Privacy Policy

1. Who is responsible for your data

The data controller is Webolute FZE, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates. Hostolute is a brand operated by Webolute FZE.

For privacy requests, email [email protected] or write to the address above. This policy should be read with our Cookie Policy and Terms & Conditions.

We handle personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and other applicable laws. If you are in the European Economic Area, the United Kingdom, or another region with similar rights, we also honour those rights where they apply to our processing of your data.

2. Personal data we collect

2.1 Information you provide

Depending on how you interact with us, this may include:

• Identity details: full name, company name, and job title
• Contact details: email address, phone number, and billing or postal address
• Account credentials: username and password (stored in hashed or equivalent form)
• Order and billing details: products purchased, domain names, hosting package, invoices, and communication history
• Payment-related information: last-four card digits, payment status, and billing country. Full card details are collected and processed by Stripe, not stored on Hostolute servers
• Customer content: logos, text, images, and other materials you send for website customization, migration, or support
• Enquiry data: messages submitted through the contact form, WhatsApp, email, or phone
• Domain registrant data required by registries (which may become public WHOIS data unless privacy services apply)

2.2 Information collected automatically

• IP address, approximate location derived from IP, browser type, and device data
• Pages viewed, referring URL, date and time, and basic usage statistics
• Cookie and similar technology data, as described in our Cookie Policy
• Security signals used to detect bots, fraud, and abuse, including Google reCAPTCHA data where that feature is enabled

2.3 Information from third parties

We may receive limited data from:

• Stripe, regarding payment success, failure, risk scoring, and refunds
• Our billing, hosting, and domain platform (WHMCS and registrar partners)
• Domain registries and WHOIS lookup services
• Analytics, email delivery, cloud hosting, and security vendors

3. Why we use personal data

We use personal data to:

• Create and administer customer accounts
• Process orders, invoices, taxes, and payments
• Register, renew, and manage domain names and DNS
• Provision hosting, SSL, email, migrations, and website packages
• Customize, deploy, and support your website
• Provide customer support and service notices, including renewal reminders
• Detect fraud, chargebacks, spam, malware, and unauthorized access
• Improve the Website, products, and user experience
• Comply with legal, tax, accounting, ICANN, registry, and law-enforcement duties
• Send service-related emails that are necessary to perform the contract
• Send marketing communications only where permitted, and with a clear opt-out in every marketing message

4. Legal bases

Where a legal basis is required, we rely on one or more of the following:

• Contract: to take steps at your request and to perform a contract for websites, hosting, domains, or related services
• Legitimate interests: to secure our systems, prevent fraud, improve services, and communicate about similar products, balanced against your rights
• Consent: for optional cookies, marketing emails, or other consent-based processing
• Legal obligation: tax, accounting, consumer, domain, and data-protection duties

You may withdraw consent at any time without affecting processing that already occurred, or that rests on another lawful basis.

5. Cookies and similar technologies

We use cookies, local storage, and similar technologies for essential site functions, checkout security, currency preference, and (where enabled) analytics. Details, including how to control cookies, are in our Cookie Policy.

6. How we share information

We do not sell your personal information. We may share it with:

• Payment processors: Stripe, to take payment, authenticate cards, prevent fraud, and issue refunds
• Hosting and billing systems: WHMCS and related infrastructure used to create accounts, invoices, hosting services, and support tickets
• Domain registries and registrars: as required to register or transfer a domain, including mandatory registrant data
• Certificate authorities and email providers: to issue SSL and provision mailboxes
• Cloud and operations vendors: including Amazon Web Services (or similar) for file storage, and SMTP providers for transactional email
• Security vendors: including Google for reCAPTCHA where enabled
• Professional advisers and authorities: where required by law, court order, or to protect rights, safety, or security
• Business transfers: in a merger, acquisition, or sale of assets, subject to appropriate safeguards

Webolute teams supporting Hostolute may access customer data as needed to design, develop, host, and support your services, under the same confidentiality and security expectations.

7. International transfers

We are established in the United Arab Emirates. Personal data may be processed in the UAE and in other countries where our providers operate (for example, payment, cloud, and email infrastructure). Where data is transferred outside your country, we take reasonable steps to implement appropriate contractual and technical safeguards consistent with applicable law.

8. Retention

We keep personal data only as long as needed for the purposes above, including:

• Active customer accounts: for the life of the account plus a reasonable wind-down period
• Order, invoice, and tax records: typically at least five (5) years, or longer if UAE accounting or tax rules require
• Support correspondence: for as long as needed to resolve issues and document advice
• Marketing contacts: until you unsubscribe or the list is no longer used
• Security logs: for a limited period appropriate to investigating abuse and protecting the platform

Domain registrant data may need to be retained under registry or ICANN rules even after a service ends. Website files and backups are deleted after service expiry, subject to any short recovery window we offer.

9. Security

We use administrative, technical, and physical measures appropriate to the risk, including encrypted payment handling via Stripe, access controls, hashed passwords, and restricted staff access. No online service is completely secure. You must also protect your own passwords, devices, and customer data stored on your website.

10. Your rights

Subject to applicable law and relevant exceptions, you may request to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Erase data we no longer need to keep
• Restrict or object to certain processing
• Withdraw consent where processing is based on consent
• Opt out of marketing emails at any time
• Receive a portable copy of data you provided to us, where that right applies

To exercise these rights, email [email protected] from the address associated with your account and describe the request. We may need to verify your identity. We will respond within the period required by applicable law.

You may also lodge a complaint with the UAE Data Office or another competent supervisory authority in your country of residence.

11. Domain WHOIS and public data

Registering a domain may require disclosure of registrant details to the registry, registrar, and, in some cases, public WHOIS or registration data directory services. Where WHOIS privacy or equivalent redaction is available and included or purchased, we will request it, but registries may still require certain data to remain available to authorities or the registrar.

12. Customer websites and hosted data

If you use Hostolute hosting or a website package, you are the controller of personal data you collect through your own website or email (for example, your customers’ form submissions). You must provide your own privacy notice and obtain any consents required for that collection. We process such data as a service provider / processor on your instructions, to host, back up, and support the service, and as required by law.

13. Children

Our Website and services are not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it unless we are legally required to retain it.

14. Third-party links

The Website may link to third-party sites, including Webolute, payment pages, and social media. Their privacy practices are their own. We encourage you to read their policies before providing information.

15. Changes

We may update this Privacy Policy to reflect operational, legal, or regulatory changes. The revised policy will be posted on this page with a new “Last Updated” date. Where a change is material, we may provide an additional notice through the Website or by email.

16. Contact

Webolute FZE (trading as Hostolute)
Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates
Email: [email protected]
Phone / WhatsApp: +971 58 592 2123
Contact form: hostolute.com/contact-us