Compliance at Tremhost
Last updated: 20 October 2026
Organisations choose a hosting and security provider partly on how it handles legal and regulatory obligations. This page explains how Tremhost approaches compliance, where to find our policies, and what we can give you when your own auditors, regulators or clients ask questions.
Our policies
- Privacy Policy – how we collect, use, share and protect personal information.
- Terms and Conditions – refunds, uptime commitment and service credits, backups, acceptable use, and liability.
- Data Protection – our security practices and our commitments when we process personal information on your behalf.
Zimbabwean legal and regulatory framework
- Cyber and Data Protection Act [Chapter 12:07] governs the collection and use of personal information in Zimbabwe.
- POTRAZ (the Postal and Telecommunications Regulatory Authority of Zimbabwe) is the designated Data Protection Authority.
- S.I. 155 of 2024 (Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations) sets licensing and Data Protection Officer requirements for organisations that process personal data.
- Domain registry rules apply to the domains you register through us, including ZISPA’s rules for .co.zw.
- Tax and accounting law determines how long we keep invoices and financial records.
Certifications and attestations
We will list any certification or attestation Tremhost holds on this page, with the issuing body and date. If it is not listed here, do not assume we hold it. Some of our services run on platforms that hold their own certifications, such as Cloudflare for Tremhost Armor, and those belong to the platform provider, not to Tremhost.
Shared responsibility
Compliance is shared between you and us. We are responsible for the infrastructure and services we operate, and for handling personal information in line with our policies. You are responsible for how you use our services, including your content, your software and plugins, your access controls, your backups, and your own obligations to the people whose data you hold. Our Data Protection page explains the split in more detail.
Documents we can provide on request
- a data processing agreement for personal information you host with us;
- our list of sub-processors;
- a summary of our security practices for your due-diligence or audit questionnaires; and
- confirmation of the services and plan you hold with us.
To request any of these, open a support ticket and mark it “Compliance”.
Regulated sectors
If you operate in finance, health, education, the public sector or another regulated field, tell us before you buy. Your requirements about data location, access controls, backups, logging and contracts may shape which service is right for you. Book a consultation and we will tell you plainly what we can and cannot support.
Reporting abuse or a security concern
To report spam, phishing, malware, a compromised website or other abuse involving our network or services, open a support ticket and include the domain or IP address, the dates and times, and any evidence such as full email headers, log lines or links. We review reports during our support hours and may suspend or limit a service where needed to protect our network and customers.
Requests from authorities
We disclose information to courts, regulators or law-enforcement bodies only where the law requires it and the request is valid. See our Data Protection page for how we handle these requests.
Contact
Use our Support page or your client area. Support hours are Monday to Friday, 8:00am to 5:00pm, closed on weekends. You can also write to Tremhost Pvt Ltd, Office 3, Mezzanine Floor, Batanai Gardens (Cnr First Street & Jason Moyo Avenue), Harare, Zimbabwe.
