Privacy policy

2. Information we handle

Depending on how you take part in an event, we may collect and hold:

• Account and contact details, such as your name, email address, account role, invitation and assignment details, and securely hashed authentication credentials.
• Event and entry details, such as event, class and arena information, draw order, rider and horse names and identifiers, entry status, and organiser details.
• Scoring and official records, including marks, comments, digital ink annotations, deductions, submission status, verification history, results, rankings, and generated score sheets.
• Technical and security information, such as IP address, device or browser type, user agent, session and access-token information, request details, timestamps, and audit and diagnostic logs.
• Communications you send us, including support requests, privacy enquiries, and related correspondence.

Young participants

TallyTrot does not routinely collect dates of birth, so we may not know whether an account holder, rider, or other participant is under 18. Competition information may relate to young participants and is generally provided by an event organiser, uploaded file, or connected system rather than by the participant directly.

A person’s ability to make their own privacy decisions depends on whether they understand what is involved. If we become aware that an account holder may not understand TallyTrot or their privacy choices, we may request confirmation from a parent, guardian, or authorised event organiser and restrict account access while that confirmation is obtained.

A participant, parent, or guardian may contact us about a young participant’s personal information using the details in section 9.

3. How we collect information

We collect information directly from you when you create an account, accept an invitation, manage an event, score a test, publish a result, or contact us. We also collect information:

• from event organisers, scoring-office staff, judges, and other authorised users;
• from connected entry, event-management, scoring, and results systems, including Global Entries Online (GEO), or from files uploaded by authorised users;
• automatically when you use TallyTrot, through essential cookies, application logs, security controls, and similar technologies; and
• from the TallyTrot mobile app when locally saved scoring data synchronises with the service.

Anyone who imports or transfers information to TallyTrot must be authorised to do so and must provide any privacy notices or obtain any consents required for that transfer, including where information concerns a young participant. Required notices should explain that TallyTrot receives and processes the information and that event details or results may be publicly displayed if an authorised organiser enables publication.

If required information is not provided, we may not be able to create an account, connect you to an event, process a score, or provide the requested feature.

Dealing with us anonymously

You can browse public live results and general pages on our website without telling us who you are. For most other activities it is not practicable to deal with us anonymously or under a pseudonym, because entries, judging, and official scoring records must be accurately attributable to a named person or horse to be valid.

4. How we use information

We use personal information to:

• create and secure accounts, authenticate users, and manage roles and permissions;
• import and manage events, entries, judge assignments, invitations, scoring, verification, publication, and official records;
• operate offline scoring and synchronise authorised data across devices;
• send communications reasonably connected with TallyTrot and the services you use;
• provide help, investigate problems, prevent misuse, maintain audit records, and protect TallyTrot and its users;
• comply with legal obligations and resolve disputes; and
• understand and improve the reliability, accessibility, and performance of the service.

We do not sell personal information or use it for targeted advertising.

Emails and other communications

We may use your email address to send communications reasonably connected with your use of TallyTrot, your account, or events in which you are involved. Communications may be sent by TallyTrot or on behalf of an authorised event organiser.

We do not send promotional or marketing email unless you have asked to receive it. If we do, the message will explain how to unsubscribe, and you can also opt out using the contact details in section 9. Opting out of marketing does not prevent us from sending communications needed to provide or secure the service.

5. Sharing and publicity

We disclose personal information only as reasonably needed for the purposes described in this policy, including to:

• authorised event users, such as organisers, scoring-office staff, and assigned judges, according to their permissions;
• connected event, entry, scoring, and results systems, including GEO, when an authorised user connects an event, imports information, or enables result delivery;
• service providers that support hosting, databases, storage, backups, email delivery, security, and technical operations;
• professional advisers, regulators, law enforcement, courts, or other parties where required or authorised by law, or where reasonably necessary to protect rights and safety; and
• a successor or transaction adviser in connection with a proposed or completed sale, restructure, or transfer of the service, subject to appropriate confidentiality safeguards.

Overseas processing

We host the TallyTrot application, database, and file storage in Australia. Some supporting providers may store or process information overseas — most commonly in the United States, and in some cases in Singapore, the European Union, or the United Kingdom — for services such as email delivery, error monitoring, and technical support tooling.

Before disclosing personal information to an overseas recipient we take steps that are reasonable in the circumstances to ensure it is handled consistently with the Australian Privacy Principles, including using reputable providers and contractual data-protection terms. Provider locations can change, so contact us if you would like current information about the countries relevant to your data.

6. Cookies and devices

The website uses essential cookies and similar local storage to keep you signed in, protect forms and sessions, remember security state, and provide requested features. Blocking these technologies may prevent parts of TallyTrot from working.

The mobile app can save assigned event and scoring information on your device so you can work without a reliable internet connection. That information synchronises when a connection becomes available. Protect your device with its available passcode, biometric, and remote-lock features, and sign out when the device is no longer under your control.

7. Storage, retention, and security

We use administrative, technical, and physical safeguards designed to protect information from loss, interference, misuse, and unauthorised access, modification, or disclosure. These include role-based access, authentication controls, encrypted network connections, private storage, audit logging, backups, and operational monitoring. No system is completely secure, so please contact us promptly if you suspect unauthorised access to your account.

Data breaches

If we suspect a data breach affecting personal information, we will contain it, assess it promptly, and take steps to reduce the risk of harm. Where a breach is likely to result in serious harm and we cannot remediate it in time, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). Where the breach involves information an event organiser provided to us, we will also notify that organiser so they can meet their own obligations.

How long we keep information

We retain information for as long as it is needed to provide the service, maintain competition and official scoring records, meet legal and accounting obligations, resolve disputes, and protect the service. Our target retention periods are:

• Event, entry, scoring, and result records — retained as ongoing competition records for at least 7 years after the event, so results can be verified, corrected, and audited.
• Account records — retained while the account is active, and for up to 12 months after it is closed.
• Audit logs — retained in the active audit log for 12 months, then moved to restricted archive storage pending permanent deletion under our retention schedule.
• Technical and diagnostic logs — retained for up to 12 months.
• Backups — retained on a rolling cycle of up to 90 days, after which they are overwritten or destroyed.
• Support and privacy correspondence — retained for up to 7 years.

We are implementing automated deletion controls for these target periods. Until that work is complete, some records may be retained for longer where required for operational, legal, backup, archival, or legitimate record-keeping purposes.

When information is no longer required, we take reasonable steps to delete or de-identify it, subject to legal, backup, archival, and legitimate record-keeping requirements.

8. Access, correction, and your choices

You may ask to access personal information we hold about you, correct information that is inaccurate, out of date, incomplete, irrelevant, or misleading, or request deletion where appropriate. Email admin@tallytrot.com with enough information for us to identify you and the relevant record.

We may need to verify your identity. In some circumstances, the law permits or requires us to refuse a request or retain information. If that happens, we will explain our decision and the available complaint options where required. We do not charge for making an access or correction request, although the law may permit a reasonable charge for providing access in some circumstances.

9. Questions and privacy complaints

For a privacy question, request, or complaint, email:

Please describe what happened and include any relevant dates or records. We will acknowledge your complaint, investigate it fairly, and aim to respond within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

You may also ask for a copy of this policy in an alternative accessible format.

10. Changes to this policy

We may update this policy when our practices, services, or legal obligations change. We will publish the revised policy here and update the effective date. If a change materially affects how we handle personal information, we will take reasonable steps to provide additional notice.