, benchmarks, models, methodologies and analytical services. This does not presume that raw facts are capable of ownership or that an output or model is anonymous, and does not affect your rights in the content you input into the EQUINET App.
(j) EDI Derived Data has the definition stated above and in Article 20(f) of the Terms of Use. Ownership or licensing rights do not expand what EDI may disclose or convert individual records into anonymous outputs. EDI clients must accept separate written B2B EDI Service Terms for every channel, preserving these safeguards, permitted-use restrictions, audit and suspension rights.
(k) Invitations. The Services allow Users to invite their customers to register, and allow authorised Users to invite other participants, including care or service providers. Invitations are sent on behalf of, and in the name of, the User who initiates them, from the inviting User's own device, messaging application or email account; the inviting User controls sending and remains responsible for the recipient, content and lawful authority to contact them. Where an invited person does not register, we do not use their contact details for our own purposes and do not send further invitations ourselves; any reminder must be initiated by the inviting User. Contact details supplied solely for an invitation are never added to a marketing list and are deleted within 30 days if the invited person does not register. Contact details already lawfully held in a User's customer or horse records are governed separately by the Terms of Use and this policy. Device-sent invitations identify the inviting User, and requests to stop them may be directed to that User. Any message actually sent by Mustad includes the identification and opt-out mechanisms required by applicable law (such as a STOP instruction for SMS).
(l) Sponsored programmes. Optional sponsored offers require a separate, affirmative opt-in, presented unticked and separately from general marketing choices and EDI choices. Mustad selects and displays offers internally within EQUINET. Sponsors receive no Personal Data, profiles, identifiable Owner, Professional, business or horse information, or individual records; any campaign results must be Anonymised and Aggregated Data meeting the EDI thresholds and disclosure controls. A user may independently contact a sponsor or expressly request that specified contact details be passed to a named sponsor. That separate user-initiated action is outside EDI and is limited to the details requested, with the applicable notice and lawful basis. Opting in to offers alone does not authorise a transfer. The opt-in may be withdrawn at any time through account settings or privacy@mustad.com without affecting access to the Services. Offers are identified as sponsored and selected according to documented criteria that do not favour Mustad group products.
(m) We publish a description of how data flows through our analytical processes, including the kinds of aggregation thresholds and other safeguards we apply (but not their numerical values), so that you can see what happens to the information you record. That description is maintained on our website.
(n) Analytical environment. The Statistical Purpose is carried out in a separate analytical environment operating on pseudonymous keys. Direct identifiers, including names, contact details, and horse microchip and registration numbers, are not admitted to it. Access is role-based and logged. Bank details and precise geolocation are also excluded. Necessary external technical support acts solely as a contracted processor, with confidentiality, role-based logged access and no independent use or entitlement to source records. Such support is not an EDI client or output recipient. Mustad commercial functions receive only compliant EDI outputs, with no EDI source-record access.
(o) Record-level data. Record-level data held in EQUINET, including the history of a horse across contributing Users, remains Personal Data where it relates to an identifiable person, and remains subject to this policy, to your opt-out and to deletion. Only outputs meeting our identifiability standard are Anonymised and Aggregated Data.
(p) Pricing and spend. Pricing and spend information, whoever records it, including historical Professional prices, is subject to the same pricing safeguards. No such data is included in a published index, benchmark or analytical output until the pricing parameters of the EDI Data Governance Standard are adopted and implemented. Historical status alone does not exclude Professional prices. Applicable objections and opt-outs remain binding.
Marketplace activities, if introduced, are separate from EDI and require their own terms and privacy information before launch. These documents do not authorise a marketplace participant to receive EDI source data or individual records. Marketplace transactions, sponsored offers and operational processing cannot be used to bypass EDI exclusions, aggregation thresholds or disclosure restrictions.
Direct marketingWhere you have given the applicable marketing consent, we may use service providers acting on our behalf to deliver marketing communications. We do not disclose Personal Data to retailers, distributors, dealers or other third parties for their own marketing, except for the separate user-requested sponsor contact described above. That request is outside EDI and limited to the specified contact details. Acceptance of the Terms and an EDI preference are not marketing consent.
You can unsubscribe from this communication or change your contact preferences at any time through the Mustad online service you are using.
If we are required by law to provide you with certain information about our products and services like product recalls, we will continue to provide that information even if you have asked not to receive general information about our products and services.
Sharing your Personal DataWe may disclose your Personal Data to other companies within the Mustad group for purposes stated in this policy. Such sharing is limited to the relevant operational purpose and authorised access; it does not permit use of identifiable information or individual records by an EDI recipient or sponsor. Any EDI output provided to a Mustad commercial function is subject to the same aggregation thresholds and disclosure restrictions as an output provided to an external EDI client.
We do not disclose Personal Data processed through EQUINET to distributors or dealers for their independent purposes. This does not prevent a user from independently contacting a named sponsor, or expressly requesting the limited contact-detail transfer described under sponsored programmes; such action is outside EDI.
Operational, legal and business-transfer disclosures described below are outside EDI. None authorises an EDI client, research partner or sponsor to obtain Personal Data, identifiable information or individual records through EDI, research or sponsored programmes. We do not use customer contact details entered by a Professional to market to those customers on our own behalf or to introduce them to other providers of equine care or services. Where a horse is recorded as receiving care or services from a Professional, we do not use the relationship or contact data recorded by that Professional to present a User authorised for that horse with alternative providers of the same type of service, or to promote or recommend a competing provider. This applies to all equine care and service providers, including farriers, veterinarians and trainers. A User may independently search for or contact providers, or expressly ask for help finding one. This does not prevent communications with a person through their own direct relationship with Mustad under Article 23(a) of the Terms of Use, subject to applicable choices and the sponsored-offer rules. These protections are addressed in Articles 23 and 34(g) of the Terms of Use. We may share Personal Data with the following parties only where necessary for the stated purpose, subject to appropriate safeguards:
l  Government institutions such as the tax authorities and supervisory authorities.
l  Mustad affiliates, suppliers and subcontractors (such as accounting services providers);
l  Chain partners and other service providers such as insurers, bailiffs, accountants, tax advisers and other advisers;
l  External suppliers such as IT service providers, hosting and cloud service providers or other suppliers to which we outsource IT and support services; and
l  To a buyer or successor in a transfer of all or substantially all of the EQUINET business, subject to the following safeguards.
In connection with a sale, spin-off, reorganisation or other separation of all or substantially all of the EQUINET business from the Mustad group, we may transfer Personal Data relating to the EQUINET Services to the entity that acquires, succeeds to or operates the EQUINET business, to the extent permitted by applicable law. That successor may become the Data Controller for relevant processing and will assume the applicable privacy obligations relating to the EQUINET Services. Where applicable law requires notice, consent or another user choice in connection with such a transfer or change of Data Controller, affected individuals will be informed and the required rights or choices will be provided. In any such transfer, your information remains protected to at least the standard set out in this Privacy Policy. Recorded objections and opt-outs continue to apply. Transfer does not itself authorise a new purpose or convert Personal Data into anonymous assets; controller obligations, processor arrangements and anonymous EDI assets are assessed separately.
Anonymised and Aggregated Data, EDI Derived Data and analytical assets that are no longer Personal Data may also transfer with the EQUINET business. Any successor receiving such assets will remain subject to the applicable commitments concerning anonymisation, non-reidentification and disclosure controls described in this Privacy Policy and the Terms of Use.
We must enter into written data-processing or service-provider terms with recipients processing Personal Data on our behalf where required by applicable law, including the FADP, GDPR and applicable US state privacy laws. For data entrusted by Professionals, AWS and other contracted technical providers act as sub-processors or sub-service providers, as applicable. Their use of that data is restricted to the authorised services and applicable legal requirements. Infrastructure access does not make them EDI clients or permit their independent commercial use of individual records. EDI clients receive only compliant Anonymised and Aggregated Data and analyses derived from it.
Hosting and international processingEQUINET application servers are hosted by Amazon Web Services (AWS) in the United States, in the US East (Ohio) Region (us-east-2).

EQUINET may use an AWS content delivery network, such as Amazon CloudFront, for some or all API endpoints. Where it does, request and response information, including IP addresses, request headers and information sent to or returned by an API, may therefore be processed outside Ohio and outside the United States, even when a response is not cached. The Ohio server location is not a commitment that all processing occurs exclusively in the United States.
Mustad is established in Switzerland. Authorised Mustad personnel may access Personal Data from Switzerland where necessary to provide, administer or secure the Services, subject to purpose limits, confidentiality and access controls. The locations and recipients used for backups, logs, support and any other remote access must be assessed separately from the Ohio application-server location.
AWS publishes its CloudFront network locations at https://aws.amazon.com/cloudfront/features/ and its sub-processor information at https://aws.amazon.com/compliance/sub-processors/. These describe AWS infrastructure; the locations relevant to EQUINET depend on the services and configuration used. Mustad must provide and keep current the country and recipient information required by applicable law, including the safeguards for transfers, in this policy or an accompanying notice provided with it. You may request further information and a copy of applicable contractual safeguards at privacy@mustad.com, subject to appropriate protection of confidential information.
Australia. Where the APPs apply, we assess whether overseas handling is a use under our effective control or a disclosure to an overseas recipient. Where APP 8 applies, we take the required reasonable steps to ensure that the overseas recipient does not breach the APPs, and remain accountable as required by the Privacy Act. We provide the overseas-recipient and country information required by APPs 1 and 5. We do not treat acceptance of these Terms or this policy as consent to waive those protections.
New Zealand. Where information is disclosed to an overseas recipient for its own purposes, we apply the safeguards required by IPP 12, including comparable protection where required. Sending information to an agent solely for storage or processing on our behalf, without its own use or disclosure, is assessed under the agency rules rather than automatically treated as an IPP 12 disclosure. We remain responsible for the information as required by the Privacy Act.
Switzerland. For disclosures abroad governed by the FADP, we assess the destination and recipient and apply an applicable adequacy finding or another permitted safeguard, including recognised standard contractual clauses with the required Swiss adaptations. Any reliance on the Swiss-US Data Privacy Framework is limited to an eligible transfer to the exact US recipient whose active certification covers the processing; it is not a blanket finding that every US recipient or AWS service is covered.
European Economic Area and United Kingdom. Where the GDPR or UK GDPR requires a mechanism for an international transfer, we use an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses with the required UK instrument where relevant, together with the necessary transfer assessment and supplementary measures. The EU-US Data Privacy Framework or UK extension is used only where the recipient and transfer qualify. AWS contractual safeguards must be assessed for the relevant contracting entity, services and onward transfers; using AWS does not by itself establish compliance.
United States. US residents retain the protections described in the US Supplement when information is processed by the Swiss operator or its contracted providers. We assess applicable US restrictions on transfers or access, including restrictions concerning sensitive personal data and prohibited recipients where relevant. We do not require blanket consent merely because a user is in the United States, and acceptance of this policy is not consent to every international transfer.
International processing must remain limited to the purposes in the Privacy Policy and subject to the safeguards required by applicable law. A hosting or CDN arrangement does not authorise a new use of Personal Data, remove an EDI opt-out or objection, or permit disclosure of individual records to EDI clients, researchers or sponsors. Before changing the primary hosting country or introducing new international processing, Mustad must assess and implement the required safeguards and give any required notice, and must follow the sub-processor procedure in Article 30 of the Terms where applicable. Where a particular law or an express contractual commitment requires more restrictive localisation or access controls, the relevant processing must meet that requirement.
Retention of dataMustad will retain your Personal Data for only as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies. Anonymised and Aggregated Data is not Personal Data and may be retained indefinitely, as described above. If you close your account, we delete or anonymise the Personal Data associated with it within 90 days, except where we must retain it to comply with the law, resolve disputes or enforce our agreements. Personal Data that a Professional controls under the Terms of Use is handled on that Professional's instructions.
Mustad will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a relatively short period of time, except when this data is used for security purposes or to improve the functionality of our Services, or if we are legally obligated to retain this data for longer time periods.
Security of dataWe take appropriate security measures to limit abuse of and unauthorized access to Personal Data. For example, we ensure that only authorised persons have access to Personal Data, that access to and transfer of the Personal Data is protected by appropriate safeguards such as secured connections and firewalls and that our security measures are evaluated and updated regularly. Mustad must maintain encryption in transit including direct connections to application servers and all connections through any content delivery network, appropriate encryption at rest, access restricted by role and operational need, and proportionate security monitoring. API responses containing Personal Data or private Owner, Professional, business or horse records must not be stored in shared CDN caches. Logging must be limited to necessary operational and security information, with access controls and retention limits; authentication secrets and unnecessary record content must not be logged.
Consequences of not providing us with access or consent to use your Personal DataIf you do not provide us with access to your Personal Data or do not consent to its use (to the extent applicable privacy laws require such consent), your ability to access our products and services may be limited. For instance, you may not be able to access the EQUINET App and make use of its full range of features. We may also be limited in our ability to fully resolve any access issues or address your queries or concerns. Opting out of EDI, or declining or withdrawing the sponsored-offer opt-in, does not affect access to the Services.
Your data protection rightsYour statutory rights depend on the law applicable to the processing. The GDPR rights below apply where the GDPR applies. Under Swiss law, individuals may exercise the applicable rights to information and access, correction and other remedies, including deletion or cessation of unlawful processing where available, and may contact the Federal Data Protection and Information Commissioner. US rights and procedures are set out in the US Supplement; Australian and New Zealand rights remain governed by their respective laws.
Where applicable, you may request access, rectification, erasure, restriction and portability of your Personal Data, and object to processing based on legitimate interests. EDI objections and the simple opt-out are addressed above. US state-law rights and request procedures are governed by the US Supplement. Australian and New Zealand rights apply under their respective laws.
Where processing is based on consent, such as optional sponsored offers, you may withdraw it at any time as easily as it was given. Withdrawal does not affect the lawfulness of prior processing based on consent. EDI is addressed separately through its legitimate-interests basis, right to object and simple opt-out; it is not described as consent-based processing.
To exercise your rights or the EDI opt-out, email privacy@mustad.com or write to Mustad Hoofcare S.A., Attn.: IT Mustad, Rue de Gruyères 106 (c/o The Work Hub Bulle Sàrl), 1630 Bulle, Switzerland. No EQUINET registration is required to contact us.
We request proportionate verification only where appropriate or legally required for the particular request. A simple EDI account-setting opt-out does not require additional identity documents.
We respond without undue delay and within the deadline required by applicable law. For GDPR requests, this is ordinarily one month; where legally permitted, we may extend by up to two further months because of complexity or number of requests, informing you within the first month and explaining why. US request deadlines are set out in the US Supplement. The EDI exclusion takes effect from receipt as described above; the response deadline is not a waiting period for continued EDI use.
Statutory rights may be subject to specific legal conditions or exceptions. If a request cannot be granted in full, we explain the reasons and available review or complaint routes. Those qualifications do not remove the voluntary EDI opt-out commitment or permit continued EDI processing within an exclusion's scope.
Where the GDPR applies, you may complain to a competent supervisory authority, including in the Member State of your habitual residence, workplace or the alleged infringement. You need not contact us first. A list is available on the European Data Protection Board website. Applicable UK and Swiss complaint rights remain available, including a complaint to the Swiss Federal Data Protection and Information Commissioner (FDPIC).
In Australia, if your concerns are not satisfactorily resolved by us, you can lodge a complaint with the Office of the Australian Information Commissioner. In New Zealand, you can lodge a complaint with the Office of the New Zealand Privacy Commissioner. Australian and New Zealand residents may request access to or correction of their personal information by emailing privacy@mustad.com; we respond within a reasonable period and, where the New Zealand Privacy Act 2020 applies, within 20 working days, and we explain our reasons and complaint options if we refuse. We assess and notify eligible data breaches under the Australian Notifiable Data Breaches scheme and notifiable privacy breaches under the New Zealand Privacy Act 2020 where those laws apply.
Children's privacyEQUINET accounts are for adults aged 18 or over. We do not knowingly collect Personal Data directly from children. If you believe a child has supplied information, please contact us. If such information is found, we restrict it and assess the appropriate removal or other action under applicable law. Users must not enter a minor's name or contact details in a Horse Record or upload photographs, recordings, attachments or notes that identify or can reasonably identify a minor. If we are notified, or otherwise become aware, that such information has been recorded, we restrict access and take appropriate steps to remove or de-identify it without undue delay, subject to applicable law. Information about persons under 18 is excluded from EDI.
Guardians and young riders. A parent or legal guardian may register horses owned or ridden by a person under 18 and manage their records through the guardian's own account. No account, login or access credentials are provided to a person under 18, and Horse Records must not identify the minor (Terms of Use, Article 32). Information about a person under 18 is not included in anonymised statistics.
Changes to this Privacy PolicyWe may update our Privacy Policy from time to time. Changes will be published on our websites and the EQUINET App. It is therefore advisable to consult our websites regularly to keep up to date with any changes. If we make material changes, we will notify you in the EQUINET App or by email before they take effect. A change to this policy does not by itself authorise new uses of information collected before the change; the Historical Professional Data notice above applies. The rollout notice specifies the common effective date for v4.0 of the Terms and this policy. Silence is not consent to new processing.
UNITED STATES PRIVACY SUPPLEMENTThis section of our Privacy Policy (the "US Supplement") applies to people living in the United States. The US Supplement explains how we collect, use, and disclose your Personal Information. For the US Supplement, "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with you, directly or indirectly. Where this US Supplement is inconsistent with the rest of this Privacy Policy for people living in the United States, this US Supplement prevails. Information is treated as deidentified or aggregate information only where it meets all applicable statutory conditions. The US Supplement does not relax the EDI disclosure restrictions or the simple EDI opt-out. Mustad Hoofcare S.A. remains the Swiss provider and relevant business or controller; the Services are already offered in the United States. US privacy rights do not depend on Mustad having a US headquarters or on all processing remaining in the United States. The hosting and international-processing section applies, including AWS Ohio hosting and any AWS content delivery network used for API endpoints.
Personal information we collect
We may collect and use the following categories of Personal Information:
l  Identifiers, such as: first name and last name; e-mail address; phone number; address, State, Province, ZIP/Postal code, City, Country.
l  Commercial information, including your purchasing habits.
l  Audio or video information, including photos you may provide.
l  Professional or employment-related information, such as your business name and title; optional further information regarding your business, such as if you work alone or in a team, job role (farrier/vet/admin etc.), location of work (own workshop, stud farms, etc.).
l  Internet or other similar network activity such as Usage Data described above; optional: the EQUINET features you expect to use.
l  Financial information, where you choose to record bank account details for invoicing purposes.
l  The following categories of sensitive personal information: your precise geolocation data.
l  Horse records: information about horses linked to you, including horse, care and spend information, as described under "Horse records" above.
Horse location. For regional statistics we use the state or region where a horse is kept, or a finer area such as a county only where our aggregation thresholds are met at that level.
We collect this Personal Information from: you, directly in person, by telephone, text, and email, and through the Services (including our live chat in the EQUINET App); your devices and cookies on our website; and through our affiliates and partners; or through social networks, data analytics platforms and other publicly available sources. Our hosting and delivery infrastructure, including any content delivery network used, processes request information such as IP addresses, timestamps, request headers and technical delivery or security events to provide and protect the Services, subject to the controls described in this policy.
We retain this Personal Information as described with respect to Personal Data under the heading "Retention of data."
Use of personal information
We use your Personal Information to provide and improve the Service and for the reasons described with respect to Personal Data under the heading "Purposes for the processing of Personal Data". For categories of Sensitive Personal Information that we collect, we will only use or disclose it either with your specific consent when required, or as otherwise permitted by law, including the CCPA. GDPR legitimate interests are not presented as a general US lawful basis. We apply the notice, purpose-limitation, security, consent and opt-out requirements of the relevant US law. Optional sponsored offers remain separately opt-in, and the EDI opt-out remains available regardless of state-law thresholds.
Disclosures of personal information
We do not sell or "share" (as that term is used in the CCPA) your Personal Information. We do provide anonymised and aggregated analyses to third parties as described under "Anonymised and aggregated data" above. Only analyses meeting all applicable deidentification or aggregation requirements are treated as outside Personal Information; merely removing names is insufficient. We maintain and use such data only in deidentified form, we commit not to attempt to reidentify it (except to test our own deidentification measures), and we contractually require recipients not to reidentify it. We may disclose Personal Information in the categories described in this US Supplement only as necessary for the stated purposes with our affiliates and related parties, vendors who provide services to us, and as otherwise described with respect to Personal Data under the heading "Sharing your Personal Data."
Sponsored offers. Optional sponsored offers require a separate, affirmative opt-in, presented unticked and separately from general marketing choices and EDI choices. Mustad selects and displays offers internally within EQUINET. Sponsors receive no Personal Data, profiles, identifiable Owner, Professional, business or horse information, or individual records; any campaign results must be Anonymised and Aggregated Data meeting the EDI thresholds and disclosure controls. A user may independently contact a sponsor or expressly request that specified contact details be passed to a named sponsor. That separate user-initiated action is outside EDI and is limited to the details requested, with the applicable notice and lawful basis. Opting in to offers alone does not authorise a transfer. The opt-in may be withdrawn at any time through account settings or privacy@mustad.com without affecting access to the Services. Offers are identified as sponsored and selected according to documented criteria that do not favour Mustad group products.
Your US privacy rights
Your rights depend on applicable state law, including the CCPA as amended by the CPRA and, where applicable, the Kentucky Consumer Data Protection Act. We also offer the request options below to all US residents, subject to applicable conditions and exceptions, without reducing any statutory right. The EDI opt-out is a separate product commitment available regardless of state-law applicability.
l  Right to Know: The right to request that we disclose to you the Personal Information we collect, use, disclose, share, or sell, and information about our data practices.
l  Right to Request Correction: The right to request that we correct inaccurate Personal Information that we maintain about you.
l  Right to Request Deletion: The right to request that we delete your Personal Information that we have collected from or about you.
l  Right to Opt Out: Where applicable, you may opt out of sale, sharing, targeted advertising and profiling used for decisions producing legal or similarly significant effects. We do not sell Personal Information or share it for cross-context behavioural advertising. You may limit sensitive-information use or withdraw consent where applicable law provides those rights. Independently, every User may use the simple EDI opt-out described above.
l  Right to Non-Discrimination: The right not to receive discriminatory treatment for exercising your privacy rights.
l  Right to Appeal: You may appeal a refusal by replying to our decision. We respond within the applicable statutory deadline and, as a product commitment, within 45 days where no shorter deadline applies. If denied, we explain how to contact the relevant state attorney general or other competent authority.
To exercise these rights, email privacy@mustad.com or usa.equinetsupport@mustad.com, or call +1 (612) 314-5764. You may use an authorised agent. We respond within 45 days or any shorter applicable deadline. We extend only where the applicable law permits and after providing the required notice and reasons. We honour Global Privacy Control and other legally recognised opt-out preference signals for the purposes required by applicable law. A sale or sharing signal and an EDI opt-out are distinct choices; the account setting or email route provides the EDI opt-out.
Any limit on the frequency of access or portability requests applies only where the relevant law permits; it does not limit EDI opt-outs or other rights.
For requests requiring verification, we seek only information proportionate to the request and sensitivity of the data, using existing account information where possible. We do not routinely require passports, driving licences or financial documents. Requests to opt out of sale, sharing or other processing are not subject to identity verification where prohibited by applicable law.
We are not obligated to make a data access or data portability disclosure if we cannot verify that the person making the request is the person about whom we collected information or is someone authorized to act on such person's behalf. Any Personal Information we collect from you to verify your identity in connection with your request will be used solely for the purposes of verification.
Financial incentivesFrom time to time we may offer loyalty points or other benefits in exchange for your participation in surveys or the provision of additional information. Participation is voluntary and you may withdraw at any time without penalty to your use of the Services. The material terms of any such programme, including a good-faith estimate of the value of the information to us and the method by which that estimate was calculated, will be provided to you at the point of enrolment. No such programme is offered at the date of this Privacy Policy.
This section also applies to any benefit offered in exchange for completing horse information or opting in to sponsored offers.
Opt-in necessary for SMS-notifications to Your Customers in the United StatesThe EQUINET App supports appointment notifications by SMS. EQUINET requires the recipient to opt in before its appointment-notification SMS service is used. This product requirement does not mean that all US Personal Data processing requires consent. Any User who uses these features must obtain and retain evidence of any consent required by the Telephone Consumer Protection Act and applicable state law; marketing texts require the separate consent described in Article 43 of the Terms. Recipients may reply STOP or otherwise revoke consent by a reasonable method permitted by law, and may reply HELP for help. Message frequency varies and message and data rates may apply. SMS opt-in information is not sold or disclosed for another party's marketing. A recipient's refusal or withdrawal must be respected within the applicable legal deadline.
Contact usMustad welcomes your comments regarding this Privacy Policy. For any questions or requests regarding the processing of your Personal Data or to exercise your rights under this policy, please contact us on the below details: The responsible EQUINET entity is Mustad Hoofcare S.A. (UID CHE-103.636.086), Rue de Gruyères 106 (c/o The Work Hub Bulle Sàrl), 1630 Bulle, Switzerland, including for US privacy requests.
l  All countries: by email at privacy@mustad.com
l  United States: by email at privacy@mustad.com or usa.equinetsupport@mustad.com, by phone +1 (612) 314-5764
l  Australia: by email at privacy@mustad.com or australia.equinetsupport@mustad.com, by phone +61 (0)3 5734 3536
l  New Zealand (served by the EQUINET Australia support team): by email at privacy@mustad.com or australia.equinetsupport@mustad.com, by phone +61 (0)3 5734 3536