Privacy Policy

AU, US, UK/EU PRIVACY POLICY

Last updated: 27^th August, 2026

About This Policy

At The Horse, keeping your personal information private is important to us.

This Privacy Policy sets out how The Horse Accessories Holdings Pty Ltd, ABN 84 691 277 719, (The Horse, we, us, our) manages personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs), the European Union General Data Protection Regulation (EU) 2016/679 (GDPR) (where applicable), and applicable United States state privacy laws, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CCPA/CPRA) (where applicable). We are committed to protecting the privacy of any personal information you provide to us.

For the purposes of the GDPR, The Horse is the data controller responsible for your personal data. Our contact details are set out in the "Contact Us" section below.

We recommend you read this policy carefully. If you have any queries, please contact us at info@thehorse.com.au or call +612 9037 3921.

Kinds of Personal Information We Collect and Hold

The types of personal information we may collect and hold include:

your name, postal address, email address and telephone number;
payment information, including credit card or debit card details;
purchase history and transaction details;
your date of birth (if provided);
information about your interactions with our website, including IP address, browser type, device identifiers, pages visited, and referring URLs;
information collected through cookies, pixels, and similar tracking technologies, including browsing behaviour and preferences; and
any other personal information you provide to us directly (for example, through enquiries, product reviews, or competition entries).

We do not generally collect sensitive information (as defined in the Privacy Act). If we ever need to do so, we will obtain your consent unless an exception under the APPs applies.

How We Collect Personal Information

We collect personal information in a number of ways, including:

directly from you, when you make a purchase on our website, subscribe to our mailing list, contact us with an enquiry, request a repair or replacement, or otherwise interact with us;
through our website, using cookies, pixels, tags and similar technologies when you browse our website;
from third-party service providers, including analytics providers, advertising platforms, and marketing tools; and
from publicly available sources.

Where it is reasonable and practicable to do so, we will collect personal information directly from you. If we receive personal information about you from a third party and we did not solicit that information, we will determine whether we could have collected the information ourselves under APP 3. If not, we will destroy or de-identify the information as soon as practicable, provided it is lawful and reasonable to do so.

Purposes of Collection, Use and Disclosure

We collect, hold, use and disclose personal information for the following purposes:

to process and fulfil your orders, including delivery and payment processing;
to provide customer service, including handling enquiries, repairs and replacements;
to send you marketing and promotional communications about our products, events and offers (subject to your right to opt out — see "Direct Marketing" below);
to personalise your shopping experience and provide targeted advertising;
to improve our website, products and services, including through analytics and trend analysis;
to comply with our legal obligations, including under the Australian Consumer Law and taxation legislation; and
for any other purpose that is related to the above, which you would reasonably expect.

We will not use or disclose your personal information for a purpose other than the primary purpose for which it was collected, unless:

you have consented;
the secondary purpose is related to the primary purpose and you would reasonably expect us to use or disclose your information for that secondary purpose;
we are required or authorised to do so by law; or
another exception under APP 6 applies.

Disclosure to Third Parties

We may disclose your personal information to third parties, including:

payment processors and financial institutions;
delivery and logistics providers;
marketing and advertising service providers, including email and SMS marketing platforms (such as Klaviyo);
website hosting and IT service providers;
analytics and data management providers;
professional advisers, including legal, accounting and auditing firms; and
government authorities or law enforcement agencies, where required or authorised by law.

We do not sell, rent or trade your personal information to or with third parties for their independent marketing purposes.

Direct Marketing

We may use your personal information to send you direct marketing communications about our products and services, including by email, SMS, post and online targeted advertising. We will only do so where:

we collected the personal information directly from you, and you would reasonably expect us to use it for direct marketing; or
you have consented to receiving such communications; or
it is impracticable to obtain your consent, and we provide you with a simple means to opt out and include a prominent opt-out statement in each communication.

In each direct marketing communication, we will provide you with a simple and free means of opting out of further communications. You may request us to stop sending direct marketing communications at any time by:

clicking the "unsubscribe" link in any email;
replying "STOP" to any SMS; or
contacting us at info@thehorse.com.au or +612 9037 3921.

We will give effect to your opt-out request within a reasonable period (and in any event no more than 30 days for non-digital channels, or 5 business days for digital channels).

You also have the right to request us to provide you with the source of any personal information we have used or disclosed for direct marketing purposes. We will comply with such a request within a reasonable period unless it is impracticable or unreasonable to do so.

Cookies, Pixels and Tracking Technologies

Our website uses cookies, pixels, tags and similar technologies. These are small data files or code snippets placed on your device that enable us to:

facilitate your use of our website and remember your preferences (essential/strictly necessary cookies);
improve the content, reliability and functionality of our website (functional cookies);
measure and analyse website traffic and usage patterns (analytics cookies);
deliver targeted advertising and measure campaign effectiveness (advertising/targeting cookies); and
understand trends and customer behaviour.

When you visit our website, third-party service providers (such as advertising networks and analytics platforms) may also place cookies on your browser for targeted advertising purposes. We collect IP addresses to gather aggregate demographic data and to diagnose server issues. We do not link IP addresses to personally identifiable information except where required to fulfil orders or comply with legal obligations.

Your choices regarding cookies:

EEA/UK visitors: We will obtain your consent before placing non-essential cookies on your device. You can manage your preferences at any time via our cookie consent tool.
California residents: Certain tracking technologies used for targeted advertising may constitute a "sale" or "sharing" of personal information under the CCPA/CPRA. You may opt out via our cookie preferences or by contacting us.
All visitors: You may configure your browser to refuse cookies or to alert you when cookies are being sent. However, disabling cookies may result in reduced functionality on our website.

Cross-Border Disclosure of Personal Information

We are likely to disclose personal information to overseas recipients. In particular, we use third-party service providers located overseas to assist us with marketing, data storage, analytics and other business operations.

The countries in which these overseas recipients are likely to be located include:

United States of America (e.g. Klaviyo, and other marketing, analytics and cloud service providers);
France (e.g. digital marketing agencies)

Australian law (APP 8): Before disclosing personal information to an overseas recipient, we will take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the APPs in relation to that information. These steps may include entering into enforceable contractual arrangements requiring the overseas recipient to handle the personal information in accordance with the APPs.

Please note that if you consent to the cross-border disclosure of your personal information and the overseas recipient handles the information in breach of the APPs, you may not be able to seek redress under the Privacy Act and we may not be accountable under the Privacy Act.

EU/UK law (GDPR): Where personal data is transferred from the EEA or UK to a country outside the EEA/UK that has not been deemed adequate by the European Commission or UK Government, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) or rely on other lawful transfer mechanisms. See the "International Data Transfers (GDPR)" section below for further details.

Data Quality

We take reasonable steps to ensure that the personal information we collect, use and disclose is accurate, up-to-date, complete and relevant. If you believe that any personal information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact us so that we can take reasonable steps to correct it.

Data Security

We take reasonable steps to protect the personal information we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure. These measures include:

the use of Secure Sockets Layer (SSL) / Transport Layer Security (TLS) encryption for data transmitted over the internet;
access controls and authentication measures;
secure storage of physical and electronic records;
staff training regarding privacy and information security; and
regular review and updating of our security practices.

It is important that you also take steps to protect your personal information, including by keeping your account password confidential and not sharing your login credentials.

Data Retention and Destruction

We will retain your personal information only for as long as it is needed for the purposes for which it was collected, or as required or authorised by law. When personal information is no longer needed for any purpose for which it may be used or disclosed under the APPs, and we are not required by law to retain it, we will take reasonable steps to destroy the information or ensure that it is de-identified.

Accessing and Correcting Your Personal Information

You have the right to request access to the personal information we hold about you. You also have the right to request correction of any personal information that is inaccurate, out of date, incomplete, irrelevant or misleading.

To request access to or correction of your personal information, please contact us at info@thehorse.com.au or call +612 9037 3921.

We will respond to your request within a reasonable period (generally within 30 days). We will not charge you for making a request, although we may charge a reasonable fee for providing access if the request requires a significant effort to locate or compile the information.

In certain limited circumstances, we may refuse a request for access or decline to make a correction. If we do so, we will provide you with written reasons for the refusal and inform you of the mechanisms available to you to make a complaint.

Anonymity and Pseudonymity

Where it is lawful and practicable, you have the option of not identifying yourself, or of using a pseudonym, when dealing with us. However, if you choose not to provide us with your personal information, we may not be able to provide you with our products or services (for example, we cannot process an order without your name and delivery address).

Notifiable Data Breaches

Australia: In the event of an eligible data breach (that is, a breach that is likely to result in serious harm to any affected individuals), we will comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. This includes notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable.

EU/UK (GDPR): Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals in the EEA or UK, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to affected individuals, we will also notify those individuals without undue delay.

United States: We will comply with applicable US state data breach notification laws, which may require notification to affected individuals and relevant state authorities within prescribed timeframes.

Complaints

If you believe we have breached the APPs or that we have not handled your personal information in accordance with this policy, you may lodge a complaint with us.

To make a complaint, please contact us in writing:

Email: info@thehorse.com.au

Post: 43/398 The Boulevarde, Kirrawee, NSW 2232 Australia

We will acknowledge your complaint within 7 days and will investigate and respond to your complaint within 30 days. We will endeavour to resolve your complaint in a fair and timely manner.

Australia: If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au

Phone: 1300 363 992

Email: enquiries@oaic.gov.au

Post: GPO Box 5218, Sydney NSW 2001

Promotional Communications

By signing up to our mailing list, you are consenting to receive news and promotional material from The Horse. If you wish to unsubscribe from our mailing lists or update your preferences, please click on the links at the bottom of our email correspondence or contact us at info@thehorse.com.au.

SMS Marketing

By entering your phone number at checkout and initiating a purchase, or subscribing via our subscription form, you agree that we may send you text notifications (including order updates and abandoned cart reminders) and text marketing offers. Text marketing messages will not exceed 6 per month. Consent is not a condition of any purchase.

You may unsubscribe from text marketing at any time by using the unsubscribe link provided in our messages or by replying "STOP". We will give effect to your request within 5 business days.

Your phone number, name and purchase information will be shared with our SMS platform provider, Klaviyo (located in the United States of America). This data will be used to send you targeted marketing messages and notifications. We have taken reasonable steps to ensure that Klaviyo handles your personal information in accordance with the APPs, including through enforceable contractual arrangements.

EEA and UK Residents

Lawful Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), we are required to have a lawful basis for processing your personal data. The lawful bases on which we rely include:

Performance of a contract (Article 6(1)(b) GDPR) — where processing is necessary to fulfil your order, deliver products, or provide services you have requested;
Consent (Article 6(1)(a) GDPR) — where you have given us clear consent to process your personal data for a specific purpose, such as subscribing to our mailing list or opting in to SMS marketing;
Legitimate interests (Article 6(1)(f) GDPR) — where processing is necessary for our legitimate business interests (such as fraud prevention, website security, analytics, and improving our services), provided those interests are not overridden by your rights and freedoms; and
Legal obligation (Article 6(1)(c) GDPR) — where processing is necessary to comply with a legal obligation to which we are subject.

Where we rely on consent as the lawful basis for processing, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal. You may withdraw consent by contacting us at info@thehorse.com.au or by using the unsubscribe mechanisms in our communications.

Additional Rights (GDPR)

If you are located in the EEA or UK, you have the following additional rights under the GDPR, in addition to the access and correction rights described above:

Right to erasure ("right to be forgotten") — You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and there is no other legal ground for processing), where you object to processing and there are no overriding legitimate grounds, or where the data has been unlawfully processed.
Right to restriction of processing — You may request that we restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data, where processing is unlawful but you oppose erasure, or where you have objected to processing pending verification of legitimate grounds.
Right to data portability — You may request to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to transmit that data to another controller, where processing is based on consent or contract and is carried out by automated means.
Right to object — You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes (including profiling related to direct marketing). Where you object to processing for direct marketing, we will cease processing your data for that purpose immediately.
Rights relating to automated decision-making — You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not currently engage in solely automated decision-making that produces legal or similarly significant effects.

To exercise any of these rights, please contact us at info@thehorse.com.au. We will respond to your request within one month, which may be extended by a further two months where necessary, having regard to the complexity of the request.

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. For residents of the EEA, a list of supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en. For UK residents, the relevant authority is the Information Commissioner's Office (ICO) at https://ico.org.uk.

International Data Transfers (GDPR)

Where we transfer your personal data from the EEA or UK to countries outside the EEA/UK (including to Australia and the United States), we will ensure that appropriate safeguards are in place to protect your personal data. These safeguards may include:

transfers to countries that have been deemed to provide an adequate level of data protection by the European Commission or the UK Government (as applicable);
the use of Standard Contractual Clauses (SCCs) approved by the European Commission or the UK International Data Transfer Agreement/Addendum (as applicable); or
your explicit consent to the transfer, after being informed of the possible risks.

You may request a copy of the relevant transfer safeguards by contacting us at info@thehorse.com.au.

Cookie Consent (GDPR)

If you are located in the EEA or UK, we will obtain your consent before placing non-essential cookies or similar tracking technologies on your device, in accordance with the ePrivacy Directive (Directive 2002/58/EC) and applicable local implementing legislation. You may manage your cookie preferences at any time through our cookie consent tool displayed on our website, or by adjusting your browser settings.

Essential cookies that are strictly necessary for the operation of our website (such as those required to enable you to navigate the site or complete a purchase) do not require consent and cannot be disabled.

US Residents

Additional Rights

If you are a resident of California, Virginia, Colorado, Connecticut, or another US state with applicable consumer privacy legislation, you may have additional rights regarding your personal information.

California Residents

Under the CCPA/CPRA, California residents have the following rights:

Right to know — You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purposes for collection, and the categories of third parties with whom we share it.
Right to delete — You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (such as where retention is necessary to complete a transaction, comply with a legal obligation, or for internal purposes reasonably aligned with your expectations).
Right to correct — You have the right to request correction of inaccurate personal information.
Right to opt-out of sale or sharing — You have the right to opt out of the "sale" or "sharing" (as those terms are defined under the CCPA/CPRA) of your personal information.
Right to limit use of sensitive personal information — Where applicable, you have the right to limit our use of sensitive personal information to purposes necessary to provide the goods or services you have requested.
Right to non-discrimination — We will not discriminate against you for exercising any of your privacy rights.

Do We Sell or Share Personal Information?

We do not "sell" personal information as traditionally understood (i.e., in exchange for monetary consideration). However, certain uses of cookies and tracking technologies for targeted advertising purposes may constitute a "sale" or "sharing" of personal information under the CCPA/CPRA. You may opt out of this by contacting us at info@thehorse.com.au or by adjusting your cookie preferences on our website.

Categories of Personal Information Collected

In the preceding 12 months, we may have collected the following categories of personal information (as defined under the CCPA/CPRA):

Identifiers (e.g. name, email address, postal address, phone number);
Commercial information (e.g. purchase history, products purchased);
Internet or other electronic network activity information (e.g. browsing history, interactions with our website);
Geolocation data (e.g. IP address-derived location); and
Financial information (e.g. credit card number for transaction processing).

These categories are collected from the sources described in the "How We Collect Personal Information" section above and used for the business purposes described in the "Purposes of Collection, Use and Disclosure" section above.

Verification of Requests:

When you submit a request to exercise your rights, we may need to verify your identity before fulfilling the request. We will do so by matching information you provide with information we already hold about you.

Authorised Agents:

You may designate an authorised agent to submit a request on your behalf. We may require proof of the agent's authorisation and may still verify your identity directly.

Other US State Residents

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with applicable consumer privacy laws may have similar rights to access, delete, correct, and opt out of targeted advertising and the sale of personal data. To exercise these rights, please contact us at info@thehorse.com.au.

Children's Privacy

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at info@thehorse.com.au and we will take steps to delete that information.

For US residents, we comply with the Children's Online Privacy Protection Act (COPPA) and do not knowingly collect personal information from children under 13.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

Contact Us

If you have any questions about this Privacy Policy, our handling of your personal information, or wish to make an access, correction or complaint request, please contact us: