Privacy policy
Last updated 29 October 2026
This policy explains what personal data HorseFairs.ie collects, why, how long we keep it and the rights you have under the EU General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018 and the ePrivacy Regulations 2011 (S.I. No. 336 of 2011).
1. Who is responsible for your data
The data controller is Lucas IT Services, Ireland, which owns and runs HorseFairs.ie (“we”, “us”). Contact us about anything in this policy at [email protected] or through the contact page. We are not required to appoint a Data Protection Officer, but this address reaches the person responsible for data protection.
2. What we collect, why, and our legal basis
| Data | Why we use it | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address | Send your one-time sign-in code, run your account, send notices about your content | Contract (6(1)(b)) |
| Display name you choose | Shown next to your photos, videos and comments | Contract (6(1)(b)) |
| Listings, dates, photos, videos, captions, comments, ratings and reports you submit | Moderate and publish them; keep the directory accurate | Contract (6(1)(b)); legitimate interest in running a reliable community directory (6(1)(f)) |
| Organiser contact details entered on a listing | Public phone and website are shown; the private organiser email is used only by moderators to check details | Legitimate interest (6(1)(f)) |
| Contact form name, email and message | Reply to you and keep a record of the request | Legitimate interest (6(1)(f)); legal obligation for data protection requests (6(1)(c)) |
| IP address, browser type, request logs, spam-check result | Security, stopping spam and abuse, rate limiting, fixing faults | Legitimate interest (6(1)(f)) |
| Location you set for a listing (map pin, Eircode, address) | Show where the fair or event is | Contract (6(1)(b)) |
| Ownership claims: your name, description, optional phone and link | Check that you organise a fair or event before we let you manage its listing | Legitimate interest (6(1)(f)) in keeping listings accurate and safe |
| Fair reminders: a push address for your device (issued by your browser's push service) and the area you chose | Send you reminders about fairs in that area | Consent (6(1)(a)), given when you allow notifications; withdraw any time |
| Advertising cookies and identifiers (only if ads are switched on) | Show and measure ads that fund the site | Consent (6(1)(a)); you can withdraw it at any time |
We do not ask for, and you should not upload, special category data (such as health, religion or ethnicity). We do not sell your personal data or use it for profiling. No decisions about you are made solely by automated means; every moderation decision is taken by a person. The spam check (Cloudflare Turnstile) is a security measure, not a decision about you.
Fair reminders
If you turn on fair reminders, your browser gives us an anonymous push address for that device and its encryption keys, and we store the area you chose (for example Munster, Northern Ireland or particular counties). We do not need your name or email for this. Each morning we check the calendar and, if a fair or event in your area starts in a week, tomorrow or today, we send one notification through your browser's push service (Google, Apple, Mozilla or Microsoft, depending on your device). The message content is encrypted so the push service cannot read it. Turn reminders off from the same button, or block notifications for horsefairs.ie in your settings. We delete the push address when you turn reminders off, when the push service tells us it is no longer valid, or after 10 failed attempts.
How listings are researched
To keep the calendar complete, we use an AI service (Anthropic's Claude) to search public web pages for horse fairs and events in Ireland and Northern Ireland. It looks for event details such as names, dates, venues and organisers' public contact pages; it is not used to profile people. What it finds is checked by a person before it is published, and is marked unconfirmed until checked with the organiser or an official source. Organisers can ask us to correct or remove any listing through the contact page.
3. People who appear in photos and videos
A photo or video can include people who did not upload it. Uploaders must confirm they have permission from anyone clearly identifiable, and that no child is identifiable without a parent or guardian's consent. Location data (EXIF and GPS) is removed from photos on your device before upload. If you appear in content on HorseFairs.ie and want it removed, use Report under it or contact us. We hide it while we review, usually within 48 hours, and act on privacy requests first. This right to object applies even if you have no account.
4. Where data comes from
Most data comes from you. Some comes from other people: organiser details entered by someone else, or a photo you appear in. We tell organisers about their listing when we can and correct or remove details on request.
5. Who we share it with
We use these service providers (data processors) under written contracts, and only for the purposes above:
- Anthropic PBC – AI research of public event information (no visitor or account data is sent)
- Google, Apple, Mozilla, Microsoft – delivering encrypted push notifications if you turn on reminders
- Cloudflare, Inc. – website delivery and security, image storage (R2), video hosting (Stream), spam checks (Turnstile)
- Resend – sending sign-in codes, contact-form messages and moderation notices
- Bluehost (Newfold Digital) – web server and database hosting
- Google – email inbox for contact-form messages (Gmail); address lookup if enabled; advertising (AdSense) only with your consent
- OpenStreetMap Foundation – map tiles and address lookup; your browser requests map tiles directly, which shares your IP address with the tile server
Public content (listings, approved photos, videos, comments and your display name) is visible to everyone, including search engines and AI assistants that read the site. We may disclose data where the law requires it, for example to An Garda Síochána with a valid request, or to protect people's safety.
6. Transfers outside the EEA
Some providers above are based in the United States or process data there. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses with additional safeguards. You can ask us for a copy of the relevant safeguards.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account (email, display name) | Until you delete your account, or 3 years after your last sign-in, when we delete it after an email warning |
| Sign-in codes | Deleted within 24 hours |
| Your photos, videos, comments, ratings | While your account exists, or until you or a moderator remove them |
| Rejected uploads | Files deleted at the moment of rejection |
| Uploads you start but do not finish | Deleted within 48 hours |
| Listings and dates | Kept as a historical record of the event; your name is removed if you delete your account |
| Reports and moderation records | 2 years, to handle appeals and repeated abuse |
| Ownership claims | 2 years after the decision, then deleted |
| Contact-form messages | 2 years from your last message |
| Fair reminder push address and area | Until you turn reminders off or the address stops working; the record of which reminders were sent is kept 60 days |
| Server and security logs, rate-limit counters | Up to 30 days |
8. Your rights
You have the right to:
- access a copy of your personal data;
- rectification of inaccurate data;
- erasure – delete your account and everything you uploaded yourself from your account page, or ask us;
- restriction of processing while a complaint is checked;
- portability – receive the data you gave us in a machine-readable format;
- object to processing based on legitimate interest, including appearing in a photo;
- withdraw consent to advertising cookies at any time, without affecting earlier processing.
Send requests to [email protected] or the contact page. We reply within one month (extendable by two months for complex requests, in which case we tell you why). We may ask you to confirm your identity, usually by replying from the email on your account. Requests are free unless clearly unfounded or excessive.
You can complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, www.dataprotection.ie, or the supervisory authority where you live. We would appreciate the chance to sort it out first.
9. Children
You must be 16 or over to create an account, the age of digital consent in Ireland under section 31 of the Data Protection Act 2018. Anyone can browse without an account. If we learn that an account belongs to someone under 16, we delete it.
10. Security
The site runs only over HTTPS. There are no passwords to leak: sign-in uses single-use codes that expire after 10 minutes and are stored only as a one-way hash. Uploads go straight from your device to Cloudflare storage using short-lived, single-purpose upload links. Moderators are the only people who can see unpublished content. If a breach is likely to put you at risk, we will tell you and the Data Protection Commission within 72 hours as required by GDPR Article 33.
11. Cookies and storage on your device
See the cookie policy. In short: anonymous visitors get no cookies from us; signing in sets one essential cookie; advertising cookies are used only if you agree.
12. Changes
We will update this page if anything changes and tell account holders by email about significant changes before they take effect.