Last updated: March 2026 · Effective date: March 2026
The data controller responsible for the personal data collected through this website and through the provision of domain name registration services is:
We are an accredited domain name registrar operating under the authority of multiple domain name registries across the EU/EEA and internationally. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), the UK General Data Protection Regulation (UK GDPR), and other applicable data protection laws.
Depending on the service you use, we collect the following categories of personal data:
We do not collect special categories of personal data as defined in GDPR Article 9. We do not process payment card data directly — payment processing is handled by our PCI-DSS-compliant payment provider.
Domain registration and lifecycle management. To register domain names on your behalf, manage renewals, transfers and deletions, and to fulfil all obligations arising from the registrar–registrant relationship.
Identity verification. To verify that the identification data you provide is accurate and complete, in compliance with the naming policies of the relevant registry. At least once per year, we will contact you to request confirmation or update of your identification data.
Communications. To send you transactional emails (registration confirmation, renewal reminders, expiry notices, security alerts). We do not send marketing emails without your separate, explicit consent.
Customer support. To respond to your questions and requests, and to resolve any disputes or issues relating to your domain names.
Legal and regulatory compliance. To respond to requests from domain registries and other competent authorities, and to fulfil our obligations as an accredited registrar.
When you register a domain name, we are required by our accreditation agreements and by applicable law to transmit your identification data (name, address, email address, phone number) to the relevant registry operator. This transmission is a legal obligation and a necessary condition for domain name registration. Each registry acts as an independent data controller for the data it receives and processes it in accordance with its own privacy policy and applicable law.
Registries may make certain registrant data publicly available via WHOIS or RDAP services, subject to applicable data protection law and each registry's own publication policy.
For domain names in French TLDs, your data is transmitted to Afnic (Association Française pour le Nommage Internet en Coopération), the registry operator headquartered in France. This obligation arises from Article R20-44-43 of the French Electronic Communications and Postal Code (CPCE) and from Afnic's naming charter. For full details of how Afnic processes registrant data as an independent data controller, please consult:
Afnic — Processing of holders’ data
Registration of a .eu domain name requires that the registrant is established in or a resident of the European Union, European Economic Area, or Switzerland. By completing a .eu registration, you self-certify your eligibility. Your data is transmitted to the official .eu registry operator, which processes it as an independent data controller in accordance with GDPR.
Your data is transmitted to the official .de registry operator, which processes it as an independent data controller in accordance with GDPR and applicable German data protection law.
Your data is transmitted to the official .uk registry operator, headquartered in the United Kingdom. Processing by the .uk registry is governed by the UK GDPR and the Data Protection Act 2018. If you are a UK resident and wish to raise a concern about how your data is processed in connection with a .uk domain registration, you may contact the UK Information Commissioner's Office (ICO) at ico.org.uk.
Your data is transmitted to the official .it registry operator, headquartered in Italy, which processes it as an independent data controller in accordance with GDPR and applicable Italian data protection law.
Your data is transmitted to the official .es registry operator, which processes it as an independent data controller in accordance with GDPR and applicable Spanish data protection law.
For any other domain extension offered on our platform, your data is transmitted to the relevant registry operator in order to complete and maintain the registration. Each registry acts as an independent data controller. We recommend consulting the privacy policy of the relevant registry for details of their data processing practices.
We may share your personal data with the following categories of third-party processors, who act strictly on our instructions and are bound by GDPR-compliant Data Processing Agreements (DPAs):
We do not sell, rent or trade your personal data to third parties for marketing purposes.
All personal data is stored and processed within the EU/EEA by default. Where a third-party processor is located outside the EU/EEA (for example, in the United Kingdom, which benefits from an EU adequacy decision for data transfers), we ensure that appropriate safeguards are in place before any transfer takes place, specifically:
No personal data is transferred to countries not offering an adequate level of protection unless covered by one of the above mechanisms.
At the end of each retention period, personal data is securely and permanently deleted from all active systems and backups. Deletion is logged in our records of processing activities.
We implement appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration or destruction, in accordance with GDPR Article 32. These include:
Under the GDPR (and, where applicable, the UK GDPR), you have the following rights with respect to your personal data:
Please note that some rights may be limited where we process your data to comply with a legal obligation, such as our duty to retain registrant data under registrar accreditation requirements.
You have the right to lodge a complaint with the competent data protection supervisory authority in your country of residence. EU/EEA residents may also contact the AEPD (Agencia Española de Protección de Datos) at www.aepd.es. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any of the rights described in Section 10, or to ask any question about how we process your personal data, please contact us electronically:
We will respond within one month of receiving your request (GDPR Article 12). For complex or numerous requests, this period may be extended by a further two months; if so, we will notify you within the first month and provide reasons for the extension. We may ask you to verify your identity before processing your request.
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will notify you by email to the address associated with your account and update the “Last updated” date at the top of this page. Previous versions of this policy are available on request by contacting support@301domains.com.
