See your new website free in about a minute Free .com domain for the first year on yearly Starter and up 30-day money-back guarantee Free website migration Live chat with real people, 7 days a week

Home Legal Privacy Policy

Privacy Policy

Your data is protected with Hostking’s privacy practices.

📅 Effective Date: October 2026  •  Last Updated: October 2026

1. Introduction

This Privacy Policy is issued by Hostking (Pty) Ltd (registration number 2013/095847/07), trading as Hostking (“Hostking”, “we”, “us”, “our”), of 105 Wellington Street, Vasco Estate, 7460, South Africa. It explains how we collect, use, store, share and protect personal information when you use our website at www.hostking.host/en-my, our Client Area at my.hostking.host, or any of our services.

As a South African company we comply with the Protection of Personal Information Act 4 of 2013 (POPIA). For people outside South Africa we also comply with the EU General Data Protection Regulation (GDPR) where it applies to you, and any other data protection law of the country where you live. For the information we collect about our customers and website visitors, Hostking is the controller (the “responsible party” under POPIA). For personal information inside the content our customers host with us, see section 6 below.

2. Information Officer and Privacy Contact

Our Information Officer is registered with South Africa’s Information Regulator and is responsible for our compliance with POPIA and the GDPR or the data protection law of your country.

3. Information We Collect

Information you provide:

  • Name, email address, phone number and billing address when you register
  • Payment information — processed securely by our payment processors (we do not store card details)
  • Domain registration details required by domain registries
  • Support ticket content and communications with our team
  • Website content and data you upload to our hosting services

Information collected automatically:

  • IP address and browser type when you visit our website
  • Pages visited, time spent and referring URLs via Google Analytics
  • Server logs relating to your hosting activity
  • Cookies — see our Cookie section below

4. How We Use Your Information

  • To provision and manage your hosting, domain and email services
  • To process payments and issue invoices in US dollars (USD)
  • To send service notifications, renewal reminders and account updates
  • To provide customer support via live chat, email and support tickets
  • To protect our servers and customers from abuse, fraud, malware and other security threats
  • To comply with the law of South Africa and of your country, and respond to lawful requests from authorities there
  • To improve our website and services through analytics
  • To send promotional communications — only where you have opted in

Website designs shown as examples

When you ask us for a free website design or use our website builder, we may show the design we make for you as an example on our websites, so other people can see our work. We always hide your phone number, email address, WhatsApp number and street address. The business name, the kind of business and the town may be shown. You can say no by ticking “Don’t show my design as an example” on the form, or at any time by emailing webdesign@hostking.host, and we will remove it. Our team checks every design before it is shown.

5. Legal Basis for Processing

  • Contract: Processing necessary to deliver the services you have purchased
  • Legal obligation: Processing required by law, including POPIA and the EU General Data Protection Regulation (GDPR) where it applies to you, and any other data protection law of the country where you live
  • Legitimate interests: Security monitoring, fraud prevention and service improvement
  • Consent: Marketing communications where you have opted in, and analytics and advertising cookies where the law requires consent (see section 13)

6. Data You Host With Us

Our customers store their own content on our services, such as websites, databases and mailboxes, and that content often contains personal information about other people. For that information, our customer is the controller and Hostking is the customer’s processor under the GDPR or the data protection law of your country (and its operator under POPIA). We process it only to provide, maintain, secure and support the services, on the customer’s instructions, or where the law requires it. We keep it confidential, protect it with the security measures in section 10, and notify the customer without undue delay if we believe it has been accessed by an unauthorised person.

The full data processing terms are in section 26A of our Terms of Service. If your personal information is stored on a website or mailbox hosted by one of our customers, please contact that customer first, as they decide how it is used.

Spam and phishing filtering

As our customers' processor, and to protect the mailboxes we host, our mail servers check incoming email for spam and phishing. Our spam filtering system reads our mail server logs, not the contents of mailboxes. For suspicious incoming email it keeps, for up to 7 days, the sender’s domain and sending server, the spam filter’s results, the subject line, and a one-way code in place of each recipient address. We use this only to find spam and phishing campaigns that reach several of our customers and to add filtering rules against them on all our servers. These rules raise a message’s spam score so it goes to the spam folder; they do not delete email. Staff can review and remove any rule.

To help judge whether a suspicious campaign is phishing, spam or legitimate mail, we send the sender’s domain, sending servers, spam filter results, message counts and up to three subject lines to Anthropic, the provider of the Claude AI service, in the United States. Email addresses and long numbers are removed from the subject lines first. We never send message contents or recipient addresses.

7. Data Sharing

We do not sell personal information. We share it only with the following parties, and only as needed for the purposes listed:

  • Hetzner Online GmbH (Germany): data centre and server provider for our hosting servers and backups, under a data processing agreement
  • Payment processors: secure payment processing for transactions in US dollars (USD)
  • Domain registries and registrars: registration details required to register and manage domain names
  • Crisp: live chat support on our website
  • Anthropic PBC (United States): AI tools that help us filter spam and phishing, and help our support team understand technical problems and prepare replies. We only share what is needed to deal with your request, and a staff member always checks and sends the reply. Anthropic does not use this information to train its AI.
  • Google Analytics: website usage data
  • Meta (Meta Pixel): measuring the effectiveness of our advertising
  • SMS and email delivery providers: sending service notifications you receive from us
  • Legal compliance: where required by the law of South Africa or your country, or by a lawful order from a regulator, a court or another authority

8. Where Your Data Is Stored

  • Our hosting servers and backup servers are in data centres in Germany, where the EU General Data Protection Regulation (GDPR) applies, and, for some older servers, in South Africa.
  • Our support and technical staff work from South Africa. Our systems are also administered remotely from the United Arab Emirates.
  • Some of the service providers in section 7, such as Google, Meta and Anthropic, may process information in other countries, including the United States.

We only transfer personal information outside South Africa where the recipient is subject to a law, binding agreement or binding corporate rules that give an adequate level of protection, as required by section 72 of POPIA. Where the GDPR or the data protection law of your country applies, Hostking transfers personal information out of your country only as that law allows, for example to countries it recognises as giving adequate protection, or under approved contract terms. Our staff are bound by confidentiality obligations.

9. Data Retention

  • Account data: retained for the duration of your account and up to 5 years after closure
  • Billing records: retained for 7 years in line with South African financial record-keeping requirements
  • Support ticket history: retained for 3 years
  • Server and website logs: generally retained for up to 30 days, and never longer than 90 days
  • Spam filter data about suspicious incoming email: up to 7 days
  • Hosting data: deleted from our servers within 30 days of account termination after the grace period
  • Backups: kept for up to 7 days while your account is active; backups of a terminated account are deleted automatically within 180 days

10. Security

  • SSL/TLS encryption for data sent to and from our website and Client Area, and encrypted connections available for your hosting, email and file transfers
  • Secure password hashing in our client portal
  • Two-factor authentication (2FA) available and recommended for all accounts
  • Malware scanning and firewall protection on our hosting servers
  • Isolation between hosting accounts on shared servers
  • Administrative access to servers restricted to Hostking system administrators
  • Access controls limiting staff access to personal information

Payment card data is never stored by Hostking — all payment processing is handled by our payment processors on PCI-DSS compliant infrastructure.

11. Security Breaches

If we have reasonable grounds to believe that personal information for which we are the controller has been accessed or acquired by an unauthorised person, we will notify the data protection authority in your country where the GDPR or the data protection law of your country requires it (within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms), the Information Regulator in South Africa, and the affected people as soon as reasonably possible. If the information is in content a customer hosts with us, we will notify that customer without undue delay so they can take the steps required of them.

12. Your Rights

Under the GDPR or the data protection law of your country and POPIA, you have the right to:

  • Be told how we use your personal information (this policy)
  • Access the personal information we hold about you
  • Have inaccurate or incomplete information corrected
  • Have your information deleted, subject to legal obligations
  • Restrict how we use your information
  • Object to processing based on our legitimate interests, and to direct marketing at any time
  • Receive your information in a portable format
  • Withdraw consent at any time, including for cookies and marketing

To exercise any of these rights, contact our Information Officer at info@hostking.host. We will respond within one month.

If you are not satisfied with how we handle your personal information, you have the right to lodge a complaint with the data protection authority in the country where you live. In the European Union this is your national supervisory authority, listed at edpb.europa.eu. You can also complain to the Information Regulator in South Africa: inforegulator.org.za.

13. Cookies

  • Essential cookies: Required for the website to function correctly
  • Analytics cookies: Google Analytics — website usage data
  • Support cookies: Crisp live chat — maintains your chat session
  • Marketing cookies: Meta Pixel — measures advertising effectiveness

What our websites use:

  • Google Analytics 4 (Google): shows how visitors use our website.
  • Google Ads tag (Google): shows which of our ads lead to orders.
  • Meta Pixel (Meta Platforms): measures our Facebook and Instagram ads. If you arrive from a Facebook ad, we pass its click id (fbclid) to our cart.
  • Crisp live chat: keeps your chat session open. Chat replies may come from an AI assistant before a staff member joins.
  • Our own attribution cookies: hk_ft records where you first came from (12 months), hk_lt your most recent source (30 days) and hk_vid a random visitor id (12 months). They record the pages, referrer, campaign (UTM) tags and ad click ids and send them to our client area at my.hostking.host, and the visitor id is added to links to my.hostking.host, so we can see which campaigns lead to sign-ups.

Google, Meta and Crisp receive your IP address, device details and the pages you view, and Google and Meta may process this in the United States. When you first visit, a cookie banner lets you accept or reject analytics and advertising cookies, and the Cookie settings link at the foot of every page lets you change your choice later. Visitors in the UK, the European Economic Area and Nigeria get none of these cookies unless they accept them. Your choice is kept in a cookie called hk_consent for 6 months. You can also email info@hostking.host, block or delete cookies in your browser, or install Google's Analytics opt-out browser add-on. Refusing these cookies does not affect your hosting services.

You can control cookie settings through your browser. Disabling cookies may affect some website functionality.

14. Children’s Privacy

Our services are not directed at individuals under 18. We do not knowingly collect data from minors. Contact us at info@hostking.host if you believe a minor has submitted data to us.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or in the law. Material changes will be notified to active customers via email. The effective date at the top of this page will be updated accordingly.

16. Contact Us