Children's data statement

Many of the riders who book lessons through Cavaliq are children — sometimes very young. We’ve built the platform around that reality, with a deliberately conservative approach to minors’ data. This page explains the principles we follow; the legal detail is in the privacy policy.

1. Age thresholds we follow

• Under 13: we do not knowingly accept any direct sign-up. If we learn that a child under 13 has a direct account, we will remove it. A parent or guardian can register on the child’s behalf and add the child as a rider on the parent’s account.
• 13 to 16: a parent or guardian creates and manages the account. The child does not have direct sign-in access of their own.
• 16 and older: can create and manage their own account, with parental oversight available where requested.

2. The parent is in control

When a parent or guardian creates the account:

• They are the contractual end-user under the end-user terms.
• They book and pay for lessons on the child’s behalf.
• They consent to and manage the child’s rider profile, including any medical notes.
• They can update, correct, or delete the child’s data at any time from the in-app profile or by emailing info@cavaliq.com.

3. What we don’t do with children’s data

• We don’t use children’s data for marketing.
• We don’t build behavioural profiles of children.
• We don’t share children’s data with advertising or analytics networks.
• We don’t apply automated decision-making to children. Horse-matching suggestions are offered to coaches; the coach makes the final call.

4. Medical notes about a child

A parent may choose to add medical notes (allergies, asthma, conditions, etc.) to a child’s rider profile so that the club’s coaches and staff can keep the child safe. These notes:

• Are encrypted at rest;
• Are visible only to authorised club staff with a role that needs to see them;
• Are never used for any purpose other than rider safety;
• Can be edited or deleted by the parent at any time.

5. The club’s responsibility

The club is the data controller of children’s rider data once it’s in the platform. The club is responsible for:

• Only collecting the data it actually needs;
• Limiting staff access to those who need it for the child’s safety;
• Acting promptly on parental requests for access, correction, or deletion;
• Notifying the parent (and Cavaliq) of any data incident.

Cavaliq provides the tools (role-based access, audit logging, encryption) and the contract (DPA) to support the club in meeting these obligations.

6. Contact

If you are a parent or guardian and you want to access, correct, or delete data about your child, write to info@cavaliq.com. We will verify that you are the parent or guardian before fulfilling the request.