Only the German version is legally binding.
Privacy policy
Version: 15 October 2026
1. Controller
Planet-Horse GmbH
Sinningen 34a
48369 Saerbeck
Germany
Amtsgericht Steinfurt, HRB 9604 · Managing director: Philippe Jully
Email: info@planet-horse.com
2. What data we process, and why
| Data | Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|---|
| Server logs (IP address, timestamp, page requested, browser identifier) | secure and stable operation | lit. f – legitimate interest |
| Access request through the public form (company, contact person, email, phone, sector, number of horses, free text) | handling your request and preparing a contract | lit. b – pre-contractual measures |
| Account and contract data (name, company, address, credentials) | performance of the contract | lit. b |
| Invoices and accounting records | statutory retention | lit. c – § 147 AO, § 257 HGB |
| Content you place in the application | delivery of the service you booked | lit. b |
| Abuse-protection counters | protection against overload and misuse | lit. f |
No special categories of data within the meaning of Art. 9 GDPR are processed. When system emails are sent, we measure no opens and no clicks.
3. Cookies, browser storage and external content
We use strictly necessary cookies only. No analytics, tracking or advertising cookies. Consent under § 25(2) no. 2 TDDDG is therefore not required.
| Name | Purpose | Retention | Type |
|---|---|---|---|
.AspNetCore.Identity.Application |
sign-in | until you close the browser; with "stay signed in", up to 14 days | cookie |
.AspNetCore.Antiforgery.… |
protection against cross-site request forgery | until you close the browser | cookie |
.AspNetCore.Culture |
language selection | 1 year | cookie |
.AspNetCore.Session |
technical state while you use the application | 30 minutes of inactivity | cookie |
.AspNetCore.Mvc.CookieTempDataProvider |
one-time notices after an action (e.g. "saved") | until you close the browser; deleted once shown | cookie |
Besides cookies, the application stores a few settings in your browser's storage
(localStorage stays on the device until you delete it; sessionStorage ends with the tab).
These entries stay on your device, are not transmitted to us or to third parties, and
serve only functions that you use yourself (§ 25(2) no. 2 TDDDG).
| Entry | Purpose | Retention | Type |
|---|---|---|---|
| Pinned navigation rail (stable area) | remembers whether the navigation rail of the stable area is pinned | until you delete it | localStorage |
| Pinned navigation rail (workspace) | the same for the navigation rail of the workspace | until you delete it | localStorage |
| Language for the scanner page | copy of the selected language for the scanner page | until you delete it | localStorage |
| Dismissed reminders | remembers which due reminders you have dismissed | until you delete it | localStorage |
| Tab of the presentation page | remembers the tab last opened on the public presentation page | until you delete it | localStorage |
| Search history | your latest search queries as an input aid — only if search is enabled | until you delete it | localStorage |
| Notice after saving (structure) | one-time notice after saving in the structure | until you close the tab | sessionStorage |
| Hand-over voice input → service report | hand-over between voice input and the service report — only if the service report is enabled | until you close the tab | sessionStorage |
| Email preview of an order | email preview for an order — only if order fulfilment is enabled | until you close the tab | sessionStorage |
You can delete any of these entries at any time in your browser settings.
No third-party content is loaded when our pages open — fonts, icons and scripts are served from our own servers. Your IP address is not passed to any external network.
The public access-request form likewise embeds no third-party service. It is protected against automated submissions by a computational puzzle solved by your browser and verified solely by our own server. No data is transmitted to any third party, no cookie is set, and nothing is stored on or read from your device. Consent under § 25(2) TDDDG is not required here either.
4. Recipients and processors
We use carefully selected service providers that act on our instructions (processing under Art. 28 GDPR):
| Provider | Service | Place of processing |
|---|---|---|
| DINAO SARL, Sanary-sur-Mer | server operation (hosting) | France (EU) |
| Scaleway SAS, Paris | sending of system emails | France (EU) |
| Mistral AI SAS | text recognition in documents, reading of horse passports and vaccination booklets (in full at the "GDPR+" tier, otherwise only a second reading of the identification page), speech recognition | France (EU) |
| OpenAI Ireland Ltd. | conversion of text into search vectors ("embeddings") | Ireland (EU) / USA |
| Anthropic | language model for preparing content and for reading horse passports and vaccination booklets (photos, possibly with the names and addresses of owners) | USA |
| Google Ireland Limited | Gmail connection — only if you activate that link yourself | Ireland (EU) / USA |
Transfer to the United States
Content may be transferred to service providers in the United States. The USA is not regarded as a country with a generally equivalent level of data protection. Transfers are based on the standard contractual clauses under Art. 46(2)(c) GDPR. Despite these safeguards, access by US authorities cannot be entirely ruled out.
Would you rather avoid this? With the "GDPR+" tier, your content is processed exclusively by providers located within the European Union. Write to us: info@planet-horse.com.
5. Retention periods
- Invoices and accounting vouchers: 8 years (§ 147(3) AO, § 257(4) HGB, § 14b(1) UStG, each as in force since 1 January 2025). Commercial books and annual financial statements: 10 years.
- Account and contract data: for the duration of the contractual relationship, then erased unless a statutory retention obligation applies.
- Access requests through the public form: erased once the request has been handled and no contract is concluded, at the latest after six months.
- Content you place in the application: erased on your instruction. Audit journals remain immutable (principles of proper bookkeeping) and are not erased.
- Server logs and abuse counters: 7 days at most.
6. Artificial intelligence
AI systems prepare content and make suggestions. No automated decision producing legal effects within the meaning of Art. 22 GDPR is taken — a human always decides. Where you communicate directly with an AI system, we tell you so at the point of input (Art. 50 AI Act).
7. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). Consent once given may be withdrawn at any time with effect for the future.
How to exercise these rights: write to info@planet-horse.com. We do not offer a self-service download of your data inside the account; access and portability are fulfilled on request — in a common, machine-readable format, free of charge and within one month (Art. 12(3) GDPR).
Right to lodge a complaint: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
8. Whether providing data is required
Data required to perform the contract must be provided; otherwise we cannot perform the contract. Providing any further data is voluntary.