Privacy Policy
We take your privacy seriously. This policy explains what personal data we collect when you use our website, why we collect it, how we use it, who we share it with and the rights you have over it.
We are established in the United Kingdom and this policy is written first to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Because we welcome readers from around the world, it is also written to comply with the EU GDPR, the Australian Privacy Act 1988, the New Zealand Privacy Act 2020, Brazil's Lei Geral de Proteção de Dados (LGPD), the UAE Personal Data Protection Law, Qatar's Law No. 13 of 2016 and the privacy laws of US states such as California, in each case where they apply to you. Section 10 sets out what is specific to your jurisdiction.
1. WHO WE ARE¶
The controller of your personal data is Alvará – The College of Working Equitation Ltd, a company registered in England and Wales with company number 17384770, whose registered office is at Suite 41, 792 Wilmslow Road, Didsbury, Manchester, United Kingdom, M20 6UG ("we", "us", "our", "the College").
We operate alvara.com, www.alvara.com and their subdomains ("our website"). "You" means any visitor to or user of our website.
Personal data (also called personal information) means any information that identifies you, such as your name or email address, or that could be used, alone or with other information, to identify you.
Questions and requests about your personal data should be sent to [email protected].
2. BROWSING ANONYMOUSLY¶
You can read every public page of our website, including the whole of the Library, without giving us any personal data. Our server logs and, if you consent to them, our analytics cookies will collect some technical data as described in sections 3 and 5, but we do not use it to identify you.
We begin to collect personal data that identifies you only when you choose to give it to us — at present, by writing to the Registrar's Office through the form on our contact page.
3. WHAT WE COLLECT, WHY, AND ON WHAT BASIS¶
We collect the minimum data we need for each purpose.
3.1 When you write to the Registrar's Office¶
Our website carries one form. It is voluntary, and you choose what you tell us.
Whatever you are writing about, we ask for:
- your first and last name;
- your email address;
- the country you live in; and
- a telephone number, if you wish to give one — this is optional.
What else we ask depends on what you are writing about. If you are registering your interest in the December intake, or writing about the Residencies or the Instructor Licence, we also ask about your involvement in working equitation, your experience of it, and — for the intake — which Membership you would prefer. If you are writing as a journalist or broadcaster we ask which publication or channel you represent and whether you are working to a deadline. Every form invites you to tell us in your own words what you are writing about.
We use all of this to answer you, and to direct your enquiry to the right desk within the College. Our legal basis is our legitimate interest in responding to people who write to us and, where you are registering interest in an intake, in building the College's membership.
Writing to us does not add you to a mailing list. The form carries no marketing opt-in and we do not treat it as one. We will answer what you wrote about, and if we later want to send you anything else we will ask for your consent first.
3.2 If you begin the form and do not finish it¶
Registering interest in the December intake, and enquiries about the Residencies and the Instructor Licence, are asked over two pages. What you enter on the first page is saved when you press Continue, before you reach the second.
We do this so the College can see where people stop, and improve the form. Our legal basis is our legitimate interest in understanding how our own website is used.
If you never complete the second page, what you entered is kept for 60 days and then deleted. We do not write to you about a form you did not finish.
3.2 When you email us directly¶
If you write to us by email rather than through a form, we keep your email, and our reply, for as long as is needed to deal with your enquiry and for our records afterwards. Our legal basis is our legitimate interest in corresponding with people who write to us.
3.3 Technical data¶
When you visit our website our servers and the services in front of them automatically record technical data, including your IP address, the pages you request, the date and time of each request, the address of the page that referred you, and your browser type and version. We use this to operate and secure our website, to detect and prevent abuse, and to diagnose faults. Our legal basis is our legitimate interest in running a secure and reliable website. Server logs are kept for a short period and then deleted.
3.4 Analytics¶
If — and only if — you consent through our cookie banner, we use Google Analytics 4 to understand how our website is used: which pages are read, from where, on what devices, and for how long. IP addresses are truncated by Google before being stored. We use this data in aggregate to improve our website. Our legal basis is your consent, which you may withdraw at any time through Cookie Settings in the footer of every page. See our Cookie Policy for the full detail.
3.5 Where the College publishes a person's name¶
Our website names the College's Fellows and describes their standing. That information is published with their consent and for the purpose of identifying them and their place in the College. If you are a Fellow and wish to change or withdraw anything published about you, write to us at [email protected].
3.6 What we do not collect¶
We do not currently collect payment details, dates of birth, phone numbers, postal addresses, or any special category of personal data such as health information. We do not take payments on our website. If that changes, we will update this policy before we do so.
4. HOW WE SHARE YOUR DATA¶
We do not sell your personal data, and we do not share it with advertisers. We share it only with the service providers who help us run our website and our business, each of whom acts on our instructions, and only to the extent needed for their function:
| Provider | Function | Location |
|---|---|---|
| OVHcloud | Hosting and storage of our website and its files | European Union (France) |
| Cloudflare, Inc. | Network security and content delivery in front of our website | Global; may process data outside the UK and EU |
| Ontraport, Inc. | Our customer-relationship and email system, which holds the details you give us in either of our website's forms and sends our updates | United States |
| Google LLC | Analytics (with your consent), reCAPTCHA, web fonts, and our business email | United States and other locations |
We may also disclose personal data where the law requires it; to our professional advisers where needed to obtain advice or to meet our legal, accounting or compliance obligations; and to a buyer or successor if the College or its business is sold, merged or reorganised, in which case we will require them to honour this policy.
5. COOKIES AND SIMILAR TECHNOLOGIES¶
Our website uses a small number of cookies. Essential cookies are set without your consent because the website cannot work without them. Functional and analytics cookies are set only if you accept them through our cookie banner, and nothing is pre-ticked. You can change your choice at any time through Cookie Settings in the footer.
Our Cookie Policy lists every cookie we use, what it does and how long it lasts.
6. INTERNATIONAL TRANSFERS¶
We are in the United Kingdom and our website is hosted in the European Union. Some of the providers listed in section 4 process data in the United States or elsewhere. Where personal data leaves the UK or the European Economic Area, we make sure it is protected by an adequacy decision (such as the UK–US Data Bridge or the EU–US Data Privacy Framework, where the provider is certified under them) or by the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, together with any further safeguards that are appropriate. You may ask us for details of the safeguards used.
If you are outside the United Kingdom, your personal data will be transferred to and processed in the United Kingdom and the European Union, whose data-protection laws may differ from those of your own country. By providing us with your data you acknowledge that transfer, and we will protect the data in accordance with this policy wherever it is processed.
7. HOW LONG WE KEEP YOUR DATA¶
| What | How long |
|---|---|
| An enquiry or registration you completed | 2 years from the day you sent it |
| A form you began and did not finish | 60 days from when you last touched it |
| Your Member account and College Record | For as long as you are a Member, and then as our Register Rules require |
We delete what we no longer need. Where a longer period is required of us by law — tax and accounting records, for example — we keep only what that law requires and only for as long as it requires it.
8. SECURITY¶
We protect your personal data with technical and organisational measures appropriate to the risk. Our website is served only over encrypted connections. Our hosting and storage providers operate secure data centres with industry-standard controls. Access to personal data inside the College is limited to those who need it.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you are not comfortable with this, please do not provide us with your personal data; if you already have and wish it deleted, write to us.
If a breach of security affecting your personal data occurs, we will notify you and the relevant supervisory authority where the law requires us to.
9. CHILDREN¶
Our website is intended for people aged 16 and over, and we do not knowingly collect personal data from anyone under 16. If you are the parent or guardian of a child under 16 and believe they have given us personal data, please write to us at [email protected] and we will delete it.
10. YOUR RIGHTS¶
Depending on where you live, you have some or all of the following rights over your personal data:
- to be told what personal data we hold about you and to receive a copy of it;
- to have inaccurate or incomplete data corrected;
- to have your data deleted, in circumstances where we have no continuing lawful reason to keep it;
- to restrict or object to our processing of it, including to object at any time to direct marketing;
- to receive the data you gave us in a structured, machine-readable format and to have it transmitted to another controller;
- to withdraw consent at any time where consent is our legal basis, without affecting the lawfulness of what was done before you withdrew it;
- not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (we make no such decisions); and
- to complain to a supervisory authority.
To exercise any of these rights, write to [email protected]. We may ask you to confirm your identity before acting. We will respond within one month, or sooner where your local law requires it, and we will not charge you unless a request is manifestly unfounded or excessive.
If you ask us to delete your data, we will remove it from our live systems promptly; it may persist in encrypted backups for a limited period until those backups are overwritten in the ordinary cycle.
11. JURISDICTION-SPECIFIC INFORMATION¶
United Kingdom. Our supervisory authority is the Information Commissioner's Office, ico.org.uk, which you may contact if you are unhappy with how we have handled your data or your request. We would welcome the chance to address your concern first.
European Union and EEA. You may complain to the supervisory authority of the member state where you live, work or where the alleged infringement occurred. A list is at edpb.europa.eu.
Australia. We handle your personal information in accordance with the Australian Privacy Principles. You may complain to us and, if you are not satisfied with our response, to the Office of the Australian Information Commissioner, oaic.gov.au. Your information is held overseas, in the United Kingdom, the European Union and the United States, as described in sections 4 and 6.
New Zealand. We handle your personal information in accordance with the Information Privacy Principles of the Privacy Act 2020. You have the right to access and correct your information, and may complain to the Office of the Privacy Commissioner, privacy.org.nz.
Brazil. Under the LGPD you have the rights listed in section 9, including the right to confirmation that we process your data, to anonymisation, and to information about the entities with which we share it. Our legal bases correspond to consent and legitimate interest under Article 7 of the LGPD. You may complain to the Autoridade Nacional de Proteção de Dados (ANPD). Questions may be addressed to our data-protection contact at [email protected].
United States. If you are a resident of California or another state with a comprehensive privacy law, you have rights to know, access, correct and delete your personal information and to opt out of its sale or sharing. We do not sell your personal information and we do not share it for cross-context behavioural advertising. The categories of personal information we collect are identifiers (name, email address, IP address), internet activity (pages visited, with your consent) and the content of the messages you send us, for the purposes and with the recipients described in sections 3 and 4. We will not discriminate against you for exercising your rights. You may use an authorised agent to make a request on your behalf.
United Arab Emirates and Qatar. We process your personal data in accordance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and Qatar's Law No. 13 of 2016 on Personal Data Privacy Protection, as they apply to us. Your data is transferred to and processed in the United Kingdom and the European Union, whose laws provide protection comparable to those laws, and you have the rights set out in section 9.
12. LINKS TO OTHER WEBSITES¶
Our website may link to other websites. This policy does not cover them, and we are not responsible for their privacy practices. Please read their own policies.
13. CHANGES TO THIS POLICY¶
We review this policy regularly and will update it as our website and the law change. The current version is always published on this page, and the version number and date at its foot tell you when it last changed. Where a change is significant and we hold your email address, we will tell you by email.
14. CONTACT¶
Alvará – The College of Working Equitation Ltd Suite 41, 792 Wilmslow Road, Didsbury, Manchester, United Kingdom, M20 6UG [email protected]
Version 1.0 — published 9 September 2026.