Privacy Policy

This Privacy Policy explains what personal data Nomeu OÜ ("nom.eu", "we", "us") collects when you visit the nom.eu website, create an account, register a name, look a name up or write to us. It also explains what we use that data for, who receives it, how long we keep it and what your rights are. A shorter guide to your rights is on our GDPR page.

We process personal data in line with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"). Words such as Account, Holder, Registry and Registrar mean the same here as in our Terms of Service.

1. Who is responsible

The data controller is Nomeu OÜ, Ahtri tn 12, 15551 Tallinn, Estonia, registry code 17644003 (Commercial Register of Estonia).

We have two roles. We run the nom.eu website, where you register names, and we run the .nom.eu registry, which keeps the record of who holds each .nom.eu name. If you hold a .nom.eu name through another registrar, that registrar passes your Holder details to the registry, and this policy applies to what the registry does with them.

Requests and questions about your personal data go to registry@nom.eu.

2. What we collect

When you create an account

• Your name, your email address and a password. We store the password only as a hash, never in a form we could read.
• The language you read the site in.
• We confirm your email address by sending a six-digit code to it. We keep only a hash of that code, and it stops working after ten minutes.

When you order a name

• Your postal address (street, city, postal code, state or region if you give one, and country) and your mobile phone number. Together with your name and email address, these are both your invoice details and the details of the Holder of your names. There are no separate contacts.
• Your country of citizenship, only if your address is outside the European Union, Iceland, Liechtenstein and Norway. We ask for it to show that you may hold a .nom.eu name.
• We confirm your phone number by a code sent by text message. The code is created, sent and checked by our messaging provider, Twilio. We keep the number and the date it was confirmed, not the code.
• Your cart: the names you chose, for how many years, and any promo code. Before you sign in the cart is kept in your session. Once you sign in it is kept with your account.
• Your orders and invoices: the names ordered, the prices, the VAT, any promo code used, whether each name was registered, any refund, and a copy of your name, address, phone number and email address as they were on the day of the order.
• Payment references. Card payments are handled by our payment provider, Stripe. You type your card details into a form that Stripe provides, so they go straight to Stripe and never reach our servers. We keep a customer reference at Stripe and the references of your payments and refunds. We never see or store your card number.
• Your names: the names registered to you, their dates and status, and the reference under which the registry knows you.

If we ask you to show that you may hold a name, as section 3.4 of the Terms allows, we also receive whatever information or documents you send us in reply.

When you use the site without an account

• Abuse reports: the name you report, the kind of abuse, your description, your email address, your name if you give it, the IP address the report was sent from and the language you used.
• Requests to be told when an ending opens: your email address, the ending you are waiting for, the name you had searched for (when you ask from a search result) and the language you used.
• Registrar applications: the company name and email address you give us, and the language you used.
• Messages you send us by email, and our answers.

Technical data

• For each visit we keep a session: your IP address, the type of browser you use and the time you were last active. If you are signed in, the session is linked to your account.
• We use your IP address to limit repeated sign-in attempts and repeated requests to the lookup and RDAP services.
• Like any website, our servers may record requests in logs that we use to keep the service secure and to find faults.
• The cookies we set are listed in section 9.

Data we receive from others

• From Stripe: whether a payment succeeded, failed or was refunded.
• From Twilio: whether the code you typed was the right one.
• From the Registry: the status of your names.

We do not buy data about you, and we do not build advertising profiles. The site shows no advertising and uses no analytics or tracking tools.

3. Why we use your data, and on which legal basis

Purpose	Data	Legal basis
Creating your account, signing you in and running your account	Account details	Performance of our contract with you (Article 6(1)(b) GDPR)
Confirming your email address and your phone number	Email address, phone number	Performance of the contract; our legitimate interest in being able to reach the Holder of a name and in preventing abuse (Article 6(1)(f))
Registering your names, recording you as their Holder at the Registry and keeping that record correct	Name, address, phone number, email address	Performance of the contract
Checking that you may hold a .nom.eu name	Country of your address, country of citizenship, anything you send us as proof	Performance of the contract; our legitimate interest in applying the rules of the ending
Taking payment, making refunds and issuing invoices	Orders, invoice details, payment references	Performance of the contract; legal obligation under accounting and tax law (Article 6(1)(c))
Sending you the messages the service needs: confirmation codes, password resets, order confirmations and messages about your names	Email address, phone number, language	Performance of the contract
Running the .nom.eu registry: the public record, disputes about a name, suspending or revoking a name	Holder details, names	Performance of the contract; our legitimate interest, and that of the public, in a reliable registry
Looking into abuse reports and answering them	Abuse reports	Our legitimate interest, and that of the public, in stopping abuse; legal obligation where the law requires us to act
Telling you when an ending opens	Email address, ending, name searched for	Your consent (Article 6(1)(a)), which you can withdraw at any time
Answering a registrar that applies for accreditation	Company name, email address	Steps taken at your request before a contract (Article 6(1)(b))
Keeping the site secure: sessions, limits on repeated attempts, preventing fraud	Technical data	Our legitimate interest in the security of our services
Complying with the law and with the orders of courts and authorities, and establishing or defending legal claims	Any of the above	Legal obligation; our legitimate interest

The details asked for at sign-up and at checkout are needed to register a name. Without them we cannot register one for you.

We send you only the messages the service needs. We do not send advertising, and we do not use your data for marketing.

4. The registry and the public record

4.1. When you register a name, we send your name, postal address, phone number and email address to the Registry as the details of the Holder. For .nom.eu names the Registry is us. Your country of citizenship and your payment details are not part of that record.

4.2. When you change your details in your Account, we pass the change on to the Registry, so that the Holder on record stays correct.

4.3. The registry publishes a record of every .nom.eu name through its lookup page and its RDAP service: the name, its status, the dates it was registered and expires, the registrar and the name servers. Because Holders of .nom.eu names are private individuals, your name, address, phone number and email address are not published.

4.4. We disclose a Holder's details only where the law requires it, for example to a court or to an authority entitled to them, or to someone who shows a legitimate interest that outweighs yours, for example a person who needs them to bring a legal claim about the name. Such a request must be made in writing to registry@nom.eu and say who is asking, which name it is about and why the details are needed. We look at each request on its own and give out only what the stated purpose needs.

4.5. When we offer names under other endings, we pass your details to the Registry that runs the ending, which needs them to operate the name. Some Registries ask for more, for example a national identity number or a date of birth. We ask you for it the first time you order a name under such an ending and keep it for your later orders. Each Registry processes your details under its own rules, as a controller in its own right, and may publish some of them in its own lookup service. We tell you before you order when an ending publishes more than .nom.eu does.

5. Who receives your data

We share personal data only with the recipients below, and only as far as the purpose requires.

Providers that work for us

• Stripe, our payment provider. Stripe receives your card details directly from you. From us it receives your name, email address, phone number and billing address, and the amount and reference of your order. Stripe also uses payment data for its own purposes, such as preventing fraud and meeting its legal duties, under its own privacy policy.
• Twilio, our messaging provider. It receives your phone number to send you a confirmation code by text message and to check the code you type.
• Our email provider, which receives your email address and the content of the messages we send you.
• Our hosting provider, on whose servers the site and its database run.

Others

• Registries of other endings, as described in section 4.5.
• Courts and public authorities, where the law requires us to disclose data.
• People who show a legitimate interest in the details of a Holder, as described in section 4.4.
• The Holder of a reported name, authorities and security organisations: when we look into an abuse report we may contact the Holder about what was reported, and we may pass a report on where the case calls for it.
• Our accountants and legal advisers, where they need the data for their work.
• A successor: if our business or the registry is transferred to another company, your data may be transferred with it.

We do not sell personal data, and we do not give it to anyone for their own marketing.

6. Where your data is processed

We keep your data within the European Economic Area where we can. Some of our providers, such as Stripe and Twilio, belong to groups based in the United States and may process data there. Where a provider processes data outside the European Economic Area, we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, for providers certified under it, or on the Commission's Standard Contractual Clauses. You can ask us which safeguard applies to a provider.

7. How long we keep your data

• Account details: for as long as your Account is open.
• Holder details at the registry: for as long as you hold a name. After a name is deleted or moved away, the record of who held it is kept for as long as it is needed to settle disputes and legal claims about the name.
• Orders, invoices and payment references: for the period that accounting and tax law requires. This includes the copy of your details on each order and invoice, which is kept even after your Account is closed.
• Your cart: until you order, empty it or, if you are not signed in, your session ends.
• Sessions: until you sign out or the session expires after a time without activity.
• Abuse reports: for as long as we need them to deal with the report and to keep a record of what was done about the name.
• Requests to be told when an ending opens: until we have told you, or until you ask us to remove your address.
• Registrar applications: for as long as we are dealing with the application and, if it leads to an agreement, for as long as that agreement lasts.
• Messages you send us: for as long as we need them to answer you and to keep a record of what was agreed.

We may keep data longer where the law requires it, or where we need it to establish or defend a legal claim.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct data that is wrong or incomplete;
• erase your data, where there is no legal reason for us to keep it;
• restrict its processing in certain cases;
• receive the data you gave us in a portable format;
• object to processing that is based on our legitimate interests;
• withdraw a consent you have given, at any time, without affecting what was done before.

How to use them:

• Correct your details: change them under My account, My details. We pass the change on to the Registry.
• Change your email address: under My account, Security. We send a code to the new address, and it only changes once you have entered that code.
• Change your password: under My account, Security.
• Change your language: with the language picker at the bottom of every page. It is saved on your account.
• Get a copy of your data: download it under My account, Privacy. You confirm with your password and get one file, at once, with everything we hold about you: your account details, your names, your orders and invoices, and what was sent to us with your email address. Your invoices as PDF are under My account, Orders and invoices. If you cannot sign in, write to registry@nom.eu from the email address on your Account.
• Close your account and erase your data: do it yourself under My account, Privacy, with your password, or write to the same address. An account can be closed once no name is left on it and no order is still open. A name is off the account once it has been moved away or, after it was given up or has expired, once it has been released. Closing removes your name, email address, phone number and postal address from the account, and it cannot be undone. Orders and invoices, with the copy of your details on them, are kept for the period that accounting and tax law requires. Closing your account does not delete two things that are kept under duties of their own: the record at the Registry of who held a name, which is kept for as long as it is needed to settle disputes about that name, and the records our payment provider, Stripe, holds about your payments, which it keeps for as long as the law requires of it.
• Anything else: write to registry@nom.eu.

We may ask you to confirm who you are before acting on a request. We answer within one month. The GDPR allows two more months for a complex request, and we tell you if we need them.

You also have the right to complain to a data protection authority: the one of the country where you live or work, or the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

9. Cookies and similar technologies

The site sets only the cookies it needs to work:

• a session cookie, which keeps you signed in and holds your cart and your language choice while you browse. It expires after a time without activity;
• a security cookie, which protects forms against forged requests;
• a "Remember me" cookie, only if you tick that box when signing in. It keeps you signed in on that browser until you sign out or the cookie expires.

These cookies are strictly necessary, so they need no consent. We use no analytics, advertising or social media cookies, and our pages load no scripts from other companies, with one exception: the page where you pay by card loads Stripe's script from js.stripe.com. On that page Stripe may set cookies of its own and read information about your device and browser, which it uses to prevent fraud.

The fonts on the site are served from our own domain, not from a font service.

While an order is being completed, the order page keeps a small counter in your browser's session storage so that it knows when to stop reloading. It is not sent to us and is gone when you close the tab.

10. Automated checks

Before taking an order the site checks automatically that each name is still free and that the country of your address, or your country of citizenship, meets section 3 of the Terms. If you think the result is wrong, write to registry@nom.eu and a person will look at it.

11. Children

Our services are for adults. You must be at least 18 years old to create an account, and we do not knowingly collect personal data from anyone younger. If you believe a minor has created an account, write to us and we will close it.

12. Security

We use encryption in transit, store passwords only in hashed form and restrict access to staff who need it. No system is perfectly secure, so we cannot promise that nothing will ever go wrong. If you think someone else has used your Account, tell us straight away at registry@nom.eu.

13. Links to other websites

The site links to websites we do not run, such as those of other registries. Their own privacy policies apply there, not this one.

14. Changes to this policy

We update this policy when our practices, our providers or the law change. The date shown on the page is the latest revision. Where a change materially affects how we use your data, we tell you by email before it takes effect.

15. Contact

Nomeu OÜ, Ahtri tn 12, 15551 Tallinn, Estonia. Email: registry@nom.eu. Abuse reports: abuse@nom.eu, or the abuse report form.