WebMail 
LiveChat 
How Credible Host looks after your personal information
This policy explains what personal information we collect when you visit our website or use our hosting, domain and email services, why we collect it, who we share it with, and the rights you have under Zimbabwe's Cyber and Data Protection Act.
Only the information required to run your account, register your domains and keep our services secure.
We share information only with the partners needed to deliver your services, or where the law requires it.
Card and mobile money details are handled by our payment partners. We never see your full card number or PIN.
You can ask to see, correct or delete your information at any time, free of charge.
1Who we are
Credible Host is a web hosting, domain registration and business email provider operated by Credible Brands, a company registered in Zimbabwe and based in Harare. In this policy, "Credible Host", "we", "us" and "our" refer to Credible Brands.
For the personal information described in this policy, Credible Brands is the data controller: we decide why and how that information is processed. We have appointed a Data Protection Officer, who can be reached at dpo@crediblebrands.co.zw.
2Scope of this policy
This policy applies when you:
- visit credible.host or our client area at my.credible.host;
- create an account, order or use our hosting, domain, email, VPS or website services;
- contact us by email, phone, WhatsApp, live chat, contact form or support ticket; or
- subscribe to our newsletter or take part in our affiliate programme.
It should be read together with our Terms of Service and Acceptable Use Policy.
3Information we collect
| Type of information | Examples | Where it comes from |
|---|---|---|
| Account and contact details | Name, company name, email address, phone number, postal address, account password (stored encrypted) | You, when you register or update your account |
| Domain registration details | Registrant, administrative, technical and billing contacts for each domain, nameservers | You, as required by domain registries |
| Billing and payment records | Invoices, order history, transaction references, payment method type, account credit | You and our payment processors |
| Support and communications | Support tickets, live chat transcripts, emails, contact form messages, call notes | You, when you contact us |
| Technical and usage data | IP address, browser and device type, pages visited, referring page, login times, server and security logs | Collected automatically when you use our website and services |
| Marketing preferences | Newsletter subscription, how you heard about us | You |
We do not ask for sensitive personal information (such as health, religious or biometric data) and ask that you do not send it to us.
4How we use your information
We only process personal information where we have a lawful reason to do so:
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account, and providing the services you order | Performance of our contract with you |
| Registering, renewing and transferring domain names with registries | Performance of our contract; registry and legal requirements |
| Billing, collecting payments and keeping financial records | Contract; legal obligation (tax and accounting laws) |
| Providing support and sending service notices (renewals, invoices, outages, security alerts) | Performance of our contract |
| Protecting our network and customers from fraud, spam, malware and abuse | Legitimate interests; legal obligation |
| Understanding how our website is used so we can improve it | Consent (through our cookie banner) |
| Sending newsletters, offers and promotions | Consent, which you can withdraw at any time |
| Complying with court orders, lawful requests from authorities, and protecting our legal rights | Legal obligation; legitimate interests |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5Domain registration data
When you register a domain name, the rules of the relevant registry require us to collect contact details for the domain and pass them to that registry. For .co.zw and other Zimbabwean domains this is the Zimbabwe domain registry; for international domains (such as .com, .net and .org) it includes the registry operator and the registrar partners we work with, under rules set by ICANN.
Some registration details may appear in public domain lookup services (WHOIS/RDDS), depending on the registry's policy. Where privacy or redaction options are available for your domain, we will apply them or let you choose them. Registries may also be required to keep registration data with an escrow provider.
6Content you host with us
Websites, files, databases and email you store on our servers belong to you. For that content you are the data controller and we act as your data processor: we store and process it only to provide the service to you.
We do not access the contents of your hosting account or mailboxes except where you ask us to (for example, for support), where it is needed to keep our systems secure (for example, automated malware scanning), or where the law requires it. If your website collects personal information from your own visitors, you are responsible for having your own privacy policy and complying with data protection law. How we process this content on your behalf is set out in our Data Processing Agreement.
9Where your information is stored
We operate servers in Zimbabwe, South Africa and the United Kingdom. Depending on the service you use, your information may therefore be stored or processed outside Zimbabwe.
We only transfer personal information outside Zimbabwe where the destination provides an adequate level of protection or appropriate safeguards are in place, as required by the Cyber and Data Protection Act. South Africa (Protection of Personal Information Act) and the United Kingdom (UK GDPR) both have comprehensive data protection laws.
Some of our service providers, such as Google, may process information in other countries. Where they do, we rely on their contractual data protection commitments.
10How long we keep it
We keep personal information only for as long as we need it for the purposes in this policy or as the law requires:
| Information | How long |
|---|---|
| Account, billing and invoice records | While your account is active, then for up to 7 years to meet tax and accounting requirements |
| Domain registration data | For the life of the registration, then as long as registry or ICANN rules require |
| Support tickets and chat transcripts | Up to 3 years after the conversation ends |
| Server and security logs | Up to 90 days, unless needed to investigate a security incident |
| Hosted websites, files and email | Deleted after your service ends; backup copies are overwritten within 30 days |
| Newsletter subscriptions | Until you unsubscribe |
When information is no longer needed, we delete it or anonymise it so it can no longer identify you.
11How we protect it
We use technical and organisational measures appropriate to the risk, including:
- encryption of data in transit (HTTPS/TLS) across our website and client area;
- firewalls, malware scanning and intrusion protection on our servers;
- restricted, role-based access to customer data for staff who need it;
- passwords stored in encrypted (hashed) form; and
- regular backups and software updates.
No system is completely secure. You can help by using a strong, unique password and keeping your login details private.
12Your rights
Under the Cyber and Data Protection Act you have the right to:
To use any of these rights, email our Data Protection Officer at dpo@crediblebrands.co.zw. We may ask you to confirm your identity before acting on your request. We will respond as soon as possible and normally within 30 days, free of charge. If we cannot fully meet your request, for example because we must keep records by law, we will explain why.
13Marketing messages
We only send newsletters and promotional messages if you have opted in. Every marketing email has an unsubscribe link, or you can email us to stop them. Service messages about your account (such as invoices, renewal reminders and security notices) are not marketing, and we will continue to send them while you have an active service.
14Children
Our services are intended for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us and we will delete it.
15Data breaches
If a security incident affects your personal information, we will act quickly to contain it, notify the Data Protection Authority (POTRAZ) as required by law, and inform affected customers without undue delay where the incident is likely to put them at risk, including what we are doing and what steps they can take.
16Other websites
Our website contains links to other websites and services, such as social media pages and payment pages. Their privacy practices are not covered by this policy, so please read their own privacy policies.
17Changes to this policy
We may update this policy to reflect changes in our services or the law. The latest version will always be published on this page with its effective date. If we make significant changes, we will notify active customers by email or through the client area.
18Contact us and complaints
If you have any questions about this policy or how we handle your information, please contact our Data Protection Officer:
If you are not satisfied with our response, you have the right to complain to Zimbabwe's Data Protection Authority, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), at www.potraz.gov.zw.
Effective date: 27 October 2025.
