Privacy Policy

NOTED
FIRST SEEN 2026-08-27 · VERSION 20260827_rev01 · COMPARED WITH 20251009_rev01

What changed, in plain language

This update is a re-translation of DonDominio's Spanish privacy policy into English, plus a new table of contents. The wording changed throughout, but the actual rules — what data is collected, how long it's kept, who it goes to, and your rights — stayed the same. One small formatting fix moved a bullet about restoring data after an incident into its proper place in the security list.

This change appears to be cosmetic (formatting, typos, or contact details).

Changelog

  1. + ADDEDTable of contents added

    A clickable list of the policy's sections was added at the top so you can jump to the part you need.

    Índice de contenido

  2. ± CHANGEDWhole document re-translated from Spanish

    Nearly every paragraph was reworded — for example 'Legitimacy of data processing' is now 'Legal basis for processing', and 'Truthfulness and legality of the data' is now 'Accuracy and Lawfulness of Data'. The meaning of the rules did not change. The Spanish version still controls if there's ever a dispute.

    ### LEGITIMACY OF DATA PROCESSING.

    ### LEGAL BASIS FOR PROCESSING.

  3. ± CHANGEDSecurity measures list reformatted

    A line about restoring your data after a physical or technical incident used to be jammed onto the end of the first bullet. It is now its own bullet in the list. The commitment itself is unchanged, though the words 'promptly' and 'ongoing' were dropped in favor of 'in the event of' and 'continued'.

    ensure the confidentiality, **integrity**, availability, and ongoing resilience of systems and data processed; - restore data and access promptly following any physical or technical incident;

    - restore data and access in the event of a physical or technical incident;

  4. ± CHANGEDNote added explaining what ICANN's Data Escrow service does

    The list of who receives your domain registration data now explains that ICANN's Data Escrow service holds registration data in safekeeping. The recipient itself is not new — only the explanation is.

    **ICANN** and its **Data Escrow** service;

    - **ICANN** and its **Data Escrow** service (registration data custody);

Full text changes — 20251009_rev01 to 20260827_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

11**Rev: 5-20250818**
22
3Índice de contenido
4
5- [DATA CONTROLLER]()
6- [PURPOSES OF DATA PROCESSING]()
7- [DATA RETENTION (DURATION OF DATA PROCESSING)]()
8- [LEGAL BASIS FOR PROCESSING.]()
9- [RECIPIENTS OF COMMUNICATIONS AND DATA TRANSFERS]()
10- [RIGHTS OF DATA SUBJECTS.]()
11- [ADDITIONAL INFORMATION]()
12- [ANNEX I - gTLD DOMAIN REGISTRATION DATA]()
13- [ANNEX II - NON-PUBLIC DATA DISCLOSURE PROCEDURE]()
14
315**IMPORTANT NOTICE:** The translated versions of the contracts and legal policies are provided solely as a convenience to facilitate reading and understanding of the Spanish versions. The objective of providing translations of contracts and legal policies is not to create a legally binding contract, and not be a substitute for the legal validity of the Spanish versions. In the event of any dispute or conflict, the Spanish versions of the contracts and legal policies will under all circumstance govern our relationship and prevail over the terms in any other language.
416
5**In compliance** with the **Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights** (LOPDGDD), the **Regulation (EU) 2016/679** of the European Parliament and of the Council, of April 27, 2016 (hereinafter, **GDPR**), and the **ICANN Registration Data Policy** (published on 21-02-2024, effective as of 21-08-2025), this **Privacy Policy** regulates the processing of personal data that **SOLUCIONES CORPORATIVAS IP, S.L.** - hereinafter, **SCIP or DonDominio** - conducts, as a **Controller** and/or **Data Processor**, regarding the information that users and/or clients (individuals) provide:
17**In compliance** with the **Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights** (LOPDGDD), the **Regulation (EU) 2016/679** of the European Parliament and of the Council, of April 27, 2016 (hereinafter, **GDPR**), and the **Registration Data Policy** of **ICANN** (published on 21-02-2024, effective from 21-08-2025), this **Privacy Policy** regulates the processing of personal data that **SOLUCIONES CORPORATIVAS IP, S.L.** -hereinafter, **SCIP or DonDominio-** carries out, as **Controller** and/or **Processor**, in relation to the information that users and/or clients (natural persons) provide:
618
7- as a consequence of the **contracting and management of services** marketed by SCIP (hereinafter, the "Services"; and
8- specifically in the **registration, transfer, and maintenance** of gTLD domain names, in accordance with the provisions of the aforementioned Registration Data Policy and the ICANN Registrar Accreditation Agreement.
19- as a consequence of the **procurement and management of the services** marketed by SCIP (hereinafter, the "Services"; and
20- specifically, in the **registration, transfer, and maintenance** of gTLD domain names, as provided in the aforementioned Registration Data Policy and the ICANN Registrar Accreditation Agreement.
921
10If you do not accept the terms of this Policy, please refrain from accessing and/or using the Services. This Policy does not apply to products, services, or activities provided by third parties unrelated to DonDominio.
22If You do not accept the terms of this Policy, please refrain from accessing and/or using the Services. This Policy does not apply to products, services or activities provided by third parties unrelated to DonDominio.
1123
12**Truthfulness and legality of the data.** Unless acting through valid legal representation, no user and/or client may use the identity of another person or communicate third-party data. Data provided to SCIP must be personal, truthful, accurate, current, adequate, and relevant to the purpose for which they are collected. The user and/or client will be solely responsible for any damage, direct or indirect, caused to third parties or SCIP by providing false, inaccurate, outdated, inadequate, or irrelevant data. Anyone providing third-party data declares to have previously obtained the corresponding consent or legal authorization and assumes any resulting liability otherwise.
24**Accuracy and Lawfulness of Data.** Unless acting under a valid legal representation, no user and/or client may use someone else's identity or communicate third-party data. The data provided to SCIP must be personal, truthful, accurate, current, adequate, and relevant to the purpose for which they are collected. The user and/or client will be solely responsible for any direct or indirect damage caused to third parties or to SCIP from providing false, inaccurate, outdated, inadequate, or irrelevant data. Anyone providing data on a third party states that they have obtained prior consent or legal authorization and assume any liability in case of the contrary.
1325
14**Capacity and minors.** The user and/or client communicating data to SCIP declares to be of legal age and to have full capacity to act in accordance with Spanish legislation. Any data related to minors will require prior authorization from parents, guardians, or legal representatives, who will be considered responsible for the truthfulness and legality of the data provided by the minors in their charge.
26**Capacity and Minors.** The user and/or client who communicates data to SCIP declares to be of legal age and to have full capacity to act according to Spanish law. Any data relating to minors will require the prior authorization of their parents, guardians, or legal representatives, who will be considered responsible for the accuracy and lawfulness of the data provided by the minors under their charge.
1527
1628### DATA CONTROLLER
1729
18- **Company Name:** SOLUCIONES CORPORATIVAS IP, S.L.,(SCIP or DonDominio)
19- **Trademark: DONDOMINIO**
20- **Address:** C/ Menestrals, 14, C.P. 07500 Manacor (Illes Balears), Spain
21- **NIF:** B57333601
22- **Email:** [info@scip.es](mailto:info@scip.es)
23- **Registration details:** Registered in the Mercantile Registry of Baleares Volume 2120, Book 0, Page 173, Sheet PM-50105
24- **Data Protection Officer (DPO):** SCIP has an **external Data Protection Officer**, appointed in accordance with Arts. 37 and 38 GDPR, whose contact address is: [dpo@scip.es](mailto:dpo@scip.es)
30- **Corporate Name:** SOLUCIONES CORPORATIVAS IP, S.L.,(SCIP or DonDominio)
31- **Trade Name: DONDOMINIO**
32- **Address:** C/ Menestrals, 14, C.P. 07500 de Manacor (Illes Balears), Spain
33- **NIF**: B57333601
34- **Email**: [info@scip.es](mailto:info@scip.es)
35- **Registration data:** Registered in the Mercantile Register of Baleares Volume 2120, Book 0, Folio 173, Sheet PM-50105
36- **Data Protection Officer (DPO)** SCIP has an **external Data Protection Officer**, appointed in accordance with Art. 37 and 38 GDPR, whose contact address is: [dpo@scip.es](mailto:dpo@scip.es)
2537
2638### PURPOSES OF DATA PROCESSING
2739
28The personal data you provide us -identification (name, surname, DNI/NIE), contact data (postal address, phone numbers, email), and, where applicable, the data fields required by ICANN's Registration Data Policy (see Annex I)- will be processed for the management and control of the legal relationship binding you to SOLUCIONES CORPORATIVAS IP, S.L. (DonDominio or SCIP), and specifically for the purposes detailed below:
40The personal data you provide us -identifying data (name, surname, DNI/NIE), contact data (postal address, telephones, email) and, where applicable, the registration data fields required by ICANN's Registration Data Policy (see Annex I)- will be processed for the management and control of the legal relationship binding you to SOLUCIONES CORPORATIVAS IP, S.L. (DonDominio or SCIP), and specifically for the purposes detailed below:
2941
30**1\. Provision and maintenance of Services:** Manage the registration, access, technical configuration, billing, renewal, transfer, and proper use of the contracted Services, according to their nature and conditions.
42**1\. Provision and maintenance of the Services:** Manage the registration, access, technical configuration, billing, renewal, transfer, and proper use of the Services contracted, according to their nature and conditions.
3143
32**2\. User/client support:** Communicate with You and respond to incidents, requests, comments, or inquiries you make through our channels (web forms, chat, phone, or email).
44**2\. User/Customer Support:** Communicate with you and respond to incidents, requests, comments, or queries you raise through our channels (web forms, chat, phone, or email).
3345
34**3\. Platform operation and security:** Provide, update, maintain, and protect our websites, infrastructures, and internal processes, ensuring their secure operation and the integrity of the registered domain names.
46**3\. Operation and security of the platform:** Provide, update, maintain, and protect our websites, infrastructures, and internal processes, ensuring their secure operation and the integrity of the registered domain names.
3547
36**4\. Registration of gTLD domain names:** Process the registration, renewal, transfer, suspension, or cancellation of domain names, in accordance with the ICANN Accreditation Agreement and the _Registration Data Policy. **Note:** Data declared as "redacted" in the RDDS/WHOIS will remain non-public unless a disclosure request is processed in accordance with the procedure in Annex II._
48**4\. Registration of gTLD domain names:** Process the registration, renewal, transfer, suspension, or cancellation of domain names, according to the ICANN Accreditation Agreement and the _Registration Data Policy. **Note:** Data declared as "redacted" in the RDDS/WHOIS will remain non-public unless a disclosure request is processed in accordance with the procedure in Annex II._
3749
38**5\. Offers and service improvements:** Send you proposals for new products, functional updates, or offers related to already contracted Services, via electronic or non-electronic means. These communications are based on SCIP's legitimate interest in retaining and improving its clients' experience; You may object at any time.
50**5\. Service offers and improvements:** Send you -by electronic or non-electronic means- proposals for new products, functional updates, or offers linked to Services already contracted. Such communications are based on SCIP's legitimate interest in retaining and improving the experience of its customers; you can object at any time.
3951
40**6\. Essential operational communications:** Send notices regarding expirations, technical incidents, scheduled maintenance, or essential contract changes. These communications are inseparable from the service and cannot be declined.
52**6\. Mandatory operational communications:** Send notices related to expirations, technical incidents, scheduled maintenance, or essential contractual changes. These communications are inseparable from the service and cannot be waived.
4153
42**7\. Marketing and surveys (with prior consent):** With your express authorization, conduct satisfaction surveys or send you commercial information about related proprietary or third-party services. Consent can be revoked at any time via the mechanism indicated in each communication.
54**7\. Marketing and surveys (prior consent):** With your express authorization, conduct satisfaction surveys or send you commercial information about own or third-party related services. Consent can be withdrawn at any time through the mechanism indicated in each communication.
4355
44**8\. Personnel or collaborator selection processes:** Manage your application when you participate in job or collaboration offers published by SCIP.
56**8\. Staff or collaborator selection processes:** Manage your application when participating in job offers or collaborations published by SCIP.
4557
46**9\. Processing on behalf of the client:** When to perform a service, SCIP must access personal data for which the client is the Controller or Processor, such data will be processed strictly as a Data Processor, in accordance with Article 28 GDPR and the corresponding data processing agreement.
58**9\. Processing on behalf of the client:** When, to execute a service, SCIP must access personal data for which the client is Controller or Processor, such data will be processed strictly as Data Processor, in accordance with Article 28 GDPR and the corresponding data processing agreement.
4759
48SCIP **will not process your data for purposes other than those described here**, except for legal obligation or judicial requirement.
60SCIP **will not process your data for purposes other than** those described herein, except for legal obligations or judicial requirements.
4961
50Completion of forms marked with an asterisk (\*) is **mandatory** to process your request or provide the service. The failure to supply the required data-or the subsequent revocation of consent in cases where it is the legitimizing basis-may prevent the proper provision of the service or the handling of your request.
62Completing the forms marked with an asterisk (\*) is **mandatory** to be able to attend to your request or provide the service. Failure to supply the required data -or subsequent withdrawal of consent in cases where it serves as the legal basis- may prevent the correct provision of the service or the attention of your request.
5163
52By providing your data, you **guarantee** its truthfulness, accuracy, and validity, and **consent** expressly to its processing in accordance with the purposes described above.
64By providing your data, you **guarantee** its truthfulness, accuracy, and timeliness and **expressly consent** to its processing in accordance with the purposes indicated above.
5365
5466### DATA RETENTION (DURATION OF DATA PROCESSING)
5567
56| **Data Category** | **Retention Period and Legal Basis** |
68| **Category of data** | **Conservation period and legal basis** |
5769| --- | --- |
58| **gTLD Domain Registration Data** (fields defined in the _Registration Data Policy_ and disclosure request logs} | **15 months** after deregistration, transfer, or expiration of the domain, in accordance with Recommendation 15 of the RDP (ICANN) [gnso.icann.org](https://gnso.icann.org/) |
59| **Data derived from the contractual relationship and billing** | During the contract's validity and, after its termination, **6 years** for commercial obligations (art. 30 CCom) and **4 years** for tax obligations (arts. 66-70 LGT) |
60| **Traffic and Connection Metadata** (hosting/email service) | **12 months** according to the Data Retention Law 25/2007 on electronic communications [boe.es](https://boe.es/) |
61| **Queries and one-off requests** | Until the request is resolved, and in any case, **max. 1 year** |
62| **Résumés and selection process data** | **1 year** from the end of the process, unless the candidate authorizes retention for a longer period |
63| **Data for commercial communications** | While maintaining a contractual relationship with DonDominio or until consent/objection is withdrawn |
64| **Contact data of those interested in information** | Until suppression or opposition is withdrawn |
70| **Domains gTLD registration data** (fields defined in the _Registration Data Policy_ and disclosure request logs) | **15 months** after domain deregistration, transfer or expiration, in accordance with Recommendation 15 of the [RDP ICANN](https://gnso.icann.org/) |
71| **Contractual relationship and billing data** | During the contract validity and, after its termination, **6 years** for commercial obligations (art. 30 CCom) and **4 years** for tax obligations (arts. 66-70 LGT) |
72| **Traffic and connection metadata** (hosting/email service) | **12 months** according to the Law 25/2007, on data retention of electronic communications ([boe.es](https://boe.es/)) |
73| **Inquiries and specific requests** | Until the request is resolved and, in any case, **max. 1 year** |
74| **Curricula and selection process data** | **1 year** from the end of the process, unless the candidate authorizes keeping it for longer |
75| **Data for commercial communications** | While maintaining a contractual relationship with DonDominio or until revoking your consent/objection |
76| **Contact data of those interested in information** | Until you revoke its deletion or objection |
6577
66Upon the expiration of the indicated periods, data will be **blocked** and kept solely to address potential administrative, civil, or criminal responsibilities until they are finally securely deleted. DonDominio will not retain data for periods longer than necessary for each purpose, except for legal obligation or judicial mandate.
78After the indicated periods, the data will be **blocked** and retained solely to address potential administrative, civil, or criminal liabilities, finally being securely deleted. DonDominio will not retain the data for longer than strictly necessary for each purpose unless legally obligated or required by court order.
6779
68### LEGITIMACY OF DATA PROCESSING.
80### LEGAL BASIS FOR PROCESSING.
6981
70The processing of your personal data is based, depending on the nature of each operation, on the legal bases provided for in Article 6 of the GDPR:
82The processing of your personal data is based, depending on the nature of each operation, on the legal bases provided in Article 6 of the GDPR:
7183
72**a) Execution of a contract (art. 6.1 b) GDPR).** It is essential for managing the registration, provision, billing, renewal, transfer, or cancellation of contracted Services, as well as for formalizing and maintaining gTLD domain name registrations in accordance with the ICANN Accreditation Agreement and the _Registration Data Policy_.
84**a) Execution of a contract (Art. 6.1 b) GDPR).** It is essential to manage registration, provision, billing, renewal, transfer, or cancellation of the contracted Services, as well as formalizing and maintaining the gTLD domain names registration according to the ICANN Accreditation Agreement and the _Registration Data Policy_.
7385
74**b) Compliance with legal obligations (art. 6.1 c) GDPR).** Certain processing is carried out because the law requires it: tax and accounting obligations, traffic data retention (_Registration Data Policy_, 25/2007 Law), obligations imposed by the _Registration Data Policy_ or requests from administrative and judicial authorities.
86**b) Compliance with legal obligations (Art. 6.1 c) GDPR).** Certain processing is carried out because the regulation requires it: fiscal and accounting obligations, data retention (Law 25/2007), duties imposed by the _Registration Data Policy_ or by requests from administrative and judicial authorities.
7587
76**c) Legitimate interest of DonDominio (art. 6.1 f) GDPR).** We use your data to ensure the security and stability of our platform and the Domain Name System, personalize our services, address claims or inquiries, conduct satisfaction surveys, and offer you products or services similar to those you already enjoy. This legitimate interest is balanced against your rights and expectations, always providing a simple mechanism to object.
88**c) Legitimate interest of DonDominio (Art. 6.1 f) GDPR).** We use your data to ensure our platform and the Domain Name System's security and stability, improve and customize our services, handle claims or inquiries, conduct satisfaction surveys, and offer similar products or services to those you already enjoy. This legitimate interest is weighed against your rights and expectations, always offering a simple mechanism to object.
7789
78**d) Consent of the interested party (art. 6.1 a) GDPR).** When required by the law, we will request your prior authorization, for example, for sending commercial communications or including your application in future selection processes. You can withdraw this consent at any time without retroactive effects on the treatments already conducted.
90**d) Consent of the data subject (Art. 6.1 a) GDPR).** When the regulation demands it, we request your prior authorization -for example, for sending commercial communications or including your application in future selection processes-. You can withdraw that consent at any time without retroactive effects on already conducted processing.
7991
80### RECIPIENTS OF COMMUNICATIONS AND DATA TRANSFERS.
92### RECIPIENTS OF COMMUNICATIONS AND DATA TRANSFERS
8193
82**General Character.** DonDominio **will not disclose or communicate** your personal data to third parties, except (i) where there is a **legal obligation**, (ii) where it is **necessary** for the correct provision of the contracted service, or (iii) where it has your **express consent**.
94**General Character.** DonDominio **will neither transfer nor communicate** your personal data to third parties, except (i) there is a **legal obligation,** (ii) it is **necessary** for the correct provision of the contracted service, or (iii) with your **express consent**.
8395
84**Domain name registration services.** To process the registration, renewal, or transfer of a gTLD domain (or a ccTLD, as appropriate), it is necessary to communicate certain data to the **competent registering entity** -the corresponding **Registry Operator**- and, where required by ICANN regulation, to: - **ICANN** and its **Data Escrow** service;
96**Domain Name Registration Services**. To process the registration, renewal, or transfer of a gTLD domain (or a ccTLD, as applicable), it is indispensable to communicate certain data to the **competent registry entity** -the corresponding **Registry Operator**- and, when required by ICANN regulation, to:
8597
98- **ICANN** and its **Data Escrow** service (registration data custody);
99
86100- the **national or international authority** managing the territorial extension (ccTLD);
87101
88- technical providers acting as **Data Processors** (e.g., payment gateways or communication dispatch platforms).
102- technical providers acting as **Data Processors** (e.g., payment gateways or messaging platforms).
89103
90In these cases, DonDominio transmits **only the essential data fields**, defined in ICANN's _Registration Data Policy_, solely for the purpose of formalizing and maintaining the registration.
104In these cases, DonDominio transmits **solely the indispensable data fields**, defined in ICANN's _Registration Data Policy_, exclusively aimed at formalizing and maintaining the registration.
91105
92The complete list of domain extension managing entities can be consulted in the **IANA** public directory: [https://www.iana.org/domains/root/db](https://www.iana.org/domains/root/db). The Internet Assigned Numbers Authority oversees, among others, root DNS servers and global IP address allocation.
106The complete list of domain extension management entities can be consulted in the public directory of the **IANA**: [https://www.iana.org/domains/root/db](https://www.iana.org/domains/root/db). The Internet Assigned Numbers Authority oversees, among others, the DNS root servers and global IP address allocation.
93107
94**International transfers.** Some Registry Operators or providers may be located **outside the European Economic Area**. When it is necessary to transfer data to a country without a European Commission adequacy decision, DonDominio will apply the **Standard Contractual Clauses 2021/914/EU** and, where necessary, additional technical measures (encryption, pseudonymization) to ensure an equivalent level of protection to that in Europe.
108**International Transfers.** Some Registry Operators or providers may be located **outside the European Economic Area**. When it is necessary to transfer data to a country without an adequacy decision from the European Commission, DonDominio applies the **Standard Contractual Clauses 2021/914/UE** and, if applicable, additional technical measures (encryption, pseudonymization) to ensure a level of protection equivalent to that in Europe.
95109
96**Credit information systems.** In the event of **non-payment or late payment** of due amounts, DonDominio may communicate the necessary data to the **ICIRED** asset solvency file or another credit information system that complies with the GDPR and LOPDGDD, solely for managing recovery and evaluating credit risk by third parties with legitimate interest.
110**Credit Information Systems.** In case of **non-payment or delinquency** of due amounts, DonDominio may communicate the necessary data to the **ICIRED** asset solvency file or another credit information system that complies with the RGPD and LOPDGDD, solely for managing collection and third-party credit risk assessment with legitimate interest.
97111
98**Effect of consent.** By accepting the Service Conditions, you **expressly authorize** the indicated transfers and disclosures as inherent to the service. If you revoke this consent, DonDominio will not be able to continue providing you with the Services requiring such communications.
112**Consent Effect.** By accepting the Service Conditions, you **expressly authorize** the indicated transfers and communications as inherent to the service. If you withdraw this consent, DonDominio will no longer be able to provide the Services requiring such communication.
99113
100### RIGHTS OF THE DATA SUBJECTS.
114### RIGHTS OF DATA SUBJECTS.
101115
102116In accordance with Articles 15 to 22 of the GDPR, you may:
103117
104118**\- Access** the personal data processed by DonDominio.
105119
106120**\- Rectify** inaccurate or incomplete data.
107121
108**\- Erase** the data when they are no longer needed or when the conditions of Article 17 GDPR apply.
122**\- Erase** the data when no longer necessary or under the Article 17 GDPR circumstances.
109123
110**\- Object** to processing or request its **restriction** where applicable.
124**\- Object** to the processing or request its **restriction** when appropriate.
111125
112- Request data **portability** that you have provided.
126- Request the **portability** of the data you provided.
113127
114- Request not to be subject to **automated individual decision-making**, including profiling.
128- Request not to be subjected to **automated individual decisions**, including profiling.
115129
116When the legal basis is consent, you can **withdraw it at any time** without retroactive effects. Certain rights may be temporarily restricted when the maintenance of the data is mandated by sector-specific laws (e.g., ICANN's _Registration Data Policy_) or by requirements from competent authorities.
130When the legal basis is consent, you may **withdraw it at any time** without retroactive effects. Certain rights may be temporarily restricted when applicable obligations require maintaining the data (e.g., ICANN's _Registration Data Policy_) or upon authority request.
117131
118**Contact details for exercising these rights:** SCIP, in compliance with Articles 37 and following of Regulation (EU) 2016/679 of April 27, 2016 (GDPR), has an officially appointed Data Protection Officer with the Control Authority, whose contact details are below:
132**Contact Data to Exercise These Rights:** SCIP, applying Articles 37 and subsequent of Regulation (EU) 2016/679 of April 27, 2016 (GDPR), has appointed an officially designated Data Protection Officer to the Supervisory Authority, whose contact information is:
119133
120134SOLUCIONES CORPORATIVAS IP, S.L. (Data Protection Officer) C/ Menestrals, 14, 07500 Manacor (Illes Balears) - Spain Email: [dpo@scip.es](mailto:dpo@scip.es)
121135
122**Complaint to the supervisory authority.** If you believe that your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency ([https://www.aepd.es](https://www.aepd.es/)).
136**Complaint with Supervisory Authority.** If you consider your rights have not been addressed, you may file a complaint with the Spanish Data Protection Agency ([https://www.aepd.es](https://www.aepd.es/)).
123137
124138### ADDITIONAL INFORMATION
125139
126**Traffic data retention (Law 25/2007).** In accordance with Law 25/2007, DonDominio is required to retain certain traffic and location data derived from electronic communications for the legally prescribed period, solely to make them available to competent authorities when there is a formal requirement.
140**Traffic Data Retention (Law 25/2007).** In accordance with Law 25/2007, DonDominio must retain certain data related to traffic and location resulting from electronic communications for the legally foreseen period, solely to make them available to competent authorities upon formal request.
127141
128**Limited publication in RDDS/WHOIS (Registration Data Policy).** For gTLD domain registrations, only fields designated as "public" by ICANN's _Registration Data Policy_ will be published in the RDDS/WHOIS directory (e.g., domain name, country of the holder, registrar identifier, and abuse contacts). Other personal data will be shown as redacted, with third-party disclosure possible only through the policy's specified request procedure.
142**Limited Publication in RDDS/WHOIS (Registration Data Policy).** For gTLD domain registrations, only fields designated as "public" by ICANN's _Registration Data Policy_ (e.g., domain name, registrant's country, registrar identifier, and abuse contacts) will be published in the RDDS/WHOIS directory. The remaining personal data will be displayed as redacted; their disclosure to third parties can only occur via the stipulated request procedure in said policy.
129143
130**Security measures.** DonDominio implements appropriate technical and organizational measures to:
144**Security Measures.** DonDominio implements appropriate technical and organizational measures to:
131145
132ensure the confidentiality, **integrity**, availability, and ongoing resilience of systems and data processed; - restore data and access promptly following any physical or technical incident;
146ensure the confidentiality, **integrity**, availability, and continued resilience of systems and data processed;
133147
134- regularly verify and assess the effectiveness of the implemented measures;
148- restore data and access in the event of a physical or technical incident;
135149
136- pseudonymize and encrypt personal data where necessary.
150- regularly verify and evaluate the effectiveness of implemented measures;
137151
138These safeguards are periodically reviewed and kept updated per the requirements of Article 32 GDPR.
152- pseudonymize and encrypt personal data when necessary.
139153
154These guarantees are periodically reviewed and kept up-to-date as required by Article 32 GDPR.
155
140156### ANNEX I - gTLD DOMAIN REGISTRATION DATA
141157
142| No | Data Fields _(data element)_ | Main Purpose | Destination (transfer) | Publication in RDDS / WHOIS |
158| No. | Data Elements | Main Purpose | Destination (transfer) | Publication in RDDS / WHOIS |
143159| --- | --- | --- | --- | --- |
144| 1 | **Registered name** (domain name) | Activate and maintain the domain | gTLD registry and ICANN | **Yes (public)** |
160| 1 | **Registered name** (domain name) | Activate and maintain the domain | gTLD registration and ICANN | **Yes (public)** |
145161| 2 | **Registrar IANA ID** | Identify the Registrar | ICANN | **Yes (public)** |
146162| 3 | **Registrar Abuse Contact Email** | Abuse channel | ICANN and public | **Yes (public)** |
147163| 4 | **Registrar Abuse Contact Phone** | Abuse channel | ICANN and public | **Yes (public)** |
148| 5 | **Registrant Country** | Locate jurisdiction of the holder | gTLD registry | **Yes (public - country)** |
149| 6 | **Registrant Email** | Contact the holder | gTLD registry | **Redacted** |
150| 7 | Registrant Name | Identify the person (optional for individuals) | gTLD registry | **Redacted** |
151| 8 | Registrant Phone | Alternate contact (optional) | gTLD registry | **Redacted** |
152| 9 | Registrant Phone ext. | Phone extension (optional) | gTLD registry | **Redacted** |
164| 5 | **Registrant Country** | Locate registrant's jurisdiction | gTLD registration | **Yes (public - country)** |
165| 6 | **Registrant Email** | Contact the registrant | gTLD registration | **Redacted** |
166| 7 | Registrant Name | Identify the person (optional for individuals) | gTLD registration | **Redacted** |
167| 8 | Registrant Phone | Alternative contact (optional) | gTLD registration | **Redacted** |
168| 9 | Registrant Phone ext. | Phone extension (optional) | gTLD registration | **Redacted** |
153169
154### ANNEX II - PROCEDURE FOR DISCLOSURE OF NON-PUBLIC DATA
170### ANNEX II - NON-PUBLIC DATA DISCLOSURE PROCEDURE
155171
156**1) Submission of the request:** Directed to [abuse@scip.es](mailto:abuse@scip.es) from a verifiable account, stating:
172**1) Application Submission:** Send to [abuse@scip.es](mailto:abuse@scip.es) from a verifiable account, indicating:
157173
158a) Affected domain
174a) Affected Domain
159175
160b) Identity of the applicant and proof of legitimacy (e.g., judicial mandate, right to legal protection, cyber-abuse investigation, etc.).
176b) Applicant's identity and proof of authorization (e.g., court order, right to judicial protection, cyber-abuse investigation, etc.).
161177
162178c) Specific data requested and motivation.
163179
164**2) Acknowledgement of receipt (≤ 5 working days):** DonDominio confirms receipt and assigns a case number.
180**2) Acknowledgment (≤ 5 business days):** DonDominio confirms receipt and assigns a file number.
165181
166**3) Assessment (≤ 30 calendar days).** Factors considered:
182**3) Assessment (≤ 30 calendar days).** Considerations are:
167183
168a) Invoked legal basis and proportionality.
184a) Legal basis invoked and proportionality.
169185
170b) Rights and privacy expectations of the holder.
186b) The privacy rights and expectations of the data subject.
171187
172c) Risk of misuse.
188c) Misuse risk.
173189
174**4) Reasoned resolution**
190**4) Reasoned Decision** a) **Partial/total Approval:** the requested data are provided through a secure channel.
175191
176a) **Partial/total approval:** requested data is provided via a secure channel.
192b) **Denial:** the reasons and the appeal channel are indicated.
177193
178b) **Denial:** reasons and appeal channels are indicated.
194**5) Registration and Custody:** All requests, decisions, and accesses are recorded and kept for 15 months (art. 15 RDP).[icann.org](https://icann.org/)
179195
180**5) Registration and storage:** All requests, decisions, and accesses are recorded and retained for 15 months (art. 15 RDP).[icann.org](https://icann.org/)
181
182**6) Appeal:** The applicant may file a complaint with the Spanish Data Protection Agency or ICANN Compliance if they disagree with the decision.
196**6) Appeal:** The applicant may appeal to the Spanish Data Protection Agency or ICANN Compliance if they disagree with the decision.