1. This Privacy Notice

Please carefully read this Privacy Notice as it provides you with information about your personal data being processed when you contact us or in connection with your access to and use of the Platform. This Privacy Notice explains which types of personal data we hold on you, how we collect and process such data, how long we keep it, and so on.

2. Interpretation

Unless otherwise provided in this Privacy Notice, capitalised terms used in this Privacy Notice have the meaning determined in the Horsebox Terms & Conditions (the “Terms”). You should read the Terms carefully as they affect your obligations and legal rights. In this Privacy Notice, “personal data” and “personal information” are synonyms. They refer to any information that identifies or can reasonably identify you, either directly or indirectly.

3. Contact Details

We, HORSEBOX RB LIMITED established under the laws of England and Wales, are the data controller for the data collected under this Privacy Notice, meaning we determine how and why your data is processed. If you have any questions about this Privacy Notice or your data processing, please contact us at: info@horsebox.io

4. Type of Data

The categories of personal data collected depend on how you interact with us, use the Platform, and the requirements of the applicable laws. We collect and process the following types of personal data:

When you register and create an Account on the Platform, you may provide us with certain personal information, including your name, email address, phone number, residential address, date of birth, profile photo, and links to your social media profiles.

Upon registration, we also automatically generate a Platform Wallet to enable you to transact with Cryptoassets and Horse Tokens, as well as assign a unique internal user identifier. This identifier is not publicly visible and is used solely for internal purposes, such as user count management and Account administration.

Please note that only your name, email address, Platform Wallet, and user identifier are required to register and use the Platform. Without this information, we cannot create or activate your Account. All other Account-related data is optional and may be provided or removed by you at any time, at your sole discretion.

This includes your email address, if you subscribe to receive our marketing emails. Subscription is always voluntary.

When you execute Transactions, they are processed by third-party payment providers or blockchain networks, depending on how the payment is made.

When payment is conducted in a fiat currency, such as British pound sterling, we receive limited details such as transaction amount, name, email address, and the last few digits of your payment card. We do not have access to your full card number, CVV code, or card expiration date. For more details, please review the privacy-related documents of the respective payment provider that are provided at the payment stage.

When payment is conducted in Cryptoassets, we receive the addresses of sending and receiving Wallets, and associated transaction data, which may include amount, ID, status, time and date, etc.

This includes data related to Transactions, such as the date, time, counterparties, type and number of the Participation Interest.

This includes technical information that is automatically collected via log files when you access the Platform, primarily to facilitate and maintain secure access. Providing this data is mandatory to enable your access to the Platform. Such information may include your Internet Protocol (IP) address, browser type, internet service provider (ISP), date and time of access, referring and exit pages, and click activity (e.g., number of clicks and navigation patterns).

With your consent, we also use Google Analytics, Hotjar and the Meta Pixel to measure use of the Platform and advertising effectiveness. This may include pages and listings viewed, registrations, enquiries, checkout activity, completed purchase value and advertising attribution identifiers. We do not send full payment-card details to these services. You can choose analytics and advertising separately, reject either purpose, or revisit your choices through Cookie settings in the Platform footer.

Separately, Horsebox uses first-party anonymous counters to understand aggregate page views, listing views, campaign landing pages, enquiries and checkout starts. These counters do not use cookies, retain a visitor identifier, build an individual journey or store the full page URL. Campaign labels are limited to non-identifying UTM values. You can object and switch these counters off at any time through Cookie settings in the Platform footer without affecting your use of Horsebox.

While using the Platform, you may be able to submit Your Content, which is typically not considered personal data. However, if Your Content includes any personal information, such as your name, address, or other personal details, we and other Platform users will be able to review that information. You provide such personal data on a voluntary basis. We encourage you not to include any personal information in Your Content. Additionally, please do not provide any third-party personal information in Your Content.

In certain circumstances, such as when creating a Listing, or purchasing or offering Participation Interests, we may verify your identity to confirm that you are who you represent yourself to be and that you possess all necessary authorisations, licences, or approvals to use the Platform. For these purposes, we may collect and verify information and documentation, which may include (without limitation): your full name, citizenship, country of domicile, place of tax residence, tax identification number, residential address, IP address, date and place of birth, as well as compliance-related documentation (including proof of identity, proof of address, and any other documents as may be reasonably requested to satisfy our legal or regulatory obligations). The provision of such information and documentation is mandatory. Failure to provide the requested information may result in your inability to use certain Platform features, such as to create a Listing, or purchase or offer Participation Interests.

This may include name, contact details, social media account handles, and other data, depending on what information you provide to us. Please do not provide personal data unless it is reasonably necessary or requested by us. Note that we may also collect certain other information, which may be required under the applicable laws.

5. Data Use

We process your personal data in accordance with applicable data protection legislation. Purposes for which we process your personal data, and the lawful bases for such processing are as follows:

6. Processing Period

As a general rule, your personal data is kept as long as it is necessary for the purposes it was collected. It may be retained longer if required to meet our legal obligations, in relation to legal proceedings, or to protect our rights and legitimate interests or those of third parties. The default storage periods are as follows:

7. Data Sharing

We do not sell or rent out your data. We only share it as described in this Privacy Notice, where permitted or required by applicable law, under the Terms, or with your consent. When sharing personal data, we take appropriate technical and organisational measures to ensure its protection in accordance with applicable data protection laws.

Depending on the nature of your interaction with the Platform, your personal data may be shared with the following categories of recipients for the purposes set out in this Privacy Notice:

• Affiliates: the term is defined in the Terms, however it basically includes the entities within our corporate group that support our operations.
• Service Providers: includes marketing, customer support, technical operations, and email delivery services.
• Payment Processors: includes providers processing payments with fiat currencies or Cryptoassets. Typically they would act as our data processors for the purpose of processing payments within the Platform, however they also act as independent data controllers, and their privacy practices are governed by their privacy-related documentation.
• Compliance and Verification Partners: such as Know Your Customer (KYC) and anti-money laundering (AML) service providers.
• Platform Users: includes Managers or other Account holders, where applicable (please note that certain information may be publicly visible within the Platform).
• Hosting and Infrastructure Providers: companies who assist in operating and maintaining the Platform.
• Regulatory and Legal Authorities: if required by law, regulation, legal process, or government request.
• Business Transfers: in the event of a merger, acquisition, sale of assets, or other corporate restructuring involving the Platform.
• Third-Party Services: where you interact with or access features provided by integrated third-party tools or platforms.

As a general rule, we do not transfer your personal data outside the United Kingdom. However, where such transfers become necessary, for example, to provide services through trusted third-party providers or to maintain the Platform infrastructure, we will ensure that your data is protected by appropriate safeguards.

If personal data is transferred to a country outside the UK, we will only transfer to countries that the UK government has determined offer an adequate level of data protection. Otherwise, we will implement appropriate safeguards, such as Standard Contractual Clauses approved by the UK Information Commissioner’s Office or equivalent legal mechanisms.

If you would like more information about whether your personal data is transferred outside the UK and the specific safeguards that apply, please contact us.

Joint controllership arises when two or more parties jointly determine the purposes and means of processing personal data. This means they share responsibility for specific aspects of that processing.

On the Platform, Managers act as joint controllers with us in relation to certain categories of data, as described below. This is because Managers must enter into contracts with users for the sale of the Participation Interest.

This joint controllership applies only to certain Account Data that is shared with the Mangers, such as name, address and contact details. Managers never have access to your Identity Verification Data.

If you wish to exercise your rights in connection with this joint processing, you may contact us directly. While both the Platform and the Managers are accountable under applicable data protection laws, we have clearly defined roles and responsibilities.

The Platform’s obligations as a joint controller are as follows:

The Platform is your main point of contact with respect to data collected under this Privacy Notice for exercising your data subject rights, answering questions about data processing, providing general information, informing you about this joint controllership arrangement, and, if necessary, facilitating communication between you and the Manager.

Other legal obligations, such as ensuring appropriate security measures or maintaining processing records, are fulfilled by both the Platform and the Manager separately For any processing activities not covered by the joint controllership, each party remains solely responsible.

If you provide us with any personal information relating to a third party, you are responsible for ensuring that you have obtained all necessary consents or have another valid legal basis to share such information with us. You must also ensure that the relevant third party has been provided with a copy of this Privacy Notice prior to you disclosing their personal information to us. In such cases, we shall not be responsible or liable for your collection, use, or disclosure of third-party personal information. Our responsibility shall be limited to processing any third-party personal information received by us in accordance with applicable data protection laws and this Privacy Notice.

8. Features of Blockchain Data Processing

Certain data, such as your Wallet address and associated blockchain transactions, may be recorded on public, decentralised blockchain networks that operate autonomously and are not controlled by any single entity, including us. “Public” means that data entered onto the blockchain is accessible to anyone and cannot be restricted, modified, or erased once confirmed. “Decentralised” means that no central authority governs the operation of the blockchain.

Due to the inherent characteristics of blockchain technology:

• Records are immutable, and they cannot be altered or deleted.
• Transactions are irreversible, which may limit or prevent the exercise of certain data protection rights (such as the right to erasure or rectification) once data is written to the blockchain.
• Access to on-chain data is unrestricted and global, and we have no control over how third parties may access or use that data.

Please be aware that submitting data to the blockchain is a voluntary action. By choosing to use blockchain-based features or services, you acknowledge and accept the potential limitations this may impose on your privacy and data rights

9. Automated Decision-Making

Automated decision-making refers to decisions made solely by automated means, without human involvement, that produce legal or similarly significant effects on you (such as profiling for creditworthiness, hiring, or service eligibility).

We do not currently carry out any automated decision-making, including profiling, that has legal or similarly significant effects on individuals

If we intend to introduce such processing in the future, we will inform you in advance and provide meaningful information about the logic involved, as well as the potential consequences of such processing. Where required, we will also ensure that you are able to exercise your rights, including the right to request human intervention, express your point of view, or contest the decision.

10. Data Subject Rights

If you wish to exercise any of your data subject rights, we may need to request specific information from you to verify your identity and ensure that you are authorised to make such a request.

Please be aware that when you interact with blockchain networks, certain data protection rights under applicable laws, such as the rights to erasure, rectification, or restriction, may not be fully exercisable in relation to data recorded on public blockchains. For example, we may be unable to modify or delete from the blockchain information such as your Platform Wallet or, if applicable, Wallet address or transaction history once it has been processed and published on a decentralised, immutable ledger. For further information, refer to the “Features of Blockchain Data Processing” section of this Privacy Notice.

According to the applicable legislation, you have the following rights:

11. Security Measures

We are committed to protecting your personal data and take appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These measures are designed to prevent unauthorised access, unlawful processing, accidental loss, destruction, or damage to your data.

Our security measures include, but are not limited to:

• Encryption of data in transit and at rest where applicable;
• Access controls and authentication mechanisms to restrict access to personal data on a need-to-know basis
• Regular monitoring of our systems for potential vulnerabilities or security breaches;
• Use of secure servers, firewalls, and intrusion detection systems;
• Employee training on data protection principles and security practices;
• Vendor due diligence and contractual safeguards when working with third-party service providers

Despite our efforts, no system can be guaranteed to be 100% secure. If you believe that your interaction with us is no longer secure (for example, if you suspect a security issue with your Account), please contact us immediately.

12. Third-Party Links

The Platform may contain links to third-party websites, applications, and social media features (such as plugins or widgets). Interacting with these features, such as clicking a link or using a plugin, may enable those third parties to collect or share information about you.

Please note that we do not control and are not responsible for the content, security, or privacy practices of such third parties. The inclusion of a link or feature does not imply our endorsement.

We encourage you to review the privacy policies and terms of use of any third-party websites or services you choose to access.

13. Personal Data of Children

The Platform is not intended for use by individuals under the age of 18 years, or the age of majority in your jurisdiction if higher. We do not knowingly collect, use, or process personal data from children.

If we become aware that we have inadvertently collected personal information from a child, we will take prompt steps to delete such data from our records.

If you are a parent or legal guardian and believe that your child has provided us with personal information, please contact us, and we will take appropriate action.

14. Modifications and Updates

We may update this Privacy Notice from time to time to reflect changes in our data processing practices, legal requirements, or business operations. When we make changes, we will revise the “Last Updated” date and, where relevant, the version number at the top of this notice

We encourage you to review this Privacy Notice periodically to stay informed about how we collect, use, and protect your personal data.