Privacy policy

Who processes your data

Kavall is a service by Cactux. The riding club you belong to decides which of your data it collects and what for: it is the data controller. Cactux acts as processor, providing the tool and handling that data on its instructions.

The distinction matters to you: requests about your membership record are handled by your club. For anything else, write to info@cactux.com.

What data we process

Only what the club needs to operate:

• Identification and contact: name, surname, email, phone and identity document.
• Club activity: lessons, attendance, levels, assigned horses and signed documents.
• Health and safety data, where the club asks for it: allergies, medication and medical notes. These are specially protected data and only staff with that permission can see them.
• Financial: fees, charges, invoices and payments.
• Technical: IP address, device identifier and notification token, so the app works and you can receive alerts.

What for, and on what legal basis

To provide the service you contracted with the club: managing your lessons, your horse and your account. The basis is the contractual relationship.

To meet the club’s legal obligations: invoicing, working-time records and any others imposed by applicable law.

For health data and for access by children under fourteen we ask for explicit consent, from the person concerned or from whoever holds guardianship. You can withdraw it at any time.

How long we keep them

Your activity data is kept while you are a member of the club and, afterwards, blocked for as long as liabilities may be claimed.

Invoices and accounting records are kept for the periods required by law — four years for tax purposes, six for commercial books — and cannot be deleted sooner, even on request: they are the club’s accounts, not just your data.

Billing records issued under the Verifactu system are chained to one another, so deleting one would invalidate those that follow. That is why they are not deleted.

Who we share them with

With no one who is not needed to provide the service. We use providers that process data on our behalf: hosting on Google Cloud (European Union), email delivery with Resend, notifications with Firebase Cloud Messaging and payments with Stripe.

We do not sell your data or share it for advertising purposes.

Your rights

You can access your data, correct it, erase it, restrict or object to its processing, and ask for it in a portable format. To exercise these rights, write to your club or to info@cactux.com.

If you believe your request was not handled properly, you can complain to the Spanish Data Protection Agency.