Privacy Policy

Last Updated: March 18, 2026

SHOWS.dog Team (“we,” “our,” or “us”) operates the SHOWS.dog platform (including judges.dog and related subdomains). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Platform.

We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable EU data protection laws.

1. Data Controller

For data we collect directly from you as a Platform user:

Controller: SHOWS.dog Team
Address: [To be updated upon company registration]
Email: privacy@shows.dog
Registration No.: [To be updated upon company registration]

For data processed on behalf of Event Organizers (e.g., Exhibitor registration data), the Organizer is the Data Controller and we are the Data Processor. See Section 9 for details.

2. What Data We Collect

2.1 Data you provide directly

Data Category	Examples	Purpose
Account data	Name, email, password (hashed), country, city, address, phone	Account creation and management
Profile data	Handler status, judge credentials, kennel club affiliations	Platform features and matching
Dog data	Dog name, breed, pedigree number, date of birth, ownership records	Show registration and catalog generation
Registration data	Show entries, class selections, handler assignments	Event participation management
Organization data	Club name, address, VAT number, company code	Organizer account and invoicing
Communication data	Support requests, feedback messages	Customer support

2.2 Data we collect automatically

Data Category	Examples	Purpose
Usage data	Pages visited, features used, timestamps	Platform improvement and analytics
Technical data	IP address, browser type, device type, operating system	Security, debugging, and performance
Authentication data	Login timestamps, session tokens (in cookies)	Account security

2.3 Data we do NOT collect

Payment card details (handled by third-party payment processors)
Biometric data
Health data (beyond dog health records voluntarily provided)
Data from social media profiles (beyond OAuth login email)

3. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

Legal Basis	Applies To
Contract performance (Art. 6(1)(b))	Account creation, providing Platform features, managing registrations
Legitimate interest (Art. 6(1)(f))	Platform security, fraud prevention, service improvement, analytics
Legal obligation (Art. 6(1)(c))	Tax records, regulatory compliance, responding to legal requests
Consent (Art. 6(1)(a))	Marketing emails (opt-in only), non-essential cookies, Auto-Fill data sharing

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

4. How We Use Your Data

We use your personal data to:

Provide, maintain, and improve the Platform.
Create and manage your account.
Process show registrations and generate catalogs.
Send transactional emails (account verification, password reset, registration confirmations).
Ensure Platform security (fraud detection, abuse prevention, rate limiting).
Comply with legal obligations.
Respond to support requests.

We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling that produces legal effects.

5. Data Sharing

We share your personal data only in the following circumstances:

Recipient	Data Shared	Purpose
Event Organizers	Exhibitor name, dog details, registration data	Event management, catalog generation
Judges (via judges.dog)	Judge profile data (name, credentials, availability)	Judge assignment and booking
Payment processors	Transaction data (not card details)	Payment processing on behalf of Organizers
Infrastructure providers	Encrypted data in transit/at rest	Cloud hosting (Hetzner, Germany), email delivery
Legal authorities	As required by law	Compliance with legal obligations or court orders

We require all third-party processors to maintain appropriate security measures and process data only according to our instructions.

5.1 Auto-Fill Data Sharing (Opt-In)

The Platform offers an optional Auto-Fill feature that allows Organizers to look up Exhibitor and dog data by microchip number during manual registration. This feature:

Is disabled by default and requires the Exhibitor to explicitly opt in via account settings.
Is based on consent (GDPR Art. 6(1)(a)) — the Exhibitor voluntarily chooses to make their data available.
Can be revoked at any time by disabling the feature in account settings, which immediately stops future data lookups.

When Auto-Fill is enabled, the following data may be retrieved by Organizers:

Data	Shared Via Auto-Fill
Exhibitor name, contact details	Yes (if opt-in enabled)
Dog name, breed, pedigree number, microchip, sire, dam	Yes (if opt-in enabled)
Account credentials, password	Never
Financial data	Never

SHOWS.dog acts solely as a technical intermediary for Auto-Fill data sharing. The decision to share data rests entirely with the Exhibitor. Once data is retrieved by an Organizer, the Organizer is responsible for its use and compliance with data protection laws. SHOWS.dog bears no responsibility for the subsequent use of data obtained through this feature.

6. International Data Transfers

Your data is stored and processed within the European Economic Area (EEA). Our servers are located in Germany (Hetzner). We do not routinely transfer data outside the EEA.

If data transfer outside the EEA becomes necessary (e.g., for specific third-party services), we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Data Retention

We distinguish between different categories of data with different retention rules:

7.1 User Profile Data

Your personal profile data (name, address, phone, email) is stored for as long as you maintain your account. You may update or delete your profile data at any time through your account settings. Upon account deletion, profile data is soft-deleted and permanently purged within 90 days.

7.2 Show Registration Data (Frozen Snapshots)

When you register for a dog show, a snapshot of your registration data (name, dog details, class selection, and any submitted documents) is created and frozen at the moment of registration. This frozen data:

Cannot be altered by subsequent changes to your profile.
Is provided to the Event Organizer as part of the event record.
Remains in our system until the event is completed.

After the event concludes:

The Event Organizer receives a download link to retrieve the frozen registration documents. This link is valid for 14 calendar days.
After the 14-day download window expires, the frozen registration data (personal details snapshot) is permanently deleted from our systems.
What remains after deletion:
- Show catalogs and results (participant name, dog, class, placement, awards) — retained as part of the public show record for historical reference, available for up to 5 years.
- Your current profile data — as it exists at that point in time (which may differ from the frozen snapshot).
- Canine data — retained indefinitely as described in Section 7.3.

This means that SHOWS.dog does not retain copies of your frozen registration documents beyond the 14-day Organizer download period. The Organizer is the Data Controller for any documents they download and is responsible for their subsequent storage and handling.

7.3 Canine Data (Non-Personal)

Information about dogs — including pedigree numbers, microchip numbers, breed, color, sire, dam, date of birth, and show results — constitutes publicly available canine registry information. This data:

Is publicly disclosed through kennel club registries, show catalogs, and official results.
Is not considered personal data under GDPR as it relates to animals, not individuals, and is stored in a de-identified manner (not linked to owner identity in public-facing databases).
Will be retained indefinitely in the SHOWS.dog database and may be used across related projects within our ecosystem (such as mypedigree.dog and future platforms) for the purpose of maintaining comprehensive canine records.
Cannot be subject to erasure requests, as this data is de-identified and serves the legitimate interest of the international dog show community in maintaining accurate breeding and competition records.

By entering dog information on the Platform, you acknowledge that this canine data is inherently public in the dog show industry and will be retained and shared across our ecosystem projects.

7.4 Other Data

Data Type	Retention Period
Invoicing and financial data	7 years (applicable tax law requirement)
Server logs (IP, access)	90 days
Email verification tokens	24 hours (auto-deleted)
Deleted account data	Soft-deleted, permanently purged within 90 days

After the applicable retention period, data is permanently and irreversibly deleted.

8. Your Rights (GDPR)

Under GDPR, you have the following rights:

Right	Description
Access (Art. 15)	Request a copy of your personal data
Rectification (Art. 16)	Request correction of inaccurate data
Erasure (Art. 17)	Request deletion of your data (“right to be forgotten”)
Restriction (Art. 18)	Request limitation of processing
Portability (Art. 20)	Receive your data in a structured, machine-readable format
Objection (Art. 21)	Object to processing based on legitimate interest
Withdraw consent (Art. 7(3))	Withdraw previously given consent at any time

To exercise any of these rights, contact us at privacy@shows.dog. We will respond within 30 days.

Note: These rights apply to your personal data. De-identified canine data (pedigree numbers, breed, sire/dam, show results) as described in Section 7.3 is not personal data and is not subject to erasure or portability requests. If you delete your account, your personal profile is removed, but canine records remain in de-identified form.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

The competent Data Protection Authority of the jurisdiction in which the SHOWS.dog Team is registered

9. Data Processing on Behalf of Organizers

When an Event Organizer uses the Platform to manage registrations, the Organizer is the Data Controller and SHOWS.dog is the Data Processor for Exhibitor data submitted during registration.

In this role, we:

Process Exhibitor data only according to the Organizer's instructions and for the purposes of providing the Platform.
Implement appropriate technical and organizational security measures.
Do not use Exhibitor data for our own purposes beyond providing the service.
Assist the Organizer in fulfilling data subject requests (access, deletion, etc.).

The terms of this processing relationship are set out in our Data Processing Agreement.

10. Security Measures

We implement industry-standard security measures to protect your data:

Passwords hashed with bcrypt (12 rounds).
Authentication via HttpOnly cookies (not localStorage) to prevent XSS attacks.
CSRF protection using double-submit cookie pattern.
TLS 1.2+ encryption for all data in transit.
Email verification tokens hashed with SHA-256 before storage.
Rate limiting on all authentication endpoints.
Regular security reviews and audits.

11. Children's Privacy

The Platform is not intended for use by children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at privacy@shows.dog and we will promptly delete it.

Event Organizers are responsible for ensuring that participants in their events meet the age requirements of their jurisdiction and event rules.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Platform at least 14 days before the changes take effect.

13. Contact Us

For any questions or requests related to this Privacy Policy or your personal data:

Email: privacy@shows.dog
Company: SHOWS.dog Team
Address: [To be updated upon company registration]