Kawanda.NET is the controller for account, billing, and support data. We operate from the Sultanate of Oman. If you are in a country with extra privacy rules, you still contract with us in Oman. We will meet those extra rules where they apply to us.

1. Data we collect

We collect what we need to take an order, issue an invoice, register a domain, host a site or mailbox, answer a ticket, and keep the platform secure:

• Identity and contact: name, email, organisation name if you give one, country, and billing address if checkout requires it.
• Account and service records: products, domains, invoices, quotes, tickets, and messages you send through our forms.
• Technical logs: IP addresses, user-agent strings, mail-delivery and authentication logs, and security events. Logs are rotated on a normal operations schedule.
• Payment metadata: invoice amounts, method, and status. For Kaspa we store a watch-only receive address, amounts, and transaction identifiers needed to match a payment. We do not collect wallet seeds, private keys, or seed phrases.
• Domain public data: registrant fields required by the registry. Where a privacy or proxy product is on the domain, public WHOIS follows that product and the registry’s policy. We do not claim that a directory is empty without it.

Public forms do not require a telephone number. Do not send us secrets (passwords, seeds, card PAN) in tickets or the contact form.

2. Why we use it

We use the data to perform the contract (billing, hosting, domains, quoted work), to keep the service secure, to meet registry and accounting duties, and, where you have asked, to reply to a brief. We do not sell your contact list. We do not publish your name, quote, or photographs as a testimonial unless you have agreed in writing.

3. Who else sees it

We share data with processors who need it to do the job: our hosting and mail platform, the domain registrar and registries, the payment provider you chose at checkout, and professional advisers under a duty of confidence. Hardware used for managed machines may sit in a datacenter we do not own; that vendor sees what is required to run the machine. We do not authorise those parties to use your data for their own marketing.

We may disclose data if a competent authority, registry, or court requires it, or if we must defend a legal claim.

4. Retention

Account and invoice records are kept for as long as the account is open and for a further period required for tax and dispute purposes (at least five years after the last invoice, or longer if Oman law requires). Logs are kept for a shorter operational period. You may ask us to close an account; we will delete or anonymise what we no longer need, except records we must keep.

5. Your requests

You may ask to see or correct account data, or to close the account, through the contact form from the email on file. We may need to verify that the request comes from the account holder. Domain data that has already been published by a registry cannot always be unpublished by us alone.

6. Security

We use ordinary industry measures (access control, TLS on the public site, restricted staff access). No method is perfect. You must keep your client-area password to yourself.

7. Changes

The date at the top is the current version. We will post updates on this page.