Privacy Policy

Your privacy is very important to us. This policy explains what information we collect, what we do with it, and how we keep it secure. It has two parts:

• Part 1 covers the personal data Hostnali Webhost collects and uses for its own purposes, as a data controller: when you visit hostnali.ng, create an account, buy a service or contact us.
• Part 2 is our data processing agreement. It governs the personal data we process on behalf of our customers (the “Data Controller”) when Hostnali Webhost (the “Data Processor”) hosts their websites, email and applications. It forms part of the Hostnali Webhost subscription agreement (the “Main Agreement”), in which the parties agreed the terms for the delivery of our services (the “Main Services”).

Applicable law

We process personal data in line with the Nigeria Data Protection Act, 2023 (NDPA) and the regulations and guidance issued under it (the “Applicable Law”).

Part 1: Personal data we collect as a controller

What we collect

• Account and billing details: your name, company, email address, phone number, postal address and payment records when you register in our Client Area or buy a service. Card payments are handled by our payment providers; we do not store full card numbers.
• Support and sales conversations: the messages you send us by email, support ticket, live chat, contact form or phone.
• Technical data: IP addresses, browser and device information, and server logs, which we use to run and secure our services.
• Website analytics: how visitors use our website, collected with Google Analytics. See our Cookie Policy.

How we use it

We use this data to provide and bill for the services you buy, to verify your identity, to answer your enquiries, to send service and renewal notices, to prevent fraud and abuse, to meet our legal and tax obligations, and to improve our website and services. We send marketing messages only where the law allows, and you can opt out at any time.

Who we share it with

We share personal data only with the service providers we need to run our business (for example domain registries and registrars, payment providers, data centres, and email, live chat and analytics providers), and with authorities where the law requires it. Domain registration details are shared with the relevant registry as required by its rules. We do not sell your personal data.

How long we keep it

We keep account and billing records for as long as your account is active and afterwards for as long as the law requires, for example for tax and accounting purposes. Support conversations and logs are kept only as long as they are needed.

Your rights

Subject to the Applicable Law, you have the right to be informed about how we use your personal data, to access it, to have it corrected or deleted, to object to or restrict its processing, to withdraw consent, and to data portability. To exercise these rights, contact us through our contact page. If you are unhappy with how we handle your data, you can also complain to the Nigeria Data Protection Commission (NDPC).

Part 2: Data processing agreement

Processing of personal data

In delivering the Main Services to the Data Controller, the Data Processor processes certain categories and types of the Data Controller’s personal data on the Data Controller’s behalf. “Personal data” means any information relating to an identified or identifiable natural person, as defined in the Applicable Law (the “Personal Data”). The categories and types of Personal Data processed are listed under Personal Data and data subjects below. The Data Processor only carries out processing that is necessary and relevant to perform the Main Services, and keeps a record of its processing activities as required by the Applicable Law.

The personal data that the Data Processor processes about the Data Controller and its employees for its own sales, marketing and product development is not covered by this Part 2, because for that data the Data Processor is the data controller. Part 1 of this policy applies to it.

Instruction

The Data Processor may only process the Personal Data in accordance with the Data Controller’s documented instruction (the “Instruction”). At the time this agreement is entered into, the Instruction is that the Data Processor may only process the Personal Data for the purpose of delivering the Main Services described in the Main Agreement. The Data Controller guarantees that the Personal Data transferred to the Data Processor is processed by the Data Controller in accordance with the Applicable Law, including its requirements on the lawfulness of processing. The Data Processor will notify the Data Controller without undue delay if it considers the current Instruction to conflict with the Applicable Law.

The Data Processor’s obligations

Confidentiality

The Data Processor treats all Personal Data as strictly confidential. The Personal Data may not be copied, transferred or otherwise processed in conflict with the Instruction unless the Data Controller has agreed in writing. The Data Processor’s employees are bound by a duty of confidentiality that requires them to treat all Personal Data under this agreement as strictly confidential.

Security

The Data Processor implements appropriate technical and organisational measures as set out in this agreement and the Applicable Law. It makes sure that access to the Personal Data is limited to employees who need it to perform the Data Processor’s obligations under the Main Agreement and this agreement, and that those employees only process the Personal Data in accordance with the Instruction. The Data Processor will provide documentation of its security measures if the Data Controller requests it in writing.

Data protection impact assessments and prior consultation

Where its assistance is necessary and relevant, the Data Processor will help the Data Controller prepare data protection impact assessments and any prior consultation with the regulator required by the Applicable Law.

Rights of data subjects

If the Data Controller receives a request from a data subject to exercise their rights under the Applicable Law, and a correct reply requires the Data Processor’s help, the Data Processor will provide the necessary information and documentation within a reasonable time. If the Data Processor receives such a request relating to the Data Controller’s Personal Data, it will forward the request to the Data Controller immediately.

Personal data breaches

The Data Processor will notify the Data Controller without undue delay of any breach of security that leads, or could lead, to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data that is transmitted, stored or otherwise processed. The Data Processor keeps a register of all personal data breaches, which includes at least:

1. a description of the nature of the breach, including, where possible, the categories and approximate number of data subjects and records affected;
2. a description of the likely and actual consequences of the breach; and
3. a description of the measures the Data Processor has taken or proposes to take to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.

The Data Processor will provide a copy of the register if the Data Controller or the relevant data protection authority requests it in writing.

Documentation of compliance

On the Data Controller’s written request, the Data Processor will provide, within a reasonable time, documentation showing that (i) it complies with its obligations under this agreement and the Instruction, and (ii) it complies with the Applicable Law in its processing of the Data Controller’s Personal Data.

Location of the Personal Data

The Data Processor may transfer, process and store Personal Data outside Nigeria wherever it operates in order to provide the Main Services. Any transfer of Personal Data to another country or an international organisation is made only where it is permitted by, and carried out in accordance with, the Applicable Law.

The Data Controller’s obligations

The Data Controller agrees that it will comply with its obligations as a data controller under the Applicable Law in respect of its processing of Personal Data and the instructions it gives the Data Processor, and that it has given all required notices and obtained (or will obtain) all consents and rights necessary under the Applicable Law for the Data Processor to process Personal Data and provide the Main Services.

Sub-processors

The Data Processor has general authorisation to engage third parties to process Personal Data (“Sub-processors”) without further specific written authorisation from the Data Controller. The Data Processor will conclude a written agreement with each Sub-processor that imposes at least the same data protection obligations as apply to the Data Processor under this agreement, and will monitor its Sub-processors’ compliance with the Applicable Law on an ongoing basis.

Remuneration and costs

The Data Processor is entitled to be paid for time and materials used to adapt its processing to changes in the Data Controller’s Instruction, including implementation costs and any additional costs of delivering the Main Services because of the change.

The Data Processor is not liable for failing to perform the Main Agreement if performance would conflict with a changed Instruction, or if delivery in line with the changed Instruction is impossible, for example where the change cannot be implemented technically, practically or legally; where the Data Controller requires the change to apply before it can be implemented; or in the period until the Main Agreement is updated to reflect the new Instruction and its commercial terms. If changes to the Applicable Law, including new guidance or court decisions, cause the Data Processor additional costs, the Data Controller will reimburse those documented costs.

Breach and liability

If there is a security leak or data leak, the Data Processor will, to the best of its ability, notify the Data Controller without undue delay, and the Data Controller will decide whether to inform the data subjects and/or the relevant regulator. This duty applies regardless of the impact of the leak. The Data Processor will endeavour to make sure the information it provides is complete, correct and accurate, and will cooperate in notifying the authorities and/or data subjects where the law requires. The Data Controller remains responsible for any statutory obligations in this respect.

The notification will in any event state that a leak has occurred and include details of its (suspected) cause, its (known and/or expected) consequences, the (proposed) solution, and the measures already taken.

Any limitation of liability in the Main Agreement does not apply to losses caused by the other party’s gross negligence or wilful misconduct, or to a party’s expenses and resources used to perform the other party’s obligations, including payment obligations, towards a data protection authority or any other authority.

Duration

This agreement remains in force until the Main Agreement is terminated.

Personal Data and data subjects

The Data Processor processes the following types of Personal Data in delivering the Main Services:

• ordinary contact information for relevant employees of the Data Controller;
• for users of the Main Services: names, phone numbers, email addresses, postal addresses and IP addresses; and
• personal data provided by users in the course of their use of the Main Services.

The data subjects are the Data Controller’s customers and end users.

Termination

The Data Processor’s authority to process Personal Data on the Data Controller’s behalf ends when this agreement ends. The Data Processor may continue to process the Personal Data after termination to the extent necessary and required by the Applicable Law, and during that period may keep the Personal Data in its backups. On termination, the Data Processor and its Sub-processors will return the Personal Data processed under this agreement to the Data Controller, unless the Data Controller already has it.

General

Legal disclosure

We may disclose personal data where the law requires it, and where we believe disclosure is necessary to protect our rights or to comply with a judicial proceeding, court order or other legal process.

Security

The security of your personal data is important to us. We follow generally accepted industry standards to protect personal data, both in transit and once we receive it, and this website is served over an encrypted (HTTPS) connection. No method of transmission over the internet or of electronic storage is 100% secure, so while we use commercially acceptable means to protect personal data, we cannot guarantee its absolute security.

Changes to this policy

If we change this privacy policy, we will publish the changes on this page and anywhere else we consider appropriate, so that you always know what information we collect, how we use it and when we disclose it. If we make material changes, we will notify you here. If you have any questions, please send them through our contact page.