Privacy Policy

Last updated: 29 September 2026

This policy explains what personal data Breed Right collects, why we collect it, who we share it with, how long we keep it and the rights you have over it, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to everyone who uses breedright.co.uk, whether you hold an account or not.

1. Who we are and how to contact us

The data controller is Whelpy Ltd, which operates the Breed Right website at breedright.co.uk. A controller is the organisation that decides why and how your personal data is used, and is answerable for it.

Registered company name: Whelpy Ltd
Place of registration: England and Wales
Company number: 17436550
Registered office: Unit 3 Factory 3 Valhalla, Dobles Lane, Holsworthy, England, EX22 6HN
Correspondence address: Unit 3 Factory 3 Valhalla, Dobles Lane, Holsworthy, England, EX22 6HN
Email: hello@breedright.co.uk
ICO data protection register: ZC238509

We are registered with the Information Commissioner’s Office and pay the data protection fee as a small organisation.

We have not appointed a Data Protection Officer, because we are not required to have one. Data protection questions come to the address above and are handled by the person who runs the service.

References to “we”, “us” and “our” in this policy are to Whelpy Ltd. References to “you” and “your” are to the person using the site, holding an account, or sending an enquiry through it.

Breed Right is independent. We are not affiliated with, endorsed by or connected to The Royal Kennel Club, the British Veterinary Association or any breed club. We do not hold a copy of the Royal Kennel Club’s records, and we have no data feed or interface with them.

2. The data we collect

We collect only what the service actually needs, and this section lists all of it. Details about dogs are records about animals rather than about people, but they appear below because they are attached to an identifiable person, namely the member who entered them.

Account and identity data: your display name, username, email address, an optional telephone number, and your password stored only as a strong one-way hash, which means we can never read it. We also hold your account type, whether your email address has been confirmed, whether you have opted in to marketing, and the dates you joined and last signed in.
Kennel and breeder profile: your kennel name, Royal Kennel Club affix, the description you write about yourself, your town, county and region, the outward part of your postcode (for example PL15), your country, a contact telephone number and contact email address, your website, the year you started breeding, whether you declare that you follow the Royal Kennel Club health standard, and your local-authority breeding licence number and the council that issued it, if you have one. We deliberately do not collect your street address or your full postcode. The site has no use for them, so holding them would be a risk with no benefit to you.
Dog records: registered name, pet name, sex, date of birth, breed, colour, and the Royal Kennel Club registration number, registered name, stud book number and register type you declare for each dog.
Health test results: hip scores, elbow grades, eye and DNA results, the date of each test, the body that issued it and the certificate reference. These are results about a dog, not about you, but they are linked to your account.
Uploaded certificates: the registration, BVA hip, elbow and eye, and DNA certificates you upload to support a verification request, together with the original file name, file type, file size and a checksum. Certificates usually show other people’s details as well as your own, such as the name and address of a previous owner or the name of the examining vet. You are asking us to store that information when you upload it, so please upload only what is needed, and see section 4 for who can open it.
Listing content and photographs: everything you write in a stud, litter or puppy listing, including prices, locations, availability and any notes, and the photographs you upload with their captions and alternative text. Photographs are re-encoded when you upload them, which strips out any EXIF data, including GPS coordinates, so a photograph taken at home does not publish where your home is.
Enquiries and messages: the name, email address, optional telephone number and message text sent through an enquiry, the listing it was about, the IP address it was sent from, and every message in the conversation that follows. Messages are stored, and they are visible to both people in the conversation and to us if we need to look at a report.
Contact and report forms: the name, email address, topic and message you send through our contact or report pages. These are emailed to us rather than saved into the site database, so they live in our mailbox — for up to two years after we close the matter, so we have a record of what we decided and why. Section 6 lists it with everything else.
Puppy alerts: if you ask to be emailed when a litter is listed, the email address you give, the breed, the region if you chose one, the date and time you ticked the consent box and which version of the wording you agreed to, the IP address the sign-up and the confirmation came from, and a record of which litters we have emailed you about. You do not need an account for this, and nothing is sent to the address until you click the confirmation link we email you.
Verification records: the request you submit, any note you send with it, and our own record of the check: which named member of our team carried it out, on what date, what they checked against the Royal Kennel Club’s public records, and what they found. We record our own words about what we saw. We do not copy or store the Royal Kennel Club’s records.
Membership and payment data: your plan, subscription status, renewal date, cancellation date, and a record of each payment with its amount, date, status and the payment provider’s reference. We never see or store your full card number. Card details are entered on the payment provider’s own pages and never reach our servers.
Technical and security data: the log our server keeps of requests, which records your IP address, your browser’s user-agent string, the page requested and the time; sign-in attempts, successful and failed, with the IP address and the email address or username used; rate-limit counters; and the records behind “keep me signed in”, password reset and email confirmation links. Where a member of our team takes an administrative action, we log the action, who took it, when, and their IP address and browser.

We do not collect special category data. We do not ask for or hold information about your health, race, religion, politics, sex life, sexual orientation, trade union membership, genetics or biometrics. Health results held on this site are results about dogs, which are not special category personal data under Article 9 of the UK GDPR. We do not buy personal data from anyone, and we do not build profiles from data collected elsewhere.

3. How and why we use it, and our lawful basis

Everything we do with personal data has one of the lawful bases set out in Article 6 of the UK GDPR. This table sets out each purpose and the basis for it:

What we do	Why	Lawful basis
Create and run your account, publish your listings, deliver enquiries to you, and provide the paid membership	It is the service you asked us for	Performance of a contract, Article 6(1)(b)
Send service emails: confirming your email address, resetting your password, notifying you of enquiries, membership receipts and renewal reminders	These are part of running your account, not marketing	Performance of a contract, Article 6(1)(b)
Check the registration and health details you declare against the Royal Kennel Club’s public records, and keep a dated record of what we checked	Keeping the directory honest for buyers, and protecting breeders who really do health test from being undercut by people who claim they do	Legitimate interests, Article 6(1)(f)
Review reports about listings, messages or members, moderate content and enforce our rules	Keeping unlawful and harmful adverts off the site, and protecting buyers and animals	Legitimate interests, Article 6(1)(f)
Keep the site secure: sign-in throttling, rate limits, anti-spam checks, server logs and the administrative audit trail	Preventing fraud, abuse and unauthorised access	Legitimate interests, Article 6(1)(f)
Take payment for membership and keep the payment records	Providing the membership you bought, and keeping proper accounts	Performance of a contract, Article 6(1)(b), and legal obligation, Article 6(1)(c)
Respond to a court order, a police request, or a local authority investigating breeding licensing	We are required to, or it is necessary to establish or defend a legal claim	Legal obligation, Article 6(1)(c), and legitimate interests, Article 6(1)(f)
Send you a puppy alert — an email when a litter of the breed you asked about is listed — and the confirmation email that sets it up	Only because you asked for it on our puppy alerts page and then confirmed by email. Every alert carries a one-click unsubscribe link	Consent, Article 6(1)(a), and regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003. You can withdraw it at any time
Send any other marketing email about Breed Right, if we ever do	Only if you have ticked the box to ask for it. We send none at present	Consent, Article 6(1)(a), which you can withdraw at any time

Legitimate interests, in plain terms. Where we rely on legitimate interests we have weighed our interest against your rights and decided that a careful, minimal use of your data does not override them. You can object to any of it under section 7, and we will stop unless we have compelling grounds to continue.

No automated decision-making and no profiling. No decision producing legal effects for you, or similarly significantly affecting you, is made about you by automated means. Verification decisions in particular are made by a named person reading the evidence, never by an algorithm, and a badge that is withdrawn is withdrawn by a person who has to record why.

Puppy alerts are the one marketing email we send, and only to people who asked for them. If you sign up on our puppy alerts page we email you a confirmation link, and nothing else until you click it. After that you get one email each time a litter of that breed is listed (in that region, if you chose one), with a link to the listing. Every alert carries a one-click unsubscribe link; unsubscribing takes effect immediately, and the same link lets you stop every alert for that address. We keep a record of when you consented and which wording you agreed to, because we have to be able to show it. Alerts are the only thing that address is used for: we never pass it to breeders or anyone else.

We send no other marketing email. There is a box on your account page recording whether you would like to hear from us, and we store your answer, but no other marketing message has been sent through this site. If we ever start, it will go only to people who have ticked that box, every message will carry an unsubscribe link, and you can change your answer at any time. We never send marketing on behalf of anyone else, and we will never sell your personal data to anyone.

4. Who we share it with, and what is published

A breeder’s listing is public by design. If you publish a stud dog, a litter or a kennel profile, you are publishing it to the open internet, where anyone can read it and search engines can index it. That is the point of a directory, and it is worth being completely clear about what does and does not appear.

Published: your kennel name and affix, your profile description, your town, county and region, your website address if you give one, your photographs, and the dog and litter details you enter, including declared health results and whether a claim has been checked by us.
Never published: your street address, your full postcode, your account email address, the contact telephone number and contact email you give us for enquiries, and your uploaded certificates. The outward part of your postcode is used to place you in a search area and is not shown on the site.
Published only in part: a Royal Kennel Club registration number is shown to the public partly masked. Only you and our team see it in full, because a complete registration number has real value to a fraudster.
Uploaded certificates are never public. They are stored outside the public part of the server, under a file name we generate, and can only be opened by you, by the breeder who owns the dog, and by our administrators, each time through a check on who is asking.

Beyond what you publish yourself, we share personal data only in these ways:

Other users, at your instruction. When you send an enquiry, your name, email address, optional telephone number and message go to that breeder so they can reply. When a breeder replies, their reply and their name go to you.
IONOS, our hosting and email provider, which stores the website, its database and its files, and delivers our outgoing email.
Stripe, our payment provider. Stripe receives your email address and collects your billing name and address on its own checkout pages in order to take the payment. Stripe acts as a controller in its own right for some of that processing, under its own privacy policy at stripe.com/privacy.
Dropbox and Microsoft, whose cloud storage (Dropbox and Microsoft OneDrive) holds copies of our backups, so that the site can be restored if our host ever loses it. Sections 5 and 6 say where those copies are kept and for how long.
Authorities and professional advisers, where the law requires it or where it is necessary to establish, exercise or defend a legal claim. That includes a court order, the police, and a local authority investigating breeding licensing.

We do not sell personal data. We do not share it with advertisers, data brokers or analytics companies. There is no advertising network, no analytics service and no tracking pixel anywhere on this site.

5. Sending data outside the UK

Our hosting and email are provided by IONOS, a European provider, on their United Kingdom service. We are confirming with IONOS exactly which data centres hold our database, our files and our mail, and we will name the country here once we have confirmed it with our host. If any of it is held in the European Economic Area rather than the UK, we will say so on this page and rely on the UK adequacy regulations that cover those countries.

Stripe processes payment data in the United States as well as in the UK and the European Union. Where that happens, the transfer is protected by Stripe’s certification under the UK Extension to the EU-US Data Privacy Framework, and by the International Data Transfer Addendum to the European Commission’s standard contractual clauses, which forms part of Stripe’s data processing agreement with us.

Backup copies in Dropbox and Microsoft OneDrive. Copies of our backups (see section 6) are kept in our own Dropbox and Microsoft OneDrive storage. Both services are provided to UK customers by a company in Ireland (Dropbox International Unlimited Company and Microsoft Ireland Operations Limited), and the UK recognises Ireland, like the rest of the European Economic Area, as protecting personal data adequately. Dropbox stores files in data centres in the United States; Microsoft may store OneDrive files in the UK or Europe, in the United States, or in another country where it has data centres. For data held in the United States, Dropbox, Inc. and Microsoft Corporation each state that they are certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), and both also rely on standard contractual clauses.

We make no other transfers outside the UK. If that ever changes we will name the provider and the safeguard in this policy before it starts.

6. How long we keep it

We keep personal data only as long as we need it. These periods are the maximums we work to:

What	How long we keep it
Account, profile, dogs, listings and photographs	While your account is open. Deleted when you delete your account, or within 30 days of asking us to close it.
Uploaded certificates	While the dog they relate to is on your account. The record is removed when you delete that dog or your account.
Our verification records: who checked what, when, and what they found	While the badge they support is displayed, and for up to 6 years afterwards. They are our evidence of what we told the public and when, so they survive the closure of an account.
Administrative audit trail of privileged actions	Up to 2 years.
Enquiries and the messages in a conversation	Up to 2 years after the last message. The breeder can delete a conversation sooner, which removes it for both people. A buyer who wants one removed can ask us. If the breeder closes their account, their conversations are deleted with it.
Payment and subscription records	6 years from the end of the accounting period they fall in, because company and tax law require it (Companies Act 2006 section 388). These survive the deletion of your account. When you delete your account the ledger entry stops naming you: the amount, the date and the payment provider’s reference stay, your name and account link do not. Data protection law expressly allows this where we have a legal obligation to keep a record (UK GDPR Article 17(3)(b)).
Messages you send us through the contact or report forms, which live in our mailbox	Up to 2 years after we close the matter, so we have a record of the decision we made and why. This is the period our listing rules and the report page refer to.
Server log	Up to 90 days.
Failed and successful sign-in attempts	24 hours. Cleared automatically — this row really is a scheduled job, not a hand sweep.
Rate-limit counters, which hold an IP address or an email address and a count	The counting window is minutes or hours. The counter resets when the window rolls over, and the record is removed in our clear-out.
“Keep me signed in” tokens	30 days at most, and sooner if you sign out or change your password. Only five devices are remembered at a time.
Password reset links	2 hours.
Email confirmation links	48 hours.
Puppy alerts you have confirmed, and the record of which litters we told you about	While the alert is active. When you unsubscribe, the alert stops immediately and the record is deleted 30 days later — it is kept that long only so the link can tell you it has already been done if you click it again.
Puppy alert sign-ups that were never confirmed	Until the confirmation link expires, which is 7 days, and then deleted. Nothing is ever sent to an unconfirmed address except that one link.
Backups of our database and uploaded files, including the copies kept in our own Dropbox and Microsoft OneDrive storage	A backup is made daily on our host. Backups are kept on a rolling schedule and older ones are deleted automatically as new ones are made, so none is kept for more than about ten weeks. Until then, something you have deleted can still be in a backup taken before you deleted it. We use backups only to restore the site after a fault, never to look things up, and if we ever restore from one, anything deleted since that backup was taken is deleted again.

How these periods are enforced. Sign-in attempts and expired tokens are cleared automatically by the site itself. The rest are enforced by a scheduled clear-out (tools/maintenance.php) that runs daily on our server, and old backups are deleted by the backup job itself each time it runs. If you want something deleted sooner than the period above, you only have to ask.

7. Your rights and how to use them

Under the UK GDPR you have the right to:

Access. Ask for a copy of the personal data we hold about you, and be told what we do with it.
Rectification. Have inaccurate data corrected. Most of your profile, dogs and listings you can edit yourself from your dashboard at any time.
Erasure. Ask us to delete your data. We will, except where we are required to keep something — payment records, which company and tax law make us keep for six years, or a verification record that is our evidence of a public claim we made. In both cases we remove what identifies you and keep only the record itself. Enquiries you sent to a breeder are also that breeder’s record; we anonymise your details in them rather than delete the conversation.
Restriction. Ask us to pause using your data while a dispute about it is sorted out.
Portability. Receive the data you gave us in a common, machine-readable format, or have us send it to another provider where that is technically possible.
Objection. Object to processing we base on legitimate interests, and object to direct marketing, which we stop straight away and without question.
Withdraw consent. Where we rely on your consent, such as marketing email, you can withdraw it at any time. Withdrawing it does not make what we did beforehand unlawful.

How to ask. Email hello@breedright.co.uk, or use our contact form and choose the “Data protection” topic. Tell us which right you want to use and, if it helps, what you are looking for. There is no charge. We reply within one calendar month, and we will tell you if a complicated request needs longer. We may first need to satisfy ourselves that you are who you say you are, which usually means replying from the email address on the account.

Closing your account. There is a delete button on your account page. It removes your account, your kennel profile, your dogs, your listings, and your photographs and uploaded certificates — the files themselves, not just the database records. Three things are deliberately not destroyed with it, and you should know about all three:

Enquiries you sent to a breeder stay in that breeder’s inbox, because the conversation is their record as much as yours. Your name, email address, telephone number and IP address are removed from them; the message text stays. The other way round, it does not survive: if the breeder closes their account, the conversation is deleted outright, including your copy of it. Keep anything you need before you rely on it.
Payment records stay for six years, because company and tax law require it. They stop naming you.
Verification records stay while they are our evidence of a badge we showed the public. They stop naming you.

Everything else goes, and it goes for good, apart from the rolling backups described in section 6, which age out within about ten weeks. If the button ever fails, email us and we will do it by hand and confirm when it is done.

Nothing in this policy reduces your rights under data protection law. If you are unhappy with how we have handled your personal data, section 11 explains how to complain to us and to the Information Commissioner.

8. Cookies

We use two cookies and both are strictly necessary for the service you have asked for. There are no analytics, advertising or tracking cookies on Breed Right.

brsess is the session cookie. It keeps you signed in as you move between pages and protects forms against cross-site request forgery. It expires when you close your browser.
br_remember is set only if you tick “keep me signed in” when you log in. It lasts up to 30 days and is removed when you log out.

Both are strictly necessary for a service you have expressly asked for. Under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 and the strictly necessary exception in paragraph 4 of Schedule A1 to those Regulations (regulation 6 as substituted, and Schedule A1 as inserted, by the Data (Use and Access) Act 2025 from 5 February 2026), that means they do not need a consent banner, which is why you have not seen one. We host our own fonts, images and scripts, so loading a page on Breed Right sends your IP address to us and to nobody else. Our cookie policy sets this out in full.

9. Keeping your data safe

Passwords are stored only as strong one-way hashes, so nobody here can read them, and they are re-hashed automatically as standards move on. Every database query uses prepared statements. Sessions use HttpOnly cookies with SameSite protection, marked secure whenever the site is served over HTTPS. State-changing forms carry anti-forgery tokens. Sign-in attempts are throttled by IP address and by account. Application code and uploaded certificates are stored outside the public part of the server, and certificates are served only after a check on who is asking. Photographs are re-encoded on upload, which removes location data and neutralises files pretending to be images. Access to the database and to uploaded files is limited to the people who operate the service.

No online system is completely secure, but we take the protection of your data seriously and review our measures regularly. If a breach ever put your rights and freedoms at risk, we would report it to the Information Commissioner within 72 hours and tell you without undue delay, as the law requires.

10. Children

Breed Right is not intended for children. You must be 18 or over to hold an account, to publish a listing or to send an enquiry, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email hello@breedright.co.uk and we will delete it.

11. Complaints

Please come to us first. Email hello@breedright.co.uk, or use our contact form (choose the “Data protection” topic), and tell us what has gone wrong. We acknowledge every data protection complaint within 30 days, investigate it, and tell you the outcome without undue delay. If it takes a while, we will tell you how it is going. We would welcome the chance to put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, and you can do that whether or not you have spoken to us first:

Online: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Complaining to the Information Commissioner does not affect any other legal right you have, including the right to seek compensation through the courts.

12. Changes to this policy

We will update this policy as the service develops, for example when card payments are switched on or when the company details in section 1 are completed, and the “Last updated” date at the top of this page shows when it was most recently revised. If a change materially affects how we use your personal data, we will tell account holders by email before it takes effect.

13. Contact us

Data controller: Whelpy Ltd
Place of registration: England and Wales
Company number: 17436550
Registered office: Unit 3 Factory 3 Valhalla, Dobles Lane, Holsworthy, England, EX22 6HN
Email: hello@breedright.co.uk
ICO data protection register: ZC238509