DomainTree Auctions: Privacy Notice
Version: 2026-11-13
This notice explains what personal data DomainTree Auctions holds about you, why, how long we keep it, who else handles it, and your rights.
1. Who is responsible
Domaintree Limited trading as DomainTree, of 51 Wiston Avenue, Worthing, West Sussex, BN14 7QX, is the controller of your personal data. ICO registration number: ZA360030. Contact us about anything in this notice at [email protected].
2. What we hold, why, and for how long
| What | Why (and lawful basis) | How long |
|---|---|---|
| Your name and email address | To run your account and email you about backorders, bids and sales (contract) | While your account is open. Removed when it's closed |
| Your account name, if you choose one, and its past versions. It is public only on listings of names you sell; bidders are never named | To show buyers who is selling (contract) | While your account is open. Removed when it's closed |
| Your password (you choose it on the link we email you when you sign up) | To sign you in. We store only a one-way scrambled form (hash), never the password itself (contract) | While your account is open |
| Your account status and our notes on it (approved, suspended, banned, and why), and which version of our terms you accepted and when | To decide who may bid, and to show what you agreed to (legitimate interests: protecting the auctions from fraud and non-payment; contract) | While your account is open; the status record then stays under your account number (see "Records" below) |
| Your backorders, bids and purchases (amounts, times, payment steps, due dates, reminders, the payer name on your bank transfer, refunds) | To run auctions and sales, settle disputes, and keep business and tax records (contract; legal obligation for tax records) | 6 years after the sale or auction ends. Once your account is closed they show only an account number |
| Your transfer details if you buy a name: registrant name, organisation, address, postcode, country, registrar tag, and when you pressed "Transfer [the name] to me now" (the request to start the transfer) | To transfer the name to you (contract) and as records (legal obligation) | Kept encrypted; deleted 6 years after the sale ends |
| Invoices and credit notes (your name and account number, the name bought, amounts) | Business and tax records (legal obligation) | 6 years after issue (and after the sale ends), then deleted |
| The devices you sign in from (a scrambled form of a random code your browser keeps, with the dates it was first and last used; we keep the last 20) | To email you when your account is signed in from a new device (legitimate interests: keeping your account safe) | 1 year after the device was last used, or until your account is closed |
| The auctions you watch, and whether you asked for our daily email of new auctions (and when you turned it on) | To email you when an auction you watch opens for bidding and before it ends (contract), and, only if you ask for it, a daily list of new auctions (consent: turn it off on your account page or with the link in any of those emails) | Watches: until you stop watching, or 30 days after the auction ends. The daily email choice: until you turn it off or close your account |
| The internet (IP) address you use to sign up, sign in, bid or backorder | Security, fraud and shill-bidding checks (legitimate interests) | 90 days, then deleted automatically |
| Copies of emails we send you | Proof of what we told you, and to resend if needed (legitimate interests) | 90 days, then deleted automatically |
| A record of what happened on your account (sign-ins, bids, approvals, changes) | Proof of what happened, for disputes and security (legitimate interests) | 6 years. It refers to you by account number only |
| If you sell names on the site: whether you sell as a business or a private person (shown on your listings), your full or business name, postal address and (if you give it) phone number (never shown on the site), and the names you list | To run your listings and deals, and because buyers must be told who they are buying from (contract; legal obligation) | While your account is open; details tied to a deal are kept with that deal (see the next row) |
| Your deals as a buyer or seller with an independent seller (the name, price, the steps each of you marked, problems reported and what was said about them) | To run the deal, settle disputes and decide on non-payment (contract; legitimate interests: protecting the auctions from fraud and non-payment) | 6 years after the deal ends. Once your account is closed they show only an account number |
| Commission invoices and credit notes to sellers | Business and tax records (legal obligation) | 6 years after issue, then deleted |
| Card payment records (Stripe payment id, amount, date, status, refunds) | To take and record your payment (contract) and as business and tax records (legal obligation) | 6 years |
| Messages you send us with the contact form (your email address, subject and message) | To answer you (legitimate interests) | In our email system for up to 2 years |
| Sign-ups whose email address was never confirmed | — | 7 days, then deleted automatically |
We don't ask for your date of birth, and we never see your card details. We ask for an address only from buyers (for the transfer) and from sellers, and for a phone number only from sellers who choose to give one.
When we review a new account we may look at publicly available information about you or your business, to keep out fake accounts (legitimate interests). A person, not a computer, decides whether to approve an account. We make no decisions about you by automated means alone.
3. Cookies
We use only the cookies the site needs to work. There are no advertising or tracking cookies, and no analytics scripts. Cloudflare's visitor statistics don't use cookies.
| Cookie | What it does | How long it lasts |
|---|---|---|
__Host-dt_session | Keeps you signed in | 24 hours after you last used the site. If you tick "Keep me signed in on this device", 30 days after you last used it |
__Host-dt_csrf | Stops other websites sending forms to us in your name | Until you close your browser |
__Host-dt_dev | Set when you sign in. It lets us recognise a device you have used before, so we can email you when your account is signed in from a new one | 1 year |
__cf_bm | Set by Cloudflare to tell people from bots and protect the site | 30 minutes |
All of these are strictly necessary: the site can't work safely without them. UK law (the Privacy and Electronic Communications Regulations) doesn't need your consent for strictly necessary cookies, so we don't show a cookie banner. The longer sign-in is only used when you ask for it by ticking the box.
4. Who else sees your data
Service providers who handle data for us, under data-processing terms:
- Cloudflare: protects the site and passes your visits to us (it sees your IP address and the pages you request).
- Google Workspace: sends and receives our emails.
- Logic Servers: hosts the server the site runs on, in the UK.
- Hetzner (Storage Box): stores encrypted backups of the site's database, in Germany.
- DigitalOcean: if you visit a domain name that is up for auction, a small server there sends you to its listing and sees your IP address.
- Stripe: takes card payments on its own payment page. We send it your email address and the amount; your card details go only to Stripe, never to us. Stripe is also responsible for payment data under its own privacy policy.
Others, only when needed:
- Nominet (the .uk registry), and your chosen registrar, when we transfer a name to you. Nominet is responsible for registrant data under its own privacy policy.
- The seller, in a sale we make as agent for a client, only where needed to complete the transfer or deal with a legal claim. Clients are never shown who bid or bought otherwise.
- The other party in a sale by an independent seller. When such an auction ends, the winning buyer sees the seller's account name, full or business name, whether they sell as a business or a private person, postal address, email address and phone number (if given), and the seller sees the buyer's name and email address, so that they can complete the sale between them. Each of them is then responsible for how they use those details. Nobody else is told who bid or bought.
- An escrow service, only if you and we (or you and the seller) agree to use one for a large sale.
- Our bank (payments), our accountant and HMRC (tax records), our professional advisers, and the police or courts where the law requires it.
We never sell your data or share it for marketing.
Some providers (such as Cloudflare and Google Workspace) may handle data outside the UK. Where they do, they use safeguards approved under UK law, such as the UK International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework.
5. How we protect it
The site runs as its own program with its own database. Passwords are hashed. Transfer details are encrypted in the database with a key kept separately. Backups are encrypted before they leave the server. Only DomainTree's administrator can see your details, and every time he looks at them it is recorded.
6. Your rights
You have the right to:
- get a copy of your data: use "Download my data" on your account page, or email us;
- have it corrected if it's wrong;
- have it deleted: use "Close my account" on your account page, or email us. We can't close an account with bids in a running auction, a purchase or deal in progress, a live listing or unpaid commission, and we keep the records described above for the time shown;
- object to, or ask us to restrict, how we use it;
- take it elsewhere (the download is a standard JSON file).
We answer requests within one month. If you're unhappy with how we handle your data, please tell us first; you can also complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.
7. Age
The site is for people aged 18 and over.
8. Changes
If we change this notice, we'll update the version at the top and, for important changes, tell account holders by email.