This addendum forms part of the Terms of Service. It applies where you, as a business customer, give us personal data of your own customers to process. In that case you are the data user and we are your data processor. For personal data on your own account we are the data user ourselves, as described in the Privacy Policy.
1. What the processing covers
| Subject matter | Processing the personal data you submit in order to provide the services you ordered (domain registration and management, billing, support). |
|---|---|
| Duration | From the moment you submit the data until the service ends and the data is deleted or returned under section 7. |
| Nature and purpose | Storage, organisation, retrieval, correction, transmission to the registrar and registry, generating invoices and notices. |
| Types of data | Your customers' names, organisation, address, email address, telephone, and domain-related details. |
| Data subjects | Your customers, your staff, your contacts. |
2. Our commitments
- Process the data only on your documented instructions (including these terms and the settings you save in the client area); we do not use it for our own purposes.
- Ensure anyone who can reach the data is under a duty of confidentiality.
- Apply appropriate technical and organisational measures, including encryption in transit, access control, least privilege and activity logging.
- Assist you in responding to access and correction requests made by data subjects under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong.
- Assist you in meeting your security and notification duties.
- Not transfer the data outside Hong Kong except as described in section 4 and with appropriate safeguards.
3. Your commitments
- You have a lawful basis under applicable law for collecting the data from your customers and giving it to us, and you have given them the notices the law requires.
- Your instructions must be lawful; we may refuse processing that would be unlawful.
- You must not ask us to process special category data (such as health, religion or political opinion) beyond the scope of this addendum.
4. Sub-processors
To provide the services we use the following sub-processors, each bound by contract to standards no lower than this addendum:
- the registrar and registries (Global Domain Group LLC / Dynadot Inc. and the registries it works with) - to effect the registration and submit WHOIS data;
- third-party payment providers - to take payments and issue refunds;
- email and SMS providers - to send verification, notices and invoices;
- cloud hosting and backup providers - to host this site and store data.
Their servers may be outside Hong Kong (including the United States and Singapore). We will announce a change of sub-processor in the client area, and you may object on reasonable grounds.
5. Personal data breaches
If a security incident affects personal data you submitted, we will notify you as soon as possible and no later than 72 hours after becoming aware, describing the nature of the incident, the categories of data involved, what we have done and what we recommend, and we will assist you in meeting your own notification duties to regulators and data subjects.
6. Audit and information
We will give you the information reasonably necessary to demonstrate compliance with this addendum. If you have good reason to require an on-site audit we can arrange one without compromising the confidentiality and security of other customers, at your cost.
7. What happens at the end
- When the service ends we delete or return the personal data we processed within 30 days of your request, unless the law or registrar rules require us to keep it (for example transaction records and domain registration data).
- Data we must keep under ICANN and registry rules is deleted when that retention period ends.
8. Governing law
This addendum is governed by Hong Kong law. If you are an EU or UK customer and the GDPR applies, this addendum is treated as the processor terms required by Article 28 GDPR, and sections 1 to 7 are the terms that Article requires. Liability is limited as set out in section 9 of the Terms of Service.