Total Registrations (‘we’ or ‘us’ or ‘our’) gather and process your personal information in accordance with this privacy notice and in compliance with the relevant data protection Regulation and laws. This notice provides you with the necessary information regarding your rights and our obligations, and explains how, why and when we process your personal data.

Total Registrations registered office is at 12 Riverview, The Embankment Business Park, Heaton Mersey, Stockport, Cheshire. SK4 3GN and we are a company registered in England and Wales under company number 04347053. We are registered on the Information Commissioner's Office Register registration number Z477168 and act as the data controller and data processor depending on the service being provided. We have a designated Data Protection Officer/Appointed Person (DPO) for the organisation and the DPO can be contacted at [email protected].

Information That We Collect

Total Registrations processes your personal information to meet our legal, statutory and contractual obligations and to provide you with our products and services. We will never collect any unnecessary personal data from you and do not process your information in any way, other than as specified in this notice.

The personal data that we collect is dependant of the service and domain name we provide to you. Below is a list of services where we obtain personal data for the purpose of providing a service to you:

Common to all services:

• Contact Name;
• Contact Phone Number;
• Contact Fax Number;
• Contact Email Address(s);
• Business Name;
• Business Address & Post/ZIP Code;
• Username;
• Password;
• Unique customer identifier(s) that tie you to customer account(s) on our systems;
• IP Address;
• VAT Number.

Domain Name Registration:

• Domain Name;
• Unique customer identifier(s) that tie you to customer account(s) on partner systems (such as Registries and Payment Providers);
• Various contact information as in "Common to all services" above for Registrant, Admin, Tech and Billing contacts (As described by you during the Registration of a domain name and could be personal data of another data subject other than yourself);
• Domain specific password(s) for change control;
• Various handle identifiers for represent specific contact information for Registrant, Admin, Tech and Billing contacts;
• Trading name of Business;
• Trade Mark Name and Qualification;
• Trade Mark Number;
• Reference Name.

Hosting:

• Domain Name;
• Business Location (City);
• Business Location (County).

We collect information in the following ways - Online using web forms for applying for services or via email for email registrations or modifications. Should we collect your personal information during an enquiry we shall remove your personal data within 12 months of us recording it unless you subsequently become a customer of Total Registrations.

How We Use Your Personal Data ( Legal Basis for Processing)

Total Registrations takes your privacy very seriously and will never disclose, share or sell your data without your consent; unless required to do so by law. We only retain your data for as long as is necessary and for the purposes specified in this notice. Where you have consented to us providing you with promotional offers and marketing, you are free to withdraw this consent at any time using your partner account control panel or web control panel provided at time of service activation. The purposes and reasons for processing your personal data are detailed below but may depend on the service :

As necessary to perform our contract with you for the relevant service:

• To ascertain the suitability for a contract to provide a service to you;
• To ensure that orders (such as domain registrations) are completed and can be delivered to you as expected in the course of a contract;
• To manage and perform that contract;
• To contact you about the contract we provide you with.
• To forward any communications in regards to Whois domain name queries from enquiring parties. For instance someone maybe interesting in purchasing a domain name in your possession and wish to contact you which they can only do through Total Registrations.

As necessary for our own legitimate interests or those of other persons and organizations:

• For good governance, accounting, managing and auditing our business operations;
• To monitor emails, calls and other communications on your account;
• For market research, analysis and developing statistics;
• To send you marketing information where we have assessed that it is beneficial to you as a customer and in our interests. Such information will be non-intrusive and we send these infrequently.
• To send you service communications, in particular scheduled down time or service interruption notifications.

As necessary to comply with legal obligations:

• In the collection and storage of your personal data for business accounting and tax purposes in-line with UK law.
• For the collection and payment of VAT associated with your account and provision of VAT exempt data to EU tax authorities.
• For compliance with legal and regulatory requirements, e.g. to meet the requirements laid down by ICANN for the registration and supply of domain names.
• For the prevention, detection and investigation of fraud.

Based on your consent:

• To send you marketing information where we have asked for your consent to do so. Specifically promotion of new services or product promotions. These are typically infrequent and likely to be a handful a year.

You are free to withdraw your consent at any time, the consequences of which may mean we are unable to provide certain services to you.

Data Subjects Rights (Your Rights)

You have the right to access any personal information that Total Registrations processes about you and to request information about:

• What personal data we hold about you
• The purposes of the processing
• The categories of personal data concerned
• The recipients to whom the personal data has/will be disclosed
• How long we intend to store your personal data for
• If we did not collect the data directly from you, information about the source

If you believe that we hold any incomplete or inaccurate data about you, you have the right to ask us to correct and/or complete the information and we will strive to update/correct it as quickly as possible; unless there is a valid reason for not doing so, at which point you will be notified.

You also have the right to request erasure of your personal data or to restrict processing (where applicable) in accordance with data protection laws, as well as to object to any direct marketing from us, to exercise your data portability rights and to be informed about any automated decision-making we may use.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request; this is to ensure that your data is protected and kept secure.

Sharing and Disclosing Your Personal Information

We do not share or disclose any of your personal information without your consent, other than for the purposes specified in this notice or where there is a legal requirement. Total Registrations uses several third-parties to provide the below services and business functions; however, all processors acting on our behalf only process your data in accordance with instructions from us and comply fully with this privacy notice, the data protection laws and any other appropriate confidentiality and security measures.

Depending on the service we provide you, will depend on whether we disclose your personal data to third-parties. Below is a list of services or processes where we disclose your personal data to third-parties and who those third-parties might be:

Common to all services:

• Government bodies, such as regulators, e.g. The Information Commissioners Office or Internet Corporation for Assigned Name and Numbers (ICANN)
• The Courts of England & Wales (To comply with legal requirements, and for the administration of justice). Acting in the capacity of Data Processor.

Domain Name Registration:

• Registry and Registrar organisations depending on your choice of domain name at time of purchase, e.g. Verisign, Afilias, Nominet, Neustar, etc... (To provide Domain Name Registration and Management services). They can act in the capacity of either Data Processor or Data Controller depending on whether they are a thin or thick (Thin being where they do not store the personal data and Thick being where they do) registry.
• Data Backup And Recovery Services to provide continuity in the event of Total Registrations ceasing to trade or it experiences a disaster where it is unable to continue doing business. Iron Mountain currently handle this service in the capacity of Data Processor.

Hosting:

• Ripe the IP Address governing body for Europe (To provide services using Internet assigned numbers). Acting in the capacity of Data Processor.

Payment Processing:

• Payment Processor Total Web Solutions to facilitate accepting payment from you on your account. Acting in the capacity of Data Processor.
• Acquiring Bank Global Payments to facilitate accepting payment from you on your account. Acting in the capacity of Data Processor.
• Fraud prevention companies (To provide an anti-fraud mechanism to help protect you from fraud on your merchant account). Acting in the capacity of Data Processor.

Please consult the relevant third-party organisation to obtain their privacy notice.

Safeguarding Measures

Total Registrations takes your privacy seriously and takes every reasonable measure and precaution to protect and secure your personal data. We work hard to protect you and your information from unauthorised access, alteration, disclosure or destruction and have several layers of security measures in place, including but not limited to:

• Secure Socket Layer (to latest TLS standard)
• Encryption of sensitive data
• Software & hardware Firewalls
• Anti-Virus software
• Intrusion Detection and Prevention Systems
• Regular Penetration Tests
• Regular software security reviews and updates
• Password protection and authentication
• Regular Vulnerability Scans
• DDOS Protection

Transfers Outside the EU

Total Registrations utilise some products or services (or parts of them) that may be hosted/stored in Australia, Canada & USA, which means that we may transfer any information which is submitted by you through the website outside the European Economic Area ("EEA") for the below purposes:

Domain Name Registration
Email Management

Therefore, when you register a domain or use our email services, the personal information you submit may be stored on servers which are hosted in Australia, Canada or the USA. Where this is the case, we will take steps to ensure that those providers use the necessary level of protection for your information and abide by strict agreements and measures set out by the ICO to protect your data and comply with the relevant data protection laws.

Consequences of Not Providing Your Data

You are not obligated to provide your personal information to Total Registrations, however, as this information is required for us to provide you with our services, we will not be able to offer some/all of our products or services without it.

Legitimate Interests

As noted in the ‘How We Use Your Personal Data’ section of this notice, we occasionally process your personal information under the legitimate interests’ legal basis. Where this is the case, we have carried out a thorough Legitimate Interests’ Assessment (LIA) to ensure that we have weighed your interests and any risk posed to you against our own and that such interests are proportionate and appropriate.

We use the legitimate interests’ legal basis for processing:

• Your email address to send you service communications to keep you informed of scheduled and unscheduled service interruption.
• Your contact information to inform you of a change to service provision i.e. No longer provide a particular service.
• Your contact information to undertake market research and analysis to determine whether a given service is beneficial to you and whether the service is cost effective.
• Your contact information to send you marketing information where we believe a particular service maybe of interest to you or have now become eligible for a service where once you were not. i.e. A new domain type has become available to register your brand under.
• Your account information, in particular invoices, where we can examine your purchases and payments to ensure good accounting practices has been applied.
• Your emails, calls and other communications where we can examine the practice of good corporate governance and for training and quality improvements.

How Long We Keep Your Data

Total Registrations only ever retains personal information for as long as is necessary and we have strict review and retention policies in place to meet these obligations. We are required under UK tax law to keep your basic personal data (name, address, contact details) for a minimum of 6 years after which time it will be destroyed. Where your personal data has been obtained pre-contract (through an enquiry about our services) we will remove your data from our systems within 12 months unless during this time you have become a customer. We shall retain your personal data even after you no longer are in contract with Total Registrations for a period of 12 months except where a domain name has been registered in which case retention periods are in accordance with ICANN's (www.icann.org) policies on retention.

Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise and/or withdraw your consent.

Your Right To Complain

Total Registrations only processes your personal information in compliance with this privacy notice and in accordance with the relevant data protection laws. If, however you wish to raise a complaint regarding the processing of your personal data or are unsatisfied with how we have handled your information, you have the right to lodge a complaint with the supervisory authority.

Data Protection Officer
Total Registrations Limited
12 Riverview
The Embankment Business Park
Heaton Mersey
Stockport
Cheshire
SK4 3GL

T: 0844 847 5838 or E: [email protected]

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

T: 0303 123 1113

Cookie Notice

A ‘cookie’ is a small piece of data sent from a website and stored on the user’s computer by the user’s web browser while the user is browsing. When you visit a site that uses cookies for the first time, a cookie is downloaded onto your computer/mobile device so that the next time you visit that site, your device will remember useful information such as items added in the shopping cart, visited pages or logging in options.

Cookies are widely used in order to make websites work, or to work more efficiently, and our site relies on cookies to optimise your user experience and for features, products and services to function properly.

Most web browsers allow some control to restrict or block cookies through the browser settings, however if you disable cookies you may find this affects your ability to use certain parts of our website or services. For more information about cookies visit https://www.allaboutcookies.org .

Our web site operates a soft opt-in giving you an opportunity to discontinue using it before cookies are set on a first visit to our web site. Continuing to use this web site by accepting this opt-in means you are agreeing to the use of cookies.