Template – review by a solicitor before launch. Placeholders in [square brackets] must be completed. Last updated 12 October 2026.
This policy explains how PaddockSense ("we", "us") uses your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
PaddockSense is operated by George Calder, a sole trader based in England, who is the data controller.
- Address: [BUSINESS ADDRESS – placeholder]
- Email: [privacy@paddocksense.com – placeholder, not yet set up]
- ICO registration number: [ICO REGISTRATION NUMBER – placeholder]
What we collect
| Data | Why | Lawful basis |
|---|---|---|
| Email address and name (account) | To create your account and send sign-in codes | Contract (Art. 6(1)(b)) |
| Confirmation you are 18+ and when you accepted our terms | To keep the service adults-only and keep a record | Legal obligation / legitimate interests |
| Horses you follow | To show your watchlist and send the alerts you asked for | Contract |
| Email alert preferences | To send (or stop) the service emails you choose | Contract |
| Marketing consent (the Sunday “Week in racing” email) | Only if you tick the optional box | Consent (Art. 6(1)(a), PECR reg. 22) – withdraw any time |
| Email delivery data (sent, opened, bounced) | To make sure emails reach you and to handle unsubscribes | Legitimate interests |
| Essential storage (sign-in session, theme, odds format, cookie choice) | To make the site work as you set it | Strictly necessary (PECR exemption) |
| Analytics (pages viewed, device type, approximate location) | To improve the site – only if you accept analytics cookies | Consent |
We do not collect payment details (the site is free), and we do not sell your data or share it for advertising.
Alerts vs marketing. Alerts about horses you follow are service emails you asked for; you can turn them off in your account. “Week in racing”, our Sunday-evening roundup, is our only marketing email and is only sent with your opt-in consent. Every email has an unsubscribe link and a "manage preferences" link.
Who processes data for us
- Supabase – account sign-in and database (accounts, follows, preferences).
- Resend – sending emails.
- Netlify – website hosting (server logs such as IP address, kept briefly for security).
- [Analytics provider – placeholder, e.g. a cookieless or consent-based tool] – only with consent.
Racing data and odds come from The Racing API; this is not personal data and we send it none of yours.
International transfers
Some providers may process data outside the UK (for example in the EU or US). Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Addendum / Agreement, or the UK–US Data Bridge where the provider is certified. [Confirm each provider's region and transfer mechanism – placeholder.]
How long we keep it
- Account, follows and preferences: while your account is open; deleted within 30 days of you closing it.
- Records of 18+ confirmation, terms acceptance and marketing consent: for the life of the account plus 2 years.
- Unsubscribe list: kept so we don't email you again.
- Email delivery logs: up to 90 days. Hosting logs: up to 30 days. Analytics: up to 14 months.
Your rights
You can ask to access, correct, delete or export your data, object to or restrict how we use it, and withdraw consent at any time (this does not affect earlier use). Contact us at the email above; we'll reply within one month. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113. We'd appreciate the chance to help first.
Children
PaddockSense is for adults aged 18 and over only. We do not knowingly collect data from under-18s and will delete any account we learn belongs to one.
Security and changes
We use providers with encryption in transit and access controls. We'll post any changes here and update the date above; significant changes will be emailed to account holders.