Privacy Policy
Horizon Hosting Limited (trading as "Horizon Hosting") Company Number: 13693820 Registered in England and Wales
Last Updated: 12 November 2026
This Privacy Policy ("Policy") forms part of, and is incorporated by reference into, our Terms and Conditions (the "Terms"), and describes how Horizon Hosting Limited ("we", "us", "our") collects, uses, discloses, and protects personal data when you use our Websites and Services, including hrznhosting.com, billing.hrznhosting.com, panel.hrznhosting.com, and any other Website or Service we operate (together, the "Service"). Capitalised terms not defined in this Policy have the meaning given to them in the Glossary.
By accessing or using the Service, you consent to the collection, use, and disclosure of your information as described in this Policy. If you do not consent, please do not access or use the Service.
1. Changes to this Policy
We may revise this Policy at any time by updating this document, in accordance with Clause 1 of the Terms. Your continued use of the Service after a revised version is posted constitutes your acceptance of the revised Policy.
2. Information We Collect
We collect and process the following personal data about you:
- full name;
- email address;
- mobile number;
- billing address;
- payment information;
- IP address;
- government-issued identification (for identity verification purposes only, as described in Clause 8);
- third-party account identifiers (such as a Discord user ID); and
- online and analytics identifiers, such as an anonymous distinct identifier, device identifier, and session identifier generated when you use the Websites, as described further in Clause 8 (Third-Party Processors) and our Cookie Policy.
3. How We Collect Your Information
We collect information about you when you use any of our Services, including our hosted services, Websites, client and control panel dashboards, game servers, and community platforms. We may store any information you provide to us.
4. How We Use Your Information, and Our Legal Basis for Doing So
Under the UK General Data Protection Regulation, we must have a valid legal basis to process your personal data. The table below sets out the purposes for which we use your information and the legal basis we rely on for each.
| Purpose | Legal Basis |
|---|---|
| Creating and administering your user account | Performance of a contract with you |
| Enforcing these Terms and our other policies | Legitimate interests (protecting our Services, other customers, and our business) |
| Payment processing | Performance of a contract with you; compliance with a legal obligation (financial record-keeping) |
| Customer support | Performance of a contract with you; legitimate interests |
| Security and fraud prevention checks | Legitimate interests; compliance with a legal obligation |
| Compliance with legal obligations | Compliance with a legal obligation |
| Service and account notifications | Legitimate interests, or your consent where required (for example, marketing communications) |
If we wish to use your information for a purpose not listed above, we will ask for your consent and will only use your information for that purpose once consent is given, unless we are otherwise required or permitted to do so by law.
5. How We Share Your Information
We do not transfer your personal data to a third party without your consent, except in the limited circumstances described in this Clause and Clause 8 (Third-Party Processors).
We require any third party to whom we transfer personal data to use it only for the purpose for which it was transferred, and not to retain it for longer than necessary for that purpose.
We may also disclose your personal data: (1) to comply with applicable law, regulation, court order, or other legal process; (2) to enforce our agreements with you, including the Terms and this Policy; or (3) to investigate or respond to a claim that your use of the Service violates the rights of a third party. If our company or the Service is merged with, or acquired by, another entity, your information will be one of the assets transferred to the new owner, subject to that entity's compliance with applicable data protection law.
6. International Data Transfers
Some of the third-party processors listed in Clause 8 are located, or process data, outside the United Kingdom, including in the United States. Where we or our processors transfer your personal data outside the UK, we do so only where an adequate level of protection applies, whether under an applicable UK adequacy regulation, or by putting in place an appropriate safeguard recognised under UK data protection law, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses. You may request further information about the safeguards that apply to a specific transfer by contacting us using the details in Clause 16 (Contact Us).
7. Retention of Your Information
We retain your personal data for between 90 days and 2 years following your account becoming idle, or for as long as we need it to fulfil the purposes described in this Policy, whichever is longer. We may retain certain information for longer periods where required for record-keeping, reporting, or other obligations under applicable law, or for other legitimate reasons such as the enforcement of legal rights or fraud prevention. Residual anonymous or aggregated information that does not identify you, directly or indirectly, may be retained indefinitely.
8. Third-Party Processors
We use the following third-party processors in connection with the Service. If we add or remove a processor, we will update this list accordingly.
Google (Sign-In) and Discord (Sign-In)
Where you choose to sign in or register using Google or Discord single sign-on, we receive limited profile information from that provider, such as your name, email address, and account identifier, to create or authenticate your account.
Google's privacy policy: https://policies.google.com/privacy Discord's privacy policy: https://discord.com/privacy
Google Ads
We use Google Ads, an advertising platform, to display and manage advertising for our Services. When a conversion (such as a purchase) occurs, we notify Google of that conversion together with a Google Click Identifier ("gclid"), which allows Google to associate the conversion with the anonymous user who clicked the relevant advertisement. We do not share your name, email address, or other identifying customer information with Google for this purpose.
Google's privacy policy: https://policies.google.com/privacy
Google Cloud Platform (GCP)
We use GCP to operate parts of our infrastructure. This includes using GCP as a front door for our Websites, directing and load-balancing web traffic to our systems, and using Google Cloud Armor and associated web application firewall (WAF) tooling to help protect the Service against distributed denial-of-service attacks and other malicious traffic; in providing this protection, GCP may process limited data about incoming requests, such as IP addresses. We also use GCP for object storage buckets used for backups of Service data.
Google's privacy policy: https://policies.google.com/privacy
Amazon Web Services (AWS) and Cloudflare
We use AWS and Cloudflare for off-site object storage, used to maintain backup copies of Service data for resilience and continuity purposes.
AWS's privacy policy: https://aws.amazon.com/privacy Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy
Langfuse
We use Langfuse to monitor, evaluate, and improve the performance of AI-assisted tools used in connection with the Service, including oversight of their outputs. Where personal data would otherwise be processed for this purpose, we take steps to obfuscate personally identifiable information before it is processed by Langfuse.
Langfuse's privacy policy: https://langfuse.com/privacy
Mailgun
We use Mailgun to send transactional and account-related emails on our behalf.
Mailgun's privacy policy: https://www.mailgun.com/privacy-policy/
PostHog
We use PostHog to process website metrics and analytics for our Websites. In doing so, we share the following information with PostHog: an anonymous distinct identifier and device identifier generated for your browser or device, session identifiers, IP address, and information about the pages you view, the features you use, and any errors you encounter. We do not share your name, email address, or other directly identifying account information with PostHog for this purpose. Further detail on the specific cookies PostHog sets, and how to manage your preferences, is set out in our Cookie Policy.
PostHog's privacy policy: https://posthog.com/privacy
PayPal
We use PayPal to process payments for purchases.
PayPal's privacy policy: https://www.paypal.com/privacy
Stripe
We use Stripe to process payments and to carry out identity verification (KYC) checks.
Stripe's privacy policy: https://stripe.com/privacy
Discord (Support)
Separately from Discord sign-in described above, we may store your Discord user ID for support purposes where you contact us via Discord.
Discord's privacy policy: https://discord.com/privacy
9. Third-Party Websites and Links
The Service may contain links or connections to third-party websites and services. This Policy does not address the privacy or data processing practices of any third party, including any processor referenced in Clause 8 or any site we link to. We encourage you to review the privacy policy of every website you visit. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party site or service.
10. Cookies
We, and some of the third-party processors listed in Clause 8 (including PostHog), use cookies and similar tracking technologies on the Websites. Further information, including how to manage your cookie preferences, is set out in our Cookie Policy.
11. Do Not Track
Some web browsers transmit "Do Not Track" ("DNT") signals to websites. There is currently no consistent industry standard for interpreting or responding to DNT signals, and no requirement under UK law — including the UK GDPR or the Privacy and Electronic Communications Regulations 2003 — that we honour them. Accordingly, we do not alter our data collection or processing practices in response to DNT signals received from your browser.
If you wish to limit or opt out of analytics cookies or other non-essential tracking, please manage your preferences through our cookie consent system, which you can access by clicking Cookie settings in the footer of any page on our Websites. Further information on how cookies and similar technologies work, and how to manage your consent, is set out in our Cookie Policy.
12. Children's Privacy
This Clause addresses our processing of personal data under applicable data protection law, and is separate from the eligibility requirements for using the Services set out in Clause 2 of the Terms (Eligibility and User Representations).
We will process a child's personal data where the child has reached the minimum age at which the data protection law of their country of habitual residence permits them to consent to such processing on their own behalf (in the United Kingdom, this is 13 years old, under the Data Protection Act 2018), or, where the child has not reached that age, where we have obtained the verifiable consent of a person holding parental responsibility for the child.
If we become aware that we have processed a child's personal data without the consent required by this Clause, we will take steps to obtain the necessary consent or, where that is not possible, to delete that information.
13. Your Rights
Depending on the law that applies to you, you may have the right to: access, rectify, or erase your personal data; receive a copy of your personal data; restrict or object to our processing of your personal data; request that we transfer (port) your personal data to another entity; withdraw any consent you have given us; and lodge a complaint with a supervisory authority, including the Information Commissioner's Office (ICO), the UK's independent regulator for data protection, at ico.org.uk, or another relevant supervisory authority in your country of residence, if applicable.
To exercise these rights, or to opt out of direct marketing communications or associated profiling, you can write to us at [email protected]. We will respond to your request in accordance with applicable law.
Please note that if you do not provide the personal data we require, or you withdraw consent for its processing where consent is our legal basis, you may not be able to access or use the Service, or the part of it for which that information was required.
14. Security
We take the security of your personal data seriously and maintain technical and organisational measures designed to protect it against loss, misuse, and unauthorised access or alteration. These measures include encrypting data in transit between your device and our systems, and restricting access to personal data to the personnel and systems that need it to provide the Service, on a need-to-know basis.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you become aware of any actual or suspected security issue affecting your account or the Service, please contact us promptly using the details in Clause 17 (Contact Us).
15. Data Breach Notification
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it, in accordance with our obligations under the UK GDPR.
Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly and without undue delay, describing the nature of the breach and the measures we have taken or propose to take to address it, unless an exemption under the UK GDPR applies (for example, because we have taken measures, such as encryption, that render the affected data unintelligible to any person not authorised to access it, or because notifying you individually would involve disproportionate effort, in which case we will instead make a public communication or take similarly effective measures).
16. Governing Law
This Policy is governed by, and forms part of an agreement governed by, the laws of England and Wales, and is subject to Clause 16 of the Terms (Governing Law, Jurisdiction and Dispute Resolution), save that nothing in this Clause affects the application of UK data protection law to our processing of your personal data, or your right to lodge a complaint with a supervisory authority under Clause 13.
17. Contact Us
If you have any questions or concerns about how we process your personal data, please contact us at:
Horizon Hosting Limited (trading as Horizon Hosting) 11 Ann Wicks Road Frampton On Severn Gloucester GL2 7HH United Kingdom
Company Number: 13693820 Email: [email protected] Phone: +44 20 3137 9373