Privacy Policy

Last updated: 13 September 2026

HEEQ (“HEEQ”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and protect personal data when you visit or use our website www.heeq.eu (the “Website”), purchase our products, visit our physical retail locations, contact us, subscribe to our marketing communications, or otherwise interact with us.

HEEQ is a company incorporated and registered in Estonia. HEEQ operates its online store and physical business activities, including a pop-up shop and warehouse, in Cyprus.

For the purposes of applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), HEEQ is the data controller of the personal data described in this Privacy Policy.

1. Data Controller

The data controller responsible for your personal data is:

Legal name: Henessy Equestrian OÜ
Estonian registry code: 17107765
Registered office: Estonia, Harju county, Tallinn city, Heinavälja street 4-79, 10617
Trading name: HEEQ
Cyprus operating location: Nikita Nikitara 5, Pyla, Larnaca 
Email: [email protected]
Website: www.heeq.eu

HEEQ is an Estonian company operating its online store and physical retail and fulfilment activities in Cyprus.

If you have any questions about how we process your personal data or wish to exercise your data protection rights, you can contact us using the contact details above.

2. Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data.

Information you provide directly

When you place an order through our Website, purchase products at our physical locations, contact us, create an account, subscribe to our newsletter or otherwise communicate with us, we may collect:

  • Full name
  • Billing address
  • Shipping or delivery address
  • Email address
  • Telephone number
  • Order and purchase information
  • Product preferences
  • Information provided when contacting customer support
  • Marketing preferences
  • Information provided in connection with returns, refunds or exchanges
  • Any other information you voluntarily provide to us

Information collected when purchasing in person

When you purchase products at our Cyprus pop-up shop or other physical retail locations, we may collect information necessary to process the transaction, provide a receipt, process returns or exchanges, provide customer service and comply with applicable legal and accounting obligations.

Payment information

When you make a purchase, payment information may be processed through third-party payment service providers.

We generally do not store complete payment card details on our own systems. Payment information may be collected and processed directly by the relevant payment provider in accordance with its privacy policy and security requirements.

Information collected automatically

When you visit our Website, certain technical information may be collected automatically, including:

  • IP address
  • Browser type and version
  • Device type
  • Operating system
  • Language and time zone settings
  • Website pages visited
  • Date and time of visits
  • Referring website
  • General website usage information
  • Cookie and similar technology information

We use this information to operate, secure and improve our Website and, where applicable, to understand how visitors use our Website.

3. How We Use Your Personal Data

We may use your personal data for the following purposes:

Processing and fulfilling orders

We use your information to:

  • Process and confirm your orders
  • Process payments
  • Arrange delivery
  • Provide order confirmations and shipping updates
  • Process returns, refunds and exchanges
  • Provide customer support
  • Communicate with you about your purchases

Operating our physical business

We may process personal data in connection with our physical retail activities in Cyprus, including our pop-up shop and warehouse, for purposes such as:

  • Processing purchases
  • Processing returns and exchanges
  • Providing customer service
  • Managing stock and orders
  • Fulfilling online orders
  • Maintaining business and transaction records
  • Preventing fraud and misuse

Operating and improving our Website

We may use technical and usage information to:

  • Maintain and operate the Website
  • Improve website functionality
  • Understand how visitors use the Website
  • Detect technical problems
  • Prevent fraud, abuse and other unlawful activity
  • Protect the security of our systems

Communication

We may use your contact details to respond to enquiries, provide customer service and communicate with you regarding your orders or other requests.

Marketing

Where permitted by applicable law and, where required, based on your consent, we may send you information about:

  • New products
  • Promotions
  • Special offers
  • Events
  • HEEQ news

You may unsubscribe from marketing communications at any time by following the unsubscribe instructions included in the communication or by contacting us.

4. Legal Bases for Processing

We process your personal data only where there is a lawful basis to do so under applicable data protection legislation.

Depending on the circumstances, we may rely on the following legal bases:

Performance of a contract

We process personal data where it is necessary to fulfil an order or provide services you have requested.

For example, we need your name, contact details and delivery address to process and deliver an online order.

Legal obligations

We may process personal data where necessary to comply with legal or regulatory obligations, including accounting, tax, consumer protection and other applicable requirements.

Legitimate interests

We may process personal data where necessary for our legitimate interests, provided that these interests are not overridden by your fundamental rights and freedoms.

This may include:

  • Operating and improving our business
  • Improving website security
  • Preventing fraud
  • Managing customer relationships
  • Responding to enquiries
  • Managing our warehouse and fulfilment operations
  • Protecting our property and business
  • Establishing, exercising or defending legal claims

Consent

Where required by law, we will ask for your consent before processing your personal data for a particular purpose, such as certain forms of marketing or non-essential cookies.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Cookies and Similar Technologies

Our Website may use cookies and similar technologies.

Cookies are small text files stored on your device that help websites function, remember preferences and, depending on the type of cookie, collect information about how the Website is used.

We may use:

Strictly necessary cookies

These cookies are necessary for the Website to function properly. They may be used for purposes such as:

  • Shopping cart functionality
  • Checkout functionality
  • Account functionality
  • Security
  • Remembering privacy or cookie preferences

These cookies generally do not require consent where they are strictly necessary to provide a service you have requested.

Analytics cookies

Where enabled, analytics cookies help us understand how visitors use our Website so that we can improve its functionality and performance.

Marketing and advertising cookies

Where applicable, these cookies may be used to provide relevant advertising, measure advertising performance or track interactions across websites.

Non-essential cookies will only be used where the required consent has been obtained.

You can manage or withdraw your cookie preferences through our cookie consent mechanism or your browser settings.

6. Who We Share Your Personal Data With

We may share personal data with trusted third parties where this is necessary to operate our business and provide our services.

These may include:

  • Payment service providers
  • Delivery and courier companies
  • Website hosting and technical service providers
  • E-commerce platform providers
  • IT and cybersecurity providers
  • Email and communication service providers
  • Analytics providers
  • Marketing service providers, where applicable
  • Accounting and financial service providers
  • Lawyers and professional advisers
  • Government authorities, regulators or law enforcement authorities where required by law

We only share personal data where there is an appropriate legal basis for doing so and, where applicable, appropriate contractual and security safeguards are in place.

We do not sell your personal data.

7. International Data Transfers

Some of our service providers may process personal data outside Estonia, Cyprus or the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we will take appropriate steps to ensure that the transfer is carried out in accordance with applicable data protection law.

Depending on the circumstances, this may include relying on:

  • An adequacy decision of the European Commission;
  • Standard Contractual Clauses approved by the European Commission; or
  • Other legally recognised safeguards or transfer mechanisms.

8. How Long We Keep Your Personal Data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

For example:

  • Order and transaction information may be retained for as long as necessary to fulfil the order, manage returns and warranties, meet accounting and tax obligations, and establish or defend legal claims.
  • Customer service communications may be retained for as long as necessary to handle the relevant enquiry and maintain appropriate business records.
  • Marketing information is generally retained until you unsubscribe or withdraw your consent, unless another lawful basis for retention applies.
  • Technical and cookie information is retained according to the applicable cookie or service settings and our legitimate business requirements.

When personal data is no longer required, we will securely delete or anonymise it where reasonably possible.

9. Data Security

We take reasonable technical and organisational measures to protect your personal data against:

  • Unauthorised access
  • Accidental loss
  • Destruction
  • Alteration
  • Unauthorised disclosure
  • Other unlawful or unauthorised processing

However, no method of transmission over the Internet or electronic storage can be guaranteed to be completely secure.

10. Your Data Protection Rights

Subject to applicable legal conditions and limitations, you may have the following rights under the GDPR:

  • Right to access – You may request a copy of the personal data we hold about you.
  • Right to rectification – You may ask us to correct inaccurate or incomplete information.
  • Right to erasure – You may request deletion of your personal data in certain circumstances.
  • Right to restriction – You may request that we restrict the processing of your personal data in certain circumstances.
  • Right to data portability – In certain circumstances, you may request your personal data in a structured, commonly used and machine-readable format.
  • Right to object – You may object to certain types of processing, including direct marketing.
  • Right to withdraw consent – Where processing is based on your consent, you may withdraw that consent at any time.
  • Rights relating to automated decision-making – Where applicable, you may have rights regarding decisions based solely on automated processing that produce legal or similarly significant effects.

These rights are not absolute and may be subject to applicable legal exceptions.

To exercise your rights, please contact us at:

[PRIVACY / CONTACT EMAIL]

We may need to verify your identity before responding to a request.

We will normally respond to valid data protection requests without undue delay and, in principle, within one month as required by the GDPR.

11. Direct Marketing

If you have subscribed to our marketing communications, we may use your email address or other contact details to send you information about HEEQ products, promotions, events and news.

You can unsubscribe at any time by:

  • Clicking the unsubscribe link in our marketing emails; or
  • Contacting us at [PRIVACY / CONTACT EMAIL].

We will not require you to provide a reason for unsubscribing.

12. Children

Our Website is not intended to knowingly collect personal data from children who are unable to provide valid consent under applicable law.

If you believe that a child has provided us with personal data without the necessary parental or guardian involvement, please contact us so that we can take appropriate steps.

13. Third-Party Websites

Our Website may contain links to third-party websites, social media platforms or other online services.

We are not responsible for the privacy practices, security or content of third-party websites.

We recommend reviewing the privacy policies of third parties before providing them with your personal data.

14. Social Media

We may maintain social media profiles or use social media features on our Website.

Interactions with social media platforms may involve the processing of personal data by those platforms independently of HEEQ.

Please refer to the privacy policies of the relevant social media providers for information about how they process personal data.

15. Automated Decision-Making and Profiling

We do not intend to make decisions about you based solely on automated processing that produce legal or similarly significant effects.

If this changes, we will provide the information required by applicable data protection legislation and, where required, provide appropriate safeguards.

16. Data Breaches

If a personal data breach occurs that is likely to result in a risk to individuals' rights and freedoms, we will handle the breach in accordance with applicable GDPR requirements, including notifying the competent supervisory authority and affected individuals where legally required.

17. Supervisory Authority and Complaints

If you have concerns about how we process your personal data, we encourage you to contact us first so that we can try to resolve the issue.

Under the GDPR, you also have the right to lodge a complaint with a competent data protection supervisory authority.

As HEEQ is an Estonian company, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) may be the relevant lead supervisory authority where Estonia is HEEQ's main establishment for the relevant cross-border processing activities.

The Estonian Data Protection Inspectorate can be contacted at:

Andmekaitse Inspektsioon
Tatari 39
10134 Tallinn
Estonia
Email: [email protected]
Website: www.aki.ee

Where applicable, individuals may also have the right to contact the data protection supervisory authority in the EU Member State where they live, work, or where an alleged infringement took place.

For customers in Cyprus, the competent Cypriot supervisory authority is the Office of the Commissioner for Personal Data Protection.

The applicable supervisory authority will depend on the circumstances and the GDPR's rules concerning cross-border processing and supervisory authority competence.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, services, technology or applicable legal requirements.

The updated version will be published on this page with a revised “Last updated” date.

We encourage you to review this Privacy Policy periodically.

19. Contact Us

If you have any questions about this Privacy Policy, our processing of personal data, or your privacy rights, please contact us:

HEEQ
Legal name: Henessy Equestrian OÜ
Estonian registry code: 17107765
Registered office: Estonia, Harju county, Tallinn city, Heinavälja street 4-79, 10617
Trading name: HEEQ
Cyprus operating location: Nikita Nikitara 5, Pyla, Larnaca
Email: [email protected]
Website: www.heeq.eu

Last updated: 13 September 2026