What personal data does your yard hold?
Compliance starts with an inventory: you can't protect data if you don't know what you hold, where and about whom. A horse is not a person, but as soon as a horse's record is linked to its owner's name, phone number and invoices, it becomes a record containing personal data. On most yards the picture looks roughly like this.
| Whose data | Examples | Where it usually lives |
|---|---|---|
| Horse owners | Name, phone, email, address, billing and payment details, messages | Livery agreements, spreadsheets, phone contacts, WhatsApp |
| Staff (grooms, trainers, managers) | ID, contact details, payroll, leave, medical certificates | Accounts, personnel files, email |
| Riders and pupils | Name, age, parent or guardian details, health declaration | Registration forms, group chats |
| Outside contractors | Vet, farrier and transporter contact details | Calendar, phones |
| Visitors | CCTV footage, sign-in records | CCTV recorder |
Information such as a staff member's medical certificate or a rider's health declaration counts as special category data under GDPR (in KVKK, özel nitelikli kişisel veri) and is subject to stricter rules. Pay particular attention to who can see it.
Key concepts: controller, processor and lawful basis
In the EU the General Data Protection Regulation (GDPR, Regulation 2016/679) applies; in Turkey it is the Personal Data Protection Law No. 6698, known as KVKK. If you are based in the EU or serve owners there, GDPR is likely to concern you; a Turkish yard falls under KVKK. The wording differs, but the core ideas are similar.
- Data controller: the party that decides why and how personal data is processed. For your owner and staff data, that is usually the yard itself.
- Data processor: a party that processes data on the controller's behalf and on its instructions, such as the cloud software or bookkeeping service you use. The relationship is expected to be governed by a written agreement.
- Lawful basis: every processing activity needs one. Where performance of a contract (an owner's contact details for a livery agreement), a legal obligation (invoice records) or legitimate interests apply, you don't need separate consent for everything.
- Consent (explicit consent in KVKK): needed where no other basis applies; it must be specific, informed and freely given. Using a photo of an owner with their horse in your marketing is a typical example.
Privacy notices and data minimisation
People whose data you collect must be told who you are, why and on what basis you process their data, who you may share it with and what their rights are. GDPR calls this a privacy notice; KVKK calls it the duty to inform (aydınlatma metni). In practice, adding a short, plain-language notice to the livery agreement, staff onboarding paperwork and rider registration form is a good start.
Don't merge the privacy notice and a consent request into one document; they do different jobs. And keep asking one question: do I actually need this? If you don't need an owner's ID number or a groom's full medical history, don't collect it. Data you never collected is data you can't lose.
Access control, devices and WhatsApp
Data leaks on yards rarely come from sophisticated attacks. They come from everyday habits: one password everyone knows, an account a former employee can still open, a lost phone. A groom has no need to see an owner's billing details; limiting access by role improves both security and order.
Basic data security checklist for a yard
- A personal data inventory exists: what data, where, who can access it.
- Everyone has their own account; no shared passwords.
- Access is limited by role (groom, trainer, bookkeeping, manager).
- Leavers lose access on the day they leave.
- Phones and computers have a screen lock and an up-to-date operating system.
- Two-step verification is switched on wherever it is available.
- Agreements, registration forms and onboarding paperwork include a privacy notice.
- Data processing agreements are in place with your software providers.
- Retention periods are defined and expired data is deleted.
- It is clear who does what in a data breach or a data subject request.
Retention periods and data subject requests
Personal data should be kept only as long as it is needed for the purpose it was collected for. Holding the contact details of an owner who left years ago indefinitely doesn't fit that principle, although tax and accounting rules may require you to keep invoice records for a set period. Agree the period for each type of record with your lawyer or accountant and write it down.
Owners and staff have the right to ask what data you hold about them and to request correction or deletion. Under GDPR you generally have one month to respond; KVKK sets a maximum of thirty days. Deciding in advance who handles these requests stops them from turning into a scramble.
In Turkey, some businesses must also register with the data controllers' registry, VERBİS. Exemptions exist based on headcount, annual balance sheet and main line of business, so check whether it applies to you.
If something goes wrong
A lost phone, a list of invoices emailed to the wrong person or a compromised email account can all count as a personal data breach. GDPR requires notifiable breaches to be reported to the supervisory authority within 72 hours of becoming aware of them; KVKK expects notification to the Board without delay, which the Board has interpreted as within 72 hours. That is a short window, so know your steps in advance.
- Record what happened: what, when it was noticed, which data was affected.
- Contain it: change passwords, lock the device remotely, close access.
- Tell your lawyer or data protection officer straight away.
- Decide together whether notification is required and how affected people will be informed.
How Equ Crm supports this
With Equ Crm, the yard is the data controller and Equ Crm acts as data processor. Data is hosted in the EU (Ireland) and connections are encrypted. With roles and permissions you grant view, add and edit rights per role and module, and limit people to specific locations or horses; important actions are kept in an access log. A vet working with several yards uses one account, while each yard's data is kept separate at database level.
Messages and approvals with owners stay tied to the horse in the horse owner portal instead of scattering across personal phones. When you need to share a report externally, you can use time-limited share links, and accounts can be deleted from within the app. If you are a Turkish yard, we recommend reviewing with your own legal adviser what EU hosting means under KVKK's rules on transfers abroad. For common security questions, see our FAQ.
Summary
Data security on a yard is not a big IT project. It comes down to knowing what you hold, collecting only what you need, limiting access by role, deleting what has expired and deciding in advance what to do on a bad day. These habits lower your legal risk and strengthen the trust owners place in you. For the details, always get support from a legal professional.
