Privacy Policy

1. Introduction

Varlox (Autonomo), trading as Varlox, is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our domain registration and management services.

This policy is compliant with the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 — and applicable Spanish data protection legislation (LOPDGDD).

2. Data We Collect

We collect the following categories of personal data:

2.1 Account Information

• First name and last name
• Email address
• Phone number
• Company name (if applicable)
• Postal address (street, city, postal code, country)
• Account password (stored in hashed form)

2.2 Domain Registration Data

• Domain name(s) registered
• Registrant contact details (as required by domain registries)
• Administrative and technical contact information
• DNS configuration data
• DNSSEC key data

2.3 Technical and Usage Data

• IP address and browser information
• Pages visited and actions taken on our website
• Login timestamps and session data
• Cookies and similar technologies (see Section 9)

3. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6(1):

• Contract performance (Art. 6(1)(b)): Processing necessary for domain registration, management, and related services.
• Legal obligation (Art. 6(1)(c)): Processing required to comply with registry regulations (DENIC, AFNIC, SIDN, EURid, and others) and applicable laws.
• Legitimate interest (Art. 6(1)(f)): Processing for fraud prevention, security, and service improvement.
• Consent (Art. 6(1)(a)): Processing for marketing communications (where applicable), which you may withdraw at any time.

4. Data Sharing with Domain Registries

When you register a domain name through Varlox, we are required to share certain personal data with the relevant registry operator. Each registry acts as an independent data controller. The data shared typically includes:

• Registrant name (individual or organization)
• Registrant contact information (email, phone, address)
• Administrative and technical contact details
• Name server information

Below are details for key European registries. For other TLDs, equivalent data sharing applies in accordance with the respective registry's policies.

4.1. DENIC (.DE)

DENIC requires registrant name, address, and contact data. Public WHOIS access is restricted in compliance with GDPR. See DENIC Data Protection.

4.2. AFNIC (.FR)

AFNIC requires registrant name, address, email, phone, and SIREN/SIRET for legal entities. Personal data is redacted from public WHOIS for natural persons. See AFNIC Privacy Policy.

4.3. Red.es (.ES)

Red.es requires registrant name, address, email, and identification (DNI/NIE/NIF or passport). Personal contact details are not publicly displayed. See Red.es Data Protection.

4.4. SIDN (.NL)

SIDN requires registrant name, contact information, and administrative/technical contacts. WHOIS displays limited information; personal data is opt-out by default. See SIDN Privacy Statement.

4.5. EURid (.EU)

EURid requires registrant name, email, country, and language preference. Data sharing is mandated by EU Regulation (EC) No 733/2002. WHOIS hides personal data by default. EURid may request eligibility documentation (EU/EEA establishment). See EURid Data Protection Policy.

4.6. Other Registries

For other TLDs (.com, .net, .org, .it, .be, .at, .ch, .dk, .io, etc.), equivalent registrant data is shared with the respective registry in accordance with their published data protection policies.

5. Data Sharing Summary

Recipient	Data Shared	Purpose	Legal Basis
Domain registries (DENIC, AFNIC, Red.es, SIDN, EURid, etc.)	Registrant name, contact info, name servers	Domain registration and management	Contract / Legal obligation
Payment processors	Billing name, email, payment details	Payment processing	Contract
Law enforcement	As required by law	Legal compliance	Legal obligation

We do not sell your personal data to third parties. We do not share your data with any parties other than those listed above unless required by law or with your explicit consent.

7. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• Account data: Retained for the duration of your account and for 2 years after account closure.
• Domain registration data: Retained for the duration of the domain registration and for 1 year after the domain expires or is transferred away.
• Transaction and billing data: Retained for 7 years as required by Spanish accounting regulations.
• Technical logs: Retained for up to 12 months.

8. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): You may request deletion of your data, subject to legal retention requirements and active domain registrations.
• Right to restrict processing (Art. 18): You may request that we limit the processing of your data in certain circumstances.
• Right to data portability (Art. 20): You may request your data in a structured, machine-readable format.
• Right to object (Art. 21): You may object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD) or any other EU supervisory authority.

9. Cookies

Our website uses cookies and similar technologies for the following purposes:

• Essential cookies: Required for website functionality and authentication. These cannot be disabled.
• Analytics cookies: Used to understand how visitors use our website. These are only placed with your consent.

You can manage your cookie preferences through your browser settings.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/SSL) and at rest
• Hashed password storage using industry-standard algorithms
• Access controls and role-based permissions
• Regular security assessments and updates
• Data backup and disaster recovery procedures

11. International Transfers

Your data is primarily processed within the European Economic Area (EEA). In cases where data is transferred outside the EEA, we ensure adequate protection through EU Standard Contractual Clauses or equivalent mechanisms recognized by the European Commission.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. If the changes are significant, we will notify you via email. Continued use of our services after notification constitutes acceptance of the updated policy.

13. Contact

For questions or concerns about this Privacy Policy or your personal data, please contact us:

Varlox (Autonomo)
Urb. Vistalmar Duquesa Norte 26a, Manilva, 29692, Spain
Email: [email protected]
VAT: ESY5460748X