GTLD Marketplace — Privacy Notice

DRAFT v1.0 | UK GDPR / Data Protection Act 2018 | Pending processor and retention approval

1. Controller and contact

The data controller for GTLD Marketplace is ZAGRAN LTD, incorporated in England and Wales (company no. 16334360), registered office 82a James Carter Road, Mildenhall, West Suffolk, IP28 7DE, United Kingdom. Contact about privacy and data rights at admin@gtld.name, with subject "Privacy request". [BEFORE LAUNCH: decide whether a separate privacy contact/DPO is appointed and provide it where appropriate.]

2. Categories of personal information

We process only what is necessary for the functions users choose: account details (verified email, hashed credentials, legal name, contact and address), buyer/seller category, company registration and representative authority, trading/VAT declarations, domain records and registrar information, verifications and their results, transaction amounts and states, bank/payment account reference or last-four metadata only where needed (not full card number or CVV), platform communications and complaint evidence, cookies/session logs, limited device/IP and security telemetry, and evidence of each versioned e-signature/checkbox acceptance. Where permitted and necessary, specialised identity vendors may inspect identity documents and perform sanctions/PEP checks. We prefer to store verification results instead of copies of documents.

[BEFORE LAUNCH: replace this section with exact vendors, whether biometrics are used, account security service, hosting region and support services.]

3. Purposes and lawful bases

We process account and transactional information as needed for contract performance, precontractual requests and administrator services. We process statutory accounting, lawful sanctions/reporting duties and compliance notices where legal obligation genuinely applies. We rely on legitimate interests when justified (with documented balancing) for fraud prevention, platform security, dispute evidence, breach detection and network integrity; for specific statutory purposes, the 2026 recognised legitimate interests basis may be considered only if all its requirements actually apply. We rely on consent for optional marketing and non-essential cookies where required; declining these does not prevent use of core functionality. Identity checks are not automatically consent-based merely because a user checks a Terms box. [APPROVAL GATE: complete and file an Article 6 lawful-basis matrix per processing purpose; if biometrics/special category data are processed, document separate Article 9 condition and DPIA.]

4. Recipients and disclosures

Role-based access to identifiable details is limited to authorised GTLD staff/contractors; involved counterparties receive the minimum lawful information needed to conclude and enforce their contract and to comply with consumer disclosure duties. An approved payment processor (such as Viva only once contracted for this use case), secure identity-verification provider, email delivery processor, hosting/backups, and professional legal/accounting advisers may process relevant data under written agreements. Courts, regulators, police, HMRC or sanctions agencies may receive legally required information. There is no sale of private ID documents or open publication of home addresses. A verified business seller may have statutory public disclosure obligations that will be specifically explained before publishing a listing.

5. Transfers outside the UK

International counterparties or providers may result in access or transfers abroad. Where UK transfer rules require safeguards, we use a UK adequacy regulation or the applicable International Data Transfer Agreement/Addendum, plus any necessary assessment and measures. [BEFORE LAUNCH: add actual overseas processor country, transfer mechanism and request method for copies.]

6. Retention and deletion

Use a written retention matrix tied to purpose, with legal hold exceptions. Suggested starting policies subject to human sign-off: transactional/accounting records and completed contracts ordinarily up to 6 years after relevant accounting period/closure (or longer where law or an active claim requires); failed/unused DNS verification challenge secrets expire after 72 hours and are then purged under normal security log retention; identity-provider result/verification reference retained as necessary during account/deal and appropriate post-transaction dispute period; manually received raw ID files, if absolutely needed, securely deleted after verification as promptly as practical (target no more than 90 days unless documented reason); unused precontract inquiries and unsuccessful signups review for deletion within 12 months; essential session logs retained a short, defined period (target 30–90 days). Do not falsely promise exact deletion dates before confirming real implementation, backups and regulatory obligations.

7. User rights

Depending on the processing and circumstances, individuals may request access, correction, erasure, restriction, object to processing, portability and withdrawal of consent. Some rights have lawful exceptions, including legal record-keeping and dispute defence. Users can complain to the UK Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/ . We ordinarily respond within one month subject to lawful extensions. We do not take solely automated decisions producing significant legal effects without a proper lawful basis and rights safeguards; high-risk fraud blocks receive human review as appropriate.

8. Security

We use secure HTTPS, encryption in transit and appropriate encryption at rest, access-control by role/transaction, audit logs, MFA for administrators, least-privilege external providers, rate limiting, protected secrets, backups and security incident response. No platform administrator should access full card numbers, passwords or CVV. Breaches are assessed promptly for ICO notification obligations and affected-user notices when legally required.

9. Cookies, marketing and profile privacy

Strictly necessary security/session cookies support accounts. Optional analytics/marketing cookies require any required prior consent and easy revocation. See Cookie Policy. Transactional emails (verification, purchase, safety notices) are not marketing; optional marketing is separately opt-in under PECR. Users can change notification preferences without hiding legally important account alerts. Public listing shows domain data, not private ID documents or payment identifiers.

10. Changes

We version and timestamp this notice and communicate material changes. Contact `admin@gtld.name` for questions or rights requests. Last updated: [APPROVED DATE]. No final notice goes live with unresolved provider, DPO or retention placeholders.