Your data, handled with care .

Who is responsible

ESTCA B.V. is the data controller for everything you do on this platform.

• ESTCA B.V., Amsterdam, the Netherlands. Custodian of the European Standard for Travel with Canine Animals.
• Contact for privacy matters: [email protected]

What we collect

We collect only what the certification pathway needs. We do not sell personal data and we do not use it for advertising.

• Dog owners — the email address you enroll with, and a password only if you choose to set one. In My Dog Portal you can add your name, your dog's name, microchip number, breed, weight, date of birth, country of residence, EU pet passport number, and rabies vaccination date. Everything except the email address is optional, and you can edit or clear it at any time.
• Dog photos — if you upload a photo of your dog it is stored in our media storage and served from an unlisted link. Anyone who has that exact link can view the image, so treat it as you would any shared photo link. You can replace it at any time or ask us to delete it.
• Trainers and ESTCA-approved assessors — business contact details, training records, and assessment evidence (video, photographs, scoring) needed to certify dogs.
• Visitors to the public site — anonymous, aggregated page-view metrics only. No individual tracking.

Cookies

We only set cookies that are strictly necessary for the site to function. Under EU law, these don't require consent.

• Authentication cookies (sb-*) — set by Supabase to keep you signed in to My Dog Portal or the trainer portal. Cleared when you sign out.
• Language preference (NEXT_LOCALE) — remembers whether you chose English, Dutch, Italian, or Swedish.
• Vercel Analytics — privacy-first, cookieless. Page views are counted via a daily anonymous fingerprint that cannot identify you across sessions.

We do not use Google Analytics, Meta Pixel, or any advertising cookies. We do not share your data with third-party advertisers.

Third parties we rely on

We use a small number of EU-friendly service providers to run the platform. Each only sees the data needed for its specific job.

• Supabase (Frankfurt, EU) — database, authentication, and file storage. Hosts owner and trainer accounts, dog records, certification data, and uploaded dog photos.
• Stripe — billing for ESTCA-approved assessors. Only used inside the trainer portal; no payment data touches the public site.
• Resend — transactional email (account confirmations, certification notices). Sees your email address when we send you a message.
• Vercel (EU regions) — hosting and cookieless page-view analytics.
• Cloudflare Turnstile — bot protection on the enrollment form. Sees your IP address and browser signals to confirm you are not a bot. It is not used to profile or track you across sites.
• Sentry — error tracking. Captures technical error logs without PII to help us fix bugs.

How long we keep data

Owner accounts and dog profiles are kept while your account is open. An enrollment that is never picked up by a trainer is archived automatically after 24 months of inactivity. Trainer accounts and dog certifications are retained for as long as the certification is valid (two years) plus the period required to demonstrate compliance with the ESTCA standard. Anonymous analytics data is retained for up to one year. You can request earlier deletion at any time.

Your rights

Under the GDPR you have the following rights regarding your personal data, free of charge:

• Request a copy of the data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete your data, subject to legal retention requirements.
• Receive your data in a portable, machine-readable format.
• Object to processing or lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

Data is encrypted in transit (HTTPS) and at rest. Access to production systems is limited to staff who need it. We log administrative actions and use short-lived service credentials.

Changes to this policy

If we make material changes — new third parties, new categories of data — we'll update this page and post the new effective date. We will not weaken your protections retroactively.