Privacy Notice

1. Who we are

Lurstan Host builds websites and provides hosting, email, servers and domains from an office in Dawaki, Abuja, Federal Capital Territory, Nigeria. For the personal data described in this notice we are the data controller: we decide why and how it is used.

For anything about your data, email info@lurstanhost.com or open a ticket in the client area.

2. What we collect

• Account and billing details: your name, business name, email address, phone number, postal address and country, and any company or tax details you give us. Your client area password is stored in hashed form, not as text.
• Orders and payments: what you bought, when, the amounts, invoices, and the payment reference and result we receive from the payment processor.
• Support records: tickets, emails and messages you send us, and our notes of calls, visits and handovers.
• Material for your website: the logo, photos, text and contact details you send us for a build.
• Domain registration details: the name, organisation, address, email address and phone number of the person or business that holds the domain.
• Technical data: our web and mail servers log IP addresses, dates and times, the pages or files requested and the browser type; mail logs also record sender and recipient addresses and whether a message was delivered. The client area records the IP address and time of each login.
• Your country, worked out from your IP address when you open the store, so that it shows prices in your currency.
• Live chat: what you type in the chat window on our site or in the store, and any name or email address you give there.

Card numbers are entered on the payment processor's own page. We never see or store your full card number or its security code.

The home page and the status page run no analytics, advertising or chat tools.

3. Why we use it, and on what basis

The Act allows us to use personal data only where we have a lawful basis. Ours are these:

• To provide what you ordered: setting up your account and services, building your website, registering domains, sending invoices, taking payment and answering support. Basis: our contract with you, or the steps you asked for before it.
• To meet the law: keeping accounting and tax records, keeping the traffic data and subscriber information that section 38 of the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 requires, and answering lawful requests from courts, law enforcement and regulators. Basis: legal obligation.
• To keep our services safe and working: server and mail logs, abuse and fraud prevention, monitoring, backups, and choosing the currency the store shows. Basis: our legitimate interests, which we weigh against your rights. You can object, as section 7 explains.
• To send news and offers: only if you agree. You can withdraw that consent at any time with the unsubscribe link in any such email or by writing to us. Invoices, renewal reminders and outage notices are part of the service, not marketing.

4. Who we share it with

We do not sell personal data. We share it only with those who need it to provide the service, and only what they need. The one exception is the Google Ads tag described below, which we use to measure our advertising:

• Payment processors: Cryptomus, for payments in cryptocurrency, and PayPal. Each receives what it needs to take the payment, such as the amount and the invoice number. If you pay by bank transfer, the payment passes through your bank and ours.
• Domain registrars and registries: the registrar we use and the registry for each extension (for example NiRA for .ng names). Registry rules may require some registration details to be published in WHOIS or RDAP.
• Data centres and server providers outside Nigeria, where our servers and backups run.
• Companies whose products we sell: business email, SSL certificates, website backup, the website builder, security scanning and VPN. Each receives what it needs to set up the product you ordered; a certificate authority, for example, checks the business details for an organisation or extended validation certificate.
• Our billing and support system, WHMCS, which runs on our own server at my.lurstanhost.com.
• ipwho.is, which receives the IP address of a store visitor and returns the country, so that the store can show prices in the right currency. We keep the result for 30 days.
• Google, because the home page and the status page load their fonts from Google Fonts: your browser sends your IP address to Google when it fetches them.
• Tawk.to, which runs the live chat window on our Terms of Service and Privacy Notice pages and in the store and client area at my.lurstanhost.com. When the chat window loads, Tawk.to receives your IP address, the rough location worked out from it, your browser and language, the page you are on and the time, even if you do not start a chat. If you do, it also receives what you type and any name, email address or other details you give. Emails sent to support@lurstanhost.com are also copied to our Tawk.to inbox. Tawk.to processes this data for us, in the United States. Its own notice is at tawk.to/privacy-policy.
• Google, for advertising. Our Terms of Service and Privacy Notice pages load the Google Ads tag, which reports your visit to Google so that we can measure how well our Google ads work. Your browser sends Google the address of the page and your IP address, and Google may set or read cookies in your browser. Depending on your Google settings, Google may also use this to personalise the ads you see on other sites and apps. Google explains this at policies.google.com/technologies/partner-sites, and you can turn off personalised ads in Google's ad settings.
• Google, if you use "Sign in with Google" on the client area login page. The login page loads Google's sign-in script, so your browser sends Google your IP address. If you sign in that way, Google tells us the name and email address on your Google account so that we can match it to your client account.
• Courts, law enforcement, the Nigeria Data Protection Commission and other authorities, when the law requires it.

5. Where it is stored

Our servers are in tier-three data centres outside Nigeria, with backups in a second location. USA RDP servers are in the United States. Some of the companies in section 4 are also abroad. Your data is therefore transferred out of Nigeria.

The live chat and the advertising tag send data from your browser straight to companies abroad: Tawk.to processes live chat data in the United States, and Google processes the data from its advertising tag on servers in many countries.

We make these transfers only as the Act allows: to countries with adequate data protection, under contract terms that require the recipient to protect the data to the Act's standard, or where the transfer is needed to perform our contract with you. Ask us for details of the safeguards for any transfer.

6. How long we keep it

• Account, billing and support records: while your account is open, and afterwards for the period Nigerian tax law requires us to keep accounting records.
• Traffic data and subscriber information: two years, the period section 38 of the Cybercrimes Act provides for, as our Acceptable Use Policy states.
• Other web and mail server logs: 30 days.
• Websites, databases and mailboxes you host with us: until the service ends. Deleted data leaves our backups as they rotate, within 30 days.
• The country found from a store visitor's IP address: 30 days.
• Marketing consent: until you withdraw it.

7. Your rights

Under the Nigeria Data Protection Act 2023 you have the right to:

• be told how your data is used (this notice);
• get a copy of the personal data we hold about you;
• have wrong or incomplete data corrected;
• have your data deleted, or its use restricted, where we no longer need it or have no lawful basis for it;
• object to our use of your data based on legitimate interests, and to direct marketing at any time;
• withdraw consent you gave, without affecting what was done before;
• receive the data you gave us in a common machine-readable format, or have it sent to another provider (data portability);
• complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

To use any of these rights, email info@lurstanhost.com or open a ticket in the client area. We may ask you to confirm who you are before we act. There is no fee, and we reply within 30 days. Some data we must keep by law, for example invoices; if so, we tell you which and why. You can complain to the NDPC at any time, but we would like the chance to put things right first.

8. Cookies and local storage

• The home page sets no cookies. If you switch the hosting prices between yearly and monthly, your browser remembers the choice in its local storage on your own device; it is not sent to us. Clearing your browser's site data removes it.
• The store and client area at my.lurstanhost.com use session cookies to keep you logged in and to hold your basket and currency. If you tick "Remember me" when logging in, a cookie keeps you logged in on that device. These cookies are needed for the store to work and are not used for advertising.
• The Tawk.to live chat window, on our Terms of Service and Privacy Notice pages and in the store and client area, stores cookies and local storage in your browser so that it can recognise your browser and keep a chat going from page to page.
• The Google Ads tag on our Terms of Service and Privacy Notice pages lets Google set or read cookies in your browser, under lurstanhost.com and under Google's own addresses. Google uses them to measure our ads and, depending on your Google settings, to personalise ads. These cookies are not needed for the pages to work: you can block or delete them in your browser settings, or turn off personalised ads in Google's ad settings.

9. Security

Our sites and client area use HTTPS. Client area passwords are stored hashed. Only staff who need your data for their work can see it. Our servers are checked every minute, and backups are kept in a second location.

If a breach of personal data is likely to put your rights at risk, we report it to the NDPC within 72 hours of becoming aware of it, and where the risk to you is high we tell you directly, with what happened and what to do.

10. Data you host with us

The websites, databases and mailboxes you run on our services hold personal data about your own customers and contacts. For that data you are the controller and we are a processor acting on your instructions, as section 6 of our Terms of Service says. We look at it only to provide and secure the service, when you ask us to, or when the law requires. Your visitors should read your own privacy notice.

11. Children

Our services are for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, tell us and we will delete it.

12. Changes to this notice

When we change this notice we update the date at the top of the page. If a change affects how we use your data in a significant way, we tell customers by email before it takes effect.

This version is dated 20 October 2026.