Privacy and Data Protection Policy

Last updated: March 2026  ·  Effective date: March 2026

1. Who we are — data controller

The data controller responsible for the personal data collected through this website is:

2. Personal data we collect

Depending on the service you use, we collect the following categories of personal data:

  • Identity: first name, last name, or company name and registration number
  • Contact: email address, phone number, postal address (street, city, postal code, country)
  • Account: username, encrypted password, account preferences
  • Transaction: domain names registered, renewal dates, transfer history, invoices
  • Technical: IP address, browser type, access logs
  • Communications: content of support requests and email exchanges

We do not collect special categories of personal data as defined in GDPR Article 9. We do not process payment card data directly — payment processing is handled by our PCI-DSS-compliant payment provider.

3. Legal basis for processing

  • Providing domain registration and management services — Art. 6(1)(b) GDPR (performance of a contract)
  • Security of the platform and fraud prevention — Art. 6(1)(f) GDPR (legitimate interests)
  • Compliance with tax and accounting obligations — Art. 6(1)(c) GDPR (legal obligation)
  • Sending service communications (renewals, expiry notices) — Art. 6(1)(b) GDPR (performance of a contract)

4. How we use your data

Domain registration and lifecycle management. To register domain names on your behalf, manage renewals, transfers and deletions.

Communications. To send you transactional emails (registration confirmation, renewal reminders, expiry notices, security alerts). We do not send marketing emails without your separate, explicit consent.

Customer support. To respond to your questions and requests, and to resolve any disputes or issues relating to your domain names.

5. Third-party processors

We may share your personal data with the following categories of third-party processors, who act strictly on our instructions and are bound by GDPR-compliant Data Processing Agreements (DPAs):

  • Cloud hosting / infrastructure: platform hosting and database storage, located within the EU/EEA
  • Payment processor: secure payment handling, located in an EU/EEA or adequacy-decision country
  • Email delivery service: transactional email dispatch, located in an EU/EEA or adequacy-decision country

We do not sell, rent or trade your personal data to third parties for marketing purposes.

6. International transfers

All personal data is stored and processed within the EU/EEA by default. Where a third-party processor is located outside the EU/EEA (for example, in the United Kingdom, which benefits from an EU adequacy decision for data transfers), we ensure that appropriate safeguards are in place before any transfer takes place, specifically:

  • An adequacy decision by the European Commission (GDPR Article 45); or
  • Standard Contractual Clauses (SCCs) approved by the European Commission (GDPR Article 46).

No personal data is transferred to countries not offering an adequate level of protection unless covered by one of the above mechanisms.

7. Retention periods

  • Account data with no active domains: 3 years after last activity, then securely deleted or anonymised
  • Transaction and invoice records: 10 years — applicable commercial and tax law
  • Support communications: 3 years from closure of the request
  • Server access logs: 12 months

At the end of each retention period, personal data is securely and permanently deleted from all active systems and backups. Deletion is logged in our records of processing activities.

8. Security measures

We implement appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration or destruction, in accordance with GDPR Article 32. These include:

  • Access control: role-based access control (RBAC) and multi-factor authentication (MFA) for all administrative accounts
  • Encryption: all data in transit is protected by TLS 1.2 or higher; data at rest is encrypted (AES-256)
  • Backups: daily automated encrypted backups stored at a separate location within the EU; integrity tested regularly
  • Patch management: critical security patches applied within 72 hours; non-critical patches within 30 days
  • Security audits: a technical security review of the entire information system is performed at least once per year and following any significant security incident
  • Breach register: we maintain a register of personal data breaches and notify the competent supervisory authority and affected individuals within GDPR-prescribed timeframes where required

9. Your rights

Under the GDPR (and, where applicable, the UK GDPR), you have the following rights with respect to your personal data:

  • Right of access (Art. 15): obtain a copy of the personal data we hold about you and information about how it is used
  • Right to rectification (Art. 16): request correction of inaccurate or incomplete data; you can also do this directly in your account portal
  • Right to erasure (Art. 17): request deletion of your data where we no longer have a legal ground to retain it
  • Right to restriction (Art. 18): request that we restrict processing of your data in certain circumstances
  • Right to portability (Art. 20): receive your data in a structured, machine-readable format and transfer it to another controller
  • Right to object (Art. 21): object to processing based on our legitimate interests

You have the right to lodge a complaint with the competent data protection supervisory authority in your country of residence. EU/EEA residents may also contact the AEPD (Agencia Española de Protección de Datos) at www.aepd.es. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.

10. How to exercise your rights

To exercise any of the rights described in Section 10, or to ask any question about how we process your personal data, please contact us electronically:

We will respond within one month of receiving your request (GDPR Article 12). For complex or numerous requests, this period may be extended by a further two months; if so, we will notify you within the first month and provide reasons for the extension. We may ask you to verify your identity before processing your request.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will notify you by email to the address associated with your account and update the “Last updated” date at the top of this page. Previous versions of this policy are available on request by contacting contact@301domains.com.