Source: https://www.domeinuak.eus/en/privacy-policy/
Timestamp: 2019-04-21 16:11:29+00:00

Document:
Your personal data may be collected via the following methods: through the Domain Name registration processes via our network of accredited registrars, via e-mail, via telephone, via fax, by attendance at an event, by using cookies or other technologies to track visitors on our websites, through communication from suppliers or partners, or by completing a form on our websites, or via any other means.
(iii) that we collect from your attendance at our events or visits to our website(s).
In the context of our business activities and in order to provide you with good service and to improve our services where possible, we may process the following personal data about you: your name, your email, the organization you work for, your job title, your personal address, your language preference, your gender, your age, your unique identification alias in our system, your Domain Name, financial data including data related to your bank account or credit card information, judicial data in relation to Domain Names, your IP address, pictures and video footage.
Since it is not possible to register a domain name directly with us, we collect your personal data from the company through which you registered your Domain Name. That company may be one of our accredited registrars or one of its resellers who collects your personal data on our behalf.
We may use your personal data to send you promotional messages, marketing, information about the .eus community, and other information that may be of interest to you.
be processed in a manner that ensure appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical organizational measures (“integrity and confidentiality”).
Who has access to you Personal Data?
Only our qualified staff has unrestricted access to this data. No third parties – other than registrars in circumstances justifiable by needs of the performance of the registration of the domain name – may have direct access to the data that we keep.
The processing may be based on the consent you have provided in connection for activities of the PuntuEUS Fundazioa.
Escrow, back-end, and storage providers: In order to guarantee the activities of the Registry Operator that enable the registration of your domain name, we need to store and back-up all registration data, including your personal data.
ICANN: The Internet Corporation for Assigned Names and Numbers may be provided with your data in connection with your .eus domain name registration, as required in our Registry Agreement with ICANN.
The exercise of some of these rights in connection with the registration of domain names may have to be conducted through the registrar of record of the domain name in question.
Your personal data is stored both electronically and manually, in-house and by third parties. We store your personal data in a form that permits identification for no longer than is necessary for the purposes for which your personal data is processed. This retention period differs based on the type of personal data processed, the purpose of processing and other factors.
As a holder of a Domain Name, we keep your personal data for one (1) years after the domain name is deleted.
The personal data of individuals that we collect outside the scope of a contract in the context of our business activities is kept until one (1) year after it becomes irrelevant.
This Section informs You about our processing of Your Registation Data in accordance with ICANN mandated policies, European Union’s General Data Protection Regulation (GDPR) and other applicable data protection legislation.
ICANN, We as Registry Operator and Your Registrar, and eventually Your reseller, are joint controllers (or Data Processors were specified) for Your data processing that is required to carry out Your Domain Name registration, as described in this Section. The main for such processing includes, among others, domain name transfers and trades, making Your domain name resolve and making available information via the Whois service.
The role of ICANN, a California based US non-for-profit corporation, is establishing the policies on aspects including the collection and publication of data as well as to ensure that the system is secure, stable and resilient.
ICANN contractually requires Us and Your Registrar to process personal data and enforce these contractual obligations, which – in part – are policies established by ICANN’s multistakeholder community. ICANN also requires the contracted parties to submit reports regularly.
It is the Registrar’s, and/or the resellers’, role to offer domain name registrations and potentially other services to the Registrants. According to ICANN’s requirements, the Degistration Data is collected by the Registrar and then transferred to the Registry.
The Registry’s role is to maintain a central repository of all domain name registrations and to make domain names resolve via the Domain Name System (DNS). The Registry does not offer domain name registrations directly to registrants.
As a community based TLD we have specific Registration Data requirements. The Registration Data is the full set of data referred to in this Section, including the data of all contacts and the intended use.
The same data elements as for the Registrant apply to the Admin contact and Tech contact. The same data elements apply also for the Billing contact, being this one optional.
Intended use: additionally, You must provide the intended use for your domain name.
The legal basis for the collection of personal information on these contacts is Art. 6.1.b) GDPR. For the Registrant and the intended use it is to perform the domain name registration in accordance with specific eligibility requirements and for post-registration validation for the contract performance purpose; for the Administrative Contact it is to be able to perform domain name management operations such as transfers, compliance and other; and for the Technical Contact it is contactability in case of technical issues.
When data of third parties is collected, e.g. where the Registrant, Admin Contact or Tech Contact is different from the person(s) the Registrar collects the data from, the Registrar is responsible for informing those third parties about the terms of this Registration policy, including all privacy related provisions.
ICANN, Registry and Registrar and, eventually, the Registrar’s reseller are Data Controllers.
We also require the Registrar to transfer the data mentioned above to us. The legal basis for that is Art. 6.1.f) GDPR since we have a legitimate interest in identifying and investigating patterns of illegal behavior, help with ownership disputes and to operate a central repository of owner data.
For this processing activity, ICANN and the Registry are the Data Controllers and the Registrar is the Data Processor.
We are using a third party Back-end Registry Service Provider (CORE Association) based in Switzerland, that is a Data Processor of Your Registration Data.
We, as Data Processors, will also pass on the data to an escrow agent as required by ICANN (Data Controller) and the data might be transferred to an Emergency Backend Operator (EBERO) appointed by ICANN in case of Registry failure.
We will not publish personal data on the whois or otherwise disclose your Registration Data to third party apart from the domain name as such except in the cases referred in the following paragraph.
Disclosure of personal data will only occur if there is an established legal basis for such disclosure based on a case-by-case assessment. The legal basis for such disclosure might be Art. 6.1.b) (in case of URDP and URS), Art. 6.1.c) (in case of requests by competent authorities) or Art. 6.1.f) (based on a legitimate third party interest).
In the absence of an accreditation model adopted by ICANN, all disclosure requests will be assessed individually.
En ausencia de un modelo de acreditación adoptado por la ICANN, todas las solicitudes de divulgación se evaluarán individualmente.
Registration data is deleted without undue delay if and to the extent that the purpose of data collection has been reached or ceases to exist. The data processed by us will be deleted at the latest after expiry of statutory retention periods. We adhere to the requirements of Articles 17 and 18 GDPR.
Please note that there might be retention periods required by ICANN. The registration data might need to be stored for a period of one (1) year after the end of the domain name registration by the parties involved.
Right to rectification. Art. 16 GDPR. Modifications shall be requested to your Registrar of record or Your reseller as the Registry can not perform such modification on its own.
Right to erasure (‘right to be forgotten’). Art. 17 GDPR Be aware that the request to erase your Data may cause the deletion of your Domain Name.
Right to object. Art. 21 GDPR.
You have the right to lodge a complaint with a supervisory authority about the processing of personal data by the controller.
You shall immediately correct and update any incorrect or inaccurate Registration Data during the term of the domain name registration.
We will only process Your Registration Data according to applicable data protection legislation and will take all technical and organizational measures to protect Your Registration Data from loss, misuse, unauthorized access or disclosure, alteration or destruction, as well as undertaking any other security measure required by applicable Law.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 16
 Art. 17
 Art. 21