01 Introduction
This Privacy Policy explains how W10 (Pty) Ltd ("W10", "we", "us", or "our") collects, uses, stores, shares, and protects your personal information.
We are committed to protecting your privacy and complying with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable South African data protection laws.
02 Who We Are
Responsible Party (POPIA term): W10 (Pty) Ltd
Registration: 2025/000000/07
VAT: 4000000000
Registered address: Johannesburg, Gauteng, South Africa
Information Officer: Our Information Officer is registered with the Information Regulator of South Africa. You can contact them at privacy@w10.co.za.
03 What We Collect
We collect the following categories of personal information:
Account Information
- First and last name
- Email address
- Phone number (optional)
- Business name (optional)
- VAT number (optional)
- Password (stored only as a one-way bcrypt hash — we never see your plain password)
Address Information (optional)
- Street address, city, province, postal code, country
- Used on invoices for tax and billing purposes
Website & Domain Information
- Domain name you register
- Website content you provide (text, images, files)
- Preferred domain extension (.co.za, .site, .online)
- Website category (business, stokvel, investment, etc.)
Payment & Billing Information
- Invoice history and amounts
- Payment confirmations and references (for EFT payments)
- Payment method type (e.g. card, EFT)
- We do NOT store card numbers, CVVs, or full banking credentials — these are handled by PCI-DSS-compliant payment processors
Technical Information
- IP address (for security, rate-limiting, and audit logging)
- Browser type and version (user agent)
- Device type and operating system
- Login times and session history
Communications
- Support tickets and messages you send us
- Emails and in-app notifications
04 How We Collect
We collect personal information through:
- Directly from you — when you sign up, fill in forms, open tickets, or contact us.
- Automatically — when you use our website (IP, browser, cookies, session data).
- From third parties — domain registrars (WHOIS data), payment processors (payment status).
05 Why We Collect
We collect and process your personal information to:
- Create and manage your account
- Register and manage your domain
- Design, build, host, and maintain your website
- Issue invoices and process payments
- Provide customer support
- Send service notifications (payment reminders, renewal notices, security alerts)
- Detect and prevent fraud, abuse, and security threats
- Comply with South African legal obligations (tax, VAT, POPIA, CPA)
- Improve our services and customer experience
06 Legal Basis for Processing
Under POPIA, we process your personal information on the following legal bases:
| Purpose | Legal Basis |
|---|---|
| Providing the Services (hosting, domains, website) | Performance of a contract — you asked us to deliver these services |
| Processing payments and issuing invoices | Performance of a contract + legal obligation (tax law) |
| Preventing fraud and abuse | Legitimate interest — protecting our platform and other users |
| Sending service notifications | Performance of a contract |
| Sending marketing emails | Consent — you opted in, and you can opt out anytime |
| Keeping audit logs (logins, admin actions) | Legitimate interest + legal obligation |
07 How We Use Your Information
Your information is used strictly for the purposes described in Section 5. We do not:
- Sell your personal information to third parties.
- Rent or trade your information to marketers.
- Use your data for purposes you have not consented to, unless required by law.
09 Storage & Security
Where We Store Your Data
- Databases: On encrypted SSD storage in South African data centres.
- Website files: On our hosting infrastructure in South Africa.
- Backups: Encrypted daily backups retained for 30 days.
How We Protect Your Data
- Encryption in transit — all traffic uses HTTPS/TLS 1.2 or higher.
- Encrypted password storage — bcrypt hashing, never plaintext.
- Access control — only authorised staff can access customer data, and only when necessary.
- Audit logging — every action taken on the platform is logged with the user, IP, and timestamp.
- Regular backups — daily encrypted backups with rolling retention.
- Security monitoring — 24/7 monitoring for threats, intrusions, and anomalies.
- Firewalls & rate limiting — prevent brute-force and abuse.
10 How Long We Keep Your Data
We keep personal information only as long as necessary:
| Data Type | Retention Period |
|---|---|
| Active account data | While your account is active |
| Cancelled account data | 30 days after cancellation (export window), then deleted or anonymised |
| Invoices & tax records | 5 years (SARS requirement) |
| Activity logs | 180 days (except critical admin actions, kept for audit) |
| Read notifications | 90 days |
| Closed support tickets | 365 days |
| Password reset tokens | Deleted when expired or used |
| Abandoned unverified signups | 30 days, then deleted |
When retention periods end, we securely delete or anonymise your data. We may retain aggregated, anonymised data for analytics indefinitely (this contains no personal information).
11 Your Rights Under POPIA
As a data subject under POPIA, you have the right to:
| Right | What It Means |
|---|---|
| Access | Request a copy of the personal information we hold about you. |
| Correction | Request that we correct inaccurate or incomplete information. |
| Deletion | Request that we delete your personal information (subject to legal retention requirements). |
| Objection | Object to processing based on legitimate interest. |
| Restriction | Ask us to temporarily stop processing your data. |
| Data Portability | Receive your data in a structured, machine-readable format (we provide JSON). |
| Withdraw Consent | Withdraw any consent you previously gave (e.g. marketing emails). |
| Complain | Lodge a complaint with the Information Regulator (see Section 19). |
• Export your data → Settings → Privacy & Data → Download my data
• Delete your account → Settings → Danger Zone
• Update your info → Profile page
For other requests, email privacy@w10.co.za. We will respond within 30 days.
13 Children's Privacy
Our services are not intended for children under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us at privacy@w10.co.za and we will delete it promptly.
14 Cross-Border Transfers
Our primary data storage is in South Africa. However, some third-party service providers (email delivery, payment processors) may process data outside South Africa.
In accordance with POPIA Section 72, when we transfer personal information outside South Africa, we ensure the receiving country has:
- Adequate data protection laws substantially similar to POPIA; OR
- A binding agreement with us that includes POPIA-equivalent protections; OR
- Your explicit consent to the transfer.
15 Third-Party Services
Our platform may link to or use third-party services. Each has its own privacy policy:
- Payment processors: PayFast, Ozow, SnapScan — for processing payments.
- Domain registrars: For .co.za, .site, .online registrations.
- Email providers: For transactional email delivery.
- Fonts and CDNs: Google Fonts, jsDelivr — serve static assets.
We are not responsible for the privacy practices of third-party sites you visit via links from our platform. Always review their policies before providing personal information.
16 Direct Marketing
We only send marketing communications (newsletters, product updates, offers) if you have opted in to receive them.
- You can opt in or out at any time in Settings → Notification Preferences.
- Every marketing email includes an unsubscribe link.
- Service notifications (payment reminders, invoices, security alerts, renewal notices) are not marketing and cannot be unsubscribed while you have an active account — they are essential to the service.
17 Data Breaches
If we become aware of a data breach that compromises your personal information, we will:
- Notify the Information Regulator as soon as reasonably possible (POPIA requirement).
- Notify you by email if the breach poses a risk to your rights or freedoms.
- Describe the nature of the breach, the data affected, and the steps we're taking.
- Take immediate steps to contain and remediate the breach.
18 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will:
- Update the "Last updated" date at the top of this page.
- Notify you by email or in-app notification at least 14 days before material changes take effect.
- For significant changes affecting your rights, we may ask for fresh consent.
19 Complaints
If you believe we have not complied with POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:
| Website | inforegulator.org.za |
| complaints.IR@justice.gov.za | |
| Phone | 010 023 5200 |
| Address | JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 |
We encourage you to contact us first at privacy@w10.co.za so we can try to resolve the matter directly.
20 Contact Us
For any questions, requests, or concerns about this Privacy Policy or your personal information:
| Company | W10 (Pty) Ltd |
| Information Officer | Information Officer, W10 (Pty) Ltd |
| Privacy Enquiries | privacy@w10.co.za |
| General Enquiries | info@w10.co.za |
| Phone | +27 00 000 0000 |
| Registered Address | Johannesburg, Gauteng, South Africa |
| Website | https://w10.co.za |