1. Who is responsible for your data
The controller of your personal data for namebest.com and your NameBest account is the administrator of the namebest.com service.
For any question about this policy or your data, write to [email protected] with the subject "Privacy". The same address handles requests from data subjects in the European Economic Area, the United Kingdom, the United States and elsewhere.
Domains are registered through an ICANN accredited registrar that sponsors each registration, and are recorded by the registry of each extension. The sponsoring registrar and the registry are independent controllers of the registration data they process under ICANN and registry rules. This policy works together with our Terms of Service and our registration agreement.
2. Data we collect
- Account data: your email address, your password (stored only as a secure hash), the 6 digit verification codes we send at sign up, your account settings, and login records with IP address and time for security.
- Registrant data: the name, organization, postal address, phone number and email address you enter at checkout for each domain, and any changes you make later. ICANN and the registries require this data to register a domain, so it is necessarily passed to the sponsoring registrar and the registry.
- Domain data: the domains in your account, their DNS records, nameservers, forwarding rules, lock and auto renew settings, and the history of renewals and transfers.
- Payment data: card payments are handled by our payment processor. We do not see or store your full card number. We receive a confirmation, the card brand, the last four digits, the expiry month and year, the billing country and the amounts, which we need for receipts, renewals and tax records.
- Search data: the names you search for, logged together with a hashed IP address and the time. We keep these logs for 90 days to prevent abuse of the search, to measure availability checks and to fix errors. The hash does not let us read your IP address back.
- Support data: the content of your emails to [email protected] and our replies.
- Technical data: server logs with IP address, browser type, requested page and time, kept for security and to keep the service running.
We do not collect special categories of data and we do not knowingly collect data from children under 16.
4. Why we use your data and on what legal basis
| Purpose | Data used | Legal basis under GDPR |
|---|---|---|
| Creating and running your account | Account data | Performance of a contract |
| Registering, renewing and transferring domains | Registrant and domain data | Performance of a contract and legal obligation under ICANN and registry rules |
| Email verification of the registrant | Registrant email | Legal obligation and performance of a contract |
| Taking payments and auto renewals | Payment data | Performance of a contract |
| Invoices, receipts and tax records | Account and payment data | Legal obligation |
| Renewal reminders and service emails | Account email, domain data | Performance of a contract |
| Preventing fraud, abuse and attacks | Technical, search and account data | Legitimate interest in a secure service |
| Handling abuse reports and disputes | Domain and registrant data | Legal obligation and legitimate interest |
| Answering your messages | Support data | Performance of a contract or legitimate interest |
| Responding to lawful requests from authorities | Relevant data | Legal obligation |
We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not send marketing email.
5. Who receives your data
We share personal data only with these categories of recipients, and only as far as each needs it:
- the sponsoring registrar, an ICANN accredited registrar through which your domains are registered;
- the registries that operate the extensions you register;
- the data escrow agent that ICANN requires registrars to use, which keeps a protected copy of registration data so that registrants are protected if a registrar fails;
- our payment processor, which handles card payments and fraud checks;
- our email delivery provider, which sends verification codes, reminders and receipts;
- our hosting provider, which runs our servers in the European Union or the United States;
- professional advisers, such as accountants and lawyers, under a duty of confidentiality;
- public authorities, courts and dispute resolution providers, when the law, a court order or a UDRP or URS proceeding requires it.
We do not sell your personal data and we do not share it for cross context behavioral advertising.
6. WHOIS, RDAP and the public record
Every domain has a public registration record in WHOIS and RDAP. Under current ICANN rules most personal data of individual registrants is redacted from the public record, but some data, such as the organization name and the state or country, may be shown depending on the registry. WHOIS privacy is included with every domain where the registry allows it: the public record then shows the privacy service details instead of yours, and messages to the published address are forwarded to you. Some extensions, such as .us, do not allow privacy and publish the registrant data. Read more on our WHOIS privacy page and in WHOIS privacy explained.
Parties with a legitimate interest, such as law enforcement or a trademark owner in a dispute, can ask the sponsoring registrar or the registry for access to non public data. Such requests are assessed case by case under ICANN rules and the law.
7. International transfers
Registries and the sponsoring registrar may be located outside your country, including in the United States and other countries outside the European Economic Area. Registering a domain in an extension means that the registrant data must be sent to the registry of that extension, wherever it is located. Where we transfer personal data from the European Economic Area or the United Kingdom to a country without an adequacy decision, we use the Standard Contractual Clauses approved by the European Commission or another lawful transfer mechanism, together with additional safeguards where needed.
8. How long we keep your data
- Account data: while your account is open, and up to 3 years after it is closed for security and legal claims.
- Registrant and domain data: for the life of each registration and then for the period ICANN requires registrars to keep it, which is normally 2 years after the registration ends.
- Payment and tax records: for the period required by tax and accounting law, normally 5 years from the end of the year of the payment.
- Search logs with hashed IP: 90 days.
- Server and security logs: up to 90 days, longer if needed to investigate a specific incident.
- Support emails: up to 3 years after the last message.
9. Your rights
Depending on where you live, you have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, to data portability, and to withdraw any consent you have given. Residents of US states with privacy laws, such as California, Colorado, Connecticut, Virginia and others, have the right to know what personal data we collect and how we use it, to access it, to correct it, to delete it, and to opt out of its sale or use for targeted advertising. We do not sell or share data for advertising, so there is nothing to opt out of, and we do not discriminate against anyone who uses these rights.
Most data can be viewed and corrected directly in the dashboard, see updating registrant contact details. For other requests, write to [email protected]. We answer within one month, or within 45 days where US state law applies, and we may need to verify your identity first. An authorized agent can make a request for you with your written permission.
Some data cannot be deleted while a domain is registered, because the registry and ICANN require it. If you want all your data deleted, transfer your domains out or let them expire first, then ask us to close the account.
If you are in the European Economic Area or the United Kingdom, you can also lodge a complaint with a data protection supervisory authority, in particular in your country of residence or place of work.
10. Security
We protect your data with encrypted connections, hashed passwords, access controls, verification codes at sign up, and the transfer lock on every domain. Only staff who need access to do their job can see account data. If a breach affects your data and creates a risk for you, we inform you and the competent authority as the law requires. Our guide to domain account security explains what you can do to protect your account.
11. Changes to this policy
We may update this policy when our services or the law change. The current version is always on this page with its effective date. If we make a material change, we email account holders before it applies.
12. Contact
Write to [email protected] with the subject "Privacy" for any question or request about your personal data, or use our contact page.