Schedule A — Sanya Host

Part 1 — Web Hosting

A.1 Service Scope

Hosting comprises the following bundled services, as specified in the plan you ordered (Standard, Business, Plus, Kasi, or any successor plan):

• Shared web hosting on a cPanel-managed NVMe/SSD server cluster, with the disk, RAM, vCPU, and bandwidth allocation stated for your plan.
• Business email (IMAP/SMTP/POP3) with webmail, SpamAssassin, and Roundcube — up to the account limit stated for your plan.
• Free AutoSSL certificates for every domain pointed at the account.
• One-click installers (Softaculous) for WordPress, Joomla, LAMP stacks, and 200+ other applications.
• Weekly off-server backups (see §A.7).
• WhatsApp + ticket support during business hours.

Domain registration is covered by Part 2 — Domains of this Schedule (§A.13 onwards), even when ordered in the same cart as hosting.

A.2 Resource Limits & Fair Use

Shared hosting is a multi-tenant environment. To keep the cluster healthy for all customers, the following limits apply:

• Disk & bandwidth: as stated for your plan. "Unlimited" or "metered fair-use" means you may use as much as you reasonably need for a single business website plus its email and incidental files — typically up to the published "soft cap" before we contact you.
• Inodes (file count): 500,000 per plan, regardless of disk allocation. Exceeding this slows backups for the whole cluster.
• Concurrent processes: typically 25 simultaneous PHP processes per account. Higher tiers permit more — see your cPanel resource page.
• CPU / RAM: capped per plan via LVE (CloudLinux). Sustained high CPU may cause temporary throttling and a notification email.

If you exceed any limit consistently, we will contact you to discuss an upgrade. We do not throttle without notice except where doing so is required to keep the cluster up for other customers (e.g., a runaway script).

Prohibited on shared hosting (must be moved to Sanya Cloud VPS):

• Bulk-email broadcasting, marketing campaigns, newsletter blasts (use SanyaSMS for SMS or a dedicated transactional-email provider).
• Crypto-mining, cryptocurrency nodes, blockchain validators.
• Public file-sharing, torrent trackers, large public download mirrors.
• Game servers, MMO backends, public IRC servers.
• Long-running background processes (workers) that don't pause when idle.
• VPN endpoints, public proxy services, Tor exit nodes.

Full prohibitions are in the Acceptable Use Policy.

A.3 Uptime SLA

We target 99.9% monthly uptime for Hosting (≤ 43.8 minutes of unplanned downtime per month). The general SLA exclusions in Master §8 apply. If we miss the SLA in a given calendar month, you may request a service credit equal to:

• 10% of that month's fee for the affected plan if uptime is between 99.0% and 99.9%.
• 25% of that month's fee if between 95.0% and 99.0%.
• 50% of that month's fee if below 95.0%.

Credits are applied to your next invoice. Credit requests must be filed within 30 days of the month-end at billing@sanya.tz with the affected URLs and approximate downtime windows.

A.4 Billing & Renewal

Hosting is billed in advance per Master §4. Available billing cycles:

• Annual (default — discounted)
• Quarterly (where offered)
• Semi-annual (where offered)

Hosting renews automatically at the end of each cycle unless cancelled. A renewal reminder is sent 14 days before the due date with the renewal invoice. Failure to receive the reminder does not extend the grace period — keep your account email current.

A.5 Refunds — 30-day Money-Back

For first-time Hosting orders on annual plans, we offer a 30-day money-back guarantee from the activation date, subject to the conditions in Refund Policy §5.1. The refund covers the hosting fee only — domain-registration fees, dedicated-IP add-ons, paid SSL upgrades, and migration labour are non-refundable.

For renewals, monthly plans, and quarterly plans: payments are final once processed. Cancellation in mid-cycle does not generate a pro-rated refund (Master §5.1).

Where eligible, refunds are returned via the original payment channel within the timelines in Refund Policy §7.

A.6 Suspension & Deletion Clock

If a renewal invoice remains unpaid past its due date, the following timeline applies (consistent with Refund Policy §8.2):

During the suspension window your data is preserved but inaccessible — payment of the renewal invoice reactivates the account automatically (typically within minutes). After deletion, the account is wiped at the infrastructure level and cannot be recovered from our side.

An immediate suspension (no grace period) may apply for AUP violations, regulatory order, or imminent security threat (Master §5.2).

A.7 Backups

We take off-server backups weekly on rotation. Backups are restored on request for free during the suspension window. Outside that window:

• Restore from our weekly backup within the suspension window: free.
• Restore after the deletion deadline: not possible — backups are wiped on the same clock as the live account.
• You should keep your own backups too. Our backups are a courtesy; the canonical disaster-recovery plan is yours. We recommend either a Sanya Cloud Storage Box or an external service.

A.8 Email-Specific Rules

Hosting includes IMAP/SMTP/POP3 email at your registered domain. Limits and rules:

• Outbound rate limit: 500 messages/hour per account by default. Higher limits available on request after a brief sender-reputation review.
• No bulk marketing email: not because we object to marketing, but because shared-IP reputation breaks for all customers if one account sends a campaign. Use a dedicated transactional-email provider or move to a Sanya Cloud VPS with your own IP and warm-up.
• SPF, DKIM, DMARC: pre-configured for every new account. Do not remove these DNS records — doing so causes your outbound mail to be rejected by Gmail, Yahoo, and Outlook.
• Anti-spam scanning: SpamAssassin is enabled by default. You may tune thresholds in cPanel.
• Mailbox size: capped per plan. Once full, new mail bounces back to sender — set up POP3 to archive locally or upgrade.
• Account-level email account count: per plan limit. Aliases and forwarders are unlimited within Inode cap (§A.2).

A.9 Customer Responsibilities

In addition to Master §3 (account security) and the AUP, on shared hosting you specifically agree to:

• Keep your application code secure. Outdated WordPress / Joomla / PHP code is the #1 cause of compromise on shared hosting. We auto-update cPanel and the PHP runtime; you are responsible for your CMS and plugins.
• Respond to abuse / compromise notices within 24 hours. If we detect malware, phishing pages, or outbound spam from your account, we will email you and may suspend if not remediated. Repeated compromise may forfeit refund eligibility.
• Not use shared hosting to host third-party customers' sites for resale unless you hold a reseller plan. Hosting your own multi-brand sites is fine; reselling space to unrelated parties is not.
• Comply with Tanzanian content law. You are responsible for the legality of content you publish — including DMCA, libel, and Tanzanian Electronic and Postal Communications Act (EPOCA) requirements.

A.10 Migration Assistance

For first-time orders we offer free migration from another host (cPanel-to-cPanel migrations, or WordPress / Laravel / Drupal site moves). To accept, send your old host's login credentials to support@sanya.tz after activation. Migration excludes:

• Custom server configurations that don't translate to cPanel (e.g., from a managed Kubernetes cluster).
• Database schema changes or application-code rewrites.
• Egress fees that the source provider charges — those remain your responsibility.

Most migrations finish within the same business day.

A.11 Transfer-Out & Final Export

You may move away from Sanya Host at any time. Migrating your data out is your responsibility, normally handled by your destination host's migration team — this is industry-standard practice, since the gaining host is the party who needs to ensure the data lands correctly on their infrastructure.

A.11.1 Your access while the account is active

As long as your account is active and not suspended, you have:

• Full cPanel access, including the "Backup" and "Backup Wizard" tools — generate a full account backup (.tar.gz) at any time, as many times as you need, at no charge.
• SSH / SFTP access for direct download of files and database dumps.
• phpMyAdmin for database exports.
• DNS-record control in cPanel — you (or your new host) can re-point the domain at the new server when ready.

These tools are what most migration teams at destination hosts use. We do not need to be in the loop.

A.11.2 If your account is suspended

If the account is suspended (unpaid invoice, AUP violation, regulatory order), the underlying suspension reason must be resolved first before cPanel access — and therefore data export — is possible:

• Unpaid invoice: pay the outstanding invoice; access restores automatically within minutes.
• AUP violation: cure the violation (remove the offending content, terminate the abusive script, respond to the abuse notice) and request reactivation review.
• Regulatory / law-enforcement hold: cooperate with the regulator's process; we cannot release data while a legal hold is in force.

We do not grant temporary cPanel access "just for the migration" while a suspension is in force. Treat the suspension trigger as a prerequisite to any data movement.

A.11.3 If your account has been deleted

If your account passes the deletion deadline in §A.6, the data is gone. There is no recovery from our side. Your own off-site backup (e.g., on a Sanya Cloud Storage Box or a third-party service) is the only recovery path.

A.11.4 What we will do

Our role in a transfer-out is limited to:

• Keeping cPanel accessible to you for the duration of your active subscription.
• Releasing any domains you registered with us under §A.17 (Transfer-Out).
• Confirming cancellation in writing when you tell us the migration is complete.

Once your migration is complete, send the cancellation request to support@sanya.tz from your registered admin email to stop renewal billing.

A.12 Service Fees Schedule

Standard plan pricing is published at sanya.tz/hosting. The following ancillary fees apply where the work is requested:

All ancillary fees are quoted in TZS, exclusive of VAT, and added to your next invoice unless paid upfront.

Part 2 — Domains

This Part governs domain registration, renewal, and transfer through Sanya Host. Many obligations here are imposed by the upstream registry (ICANN for generic TLDs, tzNIC for .tz) and are non-negotiable — we pass them through to you. (Formerly published as Schedule B.)

A.13 Domains — Service Scope & TLDs Offered

Through Sanya Host you may register, renew, or transfer domain names in the following TLDs (non-exhaustive — full live list at order time):

• Tanzania local TLDs: .tz, .co.tz, .or.tz, .ac.tz, .go.tz, .sc.tz, .ne.tz, .mil.tz, .hotel.tz — registered through tzNIC, where we are an accredited registrar.
• Generic TLDs: .com, .net, .org, .info, .biz, .africa, and 200+ others — registered through ICANN-accredited upstream registrars.
• Country-code TLDs (selected): .ke, .ug, .rw, .cd, .us, .uk — subject to each country registry's eligibility rules.

Netpoa Limited acts as registrar (or via an upstream registrar, depending on TLD); you are the registrant. The relationship between you and the registry is established by your registration; we are your administrative agent but are not the owner of your domain.

A.14 Registration & Registry Rules

A.14.1 Accuracy Obligation

You agree to provide accurate, current, and complete information for the registrant, administrative contact, technical contact, and billing contact (the "WHOIS data") and to keep it current throughout the registration period. Providing false WHOIS data is a basis for the registry to suspend or cancel the domain.

A.14.2 Registry Terms Bind You

By registering a domain you agree to the relevant registry's published policies and the underlying statutory framework, including:

• For .tz family domains — the Tanzania Communications Regulatory Authority (TCRA) instruments listed in §A.24 (Appendix) below, in particular:
  • The Electronic and Postal Communications (Domain Names Management) Regulations, 2020 (GN No. 940 of 30 October 2020), as amended in 2023.
  • The TCRA Guidelines for the Registration of Dot TZ Second Level Domain Names (Doc No. TCRA/EXT/DICT/GUS-SLD/001, in force from 1 March 2022), which established direct second-level .tz registrations alongside the existing third-level namespaces.
  • The TCRA Domain Name Dispute Resolution Guidelines (see §A.19.2).
  • The TCRA Second Level Reserved Names List and length-based restrictions (see §A.14.4).
  • The TCRA WHOIS Data and Services Terms of Use (see §A.18).
• For gTLDs — ICANN's Registrant Rights and Responsibilities, the Uniform Domain-Name Dispute-Resolution Policy ("UDRP") (see §A.19.1), and the published policies of the specific registry-of-record for each TLD (Verisign for .com/.net, PIR for .org, etc.).
• Eligibility-restricted .tz namespaces: .go.tz — government entities only; .ac.tz — accredited academic institutions; .mil.tz — defence forces; .sc.tz — registered schools; .ne.tz — network operators; .hotel.tz — licensed hotels.

These policies may change without our notice. We will pass through any material registry-policy change that affects you. You can review the current policies directly at karibu.tz/regulations at any time.

A.14.3 Eligibility Checks

Restricted TLDs require proof of eligibility (e.g., business registration certificate for .co.tz in some cases, accreditation letter from the Ministry of Education for .ac.tz, government appointment letter for .go.tz, hotel licence for .hotel.tz). We will request this at order time. Failure to provide it within 7 days of the request will result in the order being cancelled and the registration fee refunded only in this specific case (failed eligibility before registration is finalised).

A.14.4 Reserved & Restricted Names

The Tanzania Communications Regulatory Authority maintains a published Second Level Reserved Names List (current version available at karibu.tz/media/DOTTZRESERVEDNAMESLIST.pdf). The following categories of second-level .tz names are not available for public registration:

• Names related to the Government — including names of ministries, agencies, regulatory authorities, regional and district commissioners, councils, water-supply authorities, regulators, parastatals, and other public institutions (e.g., tcra.tz, bot.tz, dawasa.tz, moh.tz, plus place-names of districts and councils). Hundreds of such names are reserved by the published list.
• Names related to ICANN, IANA, Internet bodies, and TLDs — e.g., icann.tz, iana.tz, www.tz, com.tz, net.tz, org.tz, mail.tz, info.tz, email.tz, whois.tz, rfc.tz, and similar names that could cause confusion with global Internet infrastructure.
• Names of one (1), two (2), or three (3) characters in length are forbidden as second-level .tz registrations under the TCRA Reserved Names List (Sections C, D, and E thereof). The minimum SLD length for a public .tz registration is therefore four characters.

If you attempt to register a reserved or length-restricted name, the order will be rejected at the registry level and any pre-paid registration fee for that specific name will be refunded under §A.20. The reserved-names list is updated by TCRA from time to time; the version in force at the moment of your order is the version that binds the registration.

A.14.5 Priority Status (Historical Note)

When direct second-level .tz registration was opened in 2022, the TCRA Guidelines (§7) provided a four-month Priority Status window during which existing third-level domain holders (e.g., the holder of example.co.tz) could claim the matching second-level name (example.tz) ahead of the public. That window closed on 30 June 2022; from 1 July 2022 onward, all unreserved and previously unclaimed second-level .tz names are available on a first-come, first-served basis through accredited registrars including Netpoa Limited. Government institutions retain registry-level priority for matching names regardless of category, per §7.3 of the TCRA Guidelines.

A.15 Renewal & Expiry

A.15.1 Renewal Term

Domains are registered for 1 to 10 years depending on the TLD (10-year maximum is an ICANN rule for gTLDs). Renewal periods follow the same range.

A.15.2 Renewal Reminders

We send renewal reminders at the following intervals before the domain's expiry date:

• 30 days before expiry — first reminder, full grace period.
• 7 days before expiry — urgent reminder.
• 1 day before expiry — final reminder.

Reminders go to your account email. Failure to receive them (e.g., spam filter, full mailbox, forgotten address) does not extend the expiry date — the registry's clock runs independently.

A.15.3 Auto-Renew Option

You may enable auto-renew at any time in your customer portal. With auto-renew on, we attempt to charge your payment method on file 14 days before expiry and apply the renewal at the registry. With auto-renew off, you must initiate the renewal manually before expiry.

A.15.4 Expiry Effects

If a domain expires without renewal:

• The website and email associated with the domain go offline immediately (DNS resolution stops at the registry level, not at our level — we cannot keep the domain resolving once the registry retracts it).
• The domain enters the redemption grace period (§A.16).
• Any hosting account that uses this domain as primary continues to run, but no traffic reaches it until the domain is renewed or replaced.

A.16 Redemption Grace Period

Most TLDs have a redemption grace period after expiry during which you may still recover the domain. Standard windows:

Recovering a domain during the Redemption Grace Period incurs a registry redemption penalty on top of the renewal — see §A.23 (typically USD 80–200 for gTLDs, billed in TZS; set by tzNIC for .tz). Once a domain leaves redemption and is released back to the public pool, anyone can register it — including domain investors who actively monitor expiry lists. Renewing within the grace period is always cheaper than recovering after release.

A.17 Transfer-In & Transfer-Out

A.17.1 Transfer-In (to us)

To transfer a domain from another registrar to us:

1. Unlock the domain at your current registrar.
2. Obtain the authorisation code ("EPP code" or "auth code") from the current registrar.
3. Initiate the transfer at netpoa.com or via your Sanya customer portal. Pay the 1-year extension fee (transfers add at least 1 year to your registration).
4. Approve the transfer authorisation email sent to your registrant email of record (within 5 days).

Transfers typically complete in 5–7 days. Some TLDs (.tz in particular) require additional registry-level approval and may take longer.

A.17.2 Transfer-Out (from us)

You may transfer any domain away from us at any time, subject to the registry's rules. We will:

• Provide the EPP code within 2 business days of request via your customer portal.
• Unlock the domain immediately on request.
• Not charge an "exit fee" — transferring out is free at our end (the gaining registrar may charge their own fee).

Registry-imposed restrictions on transfer-out:

• 60-day lock after new registration or after a previous transfer (ICANN rule for gTLDs).
• 60-day lock after a WHOIS change to the registrant name or organisation (ICANN rule; can be opted out at the time of change in some cases).
• Some ccTLDs have their own lock periods and may require additional documentation.

If a transfer-out is requested within a registry lock period, we will provide the EPP code anyway, but the gaining registrar's transfer-in attempt will fail until the lock lifts.

A.18 WHOIS & Registrant Information

A.18.1 WHOIS Publication

For gTLDs, the registrant name, email, and country are typically published in the public WHOIS database per ICANN policy (with regional GDPR-style redactions where applicable). For .tz family domains, publication rules are set by the TCRA WHOIS Data and Services Terms of Use (see §A.24 (Appendix)) and the underlying GN No. 940 of 2020 regulations. The registry maintains both the WHOIS service and a Registration Data Access Protocol (RDAP) endpoint, the latter following the Technical Specification for dot tz Central Registry Access.

Registry Data (as defined by the TCRA Guidelines §2) includes holder contact information, technical and administrative contact information, WHOIS data, all other electronic submissions by registrars, and any other data concerning particular registrations or name servers held in the Registry Database.

A.18.2 WHOIS Privacy

Where available (most gTLDs), you may enable WHOIS privacy at no extra charge — this replaces your contact details in public WHOIS with proxy details, while we retain the real registrant data privately for registry and law-enforcement compliance. WHOIS privacy is not available for most ccTLDs including .tz family.

A.18.3 Registrant of Record

You ("the registrant of record") are the legal owner of the domain. Netpoa Limited is the registrar. Hosting providers, web designers, or staff members who help you with the registration are not the owners — make sure the registrant of record is the actual individual or organisation that should own the domain. We strongly advise against listing a web designer's personal name as registrant.

A.19 Domain Disputes

A.19.1 UDRP (gTLDs)

For gTLD domains, ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP) applies. A trademark holder can file a UDRP complaint against your domain; if upheld, the domain may be transferred or cancelled. Defending a UDRP requires legal counsel; this is your responsibility.

A.19.2 tzNIC Dispute Resolution Guidelines

For .tz family domains, the TCRA Domain Name Dispute Resolution Guidelines apply (published at karibu.tz/regulations). The Guidelines provide a defined procedure for trademark holders, prior-rights claimants, or aggrieved parties to challenge a .tz registration, aligned in substance with UDRP principles but adjudicated under Tanzanian law and the TCRA framework rather than at WIPO. A .tz domain that becomes the subject of a dispute resolution proceeding cannot be transferred to another registrant or another registrar until the proceeding concludes (per the TCRA Guidelines §9.3(b)). tzNIC will also act on any binding order of a Tanzanian court.

A.19.3 Our Role in Disputes

Netpoa Limited is not a party to domain disputes between registrants and trademark holders. We will comply with a registry order, UDRP arbitration result, or Tanzanian court order to transfer, lock, or cancel a domain. We do not adjudicate disputes ourselves and cannot advise on them — consult a lawyer or the registry directly.

A.20 Domain Refunds — Not Available

Domain registration fees, renewal fees, transfer fees, and redemption fees are non-refundable. This is because the moment we register or renew a domain, we have paid the registry on your behalf — that money is gone from our side regardless of whether you later change your mind.

Limited exceptions, per Refund Policy §5.1:

• If the registration fails at the registry (e.g., name already taken between cart and checkout, eligibility rejection), you receive a full refund of the failed-registration fee.
• If we caused a renewal failure through our own error and the domain consequently expired, we will at our expense recover or re-register the domain.

A.21 DNS Hosting

We provide free DNS hosting for any domain registered with us, using our anycast nameservers. You may instead point the domain at external nameservers (e.g., Cloudflare, AWS Route 53) at any time — the domain remains yours.

DNS-record changes you make in our portal propagate to our nameservers within seconds. Global cache propagation depends on each resolver's TTL — typically 5 minutes to 24 hours.

If the domain leaves us (transfer-out or expiry), our DNS hosting for that domain ceases unless you explicitly continue it as a standalone DNS-only service.

A.22 Suspension & Termination by Registry

A registry may suspend, transfer, or cancel a domain for reasons outside our control, including:

• WHOIS verification failure (after multiple notices).
• Court order, regulatory order, law-enforcement request.
• UDRP / tzNIC arbitration result against the registrant.
• Trademark conflict resolved through Sunrise / Trademark Clearinghouse.
• Discovery that the domain was registered with materially false information.
• Use of the domain for activities specifically prohibited by the registry (e.g., child-sexual-abuse material — instant takedown at every registry).

We will notify you immediately if we receive such an order. We are not liable for losses arising from a registry-initiated action — those flow from the registry's own policies which you agreed to under §A.14.2.

A.23 Domain Fees Schedule

For .tz family domains, the retail prices are set by tzNIC / TCRA under the Electronic and Postal Communications (Domain Names Management) Regulations (Second Schedule, "Registrar Prices", as amended by GN No. 422). The standard regulated prices are:

Offers. The figures above are the standard tzNIC-regulated retail prices. If the price shown in your customer portal or at checkout is lower than the figure above, that lower price is a promotional offer from us for that order — not the standard price. We do not charge above the regulated price.

Other (non-.tz) TLDs are not price-regulated by tzNIC; they are priced at the registry wholesale plus our margin and shown live at order time on netpoa.com or in your customer portal. Indicative figures:

All fees are quoted in TZS, exclusive of VAT, and are payable at the time of the requested action.

A.24 Appendix — tzNIC Governing Documents

For transparency, the full set of TCRA / tzNIC instruments that govern .tz family domain registrations (and which the registrant agreement above incorporates by reference) are listed below. The authoritative copies are published at karibu.tz/regulations; if there is any difference between the references in this Schedule and the version of a document currently published by TCRA, the published TCRA version prevails.

Documents #1–3 establish the statutory framework under the Electronic and Postal Communications Act (Tanzania Communications Regulatory Authority Act No. 12 of 2003 and the Electronic and Postal Communications Act, Cap 306 R.E. 2022). Documents #4–10 are TCRA / tzNIC published instruments that implement and operationalise the statutory framework. As an accredited .tz registrar, Netpoa Limited is bound by all of these, and we pass through to you those obligations that apply to registrants.

For convenience, the consolidated entry point to all of the above is karibu.tz/regulations (the official tzNIC / TCRA portal). If you cannot access a document at the cited URL, contact legal@sanya.tz and we will provide a copy.