Get hosting

Privacy policy

Last updated 15 November 2026

1. About this policy

  1. This policy explains how Zension Private Limited (UEN 200713764M, “Zension”, “we”, “us”) handles personal data. It is written with Singapore’s Personal Data Protection Act 2012 (PDPA) in mind. For general information about the PDPA, see the Personal Data Protection Commission at https://www.pdpc.gov.sg.
  2. It applies to visitors to zension.com, people who open an account on our client portal at https://my.zension.com, and people who contact us.
  3. Personal data means data about an individual who can be identified from it. Business information that is not about an individual is not personal data.

2. Two roles: organisation and data intermediary

We act in two different roles, and the rules differ.

  1. As an organisation, for our own customers. For the details of our own customers and contacts, such as account, billing and support data, we decide why and how the data is used. We are responsible for it under the PDPA. Most of this policy is about this role.
  2. As a data intermediary, for content you host with us. When you host a website, email or a server with us, the personal data inside it, such as your customers’ details, your mailboxes and your databases, belongs to you. We process it only on your behalf and on your instructions, to provide the service. You are responsible for having the consent or other lawful basis to collect and use that data, and for telling your own customers how you use it.
  3. As a data intermediary we protect that data with reasonable security arrangements and delete it when the service ends, as set out in clause 8. Where you need a data processing agreement, contact us.
  4. If someone contacts us about data in a site you host, we will usually pass the request to you.

3. What we collect

  1. Account data: your name, company name, email address, phone number, billing and contact addresses, and the login details you set.
  2. Billing data: invoices, payment history, GST details where relevant, and the last digits and type of a payment card. Our payment processors hold full card details. We do not store them.
  3. Support data: tickets, emails, call notes and files you send us when you ask for help.
  4. Domain registration data: registrant name, organisation, address, email and phone, and, for .sg and .com.sg names, identity or business documents needed for SGNIC verification.
  5. Technical data: IP addresses, login and access logs, server and email logs, device and browser information, and security event data. These are needed to run, secure and troubleshoot the services.
  6. Website data: pages visited and cookie data, as set out in clause 10.

4. How we collect it

We collect data from you when you order, create an account, use the portal, contact us or register a domain. We also collect it automatically from our systems and from your use of the services. Where you give us another person’s data, for example a colleague as a technical contact, you confirm you may do so.

5. Why we use it

  1. To set up, provide, bill and support the services you order.
  2. To register and renew domain names and to meet registry rules, including identity verification.
  3. To keep the services secure, prevent fraud and abuse, and enforce our Acceptable use policy.
  4. To send service messages, such as invoices, renewal and maintenance notices, security alerts and replies to your tickets.
  5. To meet legal, tax, accounting and regulatory requirements.
  6. To improve our website and services, using aggregate or de-identified information where we can.
  7. To send you news about our services, only where you have agreed to receive it. You can stop at any time.
  1. We collect, use and disclose personal data with your consent, or where the PDPA allows it without consent, for example where it is needed to perform a contract with you or to comply with the law.
  2. By ordering, creating an account or giving us your data for a stated purpose, you agree to its use for the purposes in this policy.
  3. You may withdraw consent for a purpose by writing to our Data Protection Officer (clause 14). We will tell you the likely effect. Withdrawing may mean we can no longer provide a service, because some data is necessary to provide it. We will act on a withdrawal within 10 business days.
  4. Withdrawing consent for marketing does not stop service messages.

7. Disclosure to others

We do not sell personal data. We share it only where needed, with:

  1. Domain registries and registrars, such as SGNIC for .sg names, which receive registrant details to register your domain. Some registrant details may appear in public registry lookups, subject to the registry’s rules.
  2. Payment processors and banks, to take payment and handle refunds.
  3. Infrastructure and data centre providers, whose facilities and networks host our servers.
  4. Software and service providers who help us run our business, such as our billing and client portal software, email delivery, support tools and security services, under contracts that require them to protect the data.
  5. Professional advisers, such as lawyers, auditors and accountants.
  6. Authorities, where the law requires it or where we must respond to a valid legal request.
  7. A buyer or successor, if our business or part of it is sold or restructured, on terms that protect the data.

8. Where data is stored and overseas transfers

  1. Our primary hosting is in Singapore, and your hosted content is stored on servers in Singapore.
  2. Some of our service providers, for example for email delivery, payment processing or support tools, may process data outside Singapore.
  3. Where we transfer personal data outside Singapore, we take reasonable steps to make sure the recipient protects it to a standard comparable to the PDPA, for example through contract terms.
  4. If you ask us to move your services or data to another location, you take responsibility for that transfer.

9. How long we keep it

  1. We keep personal data only as long as we need it for the purpose it was collected or for legal or business reasons.
  2. Billing and accounting records: 7 years after the end of the financial year to which they relate.
  3. Account and support records: 2 years after your last service ends.
  4. Technical logs: 90 days, unless needed longer to investigate abuse or a security incident.
  5. Hosted content: after a service ends we delete it within 30 days, and backups expire on their normal schedule.
  6. When we no longer need data, we delete or anonymise it.

10. Cookies and analytics

  1. Our website uses cookies and similar technologies. Essential cookies keep the site and client portal working, for example by keeping you logged in.
  2. We do not use analytics or advertising cookies on our website. If we add an analytics tool, we will name it here, with the data it collects and any cookies it sets, before we start using it.
  3. You can block or delete cookies in your browser settings. Some parts of the site may not work without essential cookies.

11. Security

  1. We protect personal data with reasonable security arrangements, which include access controls, encryption of connections to the client portal, monitoring, and limiting staff access to what they need.
  2. No system is completely secure. You should use strong passwords and keep your own credentials safe.
  3. If a data breach is likely to cause significant harm, or is of a significant scale, we will assess it and notify the PDPC and affected individuals as the PDPA requires.

12. Your rights: access and correction

  1. You may ask us for the personal data we hold about you and how we have used or disclosed it in the past year.
  2. You may ask us to correct personal data that is inaccurate or incomplete.
  3. Send a request to our Data Protection Officer (clause 14). We may need to verify your identity first.
  4. We will respond within 30 days. If we need longer, we will tell you when we expect to respond. The PDPA lets us charge a reasonable fee for access requests. We will tell you the fee before we act. We do not currently charge a fee.
  5. We may refuse a request where the PDPA allows, and we will explain why.

13. Data you host

If you want to see, correct or delete personal data held in your own site or mailboxes, you can do so through your control panel or by asking us. If you are a customer of one of our customers, please contact that business first.

14. Data Protection Officer

Our Data Protection Officer can be reached at enquiry@zension.com. Please put “Data Protection Officer” in the subject line.

Email: enquiry@zension.com Phone: +65 3112 2333, Monday to Friday, 9am to 6pm SGT Post: write to us by email first and we will give you the address for correspondence.

15. Complaints

  1. If you are unhappy with how we have handled your personal data, write to our Data Protection Officer. We will investigate and reply in writing.
  2. If you are not satisfied with our reply, you may contact the Personal Data Protection Commission at https://www.pdpc.gov.sg.

16. Changes to this policy

We may update this policy from time to time. The date at the top of the page shows when it last changed. For material changes we will notify account holders by email or in the client portal.