Privacy Policy

1. The Scope of This Privacy Policy

This policy applies to every interaction you have with CSW BLOODSTOCK LTD through this website and through the bloodstock data systems we design and operate for breeding operations. It covers the personal information of visitors, enquirers, clients, partners, suppliers and the individuals whose details appear within bloodstock records that a client may ask us to build, migrate or maintain.

Where we act as a service provider and process records on behalf of a breeding operation, that operation remains the controller of the data and we act on its documented instructions. In those cases the operation is responsible for the lawfulness of the original collection, and we are responsible for handling the records securely and only for the agreed purposes. Where we operate this website and respond to enquiries in our own name, we act as the controller directly.

This policy does not apply to third party websites that you may reach from links on our pages. We do not control those sites and we encourage you to read their own privacy notices before providing any information to them.

2. Who We Are and How to Reach Us

CSW BLOODSTOCK LTD is a computer systems design company working in the bloodstock and stud farm sector. Our registered address is 70 Westerleigh Road, Yate, Bristol - BS37 4BN, United Kingdom (GB). Our industry classifications include computer systems design and related services, and professional, scientific and technical services.

For any question about this policy, any request to exercise a right, or any concern about how your information has been handled, you may contact us by email at media@cswbloodstock.lol or by telephone on +12277705575. Written correspondence may be addressed to the Data Protection Team at the registered address given above.

We take pride in answering privacy questions directly and without unnecessary formality. If you are unsure whether a matter relates to this policy or to a client engagement, write to us and we will route it to the correct person.

3. The Information We Collect

We collect information in three broad ways: information you give us directly, information generated as you use our website, and information contained within the records of a client engagement.

Information you give us directly includes your name, email address, telephone number, the organisation you represent, the content of your message and any documents you choose to send. When you complete the enquiry form on our contact page, those fields are used to prepare and send an email from your own mail client, and the details are then held in the resulting correspondence.

Information generated as you use the website is limited and technical. It can include the pages you visit, the time of your visit, the type of device and browser you use, and general region information derived from your connection. We use this only to keep the site working and secure, and to understand at a high level which information is useful to visitors.

Information contained within client records is the largest category by volume. A studbook or bloodstock database may include the names of owners, breeders, trainers, stable staff, veterinarians and consignors, along with contact details, contractual notes, ownership history and the pedigree records of animals. This information is described more fully in the following section.

4. Bloodstock and Pedigree Records

Bloodstock records are unusual because they mix ordinary business and personal information with detailed genealogical data about animals. We treat the whole of a register as confidential business information, and we treat the personal elements within it as personal data subject to this policy.

A typical register may contain the names of individuals connected with a horse, the amounts paid at sale, the terms of a covering or a lease, veterinary observations and notes about ownership changes. Some of this is commercial, some is personal, and a small part could be sensitive if it concerned a person rather than an animal, which is rare in this sector but possible in staff or welfare notes.

When we build or migrate such records, we do so under the instructions of the breeding operation that controls them. We do not repurpose the personal elements of a register for our own marketing, and we do not sell or rent them. Our interest is in the structure and integrity of the register, not in the commercial exploitation of the individuals named inside it.

Where a register contains information about a living individual, that individual may have rights under data protection law. We support our clients in responding to such requests and we handle them with the same care we apply to our own records.

5. How We Use Personal Information

We use personal information to respond to enquiries, to prepare proposals, to deliver the services described on our services page, to maintain and support the systems we build, to keep our own accounts and records, and to meet legal and regulatory obligations.

In responding to an enquiry we use your contact details and the content of your message to answer you and to keep a record of the conversation. In delivering a project we use client contact details to coordinate work, and we use the records supplied by a client to design, migrate and test the register. In supporting a live system we may access records to diagnose a fault or implement a change, always within the scope of the engagement.

We also use limited technical information from the website to keep it available, to detect abuse and to improve its structure. We do not use this information to build advertising profiles, and we do not track you across other websites.

6. The Lawful Bases for Our Processing

Data protection law requires us to have a lawful basis for each use of personal information. We rely on the following bases depending on the circumstances.

We rely on legitimate interests to respond to enquiries, to operate and secure our website, to manage our business relationships and to improve our services. We have considered the impact of these activities on individuals and we keep them proportionate and limited.

We rely on the performance of a contract, or on steps taken at your request before a contract, to deliver services to clients and to process the records needed to carry out an engagement. We rely on legal obligation to keep accounting records and to respond to lawful requests from authorities. Where we ask for consent, for example for an optional newsletter, we rely on that consent and you may withdraw it at any time.

When we process records on behalf of a breeding operation, the lawful basis is determined by that operation as controller, and we act on its instructions. We are happy to explain the basis for any particular processing activity if you ask us.

7. Cookies and Website Technologies

Our website is deliberately simple. We do not use advertising cookies, we do not embed third party tracking scripts, and we do not sell any information derived from your visit. Any cookies we set are strictly necessary to keep the site functioning correctly, or are used to remember a small preference such as whether the mobile menu is open.

You can control cookies through your browser settings. Blocking strictly necessary cookies may affect how parts of the site behave, but you will still be able to read every page. If we ever introduce a new cookie for a new purpose, we will describe it here and, where required, ask for your consent before it is set.

Server logs may record technical requests to our site for security and diagnostic purposes. These logs are kept for a limited period and are not combined with other information to identify individual visitors for marketing.

8. Sharing Information with Others

We do not sell personal information and we do not rent it to anyone. We share information only where it is necessary to deliver a service, to comply with the law, or to protect our rights and those of our clients.

We may share information with trusted suppliers who help us operate, such as hosting providers and professional advisers. These suppliers act under contract and may use the information only for the agreed purpose. We keep the number of such suppliers small and we review them regularly.

We may disclose information where we are required to do so by law, by a court order, or by a regulator with lawful authority. We may also disclose information to establish, exercise or defend a legal claim. Where possible and lawful, we will tell you before doing so.

Within a client engagement, records belong to the operating breeding business. We share them only with the individuals that business authorises, and only to the extent needed to complete the work.

9. Data Migration and Third Party Records

Our data migration service moves records from paper ledgers, older desktop software and ad hoc spreadsheets into a modern register. Such records frequently contain names and details of people who never dealt with us directly, including former owners, past staff and counterparties.

When we migrate such records we act on the instructions of the breeding operation that controls them. We do not add the individuals in those records to our own mailing lists, we do not use them for our own purposes, and we delete working copies once the migration is complete and accepted. Where a record is ambiguous and a human decision is needed, we flag it rather than guessing, so that the controller can judge what is correct.

If you are named in a register that a client has asked us to migrate and you wish to understand your position, you should contact the breeding operation that holds the register. We will support that operation in responding to you, and you are also welcome to contact us at media@cswbloodstock.lol for guidance on where to direct your request.

10. International Transfers of Information

We are based in the United Kingdom and we normally store information within the United Kingdom or the European Economic Area. On occasion, a service provider or a client operation may require information to be accessed from another country.

Where information is transferred outside the United Kingdom or the European Economic Area, we take steps to ensure it remains protected. These steps can include contractual clauses approved for the purpose, an assessment of the legal environment of the destination, and technical measures such as encryption in transit and at rest.

We keep a record of the transfers we make and we review them when the law or our suppliers change. If you would like to know whether a specific engagement involves a transfer outside the United Kingdom, you may ask us and we will explain the position for that engagement.

11. How Long We Keep Information

We keep personal information only for as long as we need it for the purpose for which it was collected, or for as long as the law requires. Retention periods differ depending on the type of information and the context.

Enquiry correspondence is ordinarily kept for a period sufficient to answer the enquiry and to maintain a record of the relationship, after which it is deleted or archived in line with our internal schedule. Contract and accounting records are kept for the period required by tax and company law in the United Kingdom. Records processed on behalf of a client are kept according to that client instructions and are returned or deleted at the end of the engagement.

Bloodstock registers are often intended to last for generations, so a register may be retained far longer than an ordinary business record. In such cases the register is retained because it is the commercial memory of the breeding operation, and personal elements within it are kept securely and used only for the purposes of the register.

12. How We Protect Information

We take the security of bloodstock and personal records seriously. Access to systems is limited to the engineers and staff who need it for a specific task, and access is granted on the principle of least privilege. We use strong authentication, encrypted connections, regular backups and documented procedures for handling data.

We train our team on data protection and security, and we review our practices as the systems we build evolve. Where we process sensitive records, we apply additional controls such as restricted access and enhanced logging. We test our backups so that we can recover records if a failure occurs.

No system can be guaranteed completely secure, but we maintain an incident response process. If a breach occurs that is likely to result in a risk to individuals, we will notify the relevant regulator and the affected individuals without undue delay, in line with our legal duties.

13. Your Rights and How to Exercise Them

Depending on your circumstances and the law that applies, you may have the right to be informed about how your information is used, to access a copy of it, to have inaccurate information corrected, to have information erased, to restrict or object to certain processing, to receive information in a portable format, and to withdraw consent where consent is the basis for processing.

You can exercise any of these rights by writing to us at media@cswbloodstock.lol or by post to the Data Protection Team at 70 Westerleigh Road, Yate, Bristol - BS37 4BN, United Kingdom (GB). Please tell us clearly what you would like us to do and provide enough information for us to identify you and the relevant records.

We will respond within the period required by law, normally within one month. If a request is complex or if we receive several requests, we may extend that period and we will tell you if we do. There is normally no charge for exercising your rights, but we may charge a reasonable fee if a request is manifestly unfounded or excessive.

If we process your information on behalf of a breeding operation, your request may need to be directed to that operation as controller. We will tell you if this is the case and we will assist the controller in responding.

14. Privacy for Children

Our website and our services are intended for businesses and adults working in the bloodstock and stud farm sector. We do not knowingly collect personal information from children, and we do not direct any part of this website at children.

If a bloodstock register that we build or migrate happens to contain information about a young person, for example in a family ownership record, we treat that information with the same care as any other record and we keep it only as part of the register. If you believe that we hold information about a child and you are concerned about it, please contact us and we will investigate promptly.

Where we become aware that we have collected information from a child without an appropriate basis, we will take steps to delete it, unless we are required to keep it by law or as part of a register that the controller must maintain.

15. Marketing and Direct Communication

We do not operate an aggressive marketing programme. We may contact existing clients and enquirers about services that are relevant to a conversation we have already had, and we may send occasional updates about our services to those who have asked to receive them.

Where we send marketing communications by electronic means, we do so in line with the rules that apply in the United Kingdom, including providing a clear way to opt out in every message. You can ask us to stop contacting you for marketing at any time by writing to media@cswbloodstock.lol.

We do not use the personal information held inside a client register for our own marketing. That information belongs to the client and is used only for the purposes of the engagement.

16. Automated Decisions and Profiling

We do not make decisions about individuals using solely automated means in a way that produces legal or similarly significant effects. The pedigree analytics we provide are tools for breeding and commercial judgement, and their outputs are always explained and always reviewed by people.

Where analytics produce a figure such as an inbreeding coefficient or a trend across a produce record, that figure relates to animals and to breeding decisions rather than to decisions about people. Any personal information that appears in such analysis is incidental to the breeding record and is not used to profile individuals.

If we ever introduce a feature that involves automated decision making about individuals, we will describe it in this policy before it is used, and we will provide a means to request human intervention where the law requires it.

17. Changes to This Privacy Policy

We review this policy regularly and we update it when our practices, our systems or the law change. When we make a material change, we will update the version number and the date at the top of the page, and where the change is significant we will take reasonable steps to bring it to the attention of those it affects.

The current version of this policy is always the one published on this website. We encourage you to return to this page from time to time if you wish to check how we handle information. Continued use of our website or services after an update indicates that you accept the revised policy.

We keep previous versions available internally so that we can explain how our practices have changed over time. If you would like to see a previous version, you may request it from the Data Protection Team.

18. How to Make a Complaint

If you are unhappy with how we have handled your information, please tell us first so that we have the chance to put it right. You can write to the Data Protection Team at media@cswbloodstock.lol or by post to 70 Westerleigh Road, Yate, Bristol - BS37 4BN, United Kingdom (GB). We will acknowledge your complaint, investigate it and respond within the period required by law.

If you remain dissatisfied after our response, you have the right to complain to the Information Commissioner, which is the data protection regulator for the United Kingdom. You can contact the Commissioner through the official channels published by that office. We will cooperate fully with any such investigation.

If you are located outside the United Kingdom, you may also have the right to complain to a regulator in your own country. We will respect any such process and provide the information needed to resolve the matter fairly.