Version privacy-2026-09-19

HATs Privacy Notice — 19 September 2026

K.M. CUNNING PLAN CONSULTING LTD, company registration number HE413011, trading as Horizon Rider, operates Horizon Adventure Trails (HATs), the route and membership service described in this document. HATs is not a separate legal entity. K.M. CUNNING PLAN CONSULTING LTD is the contracting entity and data controller.

Registered office: Athinon & Anexartisias, NORA COURT, Floor 3, Flat 301, 3040 Lemesos, Cyprus

Support and privacy email: support@hats.bike

1. Data controller and contact

The data controller is K.M. CUNNING PLAN CONSULTING LTD, trading as Horizon Rider. Horizon Adventure Trails (HATs) is the route and membership service through which the processing described in this notice takes place.

Support and privacy email: support@hats.bike

2. Information we use

• your name and email address;
• account and security information, including a securely salted password hash, verification and reset-token records, and essential session information;
• membership start, renewal or expiry dates and status, and permanent Founder Member status;
• the Terms and Privacy document versions you accepted and the acceptance time;
• login and security records, including last login and authentication events;
• GPX download time and pack version; and
• your separate Horizon Rider marketing preference, including its state, time and source.

Passwords are not stored in readable or recoverable form and are not displayed to administrators.

3. Why we use it and our legal bases

• Contract: to create and run your account, activate and administer membership, provide the member network and GPX downloads, and send service messages needed to deliver those functions.
• Legitimate interests: to secure, troubleshoot and improve the reliability of the service; prevent misuse; maintain audit records; and administer the HATs route service, balanced against your rights.
• Legal obligation: where records or disclosures are required by applicable law.
• Consent: only for the optional Horizon Rider news, rides and offers preference. You may withdraw it at any time in your account without affecting membership or earlier lawful processing.

4. Operational messages are not marketing

HATs may send account verification, password-reset, security, membership-administration and important route or service notifications needed to operate or protect the service. These operational messages are separate from Horizon Rider marketing and do not depend on marketing consent.

5. Sharing and service providers

Data is shared only where necessary with HRCCC, the common People/customer system used by K.M. CUNNING PLAN CONSULTING LTD for Horizon Rider and HATs; Cloudflare, which hosts the Worker, D1 database, R2 storage, related infrastructure and transactional-email delivery; and professional or technical service providers acting under appropriate obligations. K.M. CUNNING PLAN CONSULTING LTD may also disclose information where required by law or to establish, exercise or defend legal claims. Personal data is not sold.

6. International transfers

Some providers may process data outside Cyprus or the European Economic Area. Where applicable, K.M. CUNNING PLAN CONSULTING LTD will use a lawful transfer mechanism, such as an adequacy decision or approved standard contractual clauses, together with appropriate supplementary safeguards where required.

7. Retention

Account and membership information is kept while your account or membership is active and afterwards only as long as reasonably necessary for administration, security, dispute handling and legal obligations. Consent and withdrawal records, security events and GPX download history are kept for an appropriate audit period. Expired verification and reset tokens and sessions are deleted or rendered unusable under the service’s security schedule. Records are then deleted or anonymised unless law requires longer retention.

8. Your data-protection rights

Subject to applicable law, you may request access, correction, erasure or restriction; object to processing based on legitimate interests; request portability; and withdraw consent at any time. You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus or another competent supervisory authority. Visit the Cyprus Commissioner’s website ↗.

9. Essential cookies

HATs uses only the strictly necessary hats_session cookie after login to keep you signed in and protect access to member functions. It is Secure in production, HttpOnly, SameSite=Lax and expires after no more than 30 days or on logout. HATs v1 does not use non-essential analytics, advertising or marketing cookies, so no cookie-consent banner is shown.

10. Changes

If this notice changes materially, K.M. CUNNING PLAN CONSULTING LTD, trading as Horizon Rider, will publish the new version and take any additional steps required by law.