Privacy Policy

Important: This Privacy Policy explains how personal information is collected, used, disclosed, stored, and protected in connection with the DirectCloud.io website, portals, and related online services (the Site) and any services supplied through the Site (Services). This Policy forms part of the Website Terms and Conditions, the Acceptable Use Policy, the Domain Registration Agreement, the Payment Terms, and any applicable Service Terms. Capitalised terms not defined here have the meanings given in those documents.

Scope and Applicable Privacy Laws
1.1 This Policy is designed to comply with applicable privacy and data protection laws in South Africa, Australia, and the United Kingdom, including:
(a) South Africa: Protection of Personal Information Act 4 of 2013 (POPIA);
(b) Australia: Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs);
(c) United Kingdom: UK GDPR and the Data Protection Act 2018 (UK DPA).
1.2 Mandatory rights under local law prevail where this Policy conflicts with non-excludable requirements.
Roles and Responsibility
2.1 The Company acts as a responsible party/controller for personal information processed for operating the Site, managing accounts, billing, support, marketing (where lawful), abuse prevention, and compliance.
2.2 For certain Registrar Services (e.g., domain registrations, WHOIS/RDAP, registry escrow), personal information is processed as required by registries and ICANN/ccTLD policies; in some cases the Company acts as agent/reseller for an accredited registrar.
2.3 Where the Company processes personal information on behalf of a business customer, the Company acts as an operator/processor under written terms.
Categories of Personal Information Collected
3.1 Information provided by Users: names, titles, organisation details, postal addresses, email addresses, telephone numbers; account identifiers and credentials; billing and payment data (tokenised by approved payment providers); support tickets; optional marketing preferences.
3.2 Technical and usage data: IP addresses, device and browser information, language and time zone, referral URLs, pages viewed, session metadata, error logs, performance metrics, security telemetry (e.g., anomaly/abuse indicators).
3.3 Service and content data: configuration of Services, DNS/nameserver settings, domain registration data (registrant, admin, technical, billing contacts), DS records, and limited content metadata necessary to operate the Services.
3.4 Special categories: special-category/sensitive data are not sought. Where a User elects to upload or process such data using the Services, appropriate legal bases, safeguards, and access controls must be in place (see AUP and Service Terms).
Lawful Bases and Purposes of Processing
Personal information is processed only where a lawful basis exists, including:
(a) Contract performance: creating and administering accounts, provisioning Services, billing, renewals, usage metering, and support;
(b) Legitimate interests: operating, securing, and improving the Site and Services; preventing fraud/abuse; protecting network integrity; analytics (using aggregated or de-identified data wherever feasible);
(c) Consent: sending electronic marketing where consent is required by law; use of non-essential cookies; participation in surveys or testimonials;
(d) Legal obligations: complying with tax, accounting, regulator or court orders; ICANN/registry rules; POPIA/APPs/UK GDPR obligations;
(e) Public interest: responding to lawful requests from competent authorities for safety, security, or enforcement.
Direct Marketing and Communications
5.1 Electronic marketing complies with POPIA s69 (South Africa), the Spam Act 2003 (Cth) (Australia), and PECR (UK). Marketing is sent only where permitted by law (consent or soft opt-in where lawful) and includes a functional unsubscribe.
5.2 Service and transactional notifications (e.g., security, billing, expiry/renewal, incident notices) are essential communications and may be sent regardless of marketing preferences where lawful.
Cookies and Similar Technologies
6.1 The Site uses cookies, local storage, and similar technologies for core functionality (strictly necessary), preferences, performance/analytics, and, where applicable, marketing.
6.2 Non-essential cookies operate only with consent where required by law. Cookie choices can be managed via the cookie banner and browser settings.
6.3 Further detail is set out in the Cookie Policy [link].
WHOIS/RDAP, Registry and ICANN/ccTLD Requirements
7.1 Domain registration data may be published via WHOIS/RDAP or disclosed to registries, registrars, data escrow agents, and competent authorities as required by applicable policies and law.
7.2 Privacy/proxy services, where available, may mask public data; underlying registrant data remains subject to verification, compliance checks, and lawful disclosure.
Disclosures of Personal Information
Personal information may be disclosed to:
(a) Service providers under contract (e.g., data centres, cloud infrastructure, email/SMS providers, payment gateways, fraud/abuse prevention, support tooling) subject to confidentiality and appropriate data protection terms;
(b) Registrars, registries, and data escrow providers for domain lifecycle operations;
(c) Professional advisers, insurers, auditors, and corporate affiliates for legitimate business purposes;
(d) Competent courts, ombuds/regulators, or law enforcement where required by law or to protect rights, safety, and network integrity;
(e) Successors and transferees in connection with a merger, acquisition, reorganisation, or asset transfer, subject to this Policy’s protections.
International Transfers
9.1 Cross-border transfers may occur to jurisdictions where infrastructure, registries, or providers are located.
9.2 Appropriate safeguards are implemented as required by law, including adequacy decisions, standard contractual clauses/UK IDTA, and POPIA-compliant transfer mechanisms. Copies of relevant transfer safeguards can be requested using the contact details above, subject to confidentiality.
Security
10.1 Appropriate technical and organisational measures are implemented, including network segmentation, access controls, MFA for privileged access, encryption in transit and at rest (where appropriate), vulnerability management, logging and monitoring, and supplier due diligence.
10.2 No environment is entirely secure. Residual risk is mitigated through layered security and incident response procedures.
Data Breach Notification
11.1 If a personal information security compromise/eligible data breach occurs, assessment and notification will be undertaken in accordance with POPIA, the Notifiable Data Breaches (NDB) scheme under the Australian Privacy Act, and UK GDPR/UK DPA requirements.
11.2 Notifications will include material information available at the time and guidance to reduce potential harm, subject to lawful restrictions.
Data Retention
12.1 Personal information is retained only for as long as necessary for the purposes described or as required by law (e.g., tax/ledger retention), dispute resolution, fraud prevention, and to enforce agreements.
12.2 Typical retention periods include: account/billing records (7–10 years, subject to applicable law); domain lifecycle and registry records (as required by ICANN/ccTLD policies); security logs (up to 12–24 months, unless extended for investigations).
12.3 Data are securely destroyed or de-identified when no longer required.
Individual Rights
Subject to applicable law and exemptions, individuals may exercise the following rights:
(a) Access: confirmation whether personal information is processed and access to it;
(b) Correction: rectification of inaccurate or incomplete information;
(c) Deletion: erasure in circumstances permitted by law (e.g., where data are no longer required or consent is withdrawn and no other basis applies);
(d) Restriction: limitation of processing in certain cases;
(e) Portability: receipt of certain data in a structured, commonly used, machine-readable format and transmission to another controller where technically feasible;
(f) Objection: objection to processing based on legitimate interests or to direct marketing at any time;
(g) Consent withdrawal: withdrawal of consent where processing relies on consent;
(h) Complaints: lodging a complaint with the relevant supervisory authority (see clause 16).
Requests may be submitted using the contact details above. Verification of identity may be required. Statutory timeframes and exemptions apply.
Children’s Privacy
The Site and Services are intended for business use and are not directed to children. Accounts should not be created by individuals below the age thresholds defined by applicable law without appropriate authorisation.
Automated Decision-Making and Profiling
Automated decision-making with legal or similarly significant effects is not undertaken. Limited profiling may be performed for security (e.g., fraud/abuse detection) and service analytics, based on legitimate interests and subject to appropriate safeguards.
Complaints and Escalation
16.1 Queries or complaints can be addressed to the Company using the contact details in the header block.
16.2 If concerns remain, individuals may contact the relevant authority:
(a) South Africa: Information Regulator (South Africa) – complaints.IR@justice.gov.za | https://inforegulator.org.za
(b) Australia: Office of the Australian Information Commissioner (OAIC) – enquiries@oaic.gov.au | https://www.oaic.gov.au
(c) United Kingdom: Information Commissioner’s Office (ICO) – https://ico.org.uk
Local contact details may change; the authority’s website should be consulted for current information.
Third-Party Links and Services
Third-party websites or services linked from the Site operate under their own privacy practices. Responsibility is not accepted for third-party content or practices. Relevant third-party privacy policies should be reviewed.
Changes to this Policy
18.1 This Policy may be amended by posting an updated version with a revised “Last updated” date. Material changes will be signposted on the Site or notified by email where practicable.
18.2 Continued use of the Site or Services after the effective date constitutes acceptance of the updated Policy.
Additional Regional Notices
19.1 South Africa (POPIA): Processing is undertaken in accordance with the conditions for lawful processing. Operator agreements are in place with processors; cross-border transfers follow section 72.
19.2 Australia (APPs): Overseas disclosure is managed under APP 8; the NDB scheme applies to eligible data breaches.
19.3 United Kingdom (UK GDPR/UK DPA): The lawful bases in clause 4 apply. The UK’s international transfer mechanisms and PECR rules for electronic marketing/cookies are observed.
Contact Details for Privacy Matters
• Email: info@directcloud.io
• Postal/service address: Unit 1 Monaco Square, 14 Church Street, Durbanville, Cape Town, South Africa, 7550
• Attention: Privacy Officer

Products

Company

Şifrə yaradın