Privacy Policy

1. About this policy

Brandon Yap and Elizabeth Yap are partners trading as Horizon Hosting (ABN 38 994 469 579), providing web hosting, email hosting, domain-name and related technical services. In this policy, “Horizon Hosting”, “we”, “us” and “our” refer to that partnership.

This policy explains how we collect, hold, use and disclose personal information. We handle personal information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply to us.

This policy applies to website visitors, prospective and current customers, authorised account contacts and other people who communicate with us.

2. Personal information we collect

Depending on how you interact with us, we may collect:

• identity and contact details, including your name, business or organisation name, ABN or business number, address, telephone number and email address;
• account and service details, including authorised contacts, hosting plan, billing cycle, domains, service configuration and support history;
• domain-registration information, including registrant and eligibility details required by TPP Wholesale or the relevant domain registry;
• billing and transaction information, including billing addresses, invoices, payment status and limited payment-method information supplied by Stripe;
• communications you send to us, including enquiries, orders, support requests, complaints and any additional information you provide;
• technical information, including IP addresses, access times, browser and device information, pages visited, referral information, cookies, analytics identifiers, server logs and security events;
• website, email, database, backup and other content stored or transmitted through services we provide; and
• information needed to investigate misuse, spam, fraud, security incidents or breaches of our terms.

Our public contact and hosting-order forms are not designed to collect payment-card details. Please do not include card details, passwords or other confidential credentials in those forms or in ordinary email.

We do not intentionally request sensitive information unless it is reasonably necessary for a particular matter. Customer websites, mailboxes and other hosted content may nevertheless contain sensitive information chosen or controlled by the customer.

3. How we collect and use information

We generally collect personal information directly from you when you order or use a service, make a payment, contact us or request support. We may also collect it from a person authorised to act for you, from providers involved in delivering your services, and automatically through cookies, server logs and the operation of our systems.

When you submit our contact form, we use your IP address to confirm that the submission originates from Australia. The address is checked using MaxMind’s geolocation service and is included with the enquiry sent to our team.

If required information is not provided, we may be unable to process an order, register a domain, provide a service, issue an invoice, respond to an enquiry or verify that a request is authorised.

Why we use personal information

• to respond to enquiries, review orders and establish and administer customer accounts;
• to register, renew, transfer and manage domain names through TPP Wholesale and relevant registries;
• to provide and support website, email, DNS, backup and related services;
• to authenticate users, diagnose faults and maintain account and system security;
• to process Stripe payments, issue invoices and manage refunds, disputes and overdue accounts;
• to send service, billing, maintenance, security and account communications;
• to understand website use, improve our services and measure advertising performance;
• to detect and prevent spam, abuse, fraud, unauthorised access and other security threats;
• to enforce our terms and meet accounting, taxation, regulatory and legal obligations; and
• to manage complaints, disputes, incidents and business records.

We may send operational messages needed to provide your services. We only send commercial electronic marketing where permitted by law, and those messages will identify us and provide a straightforward way to unsubscribe. We do not sell customer contact lists or personal information.

Payments and automated checks

Card payments are collected and processed by Stripe. Horizon Hosting does not collect or store full payment-card numbers or security codes on its systems. Stripe may provide us with transaction records, payment status and limited payment-method information needed to administer payments, refunds and disputes.

Stripe, banks and payment networks may use payment details, transaction history, billing information, IP addresses and device information to authorise payments and assess fraud risk. Their automated systems may approve, decline or flag a payment for review. If a payment cannot be completed, contact us to discuss the order or another payment method. We cannot override a decision made by Stripe, a bank or a payment network.

4. Customer-hosted content

Customers may use our services to store or transmit information about their own customers, employees or other people. The Horizon Hosting customer generally decides what that information is and why it is handled.

Our systems automatically process customer-hosted content as necessary to store, transmit, back up, filter and secure the service. Our personnel access that content only where reasonably necessary to provide support, maintain or secure the service, respond to an authorised request, enforce our terms or comply with law.

If your information appears in a website, mailbox or service operated by one of our customers, you should normally direct your privacy request to that customer. We will provide reasonable assistance where appropriate.

5. Cookies, analytics and advertising

Our website uses essential session cookies for form security and normal operation. It also uses Google Analytics to understand website traffic, sessions, approximate location, devices and page use, and Google Ads measurement technologies on some pages to measure enquiries and advertising performance.

These services may use cookies or similar identifiers. We do not intentionally send names, email addresses or other directly identifying form contents to Google Analytics. You can restrict cookies through your browser and use Google’s privacy and advertising controls, although blocking essential cookies may prevent some forms from working correctly.

For more information, see Google’s Privacy Policy.

6. When we disclose information

We may disclose personal information to:

• hosting infrastructure, datacentre, backup, email and security providers;
• TPP Wholesale, its related service providers and the registry responsible for a domain extension;
• Stripe, banks, payment networks and financial institutions;
• analytics, advertising and geolocation providers, including Google and MaxMind;
• accountants, insurers, lawyers, auditors, debt-recovery services and other professional advisers;
• contractors who help us operate or support our services;
• regulators, law-enforcement agencies, courts or other parties where required or authorised by law; and
• a prospective purchaser or adviser involved in a proposed sale or restructuring of the business, subject to appropriate confidentiality protections.

Domain-registration rules require us to provide registrant and eligibility information to TPP Wholesale and the applicable registry. Some registration information may be disclosed through domain-registration systems where required by registry rules or law.

Stripe and TPP Wholesale handle information under their own terms and privacy practices. You can read the Stripe Privacy Policy and TPP Wholesale Privacy Policy.

Overseas disclosures

Horizon Hosting’s website and email hosting infrastructure is located in Australia. However, using an Australian hosting service does not mean every item of personal information remains in Australia.

Likely overseas recipients include service providers in the United States, United Kingdom, Ireland and India. Domain-registration information may also be disclosed to registry operators or service providers in countries associated with particular domain extensions. The countries involved can vary according to the domain, provider and service selected.

Where the Australian Privacy Principles apply, we take reasonable steps to ensure overseas disclosures are handled consistently with those principles unless an exception applies.

7. Storage, security and retention

Personal information may be held in customer and billing systems, email, support records, server logs, hosting systems, backups and records maintained by our service providers.

We use reasonable technical and organisational safeguards appropriate to the information and risks involved. These may include access controls, authentication, encryption in transit, system monitoring, backups and restrictions on administrative access. No internet transmission or storage system is completely secure. You are responsible for protecting passwords and promptly notifying us if you believe an account or credential has been compromised.

We retain information only for as long as reasonably necessary to provide services, maintain business and taxation records, resolve disputes, meet legal obligations, enforce agreements and manage security. Information that is no longer required is destroyed or de-identified where reasonably practicable. Residual copies may remain in backups until those backups are rotated or securely retired.

Data breaches

If we become aware of a suspected data breach, we will take reasonable steps to contain and assess it, reduce any resulting risk and notify affected people and the Office of the Australian Information Commissioner where required by law.

8. Accessing or correcting your information

You may ask to access personal information we hold about you or request that inaccurate, out-of-date, incomplete, irrelevant or misleading information be corrected.

Contact us using the details below. We may need to verify your identity and authority before acting on a request. In some circumstances, the law allows or requires us to refuse access. If that occurs, we will explain the reason where permitted.

We do not ordinarily charge for making a request. If providing access would involve substantial work or expense, we will discuss any reasonable charge with you first.

Privacy complaints

If you believe we have mishandled your personal information, contact us and provide enough detail for us to investigate. We will acknowledge the complaint, investigate it fairly and respond within a reasonable period. We may contact you for further information.

If the Privacy Act applies to the matter and you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner.

9. Changes to this policy and contact details

We may update this policy when our services, providers, practices or legal obligations change. The current version and its last-updated date will be published on this page. Where practical, we will give additional notice of material changes.

Privacy enquiries, access and correction requests, and complaints can be sent to: