1. Controller
The controller responsible for the processing of personal data on the upname.io website is:
Martin-Andree Herz
Sole proprietorship
Nordersteinstraße 10
27472 Cuxhaven
Germany
Email: via the contact form
2. General Information on Data Processing
We process personal data only insofar as this is necessary to provide our website, process inquiries, perform contracts, and ensure the secure and reliable operation of our systems.
The processing of personal data is based in particular on:
- Art. 6(1)(a) GDPR, where consent has been given,
- Art. 6(1)(b) GDPR, where processing is necessary for the performance of a contract or for taking steps prior to entering into a contract,
- Art. 6(1)(c) GDPR, where processing is necessary for compliance with a legal obligation,
- Art. 6(1)(f) GDPR, where processing is necessary for the purposes of our legitimate interests.
Our legitimate interests particularly include the secure, stable, and technically reliable provision of upname.io, the prevention of misuse, and the documentation of security-relevant and business-related activities.
3. Hosting and Technical Infrastructure
upname.io is operated on a dedicated server hosted by Hetzner. The server is located in the Falkenstein data center, Germany.
The technical infrastructure is operated within virtual machines. The website uses, among other components:
- Proxmox for virtualization,
- Caddy as a reverse proxy,
- Next.js for the web application,
- PostgreSQL as the database,
- Docker for running the applications.
As part of the technical operation, IP addresses, timestamps, requested resources, and other technical information may be processed insofar as this is necessary for providing and securing the services.
The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website and its underlying infrastructure.
We do not maintain separate, dedicated access logs for all website visits for analytical purposes. However, technical logs may be generated by the operating systems and system components used as part of their normal operation.
4. Audit and Security Logs
Audit logs are maintained to ensure the traceability of security-relevant and administrative activities.
The following information may in particular be stored:
- timestamp of the activity,
- type of activity,
- affected resource or reference,
- IP address,
- user agent used,
- previous path or technical context information.
The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is particularly the security of our systems, the detection and investigation of misuse, and the traceability of administrative activities.
IP addresses stored in the audit logs are anonymized after 14 days.
The audit logs may subsequently be retained for up to 24 months, insofar as this is necessary for documenting security-relevant activities, investigating misuse, or asserting or defending legal claims.
5. Contact and Contact Inquiries
Users can submit inquiries via the contact form on the website.
The following data may in particular be processed:
- name,
- email address,
- subject,
- message,
- any additional information voluntarily provided.
The information is processed for the purpose of handling the respective inquiry.
Where the contact is made in connection with entering into or performing a contract, processing is based on Art. 6(1)(b) GDPR. In other cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is the handling and response to incoming inquiries.
Contact inquiries are stored within the system and, where necessary, forwarded by email to responsible administrators and the relevant seller.
Further communication generally takes place by email unless another form of communication has been agreed upon in an individual case.
The data will be deleted once the inquiry has been conclusively processed, unless statutory retention obligations or legitimate reasons require longer retention.
6. Domain Inquiries
Users can submit inquiries regarding domains offered through upname.io.
The following information may in particular be processed:
- name,
- email address,
- telephone number, where provided,
- requested domain,
- any price offer submitted by the interested party,
- message or other information relating to the inquiry.
The processing is carried out to handle the inquiry and, where applicable, to prepare for the conclusion of a contract.
The legal basis is Art. 6(1)(b) GDPR where the inquiry is directed towards entering into a contract. In other cases, processing is based on Art. 6(1)(f) GDPR.
The inquiry may be forwarded to the administrator or seller responsible for the respective domain.
7. Domain Information and Technical Domain Queries
upname.io provides technical functions for retrieving domain information. This may include RDAP, WHOIS, and DNS queries as well as information from the corresponding registration and namespace services.
For this purpose, publicly available information about domains may be retrieved. The services used include in particular:
- RDAP,
- WHOIS,
- IANA Bootstrap Services,
- DNS queries.
The queries are performed server-side.
The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is to provide users with the technical domain functions of upname.io and to reliably retrieve information about domains.
Where personal data relating to third parties is retrieved from publicly available domain information through the use of these services, such processing takes place solely within the scope of the technically necessary domain query.
8. Database
The data required for upname.io is stored in a PostgreSQL database. The database is operated within our own server infrastructure.
Data processing is carried out on the basis applicable to the respective processing activity, in particular Art. 6(1)(b), (c), or (f) GDPR.
Deleted data is removed from the production database. However, it may remain technically available through existing backups.
9. Data Backups
Regular database and system backups are created to ensure the availability and recoverability of our systems.
Database backups are created approximately every 24 hours whenever possible. Under the regular rotation process, the three most recent dumps are retained. In addition, older restore points are retained according to a staggered schedule, in particular at:
- 7 days,
- 14 days,
- 30 days.
Backups are stored both on the dedicated server and on a Hetzner Storage Box.
The processing and storage of data contained in backups is based on Art. 6(1)(f) GDPR. Our legitimate interest is to ensure the availability, integrity, and recoverability of our systems.
Deleted data may therefore technically remain contained in backups until the respective backup retention periods have expired. However, such data is not restored from backups for regular operation unless there is a legitimate reason for restoration.
10. User Accounts and Administration
At present, external users cannot create their own buyer or seller accounts on upname.io.
Only internal administrator accounts exist for managing the platform.
The following data may in particular be processed for administrator accounts:
- name,
- username,
- email address,
- password or password hash,
- roles and permissions,
- information relating to two-factor authentication,
- security and login information.
The processing is based on Art. 6(1)(b) GDPR insofar as it is necessary for the administration of an existing employment or other user relationship, or on Art. 6(1)(f) GDPR for the secure administration of the platform.
11. Email Communication and System Emails
Zoho Mail is used for the operation of business email communication and the automated delivery of system emails.
Automated emails are sent via SMTP.
The email infrastructure may in particular be used to send:
- contact inquiries,
- notifications relating to domain inquiries,
- administrative notifications,
- security-related messages,
- other system emails required for the operation of upname.io.
Processing is based on Art. 6(1)(b) GDPR insofar as communication is necessary for the performance of a contract or for pre-contractual measures, or on Art. 6(1)(f) GDPR for other business and technical communications.
Processing takes place within the email infrastructure provided by Zoho and in accordance with the applicable data protection terms.
12. Web Analytics with Umami
Umami is used to statistically analyze the use of upname.io.
The Umami instance is operated by us and is located on a separate virtual machine on the same dedicated Hetzner server. It is integrated via:
https://umami.martin-herz.io
Umami is used to generate statistical information about the use of the website.
The information processed may include technical usage data and information about website visits.
The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is to understand how our website is used, identify technical problems, and further develop the upname.io service.
No external analytics providers such as Google Analytics are used.
13. Cookies and Local Storage
upname.io only uses cookies or browser storage mechanisms that are necessary for the operation of the website or for functions requested by the user.
The processing of technically necessary cookies is based on Section 25(2) No. 2 TDDDG. Where the storage of or access to information also involves the processing of personal data, the subsequent processing is based on the applicable legal basis under Art. 6 GDPR.
No additional tracking, advertising, or marketing cookies are used.
14. External Content and Services
Except for services required for the operation of the website, no external tracking or marketing services are integrated.
In particular, no external font libraries such as Google Fonts are loaded at runtime.
The fonts and other resources required for displaying the website are, where possible, served directly by the website itself.
15. Disclosure to Recipients
As part of the processing described in this Privacy Policy, personal data may be transmitted to or made accessible to the following categories of recipients:
- Hetzner as hosting and infrastructure provider,
- Hetzner Storage Box for data backups,
- Zoho Mail for email communication and automated email delivery,
- responsible sellers in connection with relevant domain inquiries,
- domain registrars and registries where necessary for the processing of a domain sale,
- operators or providers of RDAP, WHOIS, IANA, and DNS services as part of technical domain queries,
- authorities and other public bodies where required by law.
Where personal data is transferred to a third country outside the European Union or the European Economic Area, such transfer will only take place in compliance with the applicable requirements of Art. 44 et seq. GDPR.
16. Domain Sales and Contract Processing
For the sale of domains, we process the personal data required to carry out and complete the respective transaction.
This may in particular include:
- the buyer's name and contact details,
- billing and payment information,
- information relating to the purchased domain,
- technical or administrative information required for transferring the domain,
- communication relating to the purchase and transfer.
Payment is currently made exclusively by bank transfer.
Domains may be managed through different registrars and registries. Where personal data must be transmitted to a registrar, registry, or another service required for domain management in order to transfer a domain, the processing is based on Art. 6(1)(b) GDPR.
The processing is carried out for the performance of the contract and compliance with statutory obligations, in particular commercial and tax retention obligations.
17. No Payment Processing via Stripe at Present
At present, Stripe is not integrated into the platform.
Accordingly, no personal data is currently processed by Stripe in connection with payment processing on upname.io.
If Stripe is integrated in the future for payment or identity services, this Privacy Policy will be updated before or, at the latest, when the relevant processing begins.
18. Deletion of Personal Data
Personal data is deleted once the purpose for which it was processed no longer applies and no statutory retention obligations or other legal grounds prevent deletion.
Statutory retention obligations may apply in particular to business and tax-related records.
Deletion from production systems does not necessarily mean that the data is immediately removed from existing backups. Data may continue to be contained in backups for the retention periods described in Section 9.
19. Rights of Data Subjects
Subject to the applicable legal requirements, data subjects have in particular the following rights:
- right of access pursuant to Art. 15 GDPR,
- right to rectification pursuant to Art. 16 GDPR,
- right to erasure pursuant to Art. 17 GDPR,
- right to restriction of processing pursuant to Art. 18 GDPR,
- right to data portability pursuant to Art. 20 GDPR,
- right to object pursuant to Art. 21 GDPR.
Where processing is based on consent, such consent may be withdrawn at any time with effect for the future.
The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
To exercise your rights, you may contact us using the contact details provided above.
20. Right to Lodge a Complaint with a Supervisory Authority
Data subjects have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority if they believe that the processing of their personal data violates the GDPR.
The competent supervisory authority may in particular be:
The State Commissioner for Data Protection of Lower Saxony (LfD Niedersachsen)
21. No Automated Decision-Making
No automated decision-making, including profiling within the meaning of Art. 22 GDPR, currently takes place.
22. Obligation to Provide Personal Data
The provision of personal data is generally voluntary.
Where certain information is required to process an inquiry, perform a contract, or comply with statutory obligations, failure to provide such information may mean that the relevant service cannot be provided or that a contract cannot be performed.
23. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy if the technical circumstances, services offered, or legal requirements change.
The current version of this Privacy Policy published on upname.io shall apply.