Privacy policy

This policy explains how Coolhost (Pty) Ltd handles personal information. It sits alongside the privacy notice, which is the shorter notice we give you at the point we collect information, and the cookie policy.

Version 1. Published 5 November 2026.

What we collect

We collect only what we need to sell and run the service, to bill you, to keep the platform secure, and to meet a legal duty.

Account and orders

Name, email address, telephone number if you give one, company name, billing address, country, and the password hash for the client area. We store a hash, not the password itself. If you turn on two-factor authentication, we store the shared secret that makes those codes work.

Payment

Invoice numbers, amounts, VAT, payment status and a reference from PayFast. PayFast collects the card or bank details. We do not store the full card number or the card security code.

Domains

Registrant, admin and technical contacts, as the registry requires. That can include a name, email, phone and postal address. The registry may publish some of those fields in WHOIS or RDAP. We also store name-server settings and the dates of registration and expiry.

Support

The messages you send us, files you attach, and the staff notes on a ticket. Live chat, if you use it, is stored with the conversation so we can carry on from where you left off.

Technical records

IP address, time, and the page or mailbox involved, in mail logs, web-server logs and security logs. We use these to deliver mail, to stop abuse, and to fix faults. They can identify you when combined with an account.

Content you host

Files, databases and mail on your service. We process that content to host it. We do not read it for marketing. We may look at a specific file or message if we are investigating abuse, a security incident, or a support request you asked us to look at.

We do not ask for special personal information (race, health, religion, biometric data, or a child’s information) and we do not want it in a support ticket. If a website you host contains that kind of information about other people, you are the responsible party for those people, and we are an operator processing it on your instructions by hosting the server.

Why we use it, and the basis

Section 11 of the Protection of Personal Information Act is the test we use.

• Contract: creating your account, provisioning hosting, email and domains, sending invoices, and replying to tickets.
• Legal duty: tax records, responding to a lawful request from a court, the South African Police Service, a registry, or the Information Regulator.
• Legitimate interest: keeping logs to secure the platform, preventing fraud, and defending a legal claim. We balance that interest against your rights, and we do not use it as a reason to send unrelated advertising.
• Consent: optional cookies, Google Fonts, and promotional email where we ask you first. You can withdraw consent. Withdrawal does not undo processing that was already lawful.

Giving your name, email and billing details is a requirement of the contract. If you do not provide them, we cannot open the account or issue a lawful invoice. A telephone number and a company name are optional. Registry fields are mandatory for a domain because the registry will reject the registration without them.

We do not make a decision that has a legal effect on you by solely automated means. Suspension for non-payment follows an unpaid invoice and a rule in the terms, and you can write to billing if the invoice is wrong.

Who receives it

Staff who need the information to do their job. Then the operators below, and only for the purpose next to their name.

• PayFast, to take payment in South Africa.
• The domain registry and, for .za, ZADNA’s framework. The registry may be outside South Africa for extensions other than .za.
• The certificate authority, when you buy an SSL certificate, to validate and issue it.
• SiteLock or CodeGuard, when you buy that add-on, to scan or back up the site.
• Cloudflare, which provides DNS and sits in front of coolhost.co.za. Cloudflare may see IP addresses of visitors to our website.
• A data-centre or server provider that houses a VPS or dedicated server. Where the product page says the server is in the United States, the content on that server is stored there.
• An auditor, an insurer, or a buyer of the business, under a duty of confidence.
• A court, regulator or law-enforcement body when the law requires it.

We do not sell personal information. We do not give it to advertisers.

Cross-border processing

Section 72 of the Protection of Personal Information Act allows a transfer outside South Africa in limited cases. We rely on it where the registry, the certificate authority, or a server you chose is outside the country, and where the transfer is necessary to perform the contract you asked for. The United States is the location we name on VPS and dedicated-server pages that are sold as USA-hosted. Google receives a request from your browser for the font file only if you allow functional cookies. If you refuse, that transfer does not happen.

How long we keep it

• Account details: for the life of the account, and for up to 24 months after it closes, so we can answer a late query or a dispute. Invoices and payment records: at least five years, because the Tax Administration Act requires us to keep tax records.
• Domain records: for the registration, and for as long as the registry requires us to retain them after expiry.
• Support tickets: three years from the last message, unless a longer hold is needed for a dispute.
• Security and mail logs: up to 12 months, unless we are investigating an incident, in which case we keep the relevant slice until the investigation and any claim are finished.
• Hosted files and mail: for the service term, and for up to 14 days after it ends, unless clause 14 of the terms says we delete sooner. Backups that include your files roll off on the backup product’s cycle.
• The cookie that stores your choice: 180 days, then we ask again.

When the period ends we delete the record or de-identify it so it can no longer be linked to you.

Security

The client area is served over HTTPS. Passwords are hashed. Access to the database is limited to staff who operate the platform. Mailboxes are reached over encrypted IMAP and SMTP as described when you set up the mailbox. No method is perfect. If we learn of a compromise that creates a risk to you, we will tell you and, where the Act requires it, the Information Regulator, as soon as we reasonably can.

You must choose a password you do not use elsewhere, and you should turn on two-factor authentication where the client area offers it.

Your rights

You may ask us to confirm whether we hold information about you, to give you a copy, to correct it, or to delete it where we have no lawful reason to keep it. You may object to processing that is based on legitimate interest, and you may withdraw consent. You may lodge a complaint with us first, and you may complain to the Information Regulator even if you have not complained to us.

Write to [email protected] with the subject “Privacy request”. Tell us what you want and the email address on the account, so we do not disclose your information to the wrong person. We may ask for enough information to confirm it is you. We aim to answer within 30 days. Access is free unless the request is manifestly unfounded or excessive, in which case we will tell you before we charge a reasonable fee.

Deleting an account does not delete invoices we must keep for tax, and it does not delete a record we must keep for a legal claim.

Promotion of Access to Information Act: a request for a record that is not your own personal information, or a request in the formal PAIA form, can be sent to the same address. We will tell you if a ground for refusal applies.

Information Regulator

The Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Telephone 010 023 5200. POPIA complaints: [email protected]. PAIA complaints: [email protected]. Website: inforegulator.org.za.

Children

Our services are for adults and for businesses. We do not knowingly open an account for a person under 18. If you believe we have, write to us and we will close it unless a parent or guardian has authorised it and the law allows us to keep it.

Changes

If we change this policy in a way that affects you, we will post the new version here and change the date. Where the change is material we will also email the address on your account before it applies.