Version 2026-10-18 · Effective 18 October 2026 · Last updated 18 October 2026
In short
- We collect what we need to run your account, hosting, domains and billing, verify businesses and keep the platform secure.
- For data inside the sites and mailboxes you host, you are in charge (responsible party) and we only process it for you (operator).
- Our platform and hosting servers are in South Africa. Our mail server is in the United Kingdom, and some providers, such as Cloudflare, Google sign-in and the AI providers you choose, process data abroad.
- We never sell personal information, and we only use essential cookies plus anonymised analytics.
- You can see, correct or delete your information, object to marketing, and complain to the Information Regulator. Our Information Officer is Nathan Avis.
1. Who we are and what this policy covers
- 1.1
NewHost is a trading name of Global Software Services (Pty) Ltd, a private company registered in South Africa (registration number 2021/476309/07), 7 Kromiet Avenue, Waldrift, Vereeniging, 1939, Gauteng, South Africa. We provide hosting, Node.js application hosting, server management, domains, e-mail, databases, backups, an AI gateway, reseller hosting and related services.
- 1.2
This policy explains how we process personal information when you visit newhost.co.za, use the dashboard at app.newhost.co.za, our API or documentation, contact us, or receive support. It is written to meet the Protection of Personal Information Act, 2013 (POPIA).
- 1.3
Our Information Officer is Nathan Avis, our director. You can reach the Information Officer at use our contact form (mark your message "For the Information Officer"), by telephone on +27 16 001 0395 (office), +27 71 680 9898 (mobile), or by post at our address above.
- 1.4
This policy does not cover the websites and applications our customers host with us. Each customer is responsible for the personal information on its own sites and must have its own privacy notice (see section 3).
2. Definitions
Words in this policy have the meaning POPIA gives them. In particular:
- "Personal information"
- information about an identifiable, living person or an existing company or organisation, such as a name, e-mail address, ID number, IP address or account details.
- "Processing"
- anything done with personal information, including collecting, storing, using, sharing and deleting it.
- "Responsible party"
- the person or organisation that decides why and how personal information is processed.
- "Operator"
- a person or organisation that processes personal information for a responsible party under a contract, without coming under its direct authority.
- "Data subject"
- the person or organisation the personal information is about.
- "Hosted content"
- the websites, applications, databases, files, mailboxes and other content our customers store or run on our services.
3. Our two roles
- 3.1
Responsible party. For information about our customers, their team members, website visitors, people who contact us and domain registrants, we decide why and how it is processed, so we are the responsible party. Sections 4 to 12 describe that processing.
- 3.2
Operator. For personal information inside hosted content (for example the customer database of an online shop hosted with us, or the e-mails in a hosted mailbox), the customer is the responsible party and we are its operator. We process that information only to provide, secure, back up and support the service, on the customer's instructions in our Terms of Service, and never for our own purposes. Section 13 explains this further. If you are a visitor of a site hosted with us, please contact that site's owner about your information.
4. Personal information we collect
We collect only what we need for the purposes in section 5:
| Category | What it includes | Where it comes from |
|---|---|---|
| Account details | Name, e-mail address, company, phone number; a password, stored only as a salted bcrypt hash | You, when you register or update your profile |
| Social sign-in | Name, e-mail address, profile picture and whether the provider verified your e-mail | Google or Facebook (through Google Firebase), only if you sign in with them |
| Security details | Two-factor method, authenticator secret (encrypted), e-mailed sign-in codes and one-time backup codes (codes stored only as keyed hashes); sign-in records | You and your use of the dashboard |
| Business verification | Entity type, legal and trading name, registration and VAT numbers, SA ID or passport number of the responsible person, contact person, phone, address, and documents such as a registration certificate, ID and proof of address | You, only if you sign up as a domain reseller or we ask you to verify your account (ordering does not need it) |
| Billing and payments | Billing name, address and e-mail, VAT number, invoices, payments and references, wallet and AI-credit balances, proof-of-payment documents you upload. Not your full card number | You, CentraPoint and Netcash |
| Domain registrant details | Name, organisation, address, e-mail and phone number of each domain's registrant | You, when you register or transfer a domain; the registries |
| Team details | E-mail addresses and roles of the people you invite | The account owner or an administrator |
| Support and enquiries | What you write to us, attachments, your contact details; for contact-form enquiries also your IP address and browser type | You |
| Usage and security logs | For each change you make in the dashboard or API: time, account, IP address, browser (user agent), the action and its result. We do not log the content of your requests | Automatically |
| Service records | Plans, deployments and their logs, backups, API-key usage, uptime checks and daily usage figures of your sites, and AI gateway usage (model, token counts, cost, status). We do not store AI prompts or responses | Automatically |
| Error reports | When something fails for you: a reference (such as ERR-7K2M9Q), the page or action, the error, your account ID and the time. E-mail addresses are masked, and passwords, keys, card and phone numbers are removed | Automatically |
| Connected services | Encrypted cloud-provider tokens, Plesk API keys, SSH keys and AI provider keys you add; basic facts about connected servers (hostname, operating system, memory, disk, load); if you connect GitHub, your GitHub username, the access token (encrypted) and the names of repositories you connect | You, your servers, the cloud providers and GitHub |
| Website analytics | Pages visited, referrer, device and browser type, approximate location, with IP anonymisation | Google Analytics cookies, only if you accept analytics cookies (section 8) |
You do not have to give us personal information, but without the information marked as needed in our forms we cannot open an account, take payment, register a domain, approve a domain reseller account or provide the service. Fields marked as optional (such as your company name when you register) can be left out. We do not intentionally collect special personal information (such as health, religious or biometric information); please don't send it to us.
5. Why we use it and our lawful basis
POPIA section 11 allows processing only on certain grounds. We rely on these:
| Purpose | Information used | Lawful basis (POPIA s11) |
|---|---|---|
| Opening and running your account, providing hosting, apps, servers, domains, e-mail, backups and the AI gateway | Account, team, service and connected-service data | Needed to conclude and perform our agreement with you (s11(1)(b)) |
| Business verification of domain reseller accounts, and of accounts we need to check for fraud or abuse | Business verification data | Our and our customers' legitimate interest in preventing fraud and misuse of the platform (s11(1)(f)); agreement (s11(1)(b)) |
| Invoicing, collecting payments, wallet and credits, keeping our accounting and tax records | Billing and account data | Agreement (s11(1)(b)); legal obligations under tax and company law (s11(1)(c)) |
| Registering, renewing and transferring domains | Registrant details | Agreement (s11(1)(b)); registry rules that require registrant details |
| Keeping accounts and the platform secure: sign-in protection, two-factor sign-in, reCAPTCHA, rate limits, audit logs, abuse handling | Security details, logs, account data | Legitimate interest in security (s11(1)(f)); protecting your legitimate interests (s11(1)(d)); agreement |
| Service e-mails: invoices, renewals, payment and suspension notices, security alerts, password resets, outage and policy-change notices | Account and billing data | Agreement (s11(1)(b)); legitimate interest (s11(1)(f)) |
| Support, answering enquiries, handling complaints | Support data, account data | Agreement or steps you asked for before one (s11(1)(b)); legitimate interest |
| Finding and fixing errors: error reports are saved and e-mailed to our developers | Error reports | Legitimate interest in a working, secure service (s11(1)(f)); agreement (s11(1)(b)) |
| Monitoring the uptime of hosted sites and alerting you when a site is down | Service records | Agreement (s11(1)(b)); legitimate interest (s11(1)(f)) |
| Handling abuse reports, take-down notices and requests from authorities | Account, logs, the report | Legal obligations (s11(1)(c)); legitimate interest in protecting the platform and third parties (s11(1)(f)) |
| Website statistics, to improve our site | Analytics data | Your consent, given in the cookie banner (s11(1)(a)); you can withdraw it at any time with "Cookie settings" |
| Marketing e-mails about our own services (we do not send any at present, see section 12) | Name and e-mail address | For people who are not customers, only your consent (s11(1)(a) and s69(1)); for customers, our customer relationship, with an opt-out in every message (s69(3)) |
| Protecting our legal rights and keeping required records | Relevant records | Legal obligation (s11(1)(c)); legitimate interest (s11(1)(f)) |
7. Information sent outside South Africa
- 7.1
Our platform, databases and hosting servers are in South Africa. Some recipients in section 6 process information in other countries:
- 7.2
- our mail server, at IONOS in the United Kingdom, for every e-mail we send you and every e-mail you send to our addresses;
- Cloudflare, worldwide, for every request to our websites, dashboard and API;
- Google (Firebase sign-in, reCAPTCHA and, with your consent, Analytics), Meta (Facebook sign-in and WhatsApp) and GitHub, mainly in the United States, when you use those features;
- the AI providers you choose, mainly in the United States, and also the European Union (Mistral AI) and China (DeepSeek); and
- cloud providers you connect, in their own country and the region you choose.
- 7.3
Under POPIA section 72 we transfer personal information outside South Africa only where the recipient is subject to a law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA (the United Kingdom and the European Union have data-protection laws of that kind), where the transfer is needed to perform our agreement with you or a step you asked for (for example sending you an invoice, signing in with Google, or using an AI model or cloud region you chose), or with your consent. We send only what is needed for the service you use.
9. How long we keep it
We keep personal information only as long as we need it for the purposes in section 5, or as the law requires (POPIA section 14):
| Information | Kept for |
|---|---|
| Account and profile details | While your account is open. When you ask us to close it, we delete or de-identify them within 90 days of closing, except what the law requires us to keep (the records below) |
| Business verification details and documents | While your account is open; after it closes, only as long as needed to deal with fraud and legal claims, and deleted on request where the law allows |
| Invoices, payments, proofs of payment, wallet, AI-credit and AI-usage records | As long as tax and company law require: at least 5 years after the transaction (Tax Administration Act s29), and 7 years for company accounting records (Companies Act s24) |
| Domain registrant details | While the domain is registered through us, and afterwards as registry rules require |
| Usage and security (audit) logs | 2 years, then deleted automatically |
| Sign-in sessions, password-reset links, two-factor challenges, team invitations | 7 days, 1 hour, 10 minutes and 7 days respectively; then they no longer work |
| GitHub delivery records | 30 days, then deleted automatically |
| Uptime checks of your sites | 90 days, then deleted automatically; daily uptime and usage summaries 400 days |
| Error reports | 180 days, then deleted automatically; the e-mailed copies are deleted when the problem is fixed and they are no longer needed |
| Support tickets and enquiries | As long as needed to help you and keep a record of the service provided; deleted on request when no longer needed |
| Backups of hosted content | Automatic backups: as long as your plan and backup settings say (14 days by default); on-demand backups at least 7 days; then deleted from our servers and from storage you added. Copies you download are yours |
| Hosted content after a service ends | At least 30 days, after which it may be deleted (Terms of Service section 23) |
| Marketing preferences | Until you object; we keep a record of objections so that we do not contact you again |
We may keep information longer where the law requires it, where it is needed for a legal claim, or in de-identified form for statistics.
10. How we protect it
POPIA section 19 requires appropriate, reasonable technical and organisational measures. Ours include:
- 10.1
encrypted connections (HTTPS/TLS) for our websites, dashboard and API, and network protection through Cloudflare;
- 10.2
passwords stored only as salted bcrypt hashes; two-factor sign-in on every account, with an authenticator app or codes e-mailed to you, and one-time backup codes; e-mail alerts when a password is set, changed or reset;
- 10.3
encryption at rest (AES-256-GCM) for two-factor secrets, cloud-provider tokens, SSH private keys, Plesk and AI provider keys, and business verification documents; API secret keys stored only as hashes;
- 10.4
role-based access for team members and staff; staff can reach a customer's own server only while the customer grants support access, and every use is recorded;
- 10.5
audit logs of changes to accounts and services, and of staff views of verification documents;
- 10.6
rate limits and reCAPTCHA against password guessing and automated abuse;
- 10.7
backups of hosted websites, applications and databases according to the plan, and regular review of our security measures as risks change.
No system is completely secure. Please protect your own account with a strong password and two-factor sign-in.
11. Your rights
Under POPIA you have the right to:
- 11.1
ask whether we hold personal information about you, free of charge, and request a copy of it (section 23);
- 11.2
ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or to destroy information we are no longer allowed to keep (section 24);
- 11.3
object to processing based on legitimate interests (section 11(3)(a)), and object to direct marketing at any time (sections 11(3)(b) and 69);
- 11.4
withdraw consent you gave, which does not affect processing that already took place;
- 11.5
not be subject to a decision with legal or similarly significant effects based solely on automated processing (section 71). Our business verification decisions are made by people. If reCAPTCHA blocks a form, contact us and we will help;
- 11.6
complain to the Information Regulator (section 74), see section 16.
How to exercise them
You can update most account and billing details yourself in the dashboard. For anything else, e-mail use our contact form for the Information Officer. You may use the forms prescribed by the POPIA regulations (Form 1 for objections, Form 2 for correction or deletion), but a clear e-mail is enough. We verify your identity before acting, respond within 30 days, and tell you if we need longer or cannot comply and why. We may keep information the law requires us to keep.
Requests for access to records may also be made under the Promotion of Access to Information Act, 2000 (PAIA) to our Information Officer. Our PAIA manual, which covers all of Global Software Services (Pty) Ltd including NewHost, explains how. Fees prescribed under PAIA may apply to copies of records.
12. Direct marketing
- 12.1
Service e-mails (invoices, renewals, payment and suspension notices, security alerts, password resets, outage and policy-change notices) are part of the service and are not marketing.
- 12.2
We do not send marketing e-mails at present, and signing up does not subscribe you to any. If we start, we will send them only to people who have consented, or to our customers about our own similar services after giving them the chance to say no; every marketing message will identify us and let you unsubscribe free of charge (POPIA section 69, ECTA section 45 and CPA section 11). We will not send marketing on Sundays or public holidays, on Saturdays before 09:00 or after 13:00, or on other days before 08:00 or after 20:00.
- 12.3
You can tell us at any time, at use our contact form, that you do not want marketing from us, and we will record it. We do not share your details with others for their marketing.
13. Personal information in content you host
When you host websites, applications, databases or mailboxes with us, you decide what personal information they contain and why. For that information:
- 13.1
you are the responsible party and must have a lawful basis for processing it, your own privacy notice, and processes to handle your users' requests;
- 13.2
we act as your operator: we process it only to provide, secure, back up and support the service, keep it confidential, and do not use it for our own purposes, sell it or use it to train AI models;
- 13.3
our staff access it only when needed for support you ask for, restores, security, abuse investigations or legal requirements;
- 13.4
we notify you without undue delay if we become aware of a security compromise affecting it, so that you can meet your own duties (POPIA sections 21 and 22);
- 13.5
we use only sub-operators bound to similar obligations, and delete the content after a service ends as set out in our Terms of Service; and
- 13.6
if we receive a request from one of your users about their information, we refer it to you.
14. Children
- 14.1
Our services are for businesses and adults. You must be 18 or older to open an account, and we do not knowingly collect personal information of children. If you believe a child has given us personal information, contact us and we will delete it.
- 14.2
Customers whose hosted sites process children's personal information are responsible for meeting POPIA sections 34 and 35, including obtaining the consent of a competent person.
15. Security compromises
- 15.1
If we have reasonable grounds to believe that personal information for which we are the responsible party has been accessed or acquired by an unauthorised person, we notify the Information Regulator and you as soon as reasonably possible (POPIA section 22), with enough information for you to protect yourself.
- 15.2
For hosted content, we notify the customer, who as responsible party notifies its own data subjects and the Regulator (section 13).
16. Complaints to the Information Regulator
- 16.1
Please contact us first so that we can try to resolve your concern. You may also complain to the Information Regulator at any time:
| Website | inforegulator.org.za |
| Online complaints (eServices portal) | eservices.inforegulator.org.za |
| Complaints (POPIA) | [email protected] |
| Complaints (PAIA) | [email protected] |
| General enquiries | [email protected] |
| Address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
17. Changes to this policy
- 17.1
We may update this policy when our services or the law change. The version and dates at the top show the current version. For material changes we notify account holders by e-mail or in the dashboard before they take effect.
18. Contact
- 18.1
Questions, requests or complaints about privacy: use our contact form (for the Information Officer, Nathan Avis), or write to Global Software Services (Pty) Ltd, 7 Kromiet Avenue, Waldrift, Vereeniging, 1939, Gauteng, South Africa. Telephone: +27 16 001 0395 (office), +27 71 680 9898 (mobile). See also our Terms of Service and our PAIA manual.