Privacy Policy

Privacy Policy

TopMostWeb Technologies, trading as TopMostWeb Hosting (“TopMostWeb,” “we,” “us” or “our”), respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you:

• Visit our website

• Create or use a client account

• Purchase or use our hosting and technology services

• Register, transfer or renew a domain

• Make a payment

• Contact our support team

• Subscribe to our communications

• Otherwise interact with TopMostWeb

By using our website or services, you acknowledge the practices described in this Privacy Policy.

1. Who We Are

TopMostWeb Technologies provides web hosting, domain registration, business email, SSL certificates, cloud solutions, website development, software development, AI integrations, IT infrastructure and related technology services.

For personal data collected directly through our website, client portal, billing system and customer relationships, TopMostWeb generally acts as the data controller.

When we host or process personal data contained in a customer’s website, database, email account or application on the customer’s instructions, TopMostWeb may act as a data processor, while the customer remains the data controller.

Contact details

TopMostWeb Technologies
Trading as TopMostWeb Hosting
Address: Brunei House, Witu Road Nairobi
Email: hosting@topmostweb.com
Website: https://topmostweb.com
Client portal: https://cloud.topmostweb.com

2. Personal Data We Collect

The personal data we collect depends on how you interact with us and the services you use.

2.1 Account and identity information

We may collect:

• Full name

• Company or business name

• National identification or business registration information where verification is required

• Username and account identifiers

• Billing and physical address

• Country of residence

• Tax information where applicable

• Account verification records

2.2 Contact information

We may collect:

• Email address

• Telephone number

• Postal or physical address

• Preferred communication details

2.3 Billing and payment information

When you purchase a service, we may collect or process:

• Billing name and address

• Invoice information

• Transaction reference

• Payment amount, date and status

• Payment method

• M-Pesa payment details, including the telephone number and transaction reference

• Limited card transaction information supplied by the payment processor

Payments may be processed by third-party payment providers. We do not ordinarily receive or store your complete payment-card number, card security code, mobile-money PIN or online banking password.

2.4 Domain registration information

When registering, transferring or managing a domain name, we may collect:

• Registrant name

• Company or organization

• Email address

• Telephone number

• Physical or postal address

• Administrative and technical contact information

• Identification documents required for restricted domain extensions

• Domain authorization or transfer codes

• Domain registration and renewal history

Some domain-registration information must be shared with the applicable registrar or registry.

2.5 Hosting and technical information

We may automatically collect or generate:

• IP address

• Browser and device information

• Operating system

• Login dates and times

• Server and access logs

• DNS records

• Resource usage

• Website and email traffic metadata

• Security events

• Error logs

• Control-panel activity

• Support diagnostic information

This information is used to operate, secure and troubleshoot our services.

2.6 Customer content

Our hosting services may store or transmit content supplied by customers, including:

• Website files

• Databases

• Email messages

• Application data

• Images and documents

• Backups

• Customer and employee information uploaded by our clients

The customer who uploads or controls this information is responsible for ensuring that it is collected and processed lawfully.

We do not use customer-hosted content for advertising or unrelated commercial purposes.

2.7 Support and communication records

When you contact us, we may retain:

• Support tickets

• Email messages

• Chat conversations

• Telephone call details

• Screenshots and attachments

• Technical diagnostic information

• Complaints and feedback

Please avoid including passwords, mobile-money PINs, payment-card security codes or other unnecessary sensitive information in support tickets.

2.8 Website usage information

When you visit our website or client portal, we may collect:

• Pages viewed

• Links selected

• Referring website

• Approximate location derived from an IP address

• Visit date and duration

• Browser and device type

• Cookie and session identifiers

• Interactions with website features

3. How We Collect Personal Data

We collect personal data:

• Directly from you when you create an account, order a service, submit a form, make a payment or contact us

• Automatically when you use our website, client portal, servers or related services

• From domain registrars and registries

• From payment processors and financial service providers

• From fraud-prevention, security and identity-verification providers

• From authorized company representatives

• From publicly available sources where permitted by law

• From third parties where you have authorized the disclosure

4. How We Use Personal Data

We may use personal data to:

• Create and administer customer accounts

• Verify identities and prevent fraudulent registrations

• Process orders, payments, invoices and refunds

• Activate, provide and maintain services

• Register, transfer and renew domain names

• Configure hosting, email, DNS and SSL services

• Provide technical support

• Migrate websites and email accounts

• Send service, billing, renewal and security notices

• Diagnose technical problems

• Monitor resource use and service performance

• Detect malware, abuse, fraud and unauthorized access

• Enforce our Terms and Conditions

• Improve our website, services and customer experience

• Maintain financial, tax and operational records

• Handle complaints and disputes

• Comply with legal, regulatory and contractual obligations

• Protect the rights, systems and safety of TopMostWeb, our customers and other parties

5. Lawful Grounds for Processing

Depending on the circumstances, we process personal data because:

• It is necessary to provide a service or perform a contract with you

• It is necessary to take requested steps before entering into a contract

• We must comply with a legal or regulatory obligation

• It is necessary for our legitimate business interests, provided those interests do not override your rights

• You have given your consent

• It is necessary to establish, exercise or defend a legal claim

• Another lawful basis recognized under applicable law applies

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal will not affect processing that was lawful before consent was withdrawn.

6. Service and Marketing Communications

We may send operational communications necessary to administer your account, including:

• Account verification messages

• Invoice and payment notices

• Domain and service renewal reminders

• Security alerts

• Maintenance announcements

• Support responses

• Changes to services or policies

These are service-related communications and may continue while you maintain an account or active service.

We will send promotional communications where permitted by law and, where required, with your consent. You may unsubscribe using the link in the message or by contacting us.

Opting out of marketing does not stop essential account, billing, renewal, support or security communications.

We do not sell personal data or disclose it to third parties for their independent direct-marketing activities without the required authorization.

7. Cookies and Similar Technologies

Our website and client portal may use cookies and similar technologies to:

• Keep users signed in

• Maintain shopping-cart and checkout sessions

• Remember settings and preferences

• Protect accounts and prevent fraud

• Measure website performance

• Understand how visitors use our website

• Improve functionality and user experience

Some cookies are essential for the website, client portal and checkout process to function. Other cookies, such as analytics or advertising cookies, should be used subject to appropriate consent where required.

You may control cookies through your browser or the cookie-preference tool available on our website. Disabling essential cookies may prevent parts of the website or client portal from working correctly.

For further details, please read our [Cookie Policy].

8. Payments

Payments may be handled by M-Pesa, banks, card networks and approved payment gateways.

These providers process payment information under their own privacy policies and legal obligations. We receive only the information required to verify the transaction, issue an invoice, prevent fraud and maintain accounting records.

You should never provide your M-Pesa PIN, online banking password or payment-card security code to TopMostWeb staff.

9. Domain Registration Data

Domain registrations are governed by the requirements of the relevant registry and registrar.

We may be required to disclose registrant information to:

• The domain registrar

• The domain registry

• ICANN, where applicable

• Dispute-resolution providers

• Law-enforcement or regulatory authorities

• Parties entitled to receive the information under applicable domain policies or law

Some registration data may be displayed through public domain-information services unless it is protected by a privacy service or restricted by applicable policies.

The availability of domain privacy protection depends on the domain extension and registrar.

10. When We Share Personal Data

We may share personal data with carefully selected recipients where necessary, including:

• Hosting, server and cloud-infrastructure providers

• Domain registrars and registries

• Payment processors, banks and mobile-money providers

• Email delivery and communication providers

• Security, fraud-prevention and monitoring providers

• Backup and data-storage providers

• Software and control-panel vendors

• Professional advisers, auditors and insurers

• Contractors assisting us in delivering support or technical services

• Government, regulatory, judicial or law-enforcement authorities where legally required

• A buyer, investor or successor in connection with a legitimate merger, acquisition, financing or transfer of business

These recipients may access only the data reasonably required for the relevant service or obligation.

We do not sell or rent customer personal data.

11. International Data Transfers

Some infrastructure, software, domain, payment or support providers may process or store personal data outside Kenya.

Where personal data is transferred internationally, we take reasonable steps to ensure the transfer is lawful and that appropriate safeguards are applied. These may include:

• Transferring data to a jurisdiction with adequate protection

• Using contractual data-protection safeguards

• Obtaining consent where appropriate

• Limiting transferred information to what is necessary

• Applying security and access controls

• Relying on another transfer mechanism permitted by law

The locations used may vary according to the services and third-party providers involved.

12. Hosting Customers’ Responsibilities

Customers using our hosting, email, cloud or software services may collect personal data from their own users, employees or customers.

Such customers are responsible for:

• Establishing a lawful basis for collecting and processing the data

• Publishing an appropriate privacy notice

• Obtaining any required consent

• Honouring data-subject requests

• Protecting account credentials

• Configuring applications securely

• Keeping software updated

• Limiting access to authorized persons

• Avoiding the collection of unnecessary personal data

• Informing TopMostWeb when assistance is required to fulfil a lawful request

When TopMostWeb acts as a processor, we process hosted personal data only to provide, secure and maintain the service, comply with lawful instructions or meet applicable legal obligations.

13. Sensitive Personal Data

You should not upload or process sensitive personal data through our services unless:

• It is necessary for a legitimate and lawful purpose

• You have a valid legal basis

• You have implemented appropriate technical and organizational safeguards

• The selected service is suitable for that type of information

Please contact us before using our services for large-scale or high-risk processing of sensitive personal data.

14. Children’s Personal Data

Our services are intended for adults and businesses. We do not knowingly offer customer accounts directly to children.

If a customer uses our hosting services to process children’s personal data, that customer is responsible for satisfying all applicable consent, notice, security and safeguarding requirements.

If you believe that a child has provided personal information directly to us without appropriate authorization, contact us so that we can investigate and take appropriate action.

15. Data Security

We use reasonable technical and organizational measures designed to protect personal data against:

• Unauthorized access

• Accidental loss

• Improper use

• Unauthorized disclosure

• Alteration

• Destruction

• Malware and other security threats

Measures may include access restrictions, authentication controls, firewalls, monitoring, backups, encryption where appropriate, software updates and staff confidentiality requirements.

No internet transmission or storage system is completely secure. You are responsible for using strong passwords, enabling available security features and protecting your devices and account credentials.

16. Personal Data Breaches

We investigate suspected personal-data breaches and take appropriate steps to contain and address them.

Where required by law, we will notify the relevant authority and affected individuals within the applicable period.

Customers must promptly inform us of any suspected compromise affecting a service hosted by TopMostWeb and cooperate with reasonable investigation and remediation measures.

17. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to:

• Provide active services

• Maintain account and transaction records

• Meet tax, accounting and legal requirements

• Resolve disputes

• Detect fraud and security incidents

• Enforce agreements

• Maintain necessary backup and audit records

Retention periods vary according to the type of data, service, legal obligations and operational requirements.

When an account or service is terminated, hosted data may be deleted after the applicable cancellation, backup or retention period. Customers must download required files, databases and email messages before cancellation.

Some information may remain temporarily in restricted backup systems until it is overwritten or securely deleted through our normal backup cycle.

We may retain limited records after account closure where necessary to comply with law, maintain financial records, prevent fraud or establish and defend legal claims.

18. Your Data-Protection Rights

Subject to applicable law and lawful limitations, you may have the right to:

• Be informed about how your personal data is used

• Request access to your personal data

• Request correction of inaccurate or incomplete data

• Object to certain processing

• Request restriction of processing

• Request deletion of personal data

• Request the transfer of eligible personal data

• Withdraw consent where processing is based on consent

• Object to decisions based solely on automated processing where applicable

• Lodge a complaint with the Office of the Data Protection Commissioner

Some requests may be restricted where retaining or processing the information is necessary to comply with law, complete a contract, protect another person’s rights or establish or defend a legal claim.

19. Exercising Your Rights

To exercise a data-protection right, contact us at support@topmostweb.com.

Your request should explain:

• Your name and account email address

• The right you wish to exercise

• The information or service concerned

• Any details that will help us locate the relevant records

We may request information necessary to verify your identity and prevent unauthorized disclosure. We will respond within the period required by applicable law.

Where TopMostWeb processes data solely on behalf of a hosting customer, we may direct you to the relevant customer because that customer controls the data and determines how it is used.

20. Automated Processing and AI-Assisted Services

TopMostWeb may use automated tools to assist with fraud prevention, spam detection, malware scanning, service monitoring and customer support.

Where AI-assisted tools are used, we seek to apply appropriate privacy, security and human-oversight measures. We do not intentionally use confidential customer-hosted content to train public artificial-intelligence models unless the customer has expressly authorized such use.

Where applicable, you may request information about a significant decision made solely through automated processing or ask for human review, subject to applicable law.

21. External Links

Our website may contain links to third-party websites and services. TopMostWeb is not responsible for the privacy, security or content practices of those third parties.

You should review the privacy policy of an external service before providing personal data.

22. Business Transfers

If TopMostWeb is involved in a merger, acquisition, restructuring, financing or sale of assets, personal data may be transferred as part of that transaction.

Any receiving organization will be required to process the transferred data consistently with applicable law and this Privacy Policy unless it provides appropriate notice of a change.

23. Changes to This Privacy Policy

We may update this Privacy Policy when our services, providers, practices or legal obligations change.

The latest version will be published on our website with its effective date. Material changes may also be communicated through email or the client portal.

We encourage you to review this policy periodically.

24. Complaints

If you have concerns about our use of your personal data, contact us first at support@topmostweb.com so that we can investigate and address the matter.

You also have the right to submit a complaint to:

Office of the Data Protection Commissioner
Website: https://www.odpc.go.ke
Email: info@odpc.go.ke

25. Contact Us

For privacy questions, requests or complaints, contact:

TopMostWeb Technologies
Trading as TopMostWeb Hosting
Address: Brunei House, Witu Road Nairobi
Email: hosting@topmostweb.com
Website: https://topmostweb.com
Client portal: https://cloud.topmostweb.com