This notice explains what information The Riding Kid Club collects when a family registers, why we collect it, where it's stored, and what rights you have over it. We collect and hold this information in accordance with the Privacy Act 2020 and its 13 Information Privacy Principles (IPPs).
What we collect
If you register as a member:
- Parent or guardian's name, email address, and mobile number
- Child's name, date of birth, and gender
- Membership type and how you heard about the club
- Any additional comments you choose to add on the registration form
If you request a pony ride event booking:
- Your name, organisation/business name (if applicable), email, and phone number
- The event address, date, time, expected number of attendees, and type of event
- Details about the space available (surface type, size) so we can plan the ponies and equipment needed
- Any comments you add on the booking form
Why we collect it
For registrations: to register your family as a member, assign a membership number, run our RK$ rewards programme, contact you about events and club news, and make sure activities are suitable for your child's age.
For booking requests: to assess whether we can support your event, quote and plan appropriately (ponies, staff, equipment), and contact you to confirm arrangements. We don't use either form's information for anything else, and we don't sell or rent it to anyone.
Where it's stored
Your information is stored in a private, access-restricted database hosted by Supabase (in a Sydney, Australia data centre), and event/email notifications are sent via Resend, an email delivery service. Both of these are international cloud providers, which means your information may be processed or stored on servers outside New Zealand rather than exclusively within NZ borders — though Sydney is the closest available hosting region to New Zealand.
Under IPP 12 of the Privacy Act 2020, we only disclose personal information overseas like this with your consent (which you give by checking the consent box on the registration form), or where the receiving organisation is required to protect the information in a way that provides comparable safeguards to the Privacy Act. The database itself is also locked down with database-level access rules so that only the club's own website functions can read or write it — not just anyone with a login to the hosting provider. Both Supabase and Resend maintain their own privacy and security programmes; you can read their policies at supabase.com/privacy and resend.com/legal/privacy-policy.
Who can access it
Only the club owner has access to the database holding member records. We don't grant broad or "anyone with the link" access, and we review who has access periodically. Each member's digital card is only viewable via a private, hard-to-guess link sent to the email address you registered with — not a guessable member number.
How long we keep it
We keep member records for as long as your family is an active member, and for a reasonable period afterwards in case you rejoin or for record-keeping purposes. If you'd like your family's information deleted sooner, contact us using the details below and we'll remove it, unless we're legally required to keep any part of it.
Your rights
Under the Privacy Act 2020, you have the right to:
- Ask what information we hold about your family and get a copy of it
- Ask us to correct anything that's wrong or out of date
- Ask us to delete your information (see above)
- Withdraw consent for us to hold your information going forward
To do any of these, or if you have any question about this notice, contact us at ingoodtimehorsepark@xtra.co.nz.
Consent, in plain terms
When you check the consent box on our registration form or our booking form, you're confirming that you've read this notice and agree to us collecting, storing (including via the overseas providers named above), and using your information as described here.