About SIDN's Privacy Policy for .nl Domain Names

Version 22 May 2018

We maintain a register of .nl domain names. That involves processing data about applicants and registrants. The data we process includes information about private individuals, companies and institutions. We also process data about, for example, the people who act as administrative and technical contacts for .nl domain names. A lot of our data processing activities come under the General Data Protection Regulation. We are responsible for processing the data referred to above in the domain name register.

We have written the Privacy Policy for .nl Domain Names for everyone whose personal data we process.

This document has been written to explain various aspects of the Privacy Policy for .nl Domain Names.

What data do we record in the register?

Our register contains data about .nl domain name registrations.

  • The way we run the register is in line with international agreements about the internet.

What do we use the data for?

  • To deal with applications to register domain names.

  • To respond to requests and complaints from registrants and data subjects.

  • To pass on to registrars, so that they can do their work.

  • To maintain the zone file.

  • To respond to information requests from investigatory and enforcement authorities and certification authorities (CAs).

  • To maintain the Whois (the part of the register that anyone can look at).

What can the data in the Whois be used for?

  • To sort out technical problems that affect how the internet works.

  • To apply for .nl domain names and to find out who the registrants of existing names are.

  • To protect intellectual property rights.

  • To stop illegal and harmful content being put on the internet, or to get it taken down.

Who do we have data about?

  • Registrants

  • The people who act as contacts for domain names

  • Registrars and their contacts

  • Resellers

What data do we include in the register?

This is the most data that we process about the people mentioned just above:

  • Details of domain name applications and applicants

  • Relationship management information

  • Security information

  • Public data

Where do we get the data from?

  • The registrant

  • The registrar who forwards the domain name application or looks after the registration

What data do we make public?

If the registrant is an ordinary person (not a business), this information is available to everyone from the Whois:

  • Domain name

  • Registration date

  • Status of the domain (Active, Requested, Free, etc)

  • E-mail address of the administrative contact

  • E-mail address of the technical contact (there can be more than one technical contact)

  • Details of the primary and secondary name servers (names and IP addresses)

If the registrant is a business, this information is available to everyone from the Whois:

  • Domain name

  • Registration date

  • Registrant's name

  • If the registrant chooses: the registrant's address

  • Status of the domain (Active, Requested, Free, etc)

  • E-mail address of the administrative contact

  • E-mail address of the technical contact (there can be more than one technical contact)

  • Details of the primary and secondary name servers (names and IP addresses)

Who has access to our data?

People who work at SIDN and have been given written permission to process data.

  • They are allowed to process data only for our registry work, to respond to enquiries and complaints, or for technical purposes.

Anyone can use the Whois to look at our public data.

  • So everyone has direct access to that data.

We make non-public data available to anyone who has a legitimate interest in it ('interested

parties').

  • If we do that, we always tell the registrant.

How long do we keep data?

We keep the data we've collected as long as the domain name it relates to is active.

  • After that, we keep it for as long as we need it for our work.

If you've got a data request, who do you ask?

If you want us to tell you what data we've got about you, or if you want the data corrected,

added to or deleted, you need to make a request through your registrar.

  • Your registrar will pass the request on to us.

  • You have a legal right to make requests like that under the General Data Protection Regulation.

You can make other requests, besides the ones mentioned in the General Data Protection Regulation.

  • They have to be made through your registrar as well. One of the things you can request is to have your personal details left out of the public register, and your registrar's details put in instead. (We call that an 'opt-out request'.)

If you are a registrar yourself, you can send your request straight to us.