Data Protection at Tremhost

Data Protection at Tremhost

Last updated: 20 October 2026

Businesses and institutions host their websites, email and systems with Tremhost, and that data often includes personal information about their own customers, staff and members. This page explains how we protect data, what we commit to when we handle personal information for you, and how you can meet your own obligations when you host with us. It works alongside our Privacy Policy and Terms and Conditions.

Our legal framework

Data protection in Zimbabwe is governed by the Cyber and Data Protection Act [Chapter 12:07]. The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) is the Data Protection Authority. The Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (S.I. 155 of 2024) set the licensing and Data Protection Officer requirements for organisations that process personal data. We work to meet these requirements in how we run our own business and in how we handle data for our customers.

Two roles, two sets of responsibilities

• When we are the controller: for the personal information we collect to run accounts, billing, domains, support and security, we decide how it is used. Our Privacy Policy covers this.
• When we are the processor: for personal information inside the websites, databases, files and email you host with us, you are the controller and we process it only to provide the service and on your instructions.

Principles we follow

• Lawful and fair: we process personal information only where we have a lawful reason.
• Purpose-limited: we use it only for the purposes we have told you about.
• Minimal: we collect only what we need.
• Accurate: we correct information when you tell us it is wrong.
• Kept only as long as needed: we delete or anonymise it when we no longer need it or the law no longer requires us to keep it.
• Secure: we protect it with measures appropriate to the risk.
• Accountable: we can explain what we do with it and why.

How we protect data

• Access control: access to customer systems and records is limited to staff who need it to do their work, and is reviewed as our team changes.
• Encryption in transit: SSL/TLS certificates secure traffic between your visitors and your site, and our client area is accessed over HTTPS.
• Malware and attack protection: shared hosting plans include Imunify360 security, DDoS protection and malware scanning, and Tremhost Armor adds Cloudflare-powered firewall and traffic protection.
• Monitoring and patching: we monitor our servers and apply security updates to the systems we manage.
• Network and platform security: customer accounts are isolated from each other, and servers run on the infrastructure we operate and manage.
• Incident response: we investigate compromises, abuse and blocklisting on our own servers and act to contain and clean them.

Security depends on both of us. On unmanaged VPS and dedicated servers, you are responsible for patching, firewalling, backups and access control unless your order says we manage them.

What we commit to when we process personal data for you

These commitments apply to personal information you host with us. A written data processing agreement with the same terms is available on request.

• We process it only to provide the services and on your documented instructions, unless the law requires otherwise.
• Our staff and contractors with access are bound by confidentiality.
• We apply the security measures described on this page.
• We use sub-processors (for example infrastructure and security providers such as Cloudflare) only under written terms that protect the data. A list is available on request, and we will tell you about material changes.
• We help you respond to requests from people exercising their rights, and to regulator enquiries, where it relates to data we hold for you.
• We tell you without undue delay if we become aware of a breach affecting personal information we process for you, and give you the information you need to meet your own notification duties.
• When your service ends, we delete or return the data in line with our Terms, unless the law requires us to keep it.
• We provide reasonable information to show that we meet these commitments.

If something goes wrong

If we suspect a security incident, we contain it, investigate what was affected, and notify affected customers. Where the law requires, we also notify the Data Protection Authority and affected individuals. If you suspect an incident on your account, contact us immediately through our Support page and mark it urgent. If your website is already compromised, our Armor SOS service can clean it up.

Requests from authorities

We disclose personal information to courts, regulators or law-enforcement bodies only where the law requires it and the request is valid. Where the law permits, we will tell the affected customer before disclosing their data.

What you are responsible for

If you host personal information with us, you are the controller of it and are responsible for:

• having a lawful basis for collecting and using it, and giving people a privacy notice;
• checking whether your organisation must hold a data controller licence and appoint a Data Protection Officer under S.I. 155 of 2024;
• keeping your website, plugins, themes and software patched;
• using strong, unique passwords and limiting who has access to your accounts;
• keeping your own backups; and
• responding to requests from the people whose data you hold.

Tremhost services that support your data protection

• SSL certificates to encrypt visitor traffic.
• Tremhost Armor (powered by Cloudflare) for website protection, staff access control and email protection against phishing and invoice fraud.
• ESET security for devices, servers and email.
• Backup Cloud and Managed Server Infrastructure for backups and administration of your servers.
• Armor SOS for emergency cleanup of compromised sites.

These services reduce risk. They do not, on their own, make an organisation compliant with data protection law.

Your rights and complaints

If we hold your personal information, you may ask for access, correction, deletion, restriction or objection, and you may withdraw consent. See our Privacy Policy for how to make a request. If you are not satisfied with our response, you may complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the Data Protection Authority.

Contact

For data protection questions, processing agreements or sub-processor information, use our Support page or your client area and mark the request “Data Protection”, or write to Tremhost Pvt Ltd, Office 3, Mezzanine Floor, Batanai Gardens (Cnr First Street & Jason Moyo Avenue), Harare, Zimbabwe.