Privacy Policy

HorseStox is a premium online marketplace for European sport horses. We are operated by HorseStox, headquartered in Amsterdam, Netherlands. For privacy matters, you can contact us at privacy@horsestox.com.

We collect the following categories of personal data: • Account data: name, email address, profile photo (from Google if you sign in with Google) • Transaction data: Hold™ payments, bid history, listing activity • Communication data: messages sent through the platform, enquiry forms • Technical data: IP address, browser type, device type, pages visited, time spent • Marketing data: email alert preferences, communication preferences We collect this data when you create an account, place a Hold™, submit a bid, complete a form, or browse our website.

We use your personal data to: • Provide and operate the HorseStox marketplace • Process Hold™ payments via Stripe • Send transaction notifications and bid updates • Send new arrival alerts (only if you subscribed) • Improve our platform through analytics • Comply with legal obligations • Prevent fraud and ensure platform security We do not sell your personal data to third parties.

Under GDPR, we process your data on the following legal bases: • Contract performance: processing necessary to provide the marketplace service • Legitimate interests: fraud prevention, platform security, service improvement • Consent: marketing emails, cookies (you can withdraw consent at any time) • Legal obligation: tax records, anti-money laundering compliance

We share data with the following trusted service providers: • Stripe (payment processing) — stripe.com/privacy • Brevo (email delivery) — brevo.com/legal/privacypolicy • Google (authentication, analytics) — policies.google.com/privacy • DigitalOcean (hosting infrastructure) — digitalocean.com/legal/privacy-policy • Meta (advertising pixel, if you consent to marketing cookies) All third parties are required to handle your data in accordance with GDPR.

We use cookies to operate the platform, remember your session, and (with your consent) measure advertising effectiveness. You can manage your cookie preferences at any time via our Cookie Settings. See our full Cookie Policy for details.

We retain your personal data for as long as your account is active, plus 7 years for financial records (legal requirement). You may request deletion of your account and associated data at any time by contacting privacy@horsestox.com.

As a data subject in the EU/EEA, you have the following rights: • Right of access: request a copy of your personal data • Right to rectification: correct inaccurate data • Right to erasure: request deletion of your data • Right to restrict processing: limit how we use your data • Right to data portability: receive your data in a portable format • Right to object: object to processing based on legitimate interests • Rights related to automated decision-making To exercise any of these rights, email privacy@horsestox.com. We will respond within 30 days.

Your data may be processed outside the EEA by our service providers (e.g. Stripe in the USA). Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

We implement appropriate technical and organisational measures to protect your personal data, including encrypted connections (HTTPS/TLS), access controls, and regular security reviews.

HorseStox is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@horsestox.com.

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. The date at the top of this page reflects the most recent update.

For privacy questions: privacy@horsestox.com If you are unsatisfied with our response, you have the right to lodge a complaint with your national data protection authority. In the Netherlands: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).