Privacy Policy

This policy explains what data HORIZON (hantavirus.software) collects, how we use it, and your rights under the UK General Data Protection Regulation. We are operated by 79th Unit Limited (Companies House 17133814, United Kingdom). Last updated: 13 May 2026.

1. What we collect

HORIZON is a read-only public-data platform. We collect the minimum data needed to operate the service securely:

• Server access logs — IP address, User-Agent, HTTP request line, response code, response size, timestamp, referrer. Retained for 30 days for security monitoring and capacity planning, then automatically purged.
• API rate-limit state — IP address kept in-memory for the duration of the 1-minute rate-limit window (60 requests per IP per minute).
• Security incident records — if we detect abuse, the relevant access-log lines may be retained beyond 30 days for investigation under our security disclosure policy.

2. What we do NOT collect

• We do not use Google Analytics, Plausible, Matomo, or any analytics service that shares data with third parties.
• We do not use advertising trackers, retargeting pixels, or social-media tracking cookies.
• We do not require an account, login, or email address to read HORIZON content or use the public API.
• We do not collect any sensitive personal data (race, ethnicity, political opinion, religion, union membership, genetic data, biometric data, health data, sex life, sexual orientation).

3. Cookies

HORIZON does not set first-party cookies. The Carto map tiles (basemaps.cartocdn.com) and Google Fonts (fonts.googleapis.com, fonts.gstatic.com) may set their own cookies under their respective privacy policies — we have no control over those. Per UK GDPR / PECR, we do not require a cookie banner because we set no first-party cookies and the third-party cookies above are strictly necessary for map rendering and webfont delivery.

4. Third-party services

Map tiles and Google Fonts are loaded by your browser directly from those third parties when you view the live map. Your IP address is visible to them in that request. We do not control their data processing.

5. Lawful basis (UK GDPR Article 6)

We process server access logs under legitimate interests (Article 6(1)(f) UK GDPR): operating, securing, and improving a public public-health surveillance service. The data we collect is limited to what is strictly necessary to detect abuse and operate the service.

6. International transfers

Server infrastructure is hosted by OVHcloud in Roubaix, France (EU). Backup infrastructure is in Strasbourg, France (EU) and Falkenstein, Germany (EU). No personal data is transferred outside the EU/UK by HORIZON's own systems. Third-party services (Carto, Google) may transfer data to their own jurisdictions per their published privacy policies.

7. Your rights under UK GDPR

You have the right to:

• Request access to any personal data we hold about you (Article 15).
• Request rectification of inaccurate personal data (Article 16).
• Request erasure of your personal data (Article 17), subject to our legitimate-interest grounds.
• Object to processing under legitimate interests (Article 21).
• Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email privacy@79thunit.co.uk. We respond within one month per UK GDPR.

8. Children

HORIZON content is not directed at children under 13. We do not knowingly process data from children. If you become aware that a child has provided personal data, email privacy@79thunit.co.uk and we will delete it.

9. Data Protection Officer

Email: privacy@79thunit.co.uk
Postal: 79th Unit Limited, United Kingdom. Companies House: 17133814.

10. Changes

Material changes to this policy will be announced in the corrections log with the effective date.

Effective date: 13 May 2026. → Terms of Service