WinsHosting Privacy Policy

Who is responsible for your personal data at WinsHosting

WinsHosting is a Pakistani web hosting company and PKNIC accredited domain registrar that has served customers since 2003. Our office is at Office 107, 1st Floor, Sajjad Center, H3 Block, Johar Town, Lahore. When this policy says "we" or "us", it means WinsHosting and the staff who run its services from that office.

We treat the information you give us as something held on trust. Running hosting accounts and registering domain names cannot be done anonymously, because registries, payment providers and the law expect us to know who our customers are. What we can promise is that we collect only what a service needs, use it for that service, and protect it with care. You can reach us about anything in this policy at info@winshosting.com or on +92-42-35311959.

Personal information we collect for hosting and domain orders

When you create an account in our client area or place an order, we ask for your full name, company name if you have one, email address, mobile and landline numbers, postal address and city. For many .pk domain registrations and for restricted extensions such as edu.pk or gov.pk, PKNIC rules also require proof of identity or organisation, which can include a CNIC number or supporting letters.

We also keep the records that a service naturally produces: invoices and payment confirmations, the domains and plans linked to your account, support tickets and emails you send us, and notes our staff add while helping you. When you sign in, our systems record the date, time and IP address of the login so that we can spot unauthorised access.

• Account details: name, company, email, phone numbers and address
• Registrant details that a domain registry requires to be held
• Billing records: invoices, payment method used and transaction references
• Support history: tickets, chat transcripts and email correspondence
• Security logs: login times and IP addresses for your client area

How WinsHosting uses customer data and the reasons we rely on

We use your information first to deliver what you ordered: to create your hosting account, register or renew your domain, issue SSL certificates, send login details and keep your services running. We use it to bill you correctly and to send renewal reminders before a domain or plan expires, because a missed renewal can take a business website offline.

We also use contact details to answer support requests, warn you about security problems on your account, and tell you about important changes to our services or to registry rules. Marketing messages about special offers are separate: you can ask us to stop them at any time and your services will not be affected. We do not sell personal information, and we do not use the content of your website or mailboxes for advertising.

Cookies on winshosting.com and the Accept all or Essential only banner

When you first open our website, a banner asks you to choose Accept all or Essential only. Essential cookies are needed for the site to work: they keep you signed in to the client area, remember the items in your shopping cart, protect forms against misuse and store the choice you made on the banner itself. These cookies do not track you across other websites.

If you choose Accept all, we also set analytics cookies that help us understand which pages are useful and where visitors leave. If you choose Essential only, those cookies are not set. You can change your mind later by clearing cookies for winshosting.com in your browser, after which the banner appears again. Our older policy described cookies collecting hardware details automatically; the consent banner replaces that approach.

Google Analytics runs only after you give consent

We use Google Analytics to measure how visitors use our website, for example which hosting plans people compare, how long pages take to load on mobile connections and which help articles answer questions. The analytics script is loaded only after you press Accept all on the cookie banner. Without that consent, no analytics request is sent from your browser.

The reports we look at are aggregated: numbers of visits, devices, approximate country or city, and pages viewed. We do not use analytics data to identify individual visitors, and we do not combine it with your client area account. Google processes this data under its own privacy terms. If you prefer, you can also install Google's browser add-on for opting out of Analytics, which works on every site that uses the service.

Google reCAPTCHA protection on our contact and order forms

Our contact form, quote requests, account deletion form and some order and login pages are protected by Google reCAPTCHA. It helps us block automated spam and attempts to guess passwords, which would otherwise flood our support desk and put customer accounts at risk.

To decide whether a request comes from a person or a bot, reCAPTCHA collects technical information such as your IP address, browser details and how you interact with the page, and sends it to Google. This processing is necessary to keep the forms secure, so it runs even if you chose Essential only on the cookie banner. The use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service. If a form will not submit because of reCAPTCHA, you can always email or call us instead.

When WinsHosting shares information with registries and other parties

Some sharing is part of the service itself. To register a domain we must pass registrant details to the relevant registry, such as PKNIC for .pk names or the registry that runs a global extension, and some of those details may appear in public WHOIS or registration data services according to that registry's rules. Payment providers such as banks, JazzCash, Easypaisa, card processors and PayPal receive what they need to complete your payment, and certificate authorities receive the domain and contact data needed to issue SSL certificates.

Our servers run in data centres operated by partners, who host the hardware but do not use your data for their own purposes. Beyond these, we disclose information to government or law enforcement agencies only when we receive a lawful order, a valid court direction or a formal complaint about illegal activity on our network. As our previous policy stated, a website used for fraud on our servers may be suspended and the account holder's details provided to the authorities that requested them.

Data retention periods for accounts, invoices, backups and logs

We keep account and contact information for as long as you have active services with us. After you close your account, we keep invoices and payment records for the period that tax and accounting rules in Pakistan require, and we keep enough registration history to deal with domain ownership disputes or registry queries that can arise long after a name has moved elsewhere.

Website files, databases and mailboxes are removed from our servers after a hosting account is terminated. Server-side backups are rolling copies that are deleted after a short period, which is why our terms advise you to keep your own copies. Support tickets are kept so that our team can see the history of a problem if it returns. Server and security logs are kept for limited periods, and for longer where Pakistani law requires a service provider to retain traffic data.

Pakistan's Prevention of Electronic Crimes Act 2016 and your data

As a service provider operating in Pakistan, WinsHosting follows the Prevention of Electronic Crimes Act 2016 (PECA). The Act makes unauthorised access to information systems and data an offence, which supports the security measures we apply to customer accounts. It also requires service providers to retain certain traffic data for a minimum period and to make data available to investigating agencies only through the legal process the Act sets out.

In practice, this means we will not hand over customer information because someone telephones and claims to be an official. Requests must come through proper legal channels, and we check them before acting. PECA also gives us a basis to act against misuse of our network, such as phishing pages, malware distribution or spam, which our acceptable use rules already forbid. Where Pakistan introduces further data protection legislation, we will update this policy to reflect it.

Your rights over the personal data WinsHosting holds

You can see and update most of your details yourself in the client area. For anything you cannot change there, write to us and we will help. We respect the following requests and answer them within a reasonable time:

• Access: ask for a copy of the personal information we hold about you
• Correction: ask us to fix details that are wrong or out of date
• Deletion: ask us to close your account and erase data we no longer need, using our account deletion request
• Objection: tell us to stop marketing messages at any time
• Consent withdrawal: switch analytics off by resetting your cookie choice

How we protect information and update this privacy policy

Our website and client area are served only over HTTPS, staff access to customer records is limited to people who need it for their work, and accounts are protected against repeated password guessing. No system is perfectly secure, so we also ask you to use strong, unique passwords and to tell us straight away if you think someone else has accessed your account.

We review this policy when our services, the law or the tools on our website change. The date at the top of the page shows when it was last reviewed. If we make a change that affects how we use information you have already given us, we will tell active customers by email rather than relying on you to check this page.