Home/Privacy
Privacy Policy
What personal data we collect when you buy hosting from us, why we hold it, where it lives, and what you can ask us to do with it.
Last updated: 12 September 2026
1. Who is responsible for your data
The HostFasts entity named on your invoice is the controller (or, under some of the laws below, the "data fiduciary") for personal data collected through hostfasts.com. This policy is written with reference to the data protection laws of the markets we serve:
- Saudi Arabia — Personal Data Protection Law (Royal Decree M/19)
- United Arab Emirates — Federal Decree-Law No. 45 of 2021
- Qatar — Law No. 13 of 2016 on Personal Data Privacy Protection
- Oman — Personal Data Protection Law (Royal Decree 6/2022)
- Bahrain — Personal Data Protection Law No. 30 of 2018
- India — Digital Personal Data Protection Act, 2023
2. What we collect
Information you give us
- Name, business name, email address, phone number and country, when you enquire or order.
- Billing address and tax registration number (VAT/TRN or GSTIN), where required to raise a compliant tax invoice.
- Registrant contact details for any domain we register on your behalf, and any supporting documentation a restricted registry requires — for example a trade licence for a .sa domain.
- Anything you choose to include in a support request.
Information generated by using the service
- Server and access logs, including IP addresses, needed to operate, secure and troubleshoot the platform.
- Records of support interactions and billing history.
What we do not collect
We do not store card numbers or bank credentials on our systems. Payments are processed by regulated payment providers who handle those details directly. This website does not run advertising trackers or third-party analytics profiling.
3. Why we hold it
- To provide the service — provisioning accounts, registering domains, issuing certificates, answering support requests.
- To bill you — issuing invoices and meeting VAT, GST and accounting obligations.
- To secure the platform — detecting abuse, investigating incidents, preventing fraud.
- To meet legal obligations — responding to lawful requests from authorities, and retaining records for the periods applicable law requires.
4. Who we share it with
We share the minimum necessary, and only with:
- Our upstream infrastructure partners, to provision and support the hosting account you have ordered, in the region you selected.
- Domain registries and registrars, where registry rules require registrant data or supporting documents.
- Certificate authorities, for the validation of SSL certificates you request.
- Payment providers, to process your payment.
- Authorities, where we are legally compelled to disclose.
We do not sell personal data, and we do not share it for third-party marketing.
5. Where your data lives
Your hosting data is held in the datacentre region you selected at order — Dubai, Riyadh or Jeddah, Bahrain, or Chennai. Where you have told us your data must remain in a named country, we confirm that placement in writing and do not move it without your agreement.
Account and billing records are held by the supplying entity. Some service providers we rely on — domain registries and certificate authorities in particular — operate outside your country, and data necessarily transferred to them is limited to what those functions require. Where a cross-border transfer requires a safeguard or a regulator notification under the laws listed above, we put that in place.
6. How long we keep it
- Account and billing records: for the duration of the relationship and then as required by tax and company law in the relevant jurisdiction.
- Service data in your hosting account: deleted approximately 30 days after termination.
- Security and access logs: retained for a limited operational period, then deleted.
7. Your rights
The exact rights available depend on which law applies to you, but in all our markets you may ask us to:
- confirm what personal data we hold about you and give you access to it;
- correct data that is inaccurate or incomplete;
- erase data where we no longer need it for the purpose it was collected, and no legal obligation requires us to keep it;
- withdraw consent where we relied on consent;
- receive a copy in a portable format, where the applicable law provides for it; and
- complain to your national supervisory authority.
Write to info@hostfasts.com and we will respond within the period the applicable law allows. We may need to verify your identity before acting, particularly for erasure requests.
8. Security
We apply the controls you would expect of a security company: encryption in transit, access control on administrative systems, network filtering, malware scanning and logging. No system is perfect. If a breach affects your personal data we will notify you and the relevant supervisory authority within the timeframe the applicable law requires.
9. Cookies
This website uses only what is necessary to serve the pages. It does not set advertising or cross-site tracking cookies. Any client area or billing portal we operate may set a session cookie so that you stay logged in; that is strictly functional.
10. Children
Our services are intended for businesses and adults. We do not knowingly collect personal data of children. If you believe we have, contact us and we will delete it.
11. Changes and contact
We will post material changes to this policy on this page and notify account holders by email. Questions, or a request to exercise your rights, go to info@hostfasts.com or +966 55 114 5016.