Data Processing Addendum
Last updated: September 2026
This addendum forms part of the agreement between DomainsDealer ("we", "us", the processor) and the customer holding a seller account ("you", the controller) for personal data we process on your behalf. It applies to every plan. A counterpart signed by us is available on request: sellers on the Brokerage plan can ask for one from the Invoicing page in their own panel, and anyone else can ask the desk at [email protected].
1. Roles
For the data in your own book you are the controller and we are the processor. For the data of your seat holders and for our own records of your account and payments, we are the controller. We process personal data only on your documented instructions, which are the instructions the product gives you: adding names, publishing a sales page, sending an offer to a buyer, inviting a seat, coordinating a transfer.
2. What we process for you
- Seat holders: name, email address, role, the price band leads are routed on, the last time the seat was used.
- Buyers who contact you: email address, name if given, the message and the offer or bid amount, and whether the address was confirmed by code.
- Transfer cases: buyer name and email, sale price, escrow provider and reference, the notes you add.
- Desk requests: the sourcing briefs you file and the messages you exchange with your broker, with the email address of the seat that wrote each one.
- Your own account: the address the account is on, the company and billing details you enter, the events in your audit log, and the IP addresses those events came from.
We do not process special category data, and the product asks for none. Do not put it in a note.
3. Duration
We process the data for as long as your account exists, and then as set out in section 8.
4. Subprocessors
We use the following subprocessors. We tell you before we add one, and you may object.
| Subprocessor | What for | Where |
|---|---|---|
| Hosting provider | Application hosting and the database | Germany (EU) |
| Payment operator | Subscriptions, invoices, card data (we never hold a card number) | Ireland (EU), United States |
| Email delivery provider | Transactional email delivery | United States |
| DNS and network protection provider | DNS and edge protection | Global edge |
Each is bound by terms no weaker than this addendum. Transfers outside the EEA rely on the European Commission's standard contractual clauses as incorporated in that subprocessor's own data processing terms.
5. Security
Our technical and organisational measures are published in full in the security overview, which forms part of this addendum. In summary: transport encryption on every connection, encryption at rest on the database volume and the backups, access to production limited to named administrators with key-based authentication, no card numbers on our systems, and an append-only audit log of account changes that Brokerage accounts can read and export themselves.
6. Confidentiality
Everyone with access to production is bound to confidentiality and has access only to what their work needs. A seller's sale price is never shown to another seller: prices that closed on this marketplace feed comparable sales without naming the seller behind them.
7. Your rights and ours
We assist you with requests from the people whose data you have put here: access, correction, deletion, portability. The seller panel already does most of it directly. Tell us about a request we need to act on and we answer within five working days at no charge.
8. Return and deletion
Close your account and your names come off the board immediately. The account, its book and its audit log stay readable to you for 90 days so you can export them, and we then delete them, except records we must keep for tax and accounting law (invoices and payment records, kept for the statutory period) and anything needed for a live legal claim. Ask for earlier deletion and we do it within 30 days, subject to those exceptions.
9. Personal data breach
We tell you without undue delay, and in any case within 48 hours of becoming aware, of a breach affecting personal data we process for you: what happened, what data, what we have done, and what we advise you to do. Contact for both directions: [email protected].
10. Audit
You may ask us, once a year, for the information you need to satisfy yourself that we meet this addendum. We answer in writing and, where that is not enough, by a call with the people who run the systems. On the Brokerage plan the security review pack is one button away in your own panel.
11. Precedence
Where this addendum and the terms of service or the privacy policy disagree about personal data processed on your behalf, this addendum wins.