Privacy Policy

Crystal Webhosting ("Crystal Webhosting", "we", "us", or "our") is committed to protecting the personal data of our clients, website visitors, and users of our client portal and hosting infrastructure (collectively the "Services"). This Privacy Policy explains what information we collect, why we collect it, how we protect it, and the rights you have over it.

This policy is designed to align with the Uganda Data Protection and Privacy Act 2019 and its regulations, and where applicable to clients located in those jurisdictions, the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA). Where requirements differ across jurisdictions, we apply the more protective standard.

This Privacy Policy does not by itself constitute your consent to processing. Where consent is our legal basis for a specific activity, we obtain it separately, and you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

1. INFORMATION WE COLLECT

We follow the principle of data minimization—we don't collect what we don't need. We collect information that identifies, relates to, describes, or can be linked to a particular consumer or device ("Personal Data"). This includes:

• Account & Contact Information: Mandatory fields required for account creation include your name, phone number, and email address. Optional fields such as company name and billing address may be provided at your discretion. This information is collected and used strictly for user account registration, identification during support interactions, and delivering essential billing notifications or critical alerts regarding your account.
• Payment Transactions: We record invoice numbers, payment statuses, and transaction reference IDs supplied by our payment gateways and financial channels. Crystal Webhosting does not collect, process, or store payment card numbers, CVV codes, or bank account credentials—these are handled entirely by our certified payment processors and financial institutions via Mobile Money, EFT, RTGS, or secure gateway platforms.
• Technical & Infrastructure Data: Data automatically generated and recorded when you visit our website, log into your client portal, or manage your hosting services. To be fully transparent, this includes:
  • IP Addresses: Logged for security, abuse prevention, and geographic routing.
  • Login Logs & Session History: Recorded to audit account access, prevent unauthorized intrusions, and protect your account security.
  • Server Configuration Data & SSH Keys: Technical parameters and cryptographic keys provided or generated by you to facilitate secure remote administration and server management.
  • Resource Consumption Metrics: CPU, memory, bandwidth, and disk usage statistics tracked to ensure system stability, resource allocation, and billing accuracy.
  • Browser & Device Fingerprints: Technical characteristics of the device or browser you use (such as screen resolution, operating system, and user-agent strings) collected via our security tools to detect automated bot activity, prevent fraud, and secure our portal against malicious logins.
• Communications: Records and transcripts of correspondence with our support, sales, and billing teams via support tickets, live chat, or email.
• Hosted Content Data: Files, databases, emails, and website scripts you upload or manage within your hosting containers (see Section 8 on how this differs from Account Data).
• Cookies & Similar Technologies: See Section 9.

2. LEGAL BASES FOR PROCESSING

We rely on the following legal bases and no single blanket basis (such as continued use of the Services) substitutes for them:

• Contractual necessity: Processing needed to set up your hosting account, register a domain, or fulfil our obligations under the Master Terms of Service.
• Legal obligation: Compliance with Ugandan law or other applicable regulation, including responding to valid court orders, subpoenas, or law enforcement requests.
• Legitimate interests: Maintaining network and information security, preventing fraud and cyber threats, and improving the performance of our portal, balanced against your rights and freedoms.
• Consent: For optional features or marketing communications. You may withdraw consent at any time via your client portal or the unsubscribe link in any marketing email.

3. HOW WE USE YOUR INFORMATION

• Service provisioning: Creating accounts, setting up hosting environments, processing renewals, delivering technical support, and authenticating your identity when you contact our support desk.
• Billing & critical communications: Executing transactions, sending automated billing notifications, and delivering critical service or security alerts regarding your user account.
• Fraud prevention & security: Executing automated fraud screening, monitoring server telemetry, investigating breaches, mitigating DDoS attacks, and protecting infrastructure using tools such as Imunify360 and cPGuard.
• Legal compliance: Responding to lawful court orders, subpoenas, or regulatory requests.

Automated Decision-Making: Our fraud-screening and bot-mitigation systems may automatically flag, delay, or block a signup or transaction without human review at the point of decision. Where such a decision produces a legal or similarly significant effect on you, you may request human review by contacting privacy@crystalwebhosting.com.

4. DATA SHARING & THIRD-PARTY DISCLOSURES

We do not sell, rent, or trade your personal data. We disclose it only as follows:

• Infrastructure, data center partners & server management: To provision servers, route IPs, manage physical infrastructure, and maintain secure server environments. Our hosting facilities are located in the New York City metro area, Miami, and Los Angeles, with planned expansion to Dallas and Amsterdam. Additionally, the Company reserves the right to utilize trusted external server management companies to perform backend administration and technical support. Each partner and third-party vendor is bound by data processing agreements requiring safeguards at least equivalent to this policy.
• Domain registrars & registries (ICANN & Regional): When you register a domain, required registrant details are forwarded to our upstream registrars (such as eNom and Tucows) and regional top-level domain registries (such as i3c for .ug domains, KeNIC for .ke domains, TZNIC for .tz domains, RICTA for .rw domains, or ZA Central Registry for .africa domains) and published in the public WHOIS directory as mandated by ICANN or the respective country registry unless you enable our WHOIS privacy protection add-on.
• Payment Gateway & Financial Method Disclosures: Payment transactions and merchant settlements are processed securely through certified external payment processors and financial institutions (such as Pesapal, DPO, PayPal, direct Mobile Money merchant integrations, EFT, and RTGS). Crystal Webhosting does not collect or store full credit card details or sensitive banking passwords. External processors and financial institutions operate under their own independent privacy policies, terms, and conditions, and we do not accept responsibility or liability for their processing practices. Clients are encouraged to review the respective privacy policies of these third-party payment providers before submitting financial data.
• Third-Party Products: Our services may incorporate third-party products or integrations. Where a customer independently chooses or integrates a third-party tool on their own accord, that provider's specific privacy policy applies rather than this policy, and it is the customer's obligation to review how it affects their data and end users.
• Legal obligations: When required by law, subpoena, or court order, or to protect the rights, safety, or property of Crystal Webhosting, our clients, or the public. Where legally permitted, we will notify the affected client before disclosure.

5. INTERNATIONAL DATA TRANSFERS

Your data may be processed in the United States and, following planned expansion, the Netherlands—including data from clients located in the European Economic Area (EEA), the United Kingdom, or other regions with data-localization requirements. Where we transfer personal data out of the EEA or UK, we rely on appropriate legal safeguards (such as European Commission Standard Contractual Clauses or UK International Data Transfer Addenda). You may request a copy of the relevant safeguard by contacting privacy@crystalwebhosting.com.

6. DATA RETENTION

We retain personal data only for as long as necessary for the purposes described in this policy:

• Account & billing records: Retained for the duration of your active account and afterward to meet tax, accounting, and audit obligations.
• Support communications: Retained for quality assurance and dispute resolution from the date of the last interaction.
• Server and access logs: Retained for security monitoring unless a longer period is required to investigate an active security incident.
• Hosted content: Deleted from active systems within 30 days of account termination and from backups on the applicable backup rotation cycle thereafter.
• Credential vault entries: Purged automatically upon ticket resolution (see Section 7).

Where we can no longer identify you, data may be retained in de-identified or aggregated form beyond these periods for statistical purposes.

7. DATA SECURITY & PLATFORM PROTECTIONS

We apply layered technical and organizational safeguards including:

• Encryption: Sensitive account fields and configuration data are encrypted at rest and in transit using industry-standard AES and RSA cryptography with installation-specific keys.
• Bot and fraud mitigation: Behavioral monitoring, CAPTCHA-style challenge-response checks, and automated fraud screening to block credential-stuffing and fraudulent registrations.
• Access governance: Administrative access to client systems requires multi-factor authentication (MFA/TOTP), is transmitted over encrypted channels, and is logged for audit purposes.
• Credential vaulting: Sensitive technical access details (root access, SSH keys, control-panel logins) submitted via support tickets are stored in encrypted vaults and automatically purged once the related ticket is resolved.
• Offloaded financial security: Payment processing is handled entirely by certified gateways and financial institutions; raw card numbers never touch our servers.

Data Breach Notification Commitment: In the unlikely event of a personal data breach affecting your rights and freedoms, we commit to notifying affected users and relevant supervisory authorities without undue delay, typically within 72 hours of becoming aware of the breach.

Shared Security Responsibilities

Cybersecurity is a shared responsibility. As a client, you are required to:

• Maintain up-to-date operating systems, web browsers, antivirus, anti-malware, and endpoint protection on any device used to access our portal, dashboards, or server terminals.
• Avoid accessing your client portal or administrative dashboards over public, unencrypted, or untrusted Wi-Fi networks unless using a secure Virtual Private Network (VPN).
• Use strong, unique passwords and enable multi-factor authentication on your account, and never recycle credentials used on external sites.
• Exercise extreme caution when interacting with incoming emails, unverified links, or unexpected attachments. Note that spoofed emails or phishing communications may originate externally from compromised third-party accounts, or internally if a client email account or script on our network is compromised and abused by unauthorized actors.
• Keep all hosted applications, themes, and plugins patched and up to date.
• Use encrypted connections (SFTP, SSH, HTTPS) for file transfers and remote administration.

Crystal Webhosting is not liable for data breaches, account compromises, or service disruptions resulting from client-side device infections, unpatched software, weak or recycled credentials, phishing susceptibility, compromised client email accounts, or unsecured networks, except to the extent caused by our own direct breach of this policy or applicable law.

8. ACCOUNT DATA VS. HOSTED CONTENT & TRANSFERS

• Account Data: Information you provide to manage your relationship with us (name, email, phone number, billing details) is controlled by us as described in this policy.
• Hosted Content: Files, databases, and emails inside your hosting containers remain your property. We act strictly as a processor/host and do not inspect or control this content except where necessary for system maintenance, abuse mitigation, automated security scanning (Imunify360, cPGuard), or legal compliance.
• Account Ownership Transfers: If you wish to transfer your account ownership to a third party, you may submit a formal request via your control portal. Following identity verification and completion of transfer documentation, the new owner will become bound by our terms and this Privacy Policy.

9. COOKIES AND TRACKING TECHNOLOGIES

We use the following categories of cookies on our website and client portal:

• Strictly necessary: Required for login session security and core portal functionality. These cannot be disabled.
• Functional: Remember your preferences and settings.
• Analytics: Help us understand site traffic and usage patterns.

Where required by law, non-essential cookies are only set after you provide affirmative consent through our cookie preference banner. You may also configure your browser to refuse cookies, though this may affect portal functionality.

10. YOUR DATA RIGHTS

Depending on your jurisdiction, you may have some or all of the following rights:

• Access & portability: Request a copy of the personal data we hold about you in a portable format where applicable.
• Rectification: Correct inaccurate or incomplete data via your client portal or by contacting support.
• Erasure: Request deletion of your account and personal data, subject to our legal obligations to retain billing or contract records.
• Restriction & objection: Request that we limit processing or object to processing based on legitimate interests in certain circumstances.
• Opt-out: Unsubscribe from marketing communications at any time. Transactional and billing-related emails cannot be opted out of while your account is active.
• Lodge a complaint: With your local data protection supervisory authority—for example, Uganda's Personal Data Protection Office, an EU/UK data protection authority, or another applicable regulator—in addition to contacting us directly.

Identity Verification Protocols: To protect your security and prevent unauthorized data disclosures, we enforce strict identity verification protocols before fulfilling any data subject access requests, privacy rights exercises, or sensitive account changes (such as email updates, ownership transfers, or credential resets). We may require you to provide specific identification details, verify ownership via your registered communication channels, or complete additional authentication steps.

Non-Discrimination Clause: We will not discriminate against any user or client for exercising their privacy rights. Exercising your data protection rights will never result in denied services, altered pricing tiers, or degraded service quality.

To exercise your rights, contact us at privacy@crystalwebhosting.com or via your client portal support desk. We will respond within the timeframe required by applicable law after identity verification is successfully completed.

11. CHILDREN'S PRIVACY

Our Services are not directed to individuals under 18, and we do not knowingly collect personal data from anyone under that age. We apply the age of 18 uniformly across all jurisdictions as our baseline standard. If we learn that a minor has provided personal data without appropriate consent, we will delete it promptly.

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will post material changes on our website and, where changes significantly affect your rights, notify you by email before they take effect. Continued use of the Services after the effective date of an update constitutes acceptance of the revised policy except where applicable law requires your affirmative consent to the change.

13. CONTACT US

Questions, concerns, or requests regarding this Privacy Policy or your personal data can be directed to:

• Email: privacy@crystalwebhosting.com