1Who we are
Ippikos is an online entry and show management service for horse shows and the societies, clubs and associations that run them. In this policy, "Ippikos", "we" and "us" mean Ippikos (ABN 96 458 658 021). "You" means anyone whose information we handle: people who enter shows, the owners, riders and handlers named in an entry, and the secretaries and committee members who run shows on Ippikos.
This policy covers ippikos.com, app.ippikos.com, entries.ippikos.com, our sign-in page and the emails we send. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
2Ippikos and the societies that use it
Every show on Ippikos is run by a society. When you enter a show, your entry goes to the society running it, and they use it to run the show: sorting entries into classes, getting in touch with you about the day, and recording results.
Once a society has your entry, it decides what it does with it, under its own privacy practices. If you want to know what a society does with entries, ask them. Their contact details are on the show's entry page.
We handle your information to provide Ippikos to you and to the society. For details a society enters on someone else's behalf, we act on the society's instructions. A society only ever sees the entries made to its own shows. Entering shows run by two different societies doesn't let either of them see your entries with the other.
3What we collect
When you sign in
Your name and email address. You sign in with a one-time code we email you, so there's no password for us to hold.
When you enter a show, or someone enters for you
- The owner's title, name, date of birth, phone number, email and street address, whether they're under 18, and their Property Identification Code (PIC) if one is given.
- An emergency contact's name, their relationship to the owner and their phone number.
- Each exhibitor's title, name and phone number, and whether they're under 18. Exhibitors are the riders and handlers in the entry.
- Each horse's name, breed and registered association.
- The classes entered, the fees, how the entry was paid, and its history: for example, whether it was changed, rejected or refunded, when, and by whom.
Information about a horse isn't personal information on its own. We treat it as personal information once it's linked to a person in an entry.
We don't ask for health information, and we don't need it. Please don't put it in an entry.
When you pay by card
You type your card details into a form provided by our payment processor, and they go straight to it. We never see or store your full card number. We keep a record of the payment: the amount, the processor's reference for it, whether it went through or was refunded, and the result of your bank's security check (3-D Secure). The payment records the processor sends us include the billing name, email, phone and address you paid with, and can include your card type and its last four digits.
When you save your details
If you leave "Remember these details for next time" ticked, we keep the owner's details, exhibitors and horses from that entry against your account, so you don't have to type them again. You can change or delete them any time under Saved details.
When you run a show
Your society's name and contact details, and the name, email and phone of the contact for each show. To check a society before it can take payments, we also collect its ABN or ACN, a public web or Facebook page, and the secretary's name and email. If the society takes bank transfers, we keep the account name, BSB and account number it wants entrants to pay into. The bank account card payouts go to is collected and held by our payment processor, not by us.
When you contact us
What you write and your email address. If you register your interest in running a show, also your society's name and when its next show is. If you use the help panel in the app, it also tells us which page you were on, so we can see what you saw.
Technical information
Like any website, our servers see the IP address of the device you're using. We use it to keep Ippikos running and to stop abuse. If something breaks, an error report goes to our monitoring service. Those reports are set up to leave personal details out: we strip email addresses and the query part of web addresses before they're sent.
4Where it comes from
Mostly from you. Some of it comes from someone else:
- The person making the entry. An owner can enter for the riders on their horses, and a parent often enters for a child. If you enter details about someone else, you need their permission, or their parent's or guardian's if they're under 18. Please point them to this policy.
- A society. A secretary can enter a show for you, from a paper form, a phone call or at the gate. When they do, they type your details in, and we email you a link to the entry at the address they give us. The entry only joins your Ippikos account when you open that link while signed in with the same email address. Until then, the secretary can correct the address if it was wrong.
- Someone setting up a society may give us the secretary's name and email, so we can check with the secretary that they're allowed to.
- Our payment processor tells us about payments, refunds and the society's payout account.
5How we use it
- To take your entry and pass it to the society running the show.
- To take payments, send refunds, and pay societies what they're owed.
- To email you about your entries: confirmations, receipts, payment links, and notices when a society records a payment or a refund.
- To sign you in, and to fill in your details next time if you've saved them.
- To check a society is genuine before it can take payments.
- To answer your messages and help when something goes wrong.
- To keep Ippikos secure, prevent fraud, and find and fix faults.
- To meet our legal obligations, such as keeping financial records.
We don't sell personal information. We don't use it for advertising, and we don't send marketing emails. If we ever want to send you news or offers, we'll ask first, and you'll be able to stop them at any time.
Ippikos doesn't make decisions about you by computer alone that significantly affect you. Our payment processor screens card payments for fraud automatically and can decline one it considers risky; it does that under its own privacy policy.
6Who we share it with
| Who | What they see |
|---|---|
| The society running the show | Everything on the entries made to its shows, including the owner's date of birth, address, PIC and emergency contact. It can correct those details, and everyone it lets into its Ippikos account can see them. It can also download a results report with riders' and horses' names, which it may publish. |
| Other people using Ippikos | Nothing. That includes other societies and other entrants. |
| The public | The shows, never the people entering them: each show's name, date, venue and society. |
The services we rely on handle information for us so Ippikos can work:
| Service | What it handles |
|---|---|
| Our payment processor | Card payments, refunds and payouts. It keeps a customer record for each person paying, with the name, email, phone and address used to pay, and sends its own receipt to the owner's email. It also handles this information under its own privacy policy. |
| Our email delivery service | Sends our emails, so it handles the addresses and contents of every email we send. |
| Our hosting provider | Hosts our servers and database, including our sign-in service. |
| Our error monitoring service | Receives the error reports described in section 3. |
| Our font provider | Serves the fonts our pages use. Your browser fetches them from the provider's servers, which see your IP address when it does. |
| Our email provider | Hosts the inboxes that receive your messages to us and our own notices, such as a new society asking to be checked. |
We may also share information when the law requires or allows it, for example to answer a court order or to help prevent fraud; with our professional advisers; or with whoever takes over Ippikos if it's ever sold, who would have to keep to this policy.
7Information that leaves Australia
Our payment processor, email delivery service, error monitoring service and font provider are based in the United States, and information we send them is likely to be stored or handled there. Our payment processor may also handle payment information in other countries where it operates.
We choose providers that protect information to a standard similar to the Australian Privacy Principles, and we remain accountable for how they handle it on our behalf.
8Cookies and browser storage
We only use the cookies Ippikos needs to work. There are no advertising or tracking cookies, and we don't use analytics.
- A sign-in cookie that keeps you signed in until 14 days after you last used Ippikos.
- A security cookie that stops other websites submitting forms as you.
- Short-lived cookies while you sign in, which make sure the sign-in you finish is the one you started.
Our payment processor sets its own cookies on the pages where you pay by card, to help detect fraud, and our sign-in page sets its own cookies to keep track of the sign-in. We also keep a few small things in your browser's session storage, such as which details were saved from the entry you just made. Session storage is cleared when you close the tab.
Because all of these are needed for Ippikos to work, we don't ask you to accept them.
9Keeping it secure
Every connection to Ippikos is encrypted, and so is the connection between our servers and our database. Sign-in cookies can't be read by scripts on the page. Societies are kept apart in the database, so one society's account can't reach another's entries. Card details never touch our servers. Only the people who run Ippikos can get into the database, and they do so to run and support the service.
No system is perfectly secure, so we can't promise nothing will ever go wrong. What we do if it does is in section 13.
10How long we keep it
We keep entries, payments and the emails we sent about them for at least as long as we need them to deal with questions, refunds and disputes, and to meet our legal obligations: tax law, for one, requires financial records to be kept for at least five years.
Your saved details stay until you delete them or your account is closed.
11Seeing, correcting and deleting your information
You can ask what personal information we hold about you, and ask us to correct it. Email [email protected]. We'll reply within 30 days, and we may need to check who you are first. There's no charge.
You can change or delete your saved details yourself, under Saved details. To correct an entry you can also ask the society running the show, since they can edit it directly.
You can ask us to close your account and delete your information, and we'll delete what we can. Some records we have to keep: an entry is part of the society's records of its show as well as yours, and payment records have to be kept for tax. If we keep something, we'll tell you what and why.
If we refuse a request, we'll tell you why and how to complain.
12Children and young riders
Plenty of exhibitors are under 18, and an entry records that so the society can apply its rules. For an exhibitor, "under 18" is all we ask about their age. We collect a date of birth only for the owner, whatever their age.
An entry involving someone under 18 should be made by their parent or guardian, or with their permission. If you're under 18, please ask a parent or guardian before you sign up or enter.
13If something goes wrong
If personal information reaches someone it shouldn't, whether because an email address was mistyped or through a security incident, we will:
- act straight away to contain it, for example by asking whoever received it to delete it
- tell the society concerned and the people affected as soon as we can, saying plainly what happened, what was involved and what they can do
- notify the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it.
If you get an email from Ippikos that wasn't meant for you, please delete it and let us know at [email protected].
14Questions and complaints
If you have a question or a complaint about how we've handled your information, email [email protected] and tell us what happened. We'll acknowledge it within 7 days and aim to resolve it within 30.
If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
15Changes to this policy
We'll update this policy when what we do changes, and move the date at the top. If a change affects how your information is used, we'll tell you by email or in the app before it takes effect.