1. Scope and identity of the controller
Domain registration is not an ordinary website account service. For gTLDs, certain Registration Data must be collected, transferred, escrowed, published or made available for lawful disclosure in accordance with applicable ICANN policies, registry requirements and data protection law.
This Privacy Policy applies when you visit our website, create or use an account, place a backorder or other domain order, register, renew, transfer, restore or manage a domain name, contact support, submit or respond to an abuse or Registration Data request, or otherwise use services provided by POWER DOMS.
POWER DOMS is the data controller for the Personal Data described in this Policy. Our registered or principal business address is published on the company information page.
Privacy questions and requests may be sent to help@powerdoms.com.
Privacy contact / Data Protection Officer: help@powerdoms.com.
EEA representative, where Article 27 GDPR applies: Not applicable.
2. Personal Data we collect
Depending on the service you use, we collect or generate Personal Data needed to provide registrar, account, payment, support, compliance and security services.
Account and identity data may include your name, organisation or company name where relevant, email address, telephone number, postal address, account identifier, username, authentication information, language, country, preferences, and identity or authorisation evidence where reasonably required for account security, fraud prevention, dispute handling or legal compliance.
For domain registrations, Registration Data may include the domain name and lifecycle or status information; Registrant name; organisation where supplied; street, city, state or province where applicable, postal code where applicable, country, telephone number and email address; optional technical-contact information where supplied; nameservers, nameserver IP addresses and DNSSEC data where applicable; registration, renewal, transfer and expiration dates; registrar, registry, reseller and transaction identifiers; and records concerning verification, publication consent, locks, transfers, disputes and registration lifecycle actions.
Order, billing and transaction data may include orders, backorders, registrations, renewals, transfers, restores and refunds; billing name and address; tax or VAT information; invoices; payment status; payment-provider transaction identifiers; limited payment metadata; account balances; credits; deposits; and transaction history where supported.
Support, abuse and correspondence data may include support tickets, emails, notices and other communications; abuse reports and supporting evidence; requests concerning non-public Registration Data and our responses; and records necessary to investigate technical, security, compliance or contractual issues.
Technical, security and usage data may include IP addresses, dates and times, browser type, user agent, device information, authentication events, security events, account activity, pages or functions used, diagnostic information, server and application logs, and cookie or preference identifiers where such technologies are used.
For standard gTLD registrations, required Registrant information includes the holder’s name, street, city, country, telephone number and email address; state or province and postal code apply where relevant to the address format. Organisation information, technical-contact information and other fields are collected where applicable. Other extensions may impose additional eligibility or data requirements.
3. Where Personal Data comes from
We obtain Personal Data directly from you when you create an account, place an order, register a domain, manage a service or contact us.
We may receive information from an authorised user, reseller, agent, organisation or other person acting for you.
We may receive or exchange information with Registry Operators, other registrars and domain-registration systems during transfers and other lifecycle operations.
Information may also come from payment, fraud-prevention, security and infrastructure providers.
For abuse, disputes and Registration Data disclosure matters, information may be provided by complainants, rights holders, security researchers, authorities or other third parties.
Technical and usage information may be collected automatically when you use the website, API, account portal or other services.
If you provide Personal Data about another individual, you should ensure that you are authorised to provide it and that any notice, authority or consent required by applicable privacy law has been provided or obtained.
4. Why we process Personal Data and our legal bases
Where the GDPR, UK GDPR or another legal-basis regime applies, we process Personal Data only where an appropriate legal basis applies. The basis depends on the particular processing activity.
We process account and authentication information to open and administer accounts, authenticate users and provide requested services. The usual basis is performance of a contract or taking steps requested before entering a contract.
We process Registration Data to register, renew, transfer, restore and manage domain names. The usual bases are performance of the registration contract and our legitimate interests in operating a reliable accredited registrar and domain-registration service.
We transfer required Registration Data to Registry Operators and ICANN-approved data escrow providers where necessary to provide registrar services and meet applicable ICANN or registry requirements. Depending on the circumstances, the basis may include performance of the contract, legitimate interests, or a legal obligation where applicable law independently requires the processing.
We operate RDAP or other Registration Data services, provide registrant contact mechanisms and respond to lawful disclosure requests based on applicable contractual requirements, legitimate interests, legal obligations where applicable, and consent where an applicable policy specifically relies on consent to publish optional information.
We process payments, invoices, tax records, credits and refunds to perform the contract and meet applicable accounting and legal obligations.
We process contact information to provide support and send service, security, renewal, expiration and policy notices based on performance of the contract, legitimate interests and applicable obligations.
We process technical and security information to prevent fraud, account compromise, DNS Abuse, attacks and other threats and to maintain service and network security. This is generally based on our legitimate interests in protecting customers, our systems and the DNS ecosystem, together with applicable legal obligations.
We process information relating to DNS Abuse, rights complaints, disputes and policy violations for our legitimate interests, performance of the Registration Agreement and applicable legal or contractual obligations.
We retain appropriate records to demonstrate compliance, resolve disputes and establish, exercise or defend legal claims. This may be based on legitimate interests or legal obligations.
Optional analytics, preference or marketing processing is based on consent where required by law, or legitimate interests where applicable law permits that basis.
Where we rely on legitimate interests, those interests include operating and securing the registrar service, preventing fraud and abuse, maintaining reliable records, resolving disputes, protecting customers and third parties, and meeting requirements of the domain-name ecosystem. We balance those interests against the rights and interests of affected individuals.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before withdrawal and does not affect processing that continues under another lawful basis.
If you decline information that is necessary to provide a registration lawfully or perform the service contract, we may be unable to provide or continue that service. Optional data and marketing choices are not made a condition of domain registration.
5. ICANN and gTLD Registration Data
For generic top-level domains, we process Registration Data in accordance with the applicable ICANN Registration Data Policy, Registrar Accreditation Agreement, Consensus Policies and the requirements of the relevant Registry Operator.
We collect and generate Registration Data needed to provide registrar services. Certain data are transferred to the relevant Registry Operator where required and where an appropriate legal basis and, when applicable, data-processing arrangement are in place.
ICANN-accredited registrars are required to deposit specified Registration Data with an ICANN-approved data escrow provider. Data escrow helps protect Registrants and supports continuity of registration services if a registrar can no longer operate.
Some domain-registration information is published through Registration Data Directory Services such as RDAP where required by ICANN policy. Personal Registration Data may be redacted from public output where required or permitted by applicable policy and law.
Where a relay email address or web contact form is required, it may allow communication with the Registered Name Holder without publicly revealing the underlying email address.
If you provide a Registrant Organisation value, that organisation may become the Registered Name Holder under the applicable ICANN policy. Where policy requires consent before publication of that value, we request that consent before publishing it.
We provide a mechanism for third parties to submit reasonable requests for lawful disclosure of non-public Registration Data. Each request is assessed under applicable ICANN policy, data protection law and other applicable law. A request does not automatically entitle the requestor to disclosure.
6. Who receives Personal Data
We do not sell Personal Data. We disclose or make Personal Data available only as reasonably necessary for the purposes described in this Policy.
Recipients may include Registry Operators for the TLDs in which domains are registered; ICANN-approved data escrow providers; ICANN where information is required for contractual compliance, audit, policy processes or another permitted purpose; other registrars and domain-industry service providers where necessary for transfers and lifecycle operations; payment processors; hosting, infrastructure, email, support, security, anti-fraud and professional service providers; dispute-resolution providers; courts, authorities and law-enforcement bodies where required or appropriately justified; and requestors of non-public Registration Data where disclosure is lawful and justified.
Personal Data may also be disclosed to a purchaser, successor or transaction counterparty in connection with a merger, acquisition, reorganisation or sale of relevant assets, subject to appropriate safeguards.
Hosting / infrastructure: Superhosting/Vultr.
Billing: Wise.
Payments: Wise.
Email / support: Superhosting.
ICANN-approved data escrow: N/A.
7. Payments
Payment card details are normally entered directly into the systems of our payment processor and are not stored by us in full.
We may receive and retain limited payment metadata such as the processor name, transaction identifier, amount, currency, status, timestamps and payment-method type.
Our current payment processors are: Wise.
A payment provider may process Personal Data under its own privacy terms where it acts as an independent controller, or under appropriate processing arrangements where it acts on our behalf.
8. Cookies, local storage and technical logs
Our services may use cookies, browser storage and similar technologies where necessary for authentication, account security, session management, language or interface preferences, fraud prevention and other requested functionality.
This informational website does not set cookies, run analytics or contain advertising trackers in its supplied configuration. The separately linked account and billing platform may use necessary cookies and has its own applicable notices.
Optional analytics, preference or marketing technologies configured for this service: None on the informational website in the supplied configuration.
Where applicable law requires consent before optional cookies or similar technologies are used, we request that consent and provide an appropriate mechanism for changing the choice.
We maintain server, application, authentication and security logs. These logs may contain IP addresses, timestamps, user-agent information, account identifiers, request information and security events and are used to operate, troubleshoot and protect the service.
9. International transfers
Domain registration is an international service. Personal Data may therefore be processed in countries outside your country of residence, including countries where Registry Operators, ICANN, data escrow providers, infrastructure providers or other service providers are located.
Where the GDPR or UK GDPR applies to a transfer to a country that is not covered by an applicable adequacy decision, we use an appropriate transfer mechanism where required, such as approved standard contractual clauses together with supplementary measures where appropriate, or another lawful transfer mechanism.
Our current international-processing arrangements and safeguards are: GDPR.
You may contact help@powerdoms.com to request further information about safeguards applicable to a particular international transfer.
10. How long we retain Personal Data
We retain Personal Data only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, accounting, security, dispute and contractual requirements. Different categories of data have different retention periods.
Active account and profile information is normally retained for the life of the account and afterwards for as long as reasonably necessary for applicable legal, security, contractual and dispute purposes.
Billing, invoice and accounting records are retained for 5 years, or longer where applicable tax or accounting law requires.
Support and ordinary correspondence are normally retained for as long as reasonably necessary for customer support, compliance and dispute purposes, unless information is needed for an ongoing dispute, investigation or compliance matter.
Security, authentication, website and access logs are normally retained for 5 years, subject to longer retention where reasonably required for an active security incident or investigation.
Registration Data needed for the ICANN Transfer Dispute Resolution Policy are retained for at least 15 months after the end of our sponsorship of the registration or after an inter-registrant transfer, to the extent required by the applicable ICANN Registration Data Policy.
Records of requests for disclosure of non-public Registration Data are retained in accordance with applicable ICANN requirements and our lawful business-record retention practices.
Abuse-case records are retained for the period stated in our Abuse Handling Procedure, subject to any longer retention necessary for ICANN compliance, applicable law, investigations or legal claims.
When a retention period ends, data are deleted, anonymised or isolated from ordinary use unless continued retention is necessary and lawful, for example to establish, exercise or defend legal claims, comply with a binding preservation requirement, or satisfy another applicable obligation.
11. Security of Personal Data
We use appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access and other unlawful processing.
Depending on the risks involved, measures may include access controls, authentication, encryption in transit, restricted administrative access, logging, backups, security monitoring, software maintenance and incident-response procedures.
No Internet service or storage system can be guaranteed to be completely secure. You are responsible for protecting your account credentials and authentication devices and should notify us promptly if you suspect unauthorised access.
12. Your privacy rights
Depending on your location and the law that applies, you may have the right to receive information about how your Personal Data are processed and to obtain access to Personal Data we hold about you.
You may have the right to have inaccurate or incomplete information corrected, request erasure where the right applies, request restriction of processing, and receive certain Personal Data in a structured, commonly used and machine-readable format where data portability applies.
You may have the right to object to processing based on legitimate interests in circumstances provided by law and to object at any time to processing for direct marketing.
Where processing is based on consent, you may withdraw your consent at any time. You may also have the right to receive information about safeguards for certain international transfers and to lodge a complaint with a competent data protection authority.
These rights are not absolute. We may need to retain Registration Data or transaction records where ICANN policy, Registry Operator requirements, applicable law, fraud prevention, security requirements or the establishment, exercise or defence of legal claims provides a lawful basis to do so.
You may view and correct registration information through your account where the functionality is available, or contact us for assistance.
We may request information reasonably necessary to verify your identity or authority before acting on a privacy request.
Our principal supervisory authority / contact is ICO.
Additional regional privacy rights: No additional regional privacy statement is configured. Rights provided by applicable law remain unaffected.
13. Automated processing and domain-service automation
Registrar services are highly automated. Our systems may automatically process backorders, availability checks, registration attempts, renewals, transfers, expiry actions, fraud and security signals, abuse controls and other service operations according to configured rules.
Ordinary domain-service automation is not intended to profile you or make a solely automated decision about you that produces legal or similarly significant effects within the meaning of Article 22 GDPR.
If we introduce processing that falls within rules governing solely automated decisions with legal or similarly significant effects, we will provide the additional information and safeguards required by applicable law.
14. Children’s privacy
Our registrar account services are not directed to children.
You must be at least 18 years old, or otherwise have the legal capacity required in your jurisdiction, to create an account or enter into a Registration Agreement with us.
If we learn that Personal Data were collected from a child in circumstances where we were not legally permitted to process them, we will take appropriate steps to delete or otherwise address the data, subject to any applicable legal or domain-registration obligations.
15. Links to third-party sites and services
Our website and services may link to ICANN, Registry Operators, payment providers and other third-party websites or services.
Those third parties have their own privacy practices and privacy notices. We encourage you to review the applicable notice when you leave our service or provide information directly to another provider.
A link to a third-party service does not by itself mean that we control that service or its processing of Personal Data.
16. Changes to this Privacy Policy
We may update this Privacy Policy when our services, data practices, providers, ICANN requirements or applicable laws change.
The current version will be published on our website with an updated effective date.
Where applicable law requires additional notice or consent for a material change, we will provide the required notice or obtain the required consent before the relevant change takes effect.
17. Contact us and complaints
For privacy questions or to exercise a privacy right, contact POWER DOMS at help@powerdoms.com.
Privacy contact / Data Protection Officer: help@powerdoms.com.
Our registered or principal business address is published on the company information page.
Where applicable, you may lodge a complaint with the data protection authority in the country where you live or work, or where you believe an infringement occurred. Our principal supervisory authority / contact is ICO.