Privacy Policy & Data Protection Notice
Last updated: October 24, 2026 · Privacy Contact: [email protected]
1. Identity and Contact Details of the Data Controller
In accordance with Articles 13 and 14 of the European Union General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Data Controller responsible for processing personal data collected through this domain sales portal is:
2. Personal Data We Collect, Purposes & GDPR Legal Bases (Article 6)
We adhere strictly to the principle of data minimization (Article 5(1)(c) GDPR). We only collect personal data that you voluntarily provide when interacting with one of our three domain acquisition features, plus minimal technical security logs:
| Activity | Data Collected | Purpose of Processing | GDPR Legal Basis |
|---|---|---|---|
| 1. Direct Purchase ("Buy Now") | Email address, name, billing details, Stripe transaction ID | Processing payment via Stripe, delivering your domain EPP transfer authorization code, and issuing payment receipts/invoices. | Art. 6(1)(b) Contract Performance & Art. 6(1)(c) Legal/Tax Obligation |
| 2. Submitting an Offer ("Make Offer") | Name, email address, offer amount, optional company/phone/message, IP address | Evaluating your purchase proposal and emailing you an acceptance, counter-offer, or private Stripe payment link. | Art. 6(1)(b) Pre-Contractual Measures & Art. 6(1)(a) Consent |
| 3. Domain Watchlist / Waiting List | Name, email address, optional planned use note, consent timestamp | Sending a confirmation email and notifying you only if the listed price for the specific domain changes or before a competing offer closes. | Art. 6(1)(a) Explicit Consent (withdrawable in 1 click at any time) |
| 4. Security & Abuse Prevention | IP address, request timestamp, rate-limit counters | Protecting forms against automated spam, brute-force attacks, and fraudulent transactions. | Art. 6(1)(f) Legitimate Interest (Recital 49 Network Security) |
3. Cookies & Zero-Tracking Commitment
This website uses no third-party advertising cookies, no behavioral analytics pixels, and no cross-site tracking scripts. We only set a single strictly necessary session cookie (DS_SESSID, configured with HttpOnly, Secure, and SameSite=Lax) to protect form submissions against Cross-Site Request Forgery (CSRF). When you proceed to checkout, Stripe sets strictly necessary security cookies on its hosted payment page to prevent payment fraud.
4. Data Recipients, Sub-Processors & International Transfers
We never sell, rent, or trade your email address or personal data to third parties or marketing lists. Data is shared strictly with the following infrastructure providers acting as GDPR processors or independent controllers:
- Stripe Payments Europe, Ltd. (Dublin, Ireland): Processes card, Apple Pay, and Google Pay payments when you purchase a domain. We never see or store your credit card numbers on our servers.
- Cloudflare, Inc.: Provides DNS resolution, TLS encryption, and DDoS mitigation at the network edge.
- Email Delivery Infrastructure: Used strictly to send transactional confirmations, offer responses, and watchlist alerts you requested.
Where any sub-processor transfers data outside the European Economic Area (EEA), such transfers are safeguarded by the EU-U.S. Data Privacy Framework and/or European Commission Standard Contractual Clauses (SCCs) pursuant to Article 46 GDPR.
5. Data Retention Periods (Article 5(1)(e) GDPR)
- Watchlist / Waiting List Subscriptions: Retained only until you click the one-click Unsubscribe link included in every watchlist email, until the domain is sold, or until you request erasure.
- Domain Offers & Inquiries: Retained for the duration of the negotiation and up to 24 months thereafter to maintain continuity of commercial correspondence, unless you request earlier deletion.
- Completed Domain Purchases & Invoices: Retained for the mandatory statutory tax and accounting period required by applicable EU/national law (typically 7 to 10 years).
- IP Rate-Limiting Records: Automatically reset or purged within 10 minutes to 30 days.
6. Your Rights Under the GDPR (Articles 15–22)
Under the GDPR, you have the following rights regarding your personal data at any time, free of charge:
- Right of Access (Art. 15): Request a copy of the personal data we hold about you.
- Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
- Right to Erasure / "Right to be Forgotten" (Art. 17): Request immediate deletion of your personal data where it is no longer necessary for contractual or statutory tax obligations.
- Right to Restriction of Processing (Art. 18) & Data Portability (Art. 20): Request restriction of processing or receive your data in a structured, machine-readable format.
- Right to Withdraw Consent (Art. 7(3)) & Right to Object (Art. 21): Withdraw your watchlist consent at any time via the Unsubscribe link in our emails, or object to processing based on legitimate interests.
To exercise any of these rights, email us at [email protected]. We respond to all verified GDPR requests within 30 days (and typically within 48 hours). You also have the right under Article 77 GDPR to lodge a complaint with your national Data Protection Supervisory Authority in the European Union.