This policy explains what personal data we process when you use xDomenii.ro, why, on what legal basis, who we share it with, how long we keep it and what your rights are, under Regulation (EU) 2016/679 (“GDPR”) and Romanian Law 190/2018.
1. Data controller
The controller is Greathost Web SRL, tax code 42858795, Trade Register no. J01/751/2020, registered office Str. Vasile Goldiș, Nr.20, Alba Iulia, jud. Alba, 510006, România.
For any question or request about personal data, write to gdpr@xdomenii.ro . We have not appointed a Data Protection Officer, as our activity does not involve large-scale systematic monitoring; this address is handled directly by our team.
2. What data we process
- Account data: name, e-mail, password (stored only as an irreversible hash), public username, phone (optional), language, country, security settings (2FA).
- Billing data: for individuals, name and address; for companies, company name, tax code, registration number and address. We do not ask for personal identification numbers; for invoices to individuals we use the generic identifier allowed by RO e-Factura rules.
- Domains and listings: domain names you add, sale and parking settings, DNS verification results, automatic appraisals.
- Public seller profile (if enabled and you have chosen a username): your username, the description you wrote, your status (individual or trader), the month you joined, listed domains, the number of completed sales, your usual response time to offers and, depending on your choice, sold domains with or without the price. Your e-mail address and phone number are never published. You can disable the profile at any time in Settings.
- Favorites and saved searches: the domains you saved and your search filters, used for the e-mail alerts you asked for (price drops, auctions, new domains). Alerts can be turned off in your account or from the link in every e-mail.
- Referral programme: if you sign up through a referral link, we record which account referred you, to apply the commission discount. The referrer only sees how many accounts were created through their link and how many have sold, not who you are. The code from the link is kept only in the browser session, not in a tracking cookie.
- Reviews: after a completed transaction you can leave a rating and a comment about the seller. They are shown publicly on the seller's page, without your name or e-mail address; contact details in the comment are hidden automatically.
- Newsletter (only if you subscribe and confirm by e-mail): your e-mail address, language, subscription and confirmation dates and a pseudonymous identifier of your IP address, as proof of consent. You can unsubscribe at any time from the link in every e-mail; after unsubscribing you receive nothing further.
- Offers, messages and auctions: name, e-mail and phone (optional) entered in the offer form, proposed amounts, messages exchanged, auction bids and maximums.
- Transactions and payments: amounts, transaction status, transfer authorization code (stored encrypted), Stripe payment identifiers. We never receive or store card data; it is entered directly on Stripe’s secure page.
- Seller identity verification (for payouts) is carried out by Stripe as an independent controller. We only receive the account status and any missing information.
- Visit statistics (parking pages and marketplace): country (derived locally from the IP address, without storing it), device type, browser, operating system, referring site and a pseudonymous identifier that changes daily (computed from IP, browser and a secret key). We do not store IP addresses and do not track visitors across days.
- Technical and security data: IP address and browser at login and in the active session, last login date, the list of devices you signed in from (browser, operating system, country and a pseudonymous identifier of the IP address), used for new sign-in alerts, administrative action log, server technical logs.
- Aggregated site statistics (if enabled): visitor numbers and pages viewed, measured without cookies and without identifying visitors (Plausible or Umami).
- Communications: messages sent through the contact form, content reports and correspondence with us.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Creating and managing the account; listing, parking and selling domains; offers, auctions, transactions, protected payment | Performance of a contract - Art. 6(1)(b) |
| Issuing invoices, submitting them to RO e-Factura, accounting records, responding to authorities | Legal obligation - Art. 6(1)(c) |
| Platform security, fraud and abuse prevention, hiding contact details in messages, periodic domain verification | Legitimate interest - Art. 6(1)(f): protecting users and transactions |
| Aggregated traffic statistics for sellers, improving automatic appraisal | Legitimate interest - Art. 6(1)(f), with minimal impact (pseudonymised data, no IP) |
| Notifications about the account, transactions, offers and auctions | Performance of a contract - Art. 6(1)(b) |
| Handling disputes, reports and complaints; establishing or defending legal claims | Legitimate interest / legal obligation (DSA) |
We do not send marketing communications or use advertising or analytics cookies. Any future newsletter will be sent only with your consent.
4. Who we share data with
- Other users, strictly as needed: the seller sees the buyer’s name but not their e-mail or phone; the buyer sees the seller’s status (private or trader); bidders appear anonymised (“Bidder 1, 2…”).
- Stripe (Stripe Payments Europe, Ltd., Ireland, and affiliates) for payments, refunds, seller payouts and seller identity verification.
- Hosting and e-mail provider (furnizorul de găzduire web din România), which stores data and sends e-mails on our behalf as a processor.
- The Romanian Tax Authority (ANAF) through RO e-Factura, for invoices issued.
- Public authorities where required by law; advisors (accountant, lawyer) under confidentiality.
To check domain age we query public services (RDAP, Internet Archive) with the domain name only, without personal data. Country lookup uses a database stored on our server; IP addresses are not sent to third parties.
5. Transfers outside the EEA
Stripe may transfer data to the United States under the EU-US Data Privacy Framework adequacy decision and/or Standard Contractual Clauses approved by the European Commission. Details: stripe.com/privacy. Platform data is hosted in the European Union.
6. How long we keep data
| Data | Period |
|---|---|
| Account and related data | While the account exists; after closure, 3 years (general limitation period) |
| Invoices, transactions and supporting documents | 10 years, under Romanian Accounting Law 82/1991 |
| Offers not confirmed by e-mail | 7 days |
| Detailed visit statistics (pseudonymised) | 13 months; only totals are kept afterwards |
| Administrative action log | 1 year |
| Login sessions | Until logout or session expiry |
| Contact messages and reports | 3 years after resolution |
7. Your rights
Under the GDPR you have the right to access your data, rectification, erasure (except data we must keep by law, such as invoices), restriction, portability, to object to processing based on legitimate interest, not to be subject to a decision based solely on automated processing producing legal effects (section 8), and to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP, 28-30 G-ral Gheorghe Magheru Blvd., District 1, Bucharest, www.dataprotection.ro) or the authority in your country of residence.
To exercise your rights, write to gdpr@xdomenii.ro . We reply within one month, extendable by two further months for complex requests, in which case we will inform you.
8. Automated processing
We use some automated mechanisms to keep transactions safe: periodic DNS verification (automatic listing suspension after repeated failures), hiding contact details in messages, filtering bots from statistics, offer-form anti-spam and automatic domain appraisal. None of these produce legal effects for you without the possibility of human intervention; you may ask a team member to review at any time, using the address above.
9. Data security
We use encrypted connections (HTTPS), irreversibly hashed passwords (bcrypt), optional two-factor authentication, encryption of sensitive data (e.g. transfer codes), restricted and logged administrative access and backups. Payments are processed entirely by Stripe, a PCI DSS Level 1 certified provider. In case of a personal data breach we notify the authority and affected persons as required by law.
10. Minors
The Platform is intended for persons aged 18 or over. We do not knowingly collect data about minors.
11. Changes
We may update this policy; the last update date is shown at the top of the page. We will inform you of significant changes by e-mail or in your account. Cookie information is in the Cookie policy.
This translation is provided for convenience. In case of any discrepancy, the Romanian version prevails.