Privacy Policy

Effective date: 30 October 2026
Last updated: 30 October 2026

SA DOMAINZ (“we”, “us”, “our”) respects your privacy and protects personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA), its Regulations, the Electronic Communications and Transactions Act (ECTA), the Consumer Protection Act (CPA) and other applicable South African laws.

This policy explains, in plain language, what personal information we collect, why we collect it, who we share it with, where it goes, how long we keep it, and what rights you have. If anything here is unclear, email us and we will explain it properly.

Who We Are

  • Responsible party (POPIA): SA DOMAINZ, a domain registration, web hosting and website building business based in Brooklyn, Cape Town, Western Cape, South Africa.
  • Privacy contact: sadomainz@sadomainz.co.za — for privacy questions, access requests, corrections, deletion requests, objections or portability requests.
  • Information Officer: under POPIA this is the head of our business, who is responsible for our POPIA and PAIA compliance. You can reach them at the same address.

We aim to acknowledge privacy requests within 5 business days and to resolve them within 30 days, or to tell you why we need longer.

What This Policy Covers

This policy applies to personal information we collect through:

  • sadomainz.co.za and sadomainz.com (both lead to the same site), including our online store and customer accounts;
  • the services you buy from us: domain registration, renewals and transfers, web and email hosting, domain protection and website building;
  • email, telephone, WhatsApp, our contact form and the chat on our site.

It does not cover the websites our hosting customers run on our servers (see Websites and Email You Host With Us), or third-party websites we link to.

What Personal Information We Collect

Account, order and billing information

  • Your name, email address, telephone number and billing address, and your company name if you give it.
  • Your username and a securely hashed password (we never see your password in readable form). If you switch on two-factor authentication, the details needed to check your codes.
  • Your orders, invoices, payment status, store credit, and the billing schedules for monthly or yearly services.

Domain names

  • The domain names you search for, register, renew or transfer, their renewal dates and settings (such as name servers), and the contact details we need to manage them for you.
  • SA DOMAINZ is the registrant of record for domains bought through us and holds them on your behalf. This means the registrant details held by the registry are ours, not yours. Where the rules for a particular domain extension require the holder’s own details, we share only what that registry requires.

Hosting and email accounts

  • The details of your hosting account: the account username, the contact email address and the domains on it.
  • The websites, files, databases and mailboxes you keep on our servers. We look after these for you and do not look at their contents, except to give you support you ask for, to keep our servers secure, or where the law requires it.
  • Server logs, such as web access logs and email delivery logs, which include IP addresses and are used for security, troubleshooting and fair use.

Website building

  • The text, images, logins and other material you send us to build or update your website.

Payment information

  • We accept card and other online payments through Yoco, and EFT. Yoco processes card details; we never see or store full card numbers or CVV codes.
  • For EFT we keep only the payment confirmation, reference and amount needed for our books.

Messages and support

  • Messages you send through our contact form, by email, by WhatsApp or through the chat on our site, and our replies.
  • When we email you, our emails can include an invisible image and tracked links that tell us whether the email was opened and which links were clicked. We use this only to check that our emails arrive and are useful.

Site, technical and security information

  • IP address, browser and device type, the pages you view and the website that referred you.
  • Security logs, including login attempts, failed logins, blocked requests, spam checks and the IP addresses involved, used to protect the site and our customers against attacks and abuse.
  • Cookies, as described under Cookies below.

We collect this information directly from you when you browse the site, create an account, place an order, use our services or contact us. We do not collect special personal information as defined in POPIA (such as health, religious, biometric or political information), and we ask that you do not send it to us.

Why We Use Your Personal Information

What we do Why we are allowed to (POPIA)
Register, renew, transfer and manage your domains Necessary to perform our contract with you
Set up, run and support your hosting and email accounts Necessary to perform our contract with you
Build and update your website Necessary to perform our contract with you
Process orders, take payment, issue invoices and manage recurring billing Necessary to perform our contract with you
Send service messages: order confirmations, invoices, renewal and expiry reminders, and account and security alerts Necessary to perform our contract with you
Answer questions and handle support requests and complaints Contract performance and our legitimate interests
Protect the site, our servers and our customers against fraud, spam, abuse and attacks Our legitimate interests and Section 19 security obligations
Check that our emails arrive and are opened Our legitimate interests
Record which website or search brought you to us when you order Your consent, given through the cookie banner
Send news and promotions by email Your explicit consent (Section 69 of POPIA)
Keep accounting and tax records Compliance with legal obligations

We will never use your information for a purpose that is incompatible with the reason we collected it, and we do not sell personal information to anyone.

Websites and Email You Host With Us

When you run a website or mailbox on our hosting, you decide what personal information it collects about your own visitors and customers. For that information you are the responsible party and we act as your operator under POPIA: we store it only to provide the hosting service, keep it secure and confidential, and do not use it for anything else. You are responsible for your own website’s privacy policy and cookie notice.

Artificial Intelligence and Automated Processing

  • The chat on our site runs on our own website. It answers from our own pages and products using software that runs on our own server. Your messages are stored in our own database and are not sent to Anthropic, OpenAI or any other outside AI provider. A member of our team may read a conversation to help you, and you can ask for a person at any time. Please do not share card details, passwords or ID numbers in chat.
  • AI-assisted site maintenance. We use AI tools to help write and maintain website content and code. Where those tools are given access to our systems, they may incidentally process personal information stored on the site. Our AI providers act as operators under POPIA and may process data only on our instructions.
  • No automated decisions about you. We do not use automated decision-making or profiling that has legal consequences for you or otherwise significantly affects you.

Who We Share Your Information With

We share personal information only where it is necessary, and only with the parties below. Each of them acts as an operator or as an independent responsible party and must keep your information secure and confidential.

Domains

  • Domains.co.za, our domain service provider, and the registry for each domain extension (for example ZACR for .co.za domains), to register, renew and transfer domains.

Payments

  • Yoco — card and other online payments. See Yoco’s Privacy Policy.
  • Our bank and accounting providers, for reconciling EFT payments and keeping the books.

Google

  • Google reCAPTCHA — on some of our forms, to tell people from bots. reCAPTCHA collects your IP address and interaction data and is subject to Google’s Privacy Policy and Terms of Service.
  • Google Fonts — the typefaces on our site are loaded from Google’s servers, so your browser sends your IP address to Google when a page loads. Google Fonts does not set cookies.

Artificial intelligence

  • Anthropic — AI tooling we use to help maintain the site. Chat conversations are not sent to Anthropic.

Infrastructure and operations

  • Our hosting provider, a South African company, whose servers hold this site, our customers’ hosting accounts and mailboxes, and the backups made on the server.
  • Microsoft OneDrive and a separate private backup server, which hold encrypted backup copies of this site. Backups are encrypted before they leave our server.
  • Our own mail server, which sends our email from our own domain. We do not route your email through a third-party bulk email platform.

Legal and regulatory

  • SARS, regulators, law enforcement, courts or our legal advisers, where we are legally required to disclose information or need to protect our rights.
  • A purchaser or successor, if our business or part of it is ever sold or restructured — in which case we will tell you, and this policy will continue to apply until it is replaced.

Sending Information Outside South Africa

Some of the services above are run by companies based outside South Africa, mainly in the United States and the European Union, so some personal information may be processed or stored abroad. In particular:

  • Google (reCAPTCHA and Google Fonts) processes data in the United States and elsewhere.
  • Microsoft (OneDrive) stores our encrypted backup copies, which may be held outside South Africa.
  • Anthropic (AI tooling we use to help maintain the site) processes data in the United States.

Where we transfer personal information across borders, we do so in line with Section 72 of POPIA, relying on the recipient being bound by agreements or rules that give a level of protection substantially similar to POPIA, on the transfer being necessary to perform our contract with you, or on your consent. If you would like more detail about the safeguards for a particular provider, email sadomainz@sadomainz.co.za.

Cookies

Cookies are small files stored on your device. We use:

  • Strictly necessary cookies — for the cart, checkout, logging in, security (including Google reCAPTCHA, which keeps spam bots off our forms), and remembering your cookie choices. The site cannot work without these.
  • Functional cookies — for conveniences such as remembering products you looked at.
  • Marketing cookies — WooCommerce order attribution, which records which website or search brought you to us. These are set only if you allow them. We do not show ads.

We do not use Google Analytics or advertising trackers on this site. The full, up-to-date list of cookies is on our Cookie Policy page. You can change your choices at any time with the round cookie settings button in the bottom corner of every page or the cookie settings link, and you can delete cookies in your browser settings.

How Long We Keep Your Information

We keep personal information only as long as we need it, and then we delete or anonymise it.

  • Orders, invoices and accounting records — at least 5 years from the end of the relevant tax year, as South African tax law requires.
  • Customer accounts — while your account is active, and for a reasonable period after it closes, for our records and fraud prevention.
  • Domain records — while we manage the domain for you, and afterwards as part of our accounting records.
  • Hosting accounts and their contents — while your hosting is active. When it ends, the account and its contents are removed from the server; copies may remain in backups until those are cycled out.
  • Chat conversations and support messages — for as long as we need them to help you and to keep a record of what was agreed.
  • Email delivery records — a record of the emails we have sent you and whether they arrived, kept with your customer records.
  • Security and login logs — for a limited period, as needed to protect the site.
  • Cookie consent records — 12 months, as proof of the choice you made.
  • Backups — encrypted backups are kept on a rolling schedule of daily, weekly and monthly copies, the oldest up to 12 months, and then deleted. Deleted information may remain in a backup until that backup is cycled out.

If you ask us to delete your information, we will do so unless we are legally required to keep it — for example, tax records for a completed order. We will tell you which parts we cannot delete and why.

How We Protect Your Information

We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, alteration or disclosure, including:

  • HTTPS encryption across our site;
  • secure hosting with firewalling, malware scanning and regular software updates;
  • password hashing, login rate limiting, brute-force protection, and two-factor authentication that you can switch on for your account;
  • encrypted off-site backups;
  • anti-spam filtering on our forms, and access to customer information limited to the people who need it.

No transmission over the internet is ever completely secure, and we cannot guarantee absolute security. Please use a strong, unique password, switch on two-factor authentication, and tell us immediately if you think your account has been compromised.

If a security compromise occurs, we will follow our incident response procedure, notify affected people as soon as reasonably possible, and report it to the Information Regulator through its eServices Portal, as required by Section 22 of POPIA.

Your Rights

Under POPIA you have the right to:

  • Be told what personal information we hold about you and who we have shared it with;
  • Access a copy of that information;
  • Correct or complete information that is inaccurate, misleading or out of date;
  • Delete or destroy information we are no longer entitled to keep;
  • Object to processing based on our legitimate interests, and to direct marketing at any time;
  • Withdraw consent you gave before, without affecting processing that already happened;
  • Data portability, where technically feasible;
  • Not be subject to automated decision-making with legal consequences;
  • Complain to us or to the Information Regulator.

To exercise any of these, email sadomainz@sadomainz.co.za. Formal access requests may be made on the prescribed POPIA Form 2. We will verify your identity before acting on a request, so that we do not hand your information to someone else. Requests are free, unless they are manifestly unfounded, excessive or repetitive, in which case a reasonable fee may apply and we will tell you before charging it.

Logged-in customers can also view and update their own details and addresses, and see their orders, under My Account.

Direct Marketing

We only send marketing email — news, offers and promotions — if you have given prior, explicit, specific, informed and voluntary opt-in consent, in line with Section 69 of POPIA.

  • Every marketing email identifies us, gives our contact details and includes a way to unsubscribe.
  • You can unsubscribe at any time, at no cost and without giving a reason.
  • Service messages — order confirmations, invoices, renewal and expiry reminders, and security alerts — are not marketing, and you will keep receiving them while you have an account or an active service with us.

Children

Our site and services are intended for adults. We do not knowingly collect personal information from children under 18 without the consent of a competent person, such as a parent or guardian. If you believe a child has given us personal information, contact sadomainz@sadomainz.co.za and we will delete it promptly.

Complaints and Regulator Contact

If you have a privacy concern, please contact us first at sadomainz@sadomainz.co.za — most issues can be sorted out quickly and directly. The Information Regulator generally expects you to give us a chance to resolve the matter first.

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa:

We will cooperate fully with the Regulator and follow its procedures.

Changes to This Policy

We may update this policy to reflect changes in our business, services, technology or the law — for example, adding a payment provider or a new service. Changes will be posted on this page with an updated date at the top, and where a change is significant and affects how we use your information, we will make reasonable efforts to tell you directly. Please review this page from time to time.