Effective date: 7 September 2026
1. Who we are
HostAbby is the trading name of Hackabby (Pty) Ltd, registration number 2026/591759/07, based in Centurion, South Africa. For account, billing, website and business-administration information, Hackabby (Pty) Ltd is generally the responsible party/controller.
For personal information that a customer uploads into its hosted website, mailbox, database or application, the customer will generally determine why and how that information is used, and HostAbby acts as an operator/processor to the extent described in the service agreement.
2. Laws and principles
We process personal information under the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African law. Where a customer or processing activity is subject to UK GDPR, EU GDPR, a US state privacy law or another mandatory privacy regime, we apply those requirements to the extent they legally apply.
We aim to process information lawfully, fairly, transparently and only for defined business and service purposes, using appropriate security safeguards and retention periods.
3. Information we collect
We may collect names, organisation details, identity or verification information where necessary, postal and billing addresses, email addresses, telephone numbers, account identifiers, support communications, invoices, transaction references, service selections, domain registration information, device/browser data, IP addresses, authentication and security logs, and usage/technical telemetry.
Payment card details are normally processed by the applicable payment gateway rather than stored directly by HostAbby, except for limited tokens, references or status information made available to our systems by the gateway.
4. Why we use information
We use personal information to create and administer accounts; provide hosting, domains, email and related Services; process and reconcile payments; prevent fraud and abuse; provide support; secure systems; perform backups and migrations; communicate service notices; comply with tax, accounting, legal and regulatory duties; investigate security events; and improve our Services.
Where direct marketing is used, we will apply consent, opt-out and electronic-communications requirements that apply to the recipient and channel.
5. Legal bases and justification
Depending on the applicable law, processing may be justified because it is necessary to conclude or perform a contract, comply with a legal obligation, protect legitimate interests such as network security and fraud prevention, protect a person's vital interests, or because consent has been obtained where consent is required.
We do not use consent as a blanket justification where another lawful basis is more appropriate, and you may withdraw consent for consent-based processing subject to legal and contractual consequences.
6. Cookies and website analytics
Our website and client systems may use necessary cookies for login, session security, shopping-cart functions, language/preferences and fraud protection. Optional analytics or marketing cookies will be handled in accordance with applicable cookie and privacy law.
Browser and server logs may record IP address, device data, timestamps, requested pages, referrers and security events for troubleshooting, analytics, abuse detection and cybersecurity.
7. Sharing and service providers
We may share only necessary information with infrastructure providers, data centres, domain registrars and registries, payment processors, email or support platforms, security vendors, professional advisers, auditors and other suppliers that support the Services.
We may disclose information where required by law, court order, regulator, lawful law-enforcement request, or where reasonably necessary to protect rights, systems or persons. We do not sell customer conversation content or hosting data as a data-broker product.
8. Domain registration data
Domain registration requires information to be supplied to registrars and registries. The information required, its public visibility and retention are governed by the relevant registry/registrar and applicable domain rules.
Where privacy/proxy services are available, their separate terms may apply. HostAbby cannot guarantee that all registration data can be hidden where a registry or law requires disclosure.
9. International hosting and cross-border transfers
HostAbby may offer or support infrastructure in South Africa, the United Kingdom, the United States or other jurisdictions through international partners. The actual hosting region depends on the selected Service and technical architecture.
When personal information is transferred from South Africa to a foreign recipient, HostAbby will use a mechanism permitted by POPIA section 72, such as an adequate law, binding agreement or corporate rules that provide appropriate protection, consent where appropriate, or a transfer necessary for the performance or conclusion of a contract in the circumstances allowed by law.
Where UK GDPR, EU GDPR or another cross-border transfer regime applies, we will use the applicable adequacy decision, contractual safeguards or other lawful transfer mechanism required by that regime.
10. Security
We use reasonable technical and organisational safeguards appropriate to the Services, such as access controls, authentication, encryption where appropriate, network and endpoint security, logging, vulnerability management, malware controls, backups and supplier due diligence.
No internet or hosting environment is completely risk-free. Customers are responsible for securing their own applications, plugins, passwords, endpoints and content unless a signed managed-security agreement assigns a specific duty to HostAbby.
11. Security incidents
We investigate suspected compromises affecting systems or personal information under our control. Where POPIA or another applicable law requires notification to a regulator or affected data subjects, we will follow the applicable notification requirements.
Customers must notify us promptly of suspected compromise of their hosted account so we can take reasonable containment and preservation steps.
12. Retention
We retain account, billing, tax, support, security and contractual records for as long as reasonably necessary for the purpose collected and to satisfy legal, accounting, fraud-prevention and dispute requirements.
Hosting content is retained while the service is active and is ordinarily deleted after termination in accordance with the Refund & Cancellation Policy, including the standard post-cancellation grace period, unless a longer period is required by law, a legal hold, security investigation or a confirmed migration extension.
13. Your privacy rights
Subject to applicable law, you may ask whether we hold personal information about you, request access, correction or deletion, object to certain processing, withdraw consent where processing relies on consent, and lodge a complaint with the competent privacy regulator.
We may need to verify identity and authority before acting on a request, and some information may be retained where law permits or requires retention.
14. Children and special personal information
HostAbby services are intended for persons legally capable of contracting or organisations represented by authorised persons. We do not intentionally collect children's information for our own marketing.
Customers that host children's information or special/sensitive personal information remain responsible for ensuring they have a lawful basis and any required safeguards. Additional contractual or technical controls may be required for high-risk processing.
15. Communications and marketing choices
Service, security, billing and legal notices are operational communications and may be necessary to perform the contract. Promotional communications will include a reasonable method to opt out where required.
You may ask us to update marketing preferences by contacting support@hostabby.com or legal@hostabby.com.
16. Contact and complaints
Privacy enquiries and data-subject requests: legal@hostabby.com. Postal/business address: 10 Probert Street, Eldoraigne, Centurion, South Africa.
If you believe your information has been handled unlawfully, please contact us first so we can investigate. You may also complain to the South African Information Regulator or another competent regulator where applicable.
17. Changes to this Privacy Policy
We may update this policy as our Services, suppliers or legal obligations change. The current version will be published on the HostAbby website with its effective date. Material changes will be communicated where required by law.
