en

Privacy Policy

PRIVACY POLICY

Last updated: August 2026

Protecting your personal data is important to us. We process personal data exclusively in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) and the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG).

This Privacy Policy explains which personal data we process, the purposes for which it is processed, the legal bases on which the processing is carried out and the rights available to you.

  1. CONTROLLER

The controller within the meaning of Art. 4 No. 7 GDPR is:

Albert Schimmel
Buymyname.com
c/o Postflex #3532
Emsdettener Str. 10
48268 Greven
Germany

Phone: +49 211 82204013

Email: privacy@buymyname.com

We have not appointed a data protection officer, as there is no legal obligation to do so.

  1. GENERAL CATEGORIES OF PERSONAL DATA

Personal data means any information relating to an identified or identifiable natural person.

Depending on the nature of your enquiry or the agreed service, we process in particular the following data:

• Name and contact details
• Email address and telephone number
• Postal and billing address
• Job title, function and organisation
• IP address and technical connection data
• Contract, quotation and order data
• Payment and billing data
• Information about domains and domain holders
• Registration and transfer data
• Negotiation and communication content

We only process additional data where this is necessary to handle your enquiry or provide the agreed service.

  1. LEGAL BASES FOR PROCESSING

We process personal data in particular on the basis of the following provisions:

• Art. 6(1)(a) GDPR – on the basis of your consent
• Art. 6(1)(b) GDPR – in order to take steps prior to entering into a contract and to perform a contract
• Art. 6(1)(c) GDPR – in order to comply with legal obligations
• Art. 6(1)(f) GDPR – in order to protect our legitimate interests or the legitimate interests of third parties

  1. DOMAIN BROKERAGE AND DOMAIN RESEARCH

Buymyname.com provides services relating to the research, valuation, brokerage, purchase, sale and transfer of domain names.

In connection with these activities, we process in particular:

• Names and contact details of prospective buyers, sellers, domain holders and contact persons
• Company and representation details
• Information about the domains concerned
• Offers, counteroffers, purchase prices and negotiation information
• Contract, invoice and payment data
• Registration and transfer information
• Communications with the parties and service providers involved

The processing is carried out in order to take steps prior to entering into a contract and to perform our contracts in accordance with Art. 6(1)(b) GDPR.

Where we research and contact domain holders or potential contact persons on behalf of a client, the processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest and the legitimate interest of our client consist of researching potential acquisition opportunities, initiating a domain transaction and conducting professional domain negotiations.

  1. SOURCES OF DATA PROCESSED IN CONNECTION WITH DOMAIN RESEARCH

As part of our brokerage and research activities, we may collect personal data from publicly accessible sources. These sources include in particular:

• Company websites
• Legal notice and contact pages
• Public registers and directories
• Domain and registration databases, such as WHOIS and RDAP services
• Business directories
• Professional networks
• Domain trading and brokerage platforms
• Information from registrars, brokers and other market participants

We process in particular names, professional contact details, company affiliations and information about the domain concerned. The legal basis is Art. 6(1)(f) GDPR.

Data subjects may object to this processing on grounds relating to their particular situation in accordance with Art. 21 GDPR.

  1. CONFIDENTIALITY AND ANONYMOUS DOMAIN BROKERAGE

When providing anonymous domain brokerage services, we generally do not disclose the identity of our client to domain holders or other negotiating parties unless disclosure is required to complete the transaction or the client has agreed to the disclosure.

The relevant data is processed for the performance of the brokerage agreement in accordance with Art. 6(1)(b) GDPR and on the basis of our legitimate interest in confidential and professional negotiations pursuant to Art. 6(1)(f) GDPR.

  1. DOMAIN REGISTRATION AND EURID

Buymyname.com is an accredited registrar for .eu domain names. If you register, renew or transfer a domain through us, we process the data required for the registration. This may include in particular:

• Name or company name
• Full address
• Email address and telephone number
• Nationality or country of establishment, where required to determine eligibility for registration
• Requested domain name
• Preferred language of communication
• Technical and administrative registration data

The processing is carried out for the performance of the registration agreement pursuant to Art. 6(1)(b) GDPR and to comply with legal and contractual obligations pursuant to Art. 6(1)(c) GDPR.

The data required for registration is transmitted to the relevant domain registry. For .eu domain names, this is:

EURid vzw
Telecomlaan 9
1831 Diegem
Belgium

Privacy Policy:
https://eurid.eu/en/privacy-policy/

EURid processes registration data under its own data protection responsibility. Certain registration information may be publicly accessible in accordance with the applicable registration and WHOIS policies or may be disclosed to authorised applicants where a legitimate interest exists.

  1. DOMAIN TRANSFERS, ESCROW AND TRANSACTION SERVICE PROVIDERS

To ensure the secure completion of a domain purchase or sale, we may involve registrars, domain registries, escrow providers, domain trading platforms, legal advisers and other specialised transaction service providers.

Depending on the particular transaction, these may include:

• Escrow.com
• escrow.domains
• Sedo
• GoDaddy
• The relevant registrar
• The registry responsible for the domain
• Appointed legal and tax advisers

We may transmit to these recipients names, contact details, company information, details of the domain, purchase price, payment information, contract data and the information required to complete the domain transfer.

The transmission is carried out in order to take steps prior to entering into a contract and to perform the relevant contract pursuant to Art. 6(1)(b) GDPR. Where required for secure processing, fraud prevention or the enforcement of legal claims, it is also carried out on the basis of Art. 6(1)(f) GDPR.

These service providers may process personal data under their own data protection responsibility. The privacy policies of the service provider used in the relevant transaction also apply.

  1. DATA RELATING TO THIRD PARTIES

If you provide us with personal data relating to other persons, you must be authorised to do so. Please ensure that the persons concerned are informed about the transmission and processing of their data, unless a legal exception to the information requirement applies.

  1. PAYMENT PROCESSING

To process payments, we may use banks, escrow providers or other payment service providers appointed in connection with the relevant transaction.

The following data may be processed in particular:

• Name and address
• Email address
• Bank or payment information
• Invoice amount and currency
• Payment reference
• Transaction and contract data

The processing is carried out for the performance of the contract pursuant to Art. 6(1)(b) GDPR. Where data is processed for fraud prevention and to ensure transaction security, the processing is carried out on the basis of Art. 6(1)(f) GDPR.

  1. CONTACT FORM AND COMMUNICATION WITH US

If you contact us through our contact form, by email or by telephone, we process the information you provide. This may include in particular:

• Name
• Email address
• Telephone number
• Company and professional function
• Requested domain name
• Content of your enquiry

The processing is carried out pursuant to Art. 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract. Other enquiries are processed on the basis of our legitimate interest in responding to your message pursuant to Art. 6(1)(f) GDPR.

  1. HOSTING AND SERVER LOG FILES

Our website is provided through the Webnode website platform.

Further information about the processing of personal data by Webnode is available at:

https://www.webnode.com/privacy-policy/

When you access our website, server log files are processed automatically. These may include in particular:

• IP address
• Date and time of access
• Page or file requested
• Browser type and version
• Operating system
• Referrer URL
• Amount of data transferred
• Access status

The processing is carried out for the technical provision of the website, to ensure its stability and security and to prevent abusive access, on the basis of Art. 6(1)(f) GDPR.

Where the hosting provider processes personal data on our behalf, a data processing agreement pursuant to Art. 28 GDPR is in place.

  1. COOKIES AND CONSENT MANAGEMENT

Our website uses cookies and comparable technologies. Technically necessary cookies are used to ensure the basic functionality and security of the website. The processing is carried out on the basis of Art. 6(1)(f) GDPR and Section 25(2) TDDDG.

Optional analytics and marketing technologies are only used with your consent. The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

You may withdraw or change your consent at any time with effect for the future through the cookie settings. This does not affect the lawfulness of processing carried out before consent was withdrawn.

  1. GOOGLE TAG MANAGER

We use Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is used to manage website tags and enables the integration of other services. Services managed through Google Tag Manager are only loaded in accordance with your consent selection.

The service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. The transfer of data to Google LLC in the United States cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework.

Further information:
https://policies.google.com/privacy

  1. GOOGLE ANALYTICS

If you have given your consent, we use Google Analytics, a web analytics service provided by:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland

Google Analytics uses cookies and comparable technologies to analyse the use of our website. The following data may be processed in particular:

• IP address
• Approximate location information
• Page views
• Time spent on the website
• Interactions with the website
• Source of the website visit
• Technical information about the browser and device

Google uses the IP address to derive approximate location information. According to Google, the IP address is not permanently logged or stored in Google Analytics.

The processing is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time through the cookie settings.

The transfer of data to Google LLC in the United States cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework. EU standard contractual clauses may also be used.

Further information:
https://policies.google.com/privacy

  1. INTERNATIONAL DATA TRANSFERS

In connection with domain transactions and the use of certain service providers, it may be necessary to transfer personal data to recipients outside the European Union or the European Economic Area.

Such transfers are only carried out in accordance with the requirements of Art. 44 et seq. GDPR. In particular, a transfer may be based on an adequacy decision by the European Commission, the recipient's certification under the EU-US Data Privacy Framework or appropriate safeguards such as the EU standard contractual clauses.

Where the transfer is necessary for the performance of a contract with you or for the performance of a contract concluded in your interest, it may also be based on Art. 49(1)(b) or (c) GDPR.

  1. RECIPIENTS OF PERSONAL DATA

We only disclose personal data where this is necessary to provide our services, where a legal obligation applies, where you have given your consent or where the disclosure is based on a legitimate interest.

Recipients may include in particular:

• Registrars and domain registries
• Domain brokers and domain trading platforms
• Escrow and transfer service providers
• Banks and payment service providers
• Hosting and IT service providers
• Support and maintenance service providers
• Legal and tax advisers
• Public authorities and courts, where a legal obligation applies

Where service providers process personal data exclusively on our behalf, data processing agreements pursuant to Art. 28 GDPR are in place. Other recipients, including banks, payment service providers, registrars, domain registries and escrow providers, may process data under their own data protection responsibility.

Personal data is not disclosed for address trading or other data-selling purposes.

  1. RETENTION PERIODS

We retain personal data only for as long as this is necessary for the relevant processing purposes or statutory retention obligations apply.

• Invoices and accounting records: 8 years
• Commercial and business correspondence and contract-related communications: 6 years
• Contract and transaction data: for the duration of the contract and subsequently in accordance with statutory retention and limitation periods
• Data relating to ongoing brokerage engagements: until the engagement has been completed or terminated
• Data relating to unsuccessful brokerage enquiries: until the enquiry has been concluded and subsequently where required to establish, exercise or defend possible legal claims
• General contact enquiries: until the enquiry has been fully handled, unless a retention obligation applies
• Data processed on the basis of consent: until consent is withdrawn

Statutory retention periods and the need to retain data for the establishment, exercise or defence of legal claims remain unaffected.

  1. YOUR RIGHTS

Subject to the applicable statutory requirements, you have the following rights in particular:

• The right to obtain access to your processed personal data pursuant to Art. 15 GDPR
• The right to have inaccurate or incomplete data rectified pursuant to Art. 16 GDPR
• The right to erasure of personal data pursuant to Art. 17 GDPR
• The right to restriction of processing pursuant to Art. 18 GDPR
• The right to data portability pursuant to Art. 20 GDPR
• The right to object to processing pursuant to Art. 21 GDPR
• The right to withdraw consent pursuant to Art. 7(3) GDPR

Withdrawal of consent takes effect for the future. It does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise your rights, please contact:

privacy@buymyname.com

  1. OBJECTION TO PROCESSING BASED ON LEGITIMATE INTERESTS

Pursuant to Art. 21 GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where that processing is based on Art. 6(1)(f) GDPR.

We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or where the processing is required for the establishment, exercise or defence of legal claims.

  1. RIGHT TO LODGE A COMPLAINT

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestraße 2–4
40213 Düsseldorf
Germany

https://www.ldi.nrw.de

  1. AUTOMATED DECISION-MAKING

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

Payment, escrow or transaction service providers used by us may employ automated procedures for fraud prevention, identity verification, risk assessment or decisions concerning the availability of their services. Information about these procedures and the associated rights is available in the privacy policies of the respective service providers.

  1. DATA SECURITY

We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and unauthorised disclosure.

Our website uses SSL or TLS encryption. You can recognise an encrypted connection by the "https://" at the beginning of the website address.

  1. CHANGES TO THIS PRIVACY POLICY

We may amend this Privacy Policy if our services, the technical design of the website or the applicable legal requirements change. The current version published on this website applies.