Privacy Policy
Last updated: May 2026
This is the plain-English version of how we handle your data at YardOS. We wrote it for actual humans — yard owners, staff, and horse owners — not lawyers. We comply with the UK GDPR and the Data Protection Act 2018.
Who we are
Nondela Ltd. ("we", "us"), trading as YardOS, is the data controller for the personal data we collect about you (our customers). We are a company registered in England and Wales (company number 14946040). You can reach us at info@yardos.co.uk.
When yard administrators use YardOS to store and manage personal data about their horse owners, riders, and staff, the yard administrator is the data controller and Nondela Ltd. is the data processor acting on their instructions. Our obligations as processor are set out in our Data Processing Agreement.
What we collect and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Name, email, password (hashed) | Create and manage your account | Contract (Art. 6(1)(b)) |
| Yard data (horses, owners, tasks, bookings, invoices) | Provide the YardOS service | Contract (Art. 6(1)(b)) |
| Payment method and billing history | Process payments and manage subscriptions | Contract (Art. 6(1)(b)) |
| Emergency contact details | Yard safety — stored at your instruction as a yard member | Legitimate interest (Art. 6(1)(f)) |
| Anonymised usage data | Improve YardOS features and performance | Legitimate interest (Art. 6(1)(f)) |
| Support emails | Respond to your questions | Legitimate interest (Art. 6(1)(f)) |
Card details are handled directly by Stripe — we never see or store them.
What we do NOT do
- We do not sell your data. Ever. To anyone.
- We do not use your data to train AI models.
- We do not run advertising on YardOS, and we do not allow anyone else to.
- We do not share your data between yards. Each yard's data is isolated.
How long we keep your data
- Active accounts. For as long as your account is active.
- After cancellation. 90 days to allow you to resubscribe and recover your data, then permanently deleted.
- Billing records. 7 years after the transaction, as required by UK tax law (HMRC).
- Support emails. 2 years from the date of the last message in the thread.
- Backups. Encrypted backups are retained for 30 days and then automatically destroyed.
Where your data lives
YardOS data is stored on cloud infrastructure in the European Union. All data is encrypted at rest (AES-256) and in transit (TLS 1.2+).
International transfers
Some of our sub-processors operate outside the UK and EEA. Where data is transferred internationally, we ensure appropriate safeguards are in place through the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses (SCCs) with the UK Addendum, or transfers to countries with an adequacy decision from the UK Secretary of State.
Who we share data with
We use a small number of trusted suppliers, each bound by a data processing agreement:
- Stripe — payment processing (US, with SCCs).
- Cloud infrastructure provider — hosting, database, and storage (EU regions).
- Transactional email provider — sending system emails such as invoices and password resets (US, with SCCs).
We never share your data with third parties for marketing purposes. A full sub-processor list is available on request by emailing info@yardos.co.uk.
Your rights under UK GDPR
- Access. Request a copy of all your personal data.
- Correction. Ask us to correct anything that's wrong.
- Deletion. Ask us to delete your account and all associated data.
- Portability. Export your data as CSV at any time from inside YardOS.
- Restriction. Ask us to restrict processing in certain circumstances.
- Objection. Object to processing based on legitimate interest.
Email info@yardos.co.uk and we'll respond within 30 days, usually much sooner. There is no fee for exercising your rights.
Cookies
We only use strictly necessary cookies — to keep you logged in and remember your session preferences. No analytics cookies, no advertising cookies, no consent banner needed.
Children
YardOS accounts are only available to individuals aged 18 or older (see our Terms of Service). We do not knowingly collect personal data from anyone under 18. Yard administrators who add information about riders under 18 (e.g. for lesson bookings) do so in their capacity as data controller and are responsible for obtaining appropriate parental consent.
Complaints
If you're unhappy with how we handle your data, please tell us first so we can fix it. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Changes to this policy
If we make material changes, we'll email everyone with an account at least 14 days before they take effect.