Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “Regulation”), Namecase GmbH (hereinafter “Namecase”), hereby provides below to its customers, including potential customers, as well as third parties in general (e.g. delegates, legal representatives, etc.) who come in contact with Namecase on behalf of or as mandated by customers, including potential customers (the “Data Subjects”), the information required by law relating to the processing of their personal data (“Data”).
About us
Data Controller
Through its legal representative Simone Ferracuti, Namecase GmbH, with registered office in Bonn, Bornheimerstrasse 127 Germany privacy@arubadomains.com
Data Protection Officer (DPO)
dpo@arubadomains.com
How we collect personal data
The data processed by the Data Controller are acquired as follows:
- from the Data Subject, also through remote communications techniques used by the Data Controller (e.g. websites, smartphone and tablet apps, call centres, etc.);
- from third parties (e.g. those arranging transactions for the Data Subject, business information etc.).
Data from public sources, such as public registers, lists, public domain documents (e.g. information contained in the register of companies at the Chambers of Commerce.
What data do we process?
| Category of data | Examples of types of data |
|---|---|
| Personal information | Name, surname, street address, nationality, province and municipality of residence, landline and/or mobile phone number, email address, access credentials, copy of an identification document |
| Banking information | IBAN and banking/postal account information (except for Credit Card number) |
| Log | source IP address, Logs |
Why are the data subject's data needed?
| PURPOSES OF THE PROCESSING | LEGAL BASIS |
|---|---|
| Registration and management of contact requests and/or information materials. Your personal data is processed to implement preliminary actions and those following a registration request, to manage information and contact requests, and/or to send informational materials, as well as to satisfy any and all other obligations arising herewith. | The legal basis for this processing is to provide the services relating to a request for registration, information and contact and/or to send information materials and to comply with legal requirements. The provision of the data is optional. However if the Data Subject refuses to provide the data, it will not be possible for the Data Controller to provide the requested service. |
| Management of the contractual relationship. The Data Subject’s personal data are processed to implement actions in preparation of and following the purchase of a Service and/or a Product, such as management of the relevant order, provision of the Service itself and/or production and/or shipping of the purchased Product, related invoicing and payment management, handling of any claims and/or notifications to the support service and provision of the support itself, sending communications for information as well as fulfilment of any and all other obligations arising from the contract. | The legal basis for this processing is to provide the services relating to the contractual relationship and to comply with the legal requirements. The provision of the data is optional. However if the Data Subject refuses to provide the data, it will not be possible for the Data Controller to provide the requested service. |
| Defending a right in court or out of court. The Data Subject’s personal data are processed to ascertain, exercise or defend a right of the Data Controller and/or to defend itself against third party claims, in court or out of court. | The legal basis of the processing is the pursuit of the legitimate interest of the Data Controller, given the balance of the rights of the latter and the Data Subject. |
| Information Security. The Data Subject’s personal data are processed to ensure network and information security, the protection of corporate assets and corporate systems. | The legal basis for this processing is compliance with the law and the pursuit of the legitimate interest of the Data Controller, given the balance of rights of the latter and the Data Subject. The Data Subject has the right to object at any time to the processing of their personal data for the purpose in question, on grounds relating to their personal situation. |
| Fraud prevention. The Data Subject’s personal data are processed to allow controls that monitor and prevent fraudulent payments by software systems running automated checks, prior to the negotiation of Services/Products. If these checks return a negative result it will be impossible to complete the transaction; the Data Subject can, of course, express their opinion, request an explanation, or challenge the decision by sending their reasons to Customer Support or to privacy@arubadomains.com . | The legal basis of the processing is the pursuit of the legitimate interest of the Data Controller, given the balance of the rights of the latter and the Data Subject. The Data Subject has the right to object at any time to the processing of their personal data for the purpose in question, on grounds relating to their personal situation. |
| Promotional activities for Services/Products similar to those purchased. The Data Subject’s personal data are processed in order to send emails relating to promotions and offers relating to the Data Controller’s Services/Products identical and/or similar to those covered by the current contract with the Data Subject, unless the Data Subject objected. | The legal basis for this processing is the legitimate interest of the Data Controller, in conjunction with Section 7(3) of the German Unfair Competition Act (UWG), to promote products or services in which the customer may reasonably be interested, taking into account the balance of the rights of the customer and the Data Controller. The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her for the purposes in question. |
| Promotional activities for Services/Products offered by Namecase. The processing of the Data Subject’s personal data is carried out for the purpose of sending newsletters and communications regarding offers, discounts and promotions of the Data Controller’s own Services/Products, subject to specific consent, through traditional methods (e.g. ordinary mail, telephone calls with an operator) and/or automated methods (e.g. e-mail, text messages, online instant messaging applications, web and mobile push notifications). | The legal basis for this processing is the consent given by the Data Subject prior to the processing itself, which can be freely revoked at any time, without prejudice to the lawfulness of the processing carried out previously. Any refusal by the Data Subject to give consent will make it impossible for the Data Controller to carry out promotional communications, without this having any prejudicial consequences on the existing contractual relationship. |
To whom do we communicate the data subject's data?
| Category of recipient | Purpose |
|---|---|
| Companies belonging to the Aruba S.p.A. Group (“Aruba Group”) | Fulfilment of administrative and accounting requirements, as well as those connected with the services requested |
| Third party providers and companies belonging to the Aruba Group | Provision of services (assistance, maintenance, product delivery/shipping, provision of additional services, network providers and electronic communication services) related to the requested service. Promotional/advertising activities only if the Data Subject has given specific consent to marketing. |
| Credit and electronic payment institutions, banks/post offices | Managing deposits, payments, reimbursements associated with the contractual service |
| External professionals/consultants and consulting firms | Fulfilment of legal requirements, exercising rights, protecting contractual rights, credit recovery |
| Financial Administration, Public Agencies, Legal Authorities, Supervisory and Oversight Authorities | Fulfilment of legal requirements, defence of rights; lists and registers held by Public Authorities or similar agencies based on specific regulations relating to the requested service |
| Formally mandated subjects or those with recognized legal rights | Legal representatives, administrators, guardians, etc. |
| Third-party owners of domain names offered for sale through the use of the services offered by Namecase GmbH | Provision of the Domain Brokerage Service, for the purpose of formulating and finalizing a customized economic offer for the transfer of the domain name requested by the interested party |
Persons belonging to these categories operate independently as separate data controllers or as data processors appointed by the Data Controller. The Data Controller’s personnel that are specially authorised for processing, including interns, temporary workers, consultants, may also have knowledge of the data, in relation to the performance of their assigned tasks. In no case shall personal data be disclosed and they shall not, therefore, be accessible by undefined parties, in any form, for example by them being made available or subject to consultation.
How we process the data subject's data
The data shall be processed using manual, electronic and remote means and in accordance with the requirements set by the relevant legislation, which seeks to ensure the confidentiality, integrity and availability of the Data, and to avoid material or moral damages.
Where we process the data subject's data
The Data Subject’s data is stored in archives located in European Union countries. Where necessary for the pursuit of the stated purposes, the Data Subject’s Data may be transferred abroad, to countries/organizations outside the European Union guaranteeing a level of personal data protection deemed adequate by the European Commission by its own decision or, otherwise, on the basis of other appropriate safeguards, such as the Standard Contractual Clauses adopted by the European Commission or the Data Subject’s consent. The Data Subject is entitled to obtain a copy of any appropriate safeguards, as well as the list of countries/organizations to which the data has been transferred by writing to privacy@arubadomains.com.
How long we retain the data subject's data
Data are stored in a form which enables the Data Subject to be identified for no longer than is necessary for the collection purposes, given the laws covering the activities and sectors in which the Data Controller operates. The Data necessary to comply with tax and accounting obligations are retained for 10 years from the termination of the contract (art. 2220 of the Civil Code). The Data related to unpaid or canceled or unfinished order requests are retained for 3 months. Logs are stored for a maximum period of 12 months from their generation. The contact Personal data are processed for promotional activities for up to 24 months from the termination of the contract, unless prior consent is revoked by the data subject. Furthermore, the processed Data as part of the marketing activities, are stored for this purpose for 24 months; Once the periods thus established have transpired, the Data will be deleted or processed anonymously, unless further retention is necessary to comply with obligations or to comply with orders issued by Public Authorities and/or Supervisory Bodies.
What are the data subject's rights?
The Data Subject shall contact privacy@arubadomains.com to exercise their the right to obtain, in the cases provided for in the Regulation, access to the data concerning him/her, deletion of the data, correction of incorrect data, completion of incomplete data, limitation on processing the data, portability of the data and opposition to the processing
The Data Subject also has the right to lodge a claim with the competent supervisory authority or with the agency performing its duties and exercises its rights in the member State where the breach occurred, as provided for in Art. 77 of the Regulation, as well as to file appropriate legal proceedings pursuant to Arts. 78 and 79 of the Regulation.
Version V.1.2_ArubaDomains_17.07.2025