This notice explains how Saddle Stories handles personal information when you browse our website, contact us, subscribe to Sunday Stories, arrange a journey or purchase a digital product. It describes the services in use as at 11 October 2026.

Who is responsible for your information?

The controller is Julia Maria Borner, Individual Entrepreneur, trading as Saddle Stories, registered in Georgia. Our business address is Apartment N4, Building 80, Gldani estate, micro/district III, Tbilisi, 0167, Georgia. For privacy questions or requests, write to hello@saddle-stories.co. Our travel-enquiry WhatsApp number is +49 151 4130 6751.

Enquiries and journey planning

We process the information you choose to send us, such as your name, email address or phone number, travel dates, destination, group size, riding experience and the contents of your messages. We use it to answer your questions, assess suitable experiences, prepare an offer and manage the arrangements you request. We obtain this information from you or, where someone is arranging a journey on your behalf, from that person.

Providing information is voluntary, but we need sufficient contact and trip details to reply and arrange your journey. A brochure download does not, by itself, subscribe you to marketing. Digital product purchases use Payhip’s separate checkout. Please do not send card details through our enquiry forms, email or WhatsApp.

Where relevant to an agreed trip, we may need additional information for local hosts, horse allocation, accommodation or transport. Health or accessibility information can be particularly sensitive: please do not include medical documents in an initial enquiry. If such details are necessary, we will explain the purpose and intended recipients and request the consent or other authorisation required by applicable law before processing them.

Why we process information

Where the EU GDPR applies, we rely on steps you request before a contract and performance of the contract for enquiries and booking administration (Article 6(1)(b)); legal obligations for required business, tax and accounting records (Article 6(1)(c)); and our legitimate interests in operating a secure website, handling general correspondence and protecting legal claims (Article 6(1)(f)). These interests are balanced against your rights.

Newsletter subscriptions, the optional Instagram feed, website analytics and marketing measurement rely on the relevant permission you give and, where required, consent (Article 6(1)(a)). You can refuse optional website services without losing access to our journeys or contact options. If we need health information and rely on consent, we request explicit consent under Article 9(2)(a). Withdrawing consent does not affect processing that was lawful before withdrawal. Georgian data-protection law and any other applicable mandatory protections also apply.

Website hosting and security

Our website is hosted by Webflow, Inc. When pages, photographs or documents load, Webflow and its infrastructure providers receive technical information such as your IP address, requested resource, browser information and access time so they can deliver and protect the site. Forms handled by Webflow may also be processed in its systems. See Webflow’s Privacy Policy.

Digital products and Payhip checkout

Purchases and downloads of our digital guides, journals and planners are supplied through Payhip Limited. Selecting a purchase link takes you to Payhip. The checkout processes your email address, order and payment status, and any name or billing information you provide, alongside technical details such as your IP address and access records. We receive purchase information to support your order and keep required business records. Payhip provides the download page and emails your receipt and download link.

Payment is handled by PayPal; we do not receive your full card details or PayPal password. Payhip and PayPal explain their own processing, cookies, retention and international transfers in Payhip’s Privacy Policy and PayPal’s Privacy Statement. Purchase receipts and download messages are separate from our optional Sunday Stories newsletter.

Sunday Stories newsletter

We use Mailchimp, provided by The Rocket Science Group LLC, an Intuit company, to manage subscriptions and send newsletters. Our newsletter forms send your email address and any other fields you submit to Mailchimp. Subscription records can include your preferences, sign-up source and time, technical information, delivery status and unsubscribe status.

We send newsletters to people who subscribe or otherwise give the permission required by applicable law; making an enquiry or booking does not automatically enrol you. You can unsubscribe using the link in a newsletter or by emailing us. Mailchimp explains its own processing in its privacy information and publishes its data-processing terms.

Email and WhatsApp

You can contact us by email without using WhatsApp. Selecting a WhatsApp link opens a service operated by WhatsApp, part of Meta; its processing, including account and connection information, is governed by its own Privacy Policy. Once you send a message, we use the phone number, profile information visible to us and message contents to respond and manage your enquiry. A WhatsApp conversation does not subscribe you to our newsletter.

Optional Instagram feed

The homepage offers recent posts from our public Instagram account through Elfsight. This optional feed stays unloaded until you allow Instagram posts in our privacy controls. Permission causes your browser to contact Elfsight and the services used to display Instagram content; they receive technical connection information, including your IP address and browser details, and may use cookies or similar technologies. Allowing the feed does not give permission for our separate analytics or advertising tools.

Elfsight’s Privacy Policy describes its technical data and its view-count cookie, elfsight_viewed_recently. Instagram’s processing is described in Meta’s Privacy Policy. Opening a post or following our profile takes you to Instagram under its own terms and settings.

We remember your selection in this browser for up to 180 days, so an allowed feed can appear automatically on later visits. You can withdraw permission through “Privacy preferences” in the footer and save your new choice; the page reloads when needed to stop an already loaded service. This does not erase information already sent or third-party cookies, which you can manage through your browser. Declining the feed does not prevent you browsing our journeys or contacting us.

Saved stories and privacy preferences

If you save an article, its identifier is stored in your browser under saddle-stories-saved-articles-v1 to provide the favourites feature you requested. The saved list is not sent to us by this feature. You can remove individual favourites or clear this website’s local data in your browser.

Our privacy controls let you reject optional services or select them individually. Your choice, its time and the notice/configuration version are stored locally under ss-consent-v1 for up to 180 days; this preference does not contain your name or email address and is not itself sent to our analytics service. Clearing browser data, using another browser or a material change to available services can require a new choice. More detail is in our Cookie Policy.

Optional website analytics and marketing

Google Analytics and Meta Pixel are separate optional categories in Privacy preferences and run only after you allow the relevant category. If you allow Marketing, Meta receives website-visit and fixed click-event information, including the page address, browser and connection information, IP address and cookie identifiers, for measurement of Facebook and Instagram advertising. Meta may connect that activity with your account and process it under its own Privacy Policy. Our setup does not enable automatic advanced matching, automatic events or additional AI page and product details, and we do not send customer names, email addresses, telephone numbers, messages or form contents as event parameters. Mailchimp’s connected-site tracking remains disabled.

If you allow Analytics, Google Analytics 4 helps us understand visits to our website and which journeys people explore. Our setup keeps the Google analytics code unloaded until you give permission; rejecting Analytics prevents it from loading, including on later visits while that choice remains valid. Permission for Instagram posts is separate, and you can withdraw either choice through Privacy preferences.

With your analytics permission, our custom measurements record fixed categories when you click our WhatsApp or email contact link, the Zimbabwe or Greater Kruger journey link, or the Rider’s Journal checkout link. Those categories contain no names, email addresses, telephone numbers, messages, form contents or search terms. A click indicates interest; it does not confirm that a message was sent, a purchase completed or a newsletter subscription confirmed.

Analytics uses pseudonymous cookie identifiers and technical information about the browser, device and visit. Google receives connection information when its service loads and processes information under its own terms; this is not an anonymous service. We do not send customer contact details or form contents as analytics event parameters, and our setup does not enable Google signals or personalised advertising. You can read how Google uses information from sites that use its services and our Cookie Policy.

The Analytics property is configured to retain user-level and event-level data for two months, with the option to reset retention on new activity switched off. This setting does not determine how long aggregated reports are retained. Google signals and user-provided data collection are inactive, and detailed location and device data collection is disabled. These settings do not change the separate lifetime of your privacy-preference record or any browser cookie.

Recipients and international processing

We share relevant information only where needed for the purposes described: with local providers involved in your requested journey, our hosting and communication services, Mailchimp for subscriptions, Payhip and PayPal for the separate digital-product checkout, and professional advisers or public authorities where required by law or necessary for legal claims. Elfsight and Instagram receive connection information if you enable the feed; Google receives analytics information only if you allow Analytics, and Meta receives marketing-measurement information only if you allow Marketing. The information needed by a riding host may differ from that needed by an accommodation or transport provider. We do not sell your personal information.

Our business operates in Georgia. Hosting and communication services may process information in the United States and other countries, and local journey providers may be in your destination country, including Zimbabwe or South Africa. These countries may have different privacy laws from your own. Mailchimp and Webflow publish data-processing and international-transfer provisions in their service documentation. Contact us for information about the recipients, transfer arrangements and safeguards applicable to your particular enquiry or booking; a provider’s general policy does not replace any safeguards required for a specific transfer.

How long information is kept

We retain enquiry information for as long as needed to respond and manage the requested arrangements. Booking and transaction records may need to be retained longer for applicable accounting, tax, regulatory or limitation periods and the establishment or defence of legal claims. The relevant period depends on the record and the laws that apply to it.

Newsletter information is kept while your subscription remains active; limited suppression and consent records may be retained to respect an unsubscribe request and demonstrate how permission was obtained. Saved stories remain on your device until you remove them or clear browser data. The website privacy choice expires after up to 180 days. External providers apply their own retention periods to information for which they are responsible.

Your rights and choices

Subject to applicable law, you may request access, correction, erasure, restriction, objection or portability, and withdraw consent at any time. You can object to direct marketing at any time. We may need proportionate information to verify a request and will respond within the applicable legal deadline. Some records must be retained where a legal obligation or valid exemption applies.

You may complain to a competent supervisory authority without first contacting us. In Georgia, the State Audit Office carries out the personal-data protection supervisory functions under the current law; see sao.ge. Where the GDPR applies, you can also contact the supervisory authority in the EEA country of your habitual residence, workplace or the alleged infringement. We do not use solely automated decisions that produce legal or similarly significant effects in our journey-enquiry process.

Children, security and changes

Journey enquiries and newsletter subscriptions are intended to be made by adults. A parent or guardian should provide any information necessary to arrange a child’s participation. Please contact us if a child has provided information without appropriate parental involvement.

We use reasonable technical and organisational safeguards, restrict information to those who need it and ask you to avoid sending unnecessary sensitive information. No online communication system can be guaranteed completely secure. When our processing changes, we will update this notice and its date and provide additional notice where required.