1. Introduction
This Privacy Policy is issued by Hostking (Pty) Ltd (registration number 2013/095847/07), trading as Hostking South Africa (“Hostking”, “we”, “us”, “our”), of 105 Wellington Street, Vasco Estate, 7460, South Africa. It explains how we collect, use, store, share and protect personal information when you use our website at www.hostking.co.za, our Client Area at my.hostking.host, or any of our services.
We comply with the Protection of Personal Information Act 4 of 2013 (POPIA). For the information we collect about our customers and website visitors, Hostking is the responsible party. For personal information inside the content our customers host with us, see section 6 below.
2. Information Officer
Our Information Officer is registered with the Information Regulator and is responsible for our compliance with POPIA.
- Information Officer: Abdul-Aziz Arnold
- Email: info@hostking.host
- Phone: +27 87 802 0155
- Address: 105 Wellington Street, Vasco Estate, 7460, South Africa
3. Information We Collect
Information you provide:
- Name, email address, phone number and billing address when you register
- Payment information — processed securely by our payment processors (we do not store card details)
- Domain registration details required by domain registries
- Support ticket content and communications with our team
- Website content and data you upload to our hosting services
Information collected automatically:
- IP address and browser type when you visit our website
- Pages visited, time spent and referring URLs via Google Analytics
- Server logs relating to your hosting activity
- Cookies — see our Cookie section below
4. How We Use Your Information
- To provision and manage your hosting, domain and email services
- To process payments and issue invoices in ZAR (South African Rand)
- To send service notifications, renewal reminders and account updates
- To provide customer support via live chat, email and support tickets
- To protect our servers and customers from abuse, fraud, malware and other security threats
- To comply with South African law and respond to lawful requests from South African authorities
- To improve our website and services through analytics
- To send promotional communications — only where you have opted in
Website designs shown as examples
When you ask us for a free website design or use our website builder, we may show the design we make for you as an example on our websites, so other people can see our work. We always hide your phone number, email address, WhatsApp number and street address. The business name, the kind of business and the town may be shown. You can say no by ticking “Don’t show my design as an example” on the form, or at any time by emailing webdesign@hostking.host, and we will remove it. Our team checks every design before it is shown.
5. Legal Basis for Processing
- Contract: Processing necessary to deliver the services you have purchased
- Legal obligation: Processing required under South African law, including POPIA and the Electronic Communications and Transactions Act (ECTA)
- Legitimate interests: Security monitoring, fraud prevention and service improvement
- Consent: Marketing communications where you have explicitly opted in
6. Data You Host With Us
Our customers store their own content on our services, such as websites, databases and mailboxes, and that content often contains personal information about other people. For that information, our customer is the responsible party and Hostking is the customer’s operator under POPIA. We process it only to provide, maintain, secure and support the services, on the customer’s instructions, or where the law requires it. We keep it confidential, protect it with the security measures in section 10, and notify the customer immediately if we believe it has been accessed by an unauthorised person.
The full operator terms are in section 26A of our Terms of Service. If your personal information is stored on a website or mailbox hosted by one of our customers, please contact that customer first, as they decide how it is used.
Spam and phishing filtering
As our customers' operator, and to protect the mailboxes we host, our mail servers check incoming email for spam and phishing. Our spam filtering system reads our mail server logs, not the contents of mailboxes. For suspicious incoming email it keeps, for up to 7 days, the sender’s domain and sending server, the spam filter’s results, the subject line, and a one-way code in place of each recipient address. We use this only to find spam and phishing campaigns that reach several of our customers and to add filtering rules against them on all our servers. These rules raise a message’s spam score so it goes to the spam folder; they do not delete email. Staff can review and remove any rule.
To help judge whether a suspicious campaign is phishing, spam or legitimate mail, we send the sender’s domain, sending servers, spam filter results, message counts and up to three subject lines to Anthropic, the provider of the Claude AI service, in the United States. Email addresses and long numbers are removed from the subject lines first. We never send message contents or recipient addresses.
7. Data Sharing
We do not sell personal information. We share it only with the following parties, and only as needed for the purposes listed:
- Hetzner Online GmbH (Germany): data centre and server provider for our hosting servers and backups, under a data processing agreement
- Payment processors: secure payment processing for transactions in ZAR (South African Rand)
- Domain registries and registrars: registration details required to register and manage domain names
- Anthropic PBC (United States): AI tools that help us filter spam and phishing, and help our support team understand technical problems and prepare replies. We only share what is needed to deal with your request, and a staff member always checks and sends the reply. Anthropic does not use this information to train its AI.
- Google Analytics: website usage data
- Meta (Meta Pixel): measuring the effectiveness of our advertising
- SMS and email delivery providers: sending service notifications you receive from us
- Legal compliance: where required by South African law, or by a lawful order from the Information Regulator, a court or another South African authority
8. Where Your Data Is Stored
- Our hosting servers and backup servers are in data centres in Germany, where the EU General Data Protection Regulation (GDPR) applies, and, for some older servers, in South Africa.
- Our support and technical staff work from South Africa. Our systems are also administered remotely from the United Arab Emirates.
- Some of the service providers in section 7, such as Google, Meta and Anthropic, may process information in other countries, including the United States.
We only transfer personal information outside South Africa where the recipient is subject to a law, binding agreement or binding corporate rules that give an adequate level of protection, as required by section 72 of POPIA. Our staff are bound by confidentiality obligations.
9. Data Retention
- Account data: retained for the duration of your account and up to 5 years after closure
- Billing records: retained for 7 years in line with South African financial record-keeping requirements
- Support ticket history: retained for 3 years
- Server and website logs: generally retained for up to 30 days, and never longer than 90 days
- Spam filter data about suspicious incoming email: up to 7 days
- Hosting data: deleted from our servers within 30 days of account termination after the grace period
- Backups: kept for up to 7 days while your account is active; backups of a terminated account are deleted automatically within 180 days
10. Security
- SSL/TLS encryption for data sent to and from our website and Client Area, and encrypted connections available for your hosting, email and file transfers
- Secure password hashing in our client portal
- Two-factor authentication (2FA) available and recommended for all accounts
- Malware scanning and firewall protection on our hosting servers
- Isolation between hosting accounts on shared servers
- Administrative access to servers restricted to Hostking system administrators
- Access controls limiting staff access to personal information
Payment card data is never stored by Hostking — all payment processing is handled by our payment processors on PCI-DSS compliant infrastructure.
11. Security Breaches
If we have reasonable grounds to believe that personal information for which we are the responsible party has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected people as soon as reasonably possible, as required by section 22 of POPIA. If the information is in content a customer hosts with us, we will notify that customer immediately so they can take the steps required of them.
12. Your Rights
Under POPIA, you have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate or incomplete information
- Request deletion of your personal information, subject to legal obligations
- Object to processing for marketing purposes
- Request your information in a portable format
- Withdraw consent for marketing communications at any time
To exercise any of these rights, contact our Information Officer at info@hostking.host. We will respond within 30 days.
If you are not satisfied with how we handle your personal information, you have the right to lodge a complaint with the Information Regulator (South Africa): inforegulator.org.za, enquiries@inforegulator.org.za, 0800 017 160.
13. Cookies
- Essential cookies: Required for the website to function correctly
- Analytics cookies: Google Analytics — website usage data
- Live chat: our own chat keeps your conversation in your browser's storage for up to 12 hours so it stays open between pages
- Marketing cookies: Meta Pixel — measures advertising effectiveness
What our websites use:
- Google Analytics 4 (Google): shows how visitors use our website.
- Google Ads tag (Google): shows which of our ads lead to orders.
- Meta Pixel (Meta Platforms): measures our Facebook and Instagram ads. If you arrive from a Facebook ad, we pass its click id (fbclid) to our cart.
- Live chat: keeps your chat open between pages for up to 12 hours (stored in your browser). Chat replies may come from an AI assistant before a staff member joins.
- Our own attribution cookies: hk_ft records where you first came from (12 months), hk_lt your most recent source (30 days) and hk_vid a random visitor id (12 months). They record the pages, referrer, campaign (UTM) tags and ad click ids and send them to our client area at my.hostking.host, and the visitor id is added to links to my.hostking.host, so we can see which campaigns lead to sign-ups.
Google and Meta receive your IP address, device details and the pages you view, and Google and Meta may process this in the United States. When you first visit, a cookie banner lets you accept or reject analytics and advertising cookies, and the Cookie settings link at the foot of every page lets you change your choice later. Visitors in the UK, the European Economic Area and Nigeria get none of these cookies unless they accept them. Your choice is kept in a cookie called hk_consent for 6 months. You can also email info@hostking.host, block or delete cookies in your browser, or install Google's Analytics opt-out browser add-on. Refusing these cookies does not affect your hosting services.
You can control cookie settings through your browser. Disabling cookies may affect some website functionality.
14. Children’s Privacy
Our services are not directed at individuals under 18. We do not knowingly collect data from minors. Contact us at info@hostking.host if you believe a minor has submitted data to us.
15. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or in South African law. Material changes will be notified to active customers via email. The effective date at the top of this page will be updated accordingly.
16. Contact Us
- Information Officer: Abdul-Aziz Arnold — info@hostking.host
- Support: support@hostking.host
- Phone: +27 87 802 0155
- Address: Hostking (Pty) Ltd, 105 Wellington Street, Vasco Estate, 7460, South Africa
- Website: www.hostking.co.za