Privacy policy

This is a translation for your convenience. Only the German version is legally binding.

This Privacy Policy explains which personal data we process when you visit or use Stablerating.com, for what purpose, on what legal basis and for how long. Last updated: November 2026.

1. Controller

Dr. Kannt IMS GmbH
Parkstrasse 24
82065 Baierbrunn
Germany
E-mail: [email protected]

For any data protection question and to exercise your rights, contact us at [email protected] or via our contact form (topic “Privacy”).

[If a data protection officer has been appointed: please add name and contact.]

2. Summary

  • You can use Stablerating.com without an account: search for stables and view profiles, ratings and top lists.
  • You need an account to rate, comment or add a stable. Ratings are shown without a name, comments under your username. Your e-mail address is never public.
  • Google Maps, Google Analytics and Google AdSense are loaded only after you have agreed. You can change your choice at any time via “Cookie settings” at the bottom of each page.
  • We do not sell data and do not pass it on for advertising purposes.

3. Legal bases

We process personal data under the EU General Data Protection Regulation (GDPR), in particular

  • Art. 6(1)(a) GDPR – your consent (e.g. maps, statistics, advertising),
  • Art. 6(1)(b) GDPR – contract and pre-contractual measures (e.g. user account, publishing ratings),
  • Art. 6(1)(c) GDPR – legal obligations (e.g. retention duties),
  • Art. 6(1)(f) GDPR – our legitimate interests (e.g. secure operation, protection against abuse, a complete directory of stables).

Storing information on your device and accessing it is governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG): strictly necessary storage takes place without consent, everything else only with your consent.

4. Hosting, delivery and server logs

Hosting: The website and database are operated by IONOS SE, Elgendorfer Strasse 57, 56410 Montabaur, Germany, in data centres in the European Union, under a data processing agreement pursuant to Art. 28 GDPR.

Delivery and security: Pages are delivered through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare protects the website against attacks and speeds up delivery, processing your IP address and technical details of the request. Cloudflare is certified under the EU-U.S. Data Privacy Framework; the EU Standard Contractual Clauses also apply. Legal basis: Art. 6(1)(f) GDPR (secure and fast operation). We do not use Cloudflare’s web analytics.

If your browser does not state a country, we use the country Cloudflare derives from your IP address to preselect the country in the search and to choose advertising for that country. Only the country is processed, not the IP address, and it is not stored.

Server logs: With every request the server automatically stores access data: IP address, date and time, page requested, amount of data transferred, referring page, browser and operating system. We need this data to detect faults and attacks (Art. 6(1)(f) GDPR). Logs are deleted after 14 days. The hosting provider’s web statistics derived from them, which contain no personal data, are kept for three months.

Data security: The connection to our website is encrypted with TLS throughout. The database is backed up every night; we keep the last three backups.

5. Cookies, local storage and consent management

Without consent we only use storage that is necessary to operate the website:

  • Sign-in: a cookie that keeps you signed in – for the session or, if you choose “stay signed in”, for up to 14 days,
  • Your privacy choice: so that we do not ask you again on every visit,
  • Your settings: e.g. the country last chosen in the search (in your browser’s local storage).

For everything else we ask you via our consent banner. We use the Borlabs Cookie plugin for this, which runs on our own server. It stores your choice and a random identifier in cookies (lifetime 60 days) so that we can respect your decision and prove your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). You can change or withdraw your choice at any time via “Cookie settings” at the bottom of every page or via the cookie icon at the bottom left.

IAB Transparency & Consent Framework (TCF): For advertising we use the industry standard TCF v2.2 of IAB Europe. Borlabs Cookie is registered as a consent management platform for it (CMP ID 323). In the banner, under “Categories”, “Legitimate interest” and “Vendors”, you can see for which purposes and by which partners data is to be processed; currently this is Google Advertising Products (Google Ireland Limited). Your choice is stored as an encoded string (TC string) in a cookie (lifetime 60 days) and passed on to these partners so that they respect your decision. Where a partner relies on legitimate interest for individual purposes, you can object to this there at any time (Art. 21 GDPR).

6. User account

To rate, comment or add stables, you create a free account. We process:

  • username (shown publicly with your comments; ratings are shown without a name),
  • e-mail address (never public; used to confirm the account, reset the password and send notices about your posts),
  • password (stored only as an encrypted hash),
  • language and country, your acceptance of the Terms of Use and this Privacy Policy with a timestamp,
  • timestamps of registration, e-mail confirmation and last sign-in.

You can rate only after confirming your e-mail address. This ensures that every rating comes from a reachable person. Legal basis: Art. 6(1)(b) GDPR. Please choose a username that does not contain your full name or your e-mail address. Accounts from the previous platform were transferred to the new system with their existing details.

You can have your account deleted at any time: write to [email protected] from the e-mail address registered. Your account data is then deleted; your published ratings and comments remain without any link to you and are shown as “Deleted user”. If you also want individual posts removed, please tell us.

7. Ratings, comments and stable entries

Ratings count towards the stable’s public average and are shown without your name. Comments are published under your username after review by our team. Posts are visible to every visitor – please do not include other people’s personal data. We store the content, the time, the stable and the link to your account. Legal bases: Art. 6(1)(b) GDPR (publication at your request) and Art. 6(1)(f) GDPR (moderation, protecting stable operators from unlawful posts).

If you add a stable, we publish the stable details you provide, including contact details (phone, e-mail, website). The stable entry remains if you delete your account, so that other users’ ratings are preserved. To have contact details removed, write to [email protected].

IP log against abuse: When you register, rate, comment or add a stable, we store your IP address together with the action. We use it only to investigate manipulation, multiple accounts and unlawful posts. Only authorised staff can view it, stating a reason; every view is logged. Entries are deleted after 30 days unless a specific case of abuse requires longer retention (Art. 6(1)(f) GDPR).

Reports: If you report a post, we store your report, the reason and – if provided – your contact details in order to handle it and inform you of the outcome.

8. Stable details and photos

Stablerating.com is a directory of riding stables and equestrian facilities. For each stable we publish business details such as name, address, website, telephone number and location on the map. These details come from stable operators, from our users or from publicly available sources such as the stable’s website. Photos on stable profiles come from operators, from users or from the stable’s website; we record the source of every photo we take over. Where such details relate to an individual (e.g. a stable run under its owner’s name), the legal basis is Art. 6(1)(f) GDPR; our legitimate interest and that of our users lies in a complete, up-to-date directory of stables with first-hand experiences.

Stable operators can ask at any time for their details to be corrected, object to individual photos, or object to the processing altogether (Art. 21 GDPR). Please write to [email protected].

9. Contact form and e-mail

If you write to us via the contact form or by e-mail, we process your name, e-mail address, chosen topic and message to handle your request (Art. 6(1)(b) or (f) GDPR). The message is stored in our administration area and also forwarded to our team by e-mail. We delete your request once it has been dealt with and no statutory retention obligations apply, at the latest after two years.

Sending e-mails: System messages (e.g. confirming your e-mail address, a new password, notices about your posts) are sent via the mail server of Mittwald CM Service GmbH & Co. KG, Königsberger Strasse 4–6, 32339 Espelkamp, Germany, under a data processing agreement. We send promotional e-mails only with your explicit consent.

10. Protection against spam and automated access

We protect our forms with an invisible check field and a limit on requests. For this limit we do not store IP addresses in plain text, only an irreversible check value that is deleted after 30 days.

When you register, rate or add a stable, we also use Cloudflare Turnstile (Cloudflare, Inc., see section 4). Turnstile checks technical characteristics of your browser to tell whether a person is using the form, without picture puzzles and without advertising cookies. Legal basis: Art. 6(1)(f) GDPR (protection against automated accounts and attacks).

11. Location search and “My location”

When you search for a place or postcode, our server sends the search term to the Google Maps Platform (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to obtain the place’s coordinates. Neither your IP address nor any other identifier of yours is transmitted to Google. We store the result for up to 30 days without any personal reference so that the same search need not go to Google again. Our server likewise sends the stables’ addresses to Google to place them on the map (Art. 6(1)(f) GDPR).

When you use the “My location” button, your browser asks whether to share your location. Only if you agree is your position sent, rounded, to our server for this one search. We do not store your location and do not pass it on to Google (Art. 6(1)(a) GDPR).

12. Google Maps (only with consent)

Maps in the search and on stable profiles are provided by Google Maps (Google Ireland Limited). The map is loaded only when you click “Show map” and agree. Your IP address and technical details are then transmitted to Google, possibly also to servers of Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time below the map or via “Cookie settings”. More information: Google Privacy Policy.

13. Google Analytics (only with consent)

If you agree, we use Google Analytics 4 (Google Ireland Limited) to understand how our pages are used and to improve them. Cookies are set and usage data (e.g. pages viewed, time spent, approximate location, device and browser) is transmitted to Google; Google Analytics 4 does not store complete IP addresses. Before you consent, the analytics script is not loaded and no cookieless signals are sent to Google either. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw via “Cookie settings”.

14. Advertising with Google AdSense (only with consent)

Stablerating.com is financed partly by advertising. If you agree, we show ads via Google AdSense (Google Ireland Limited). Besides ad spaces on the pages, full-page ads may appear between two page views; you can close them at any time. Google uses cookies and similar identifiers to deliver ads, measure their effectiveness and – where you have consented – tailor them to your interests. Without your consent no AdSense ads are loaded; ad spaces we agree directly with partners are delivered from our own server without tracking. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw via “Cookie settings”. More information: How Google uses data in advertising.

15. Links to social networks

At the bottom of the page we link to our social media profiles. These are plain links, not embedded plugins: only when you click a link are you taken to the network, whose privacy policy then applies.

Fonts and all other parts of the website are delivered from our own server; we do not embed Google Fonts or other external font services.

16. Transfers to third countries

With Cloudflare (sections 4 and 10) and – only with your consent – with Google (sections 12 to 14), data may be transferred to the USA. Both providers are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR); the EU Standard Contractual Clauses apply in addition.

17. Retention periods at a glance

  • Server logs: 14 days; hosting provider’s web statistics: three months
  • IP log for ratings, comments, registration and stable entries: 30 days (longer only in a specific case of abuse)
  • Spam protection check values: 30 days
  • User account: until deleted by you or by us
  • Ratings and comments: as long as they are published; after account deletion without personal reference
  • Contact requests: until dealt with, at most two years
  • Proof of consent: one year
  • Location search results (no personal reference): 30 days
  • Backups: deleted data remains in the nightly backups for up to three days and is then overwritten.

Statutory retention obligations, e.g. under commercial and tax law, remain unaffected.

18. Your rights

You have the right to

  • access the data we hold about you (Art. 15 GDPR),
  • rectification of inaccurate data (Art. 16 GDPR),
  • erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless there are compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

Simply contact [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

19. No automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR). Average scores and top lists are calculated automatically from the ratings submitted, but they concern the stables rated, not the people rating them.

20. Changes to this Privacy Policy

We update this Privacy Policy when our service or the law changes. The version published here applies.