Privacy Policy & POPIA Notice

Introduction and Scope

This Privacy Policy & POPIA Notice explains how Padroni Hosting (“Padroni”, “we”, “us” or “our”) handles personal information for enquiries, client accounts, billing, hosting, domains, email, website work, support and security operations.

We process information subject to the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable law. This notice explains our practices and obligations; it is not blanket consent to every use or disclosure of information.

Read this notice alongside our Terms & Conditions and Acceptable Use Policy for the contractual service rules, abuse enforcement and service data arrangements. This notice explains how personal information is handled in those processes; it does not remove privacy rights or provide blanket consent to processing.

For our own account, billing and operational records, we determine the relevant processing purposes. For personal information hosted or handled on a client’s instructions, we may act as an operator; the client remains responsible for its own lawful collection and use. Our own legal and security obligations still apply.

Information We Collect

Depending on the service and circumstances, we collect information needed for the relevant purpose, including:

• Names, business details, authorised contacts, email addresses and telephone numbers.
• Account, billing and transaction records, invoice references and payment verification information.
• Domain and registrant details, hosting account identifiers and service settings.
• Support requests, correspondence and information reasonably needed to complete authorised technical work.
• IP addresses, timestamps, browser or device information, authentication records, server logs and message metadata.
• Relevant abuse reports, message headers, content samples and security findings where lawful and necessary.

We may access website, database, mailbox or backup content to the extent necessary for authorised service delivery, troubleshooting, recovery, security response or a lawful requirement. Do not send passwords, identity documents or sensitive records through ordinary messages unless required; ask us for a suitable method.

Sources and Required Information

Information may come from you, your authorised representative, service use, payment verification, a registrar or other relevant provider, and reports submitted by affected parties. We assess third-party reports in context rather than assuming every allegation is correct.

Some information is required to create an account, verify authority, process a payment, register a domain or deliver support. If it is not supplied, we may be unable to complete that service or request. Optional information is not a condition of service unless there is a legitimate service requirement or applicable legal requirement.

Purposes and Lawful Grounds

We use relevant information to deliver and administer services, respond to enquiries, manage billing and renewals, verify access, provide authorised support, protect infrastructure, investigate abuse and meet legal obligations.

Our processing relies on an applicable lawful ground, such as contractual necessity, a legal obligation, a legitimate interest recognised by POPIA, or consent where required. We limit processing to information reasonably necessary for the purpose. Where processing depends on consent, it may be withdrawn, subject to lawful processing on another applicable ground.

We do not sell client personal information. A complaint, service cancellation or withdrawal of marketing consent does not automatically require deletion of records we must lawfully retain.

Abuse Prevention and Investigation

We use relevant technical records and reports to detect and contain spam, phishing, fraud, malware, unauthorised access, harmful sending and other acceptable use breaches. We may examine affected content only where lawful, proportionate and necessary for the investigation or response.

Automated filtering may block or limit traffic to protect services. A permanent adverse abuse decision is reviewed against the available evidence and context. You may ask us to review a decision and provide your explanation and supporting information.

We limit access to authorised personnel and relevant providers. This policy does not authorise unrestricted interception, publication of private information to shame clients, or disclosure unrelated to a lawful purpose.

Sharing with Providers and Authorities

We may disclose information necessary for the relevant purpose to domain registrars and registries, hosting and infrastructure providers, email and security providers, payment processors, authorised technical providers and professional advisers.

We may disclose relevant information to a competent authority where required by law or where another lawful basis supports a necessary and proportionate report. A private complaint does not create an automatic right to receive another client’s personal information.

Providers processing personal information on our behalf must be subject to appropriate confidentiality, security and processing arrangements. Domain registration may involve mandatory submission of registrant information; any public availability is governed by the relevant registry rules and law.

International Services and Transfers

Some infrastructure, email services, registrars or technical providers may operate outside South Africa. Where service delivery involves an international transfer, it must satisfy POPIA’s requirements, including an applicable lawful transfer ground and appropriate protection where required.

You may contact us for information about the provider locations and transfer arrangements relevant to your service. This notice does not treat use of hosting as unrestricted consent to send information to any country or recipient.

Cookies and Website Technology

Our website and Client Area may use cookies or similar technology for functions such as sign-in sessions, security, preferences and completing an order. Technical records may also be created when you access the website.

If optional analytics, advertising or third-party embedded tools are used, their relevant purposes, providers and choices must be disclosed at the point of use, and consent obtained where required. This notice is not a substitute for those disclosures or controls.

Browser settings can restrict cookies, although this may affect login or other functionality. A privacy request can be sent to the contact address below.

Service Messages and Direct Marketing

We use contact information for service, billing, renewal, security and support notices necessary to administer the account. These essential communications are separate from promotional marketing.

We send electronic direct marketing only where permitted by applicable law, including the relevant consent or existing-customer requirements under POPIA. Marketing must identify us and provide a way to opt out without charge. An opt-out mechanism alone does not establish consent.

You can object to marketing or withdraw marketing consent through the method provided in the message or by emailing support@padroni.info. This does not prevent necessary service or legal notices.

Security and Security Compromises

We take reasonable technical and organisational measures appropriate to the information and risks to protect against unlawful access, loss, misuse, disclosure, alteration or destruction. No system can guarantee absolute security. Clients must secure access under their control and promptly report suspected compromise.

Where POPIA requires security-compromise notification, we will notify the Information Regulator and affected data subjects as soon as reasonably possible in accordance with the law. Where we act as an operator, we will notify the relevant responsible party immediately when the statutory conditions are met and assist with the applicable response.

A general abuse investigation does not remove mandatory notification duties or create an unrestricted right to delay them.

Retention and Deletion

We retain personal information only for as long as lawfully necessary for the purpose, an applicable recordkeeping obligation, authorised service delivery or another recognised retention ground.

Account closure does not immediately remove billing, transaction, security or dispute records that still have a lawful retention purpose. Relevant evidence may be preserved while necessary for an investigation, dispute, legal claim or binding preservation requirement. It must not be kept indefinitely merely because it might be useful.

When retention is no longer authorised, information will be securely deleted, destroyed or de-identified as appropriate. Backup copies may remain until the applicable overwrite cycle, with access restricted and subject to legal retention or deletion obligations. Service data export and termination arrangements are explained in the Terms & Conditions.

Your Rights

Subject to the applicable legal conditions, you may:

• Ask whether we hold personal information about you and request access.
• Request correction of inaccurate information or deletion, destruction or restriction where the legal conditions are met.
• Object to qualifying processing and stop direct marketing.
• Withdraw consent where consent is the processing ground.
• Raise a concern about a relevant automated decision or request review.
• Lodge a complaint with the Information Regulator or use another available legal remedy.

These rights are subject to lawful verification, third-party privacy, applicable exemptions and recordkeeping duties. If a request cannot be granted, we will explain the applicable reason. Any access fee must be permitted by law and explained before it is charged.

Requests and Complaints

Email support@padroni.info, marked “Privacy Request” or “For the Information Officer”. Include your name, a contact method, the account or domain concerned where relevant, and the request. We may ask for proportionate verification of identity or authority.

We will assist with applicable request requirements and respond within the period required by law. Do not send unnecessary identity documents or other sensitive material before we explain what verification is needed.

You may also submit a complaint directly to the Information Regulator. You do not have to waive that right or complete our internal process first.

Updates to This Notice

We may update this notice to reflect changes in services, information practices or law. Material changes will be communicated appropriately. The updated date identifies this version; a revised notice does not retrospectively authorise processing or replace consent where consent is legally required.

Related Legal Policies

Terms & Conditions · Acceptable Use Policy · Privacy Policy & POPIA Notice