DATA PROTECTION AND PRIVACY POLICY
Version 1.0
What personal data does theRegistry Operator collect?

The Registry Operator will collect all registrant data required byspecification 4 of the Registry Agreement with ICANN. This data
is provided to us by the registrant’s domain Registrar for thepurpose of operating the Registry Operator's WHOIS directory
If you are an individual registrant, the collected data will include
personal details which you provide to the Registrar which may beconsidered sensitive and from which you may be personallyidentifiable (“Personal Data”).
As part of our commitment to compliance with data privacy
requirements, and to reflect changes in Registry Operator
operating procedures, we may need to update the terms of thispolicy from time-to-time.

How do we process data?

We will only use data provided to us about any registrant,
including Personal Data, for the following purposes:
 inclusion in the said searchable WHOIS directory providing
free public query-based access to the details as required byclauses 1.5 and 1.6 of specification 4 of the Registry
Agreement (please see our WHOIS Policy); research on an anonymised amalgamated statistical basis; day to day operations of the Registry Operator, including
email contact by the Registry Operator with the registrant as
required in accordance with our Acceptable Use Policy;
 to our service providers which/who provide legal, accounting,delivery, installation, systems support, escrow, marketing,clearinghouse and directory services on our behalf; as may be required by law enforcement agencies or a court
order or other compulsory operation of law applicable to theRegistry Operator;
 as may be required by ICANN in accordance with a zone fileaccess request in accordance with specification 4 of theRegistry Agreement.
For more information please contact abuse@grs.domains

Third party use

We will only share Personal Data with third parties as statedabove. Our service providers companies are prohibited fromretaining, sharing, storing or using Personal Data for any
secondary purposes. However, please note that these third
P: +448455644650
E:legal@grs.domains

327MainStreet
GibraltarGX111AA

W: www.grs.domains
Global Registry Services limited is a company in Gibraltar with registered address 327 Main Street, Gibraltar.

parties may use cookies and action tags to measure advertising
effectiveness on an anonymous basis.
We will never sell Personal Data to a third party. However, wecannot control the use made by third parties of WHOIS data
which is in the public domain and is searchable globally. We
disclaim all liability for any misuse of the data made by a third
party of WHOIS data.
We will also provide Personal Data to third parties when obliged
by applicable law. We may also provide such information wherelegal action is proceeding or contemplated or as requested by alegitimate law enforcement agency.
How can you correct or delete
Data if you are a registrant?

We only accept registrant data from the relevant Registrar. In thecase that you may wish to access, update, correct, rectify ordelete Personal Data, please contact the relevant Registrar.
In case that the Registrar has failed to take the appropriate
action within the timelines they have specified, you may contact
your national data protection or information commissioner or
our abuse point of contact: abuse@grs.domains
Please note that deactivation an account with the Registrar does
not mean that relevant that Personal Data for that account has
been deleted from our database entirely. While as a general rule
we will not retain Personal Data records for more than two years
after the expiry of the relevant domain name registration, wereserve the right to retain and use Personal Data for longer inorder to comply with our legal obligations, resolve disputes or toenforce our agreements.

How do we prevent unauthorised
access to Personal Data?

We have implemented the appropriate technical andorganizational security measures to protect Personal Data,including internal security procedures that restrict access to anddisclosure of Personal Data.
We also use encryption, firewalls and other technology andsecurity procedures to help ensure the accuracy and security of
Personal Data and to prevent unauthorized access or improperuse.
We will also cooperate with duly authorised law enforcement
agencies regarding any allegations of abuse or violation of systemor network security as set out in our Acceptable Use Policy.

Regulatory

Any party who feels that its data protection issue has not been
dealt with appropriately under the Registrar’s procedures canconsult the Registry Operator's Acceptable Use Policy and may
submit a data protection complaint directly to the Registry
Operator at abuse@grs.domais or contact thePage 2 of 3

Gibraltar Regulatory Authority.
Further data protection issues can be raised with:The Gibraltar Regulatory Authority
Suite 603, Europort
Gibraltar GX11 1AA
Tel:(+350) 20074636
Fax:(+350) 20072166
Email:
http://www.gra.gi/index.php?site=dataprotection&topic=contact%20us

Page 3 of 3