Privacy Policy

Gandi is attentive to the respect of your privacy and the protection of your personal data. In to be transparent with its customers, Gandi has adopted a "Privacy Policy" concerning the personal data collected or processed by Gandi on its various websites (hereinafter referred to as the "Websites").

Gandi has updated its Privacy Policy in accordance with applicable regulations, especially the Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the French Data Protection Act n°78-17 of 6 January 1978 as amended pertaining to data protection.

In this Privacy Policy, "Gandi" refers to the companies of Gandi group as a whole, all of these entities being subject to the same level of data protection.

Gandi is the data controller as it processes your data on its own behalf. Gandi has designated the French data protection authority (CNIL) as the lead authority in terms of data protection. The contact details of the data controller are :

• Gandi SAS
• 63-65 Boulevard Masséna, 75013 Paris

If you have any questions, you may contact Gandi’s Data Protection Officer, whose contact information is listed in section 7 below.

This Privacy Policy only applies to cases where Gandi acts as a data controller.

When Gandi is a processor of personal data, it processes the data in accordance with the instructions of the data controllers. Gandi may indeed process your data as a processor, when your data is processed by one of Gandi's client acting as a data controller. In this case, Gandi provides the data controllers with a data protection agreement in order to govern this processing.

As a user, when you browse the Websites and/or use the services offered on the Websites, Gandi may collect the following personal data about you:

- Identification data: name, ID card and/or passport number and/or any other identification number or document, nationality, residence permit, place and date of birth, IP address and its location, user ID;

- Contact data: postal and email address, telephone number;

- Data related to the interactions between the customer and Gandi: cookies, hidden pixels, customer experience, payment methods used, e-mail exchanges, ;

- Data relative to user accounts on social networks;

- Data relative to the processing of emails and communications sent to you, such as timestamp and date.

Regardless of the method of collection, Gandi undertakes to inform its users of:

- The purpose of the processing carried out;

- The compulsory or optional nature of the information requested and the possible consequences of a lack of response

- The recipients of the data;

- The existence and the methods for exercising your rights (including in particular the rights of access, rectification, and opposition to the processing of your personal data).

Gandi may process your personal data, as the case may be, on the basis of a legal obligation, your consent, a contractual relationship with you, and/or for the pursuit of its legitimate interests.

Gandi may thus process your personal data for one of the following purposes:

- To provide the services offered online;

- To communicate with you during the course of the online services and technical support;

- To fight against fraud; when placing an order proof of identity may be requested in order to limit fraud. In any case, no decision is based exclusively on automatic processing. Each decision is taken by one of our agents on the basis of information provided by our fraud risk detection tool. You have the right to present your point of view and to contest the decision.

- To send invitations to events, satisfaction surveys, promotional offers and newsletters;

- To organize promotional events;

- To carry out statistical analysis for profiling and segmentation purposes for targeted marketing, audience measurement and performance measurement;

- To meet its legal or administrative obligations;

- To fulfill contractual obligations arising from our relationship with the Trustee Authorities and Registries and in particular the transmission of domain name information (including personal data associated with the various contacts of the domain name and any additional information required by the Registry) to the Registries;

In the event that your personal data is processed for other purposes, Gandi will inform you and, when required by law, will obtain your prior consent.

Gandi is likely to collect your data via:

• Gandi's Websites (in particular when creating a customer account or subscribing to a service);
• Specialized websites for job applications (for example: Welcome to the jungle or Monster, etc.);
• Social networks: when you interact with Gandi on social networks, you accept that Gandi collects and processes this data for one of the purposes mentioned in article 3;
• Exchanges with us, whether you are a customer or a third party;
• Third parties, in particular in the context of the contractual relationship with our customers or resellers, or in the context of incoming transfers of domain names from other registrars;
• The companies of the Gandi Group.

Gandi may transfer your personal data outside the European Union, to countries that do not ensure an adequate level of protection of personal data.

This is notably the case in the context of the 24-hour technical support provided by the various entities of the Gandi Group, or when a registry or a technical operator of the registry for a TLD (Top Level Domain) is established in a third country.

Data transfers may also take place within the framework of the aforementioned purposes in connection with service providers (for example: recruitment, fight against fraud, statistical analyses, data aggregation, Zendesk Chat module, etc.).

Gandi may also transfer your data to third parties, if this is required by legal or regulatory provisions or in the context of legitimate requests from third parties (for example: respect of intellectual property rights, etc.).

These transfers are governed either by standard contractual clauses or by data protection agreements (DPA) concluded with the parties concerned, or by the provisions of Article 49, 1, b) of the GDPR.

Personal data are kept in accordance with legal and tax provisions for a period that does not exceed that which is necessary for the purposes for which data were collected and processed.

For each processing and purpose, Gandi has defined a maximum retention period for the data, proportionate to the purpose and objective pursued.

You have the following rights with regards to the processing of your personal data:

- to request access to your personal data ;

- to obtain the rectification of inaccurate data;

- in certain specific cases, obtain the deletion of some of your data;

- in certain specific cases, obtain the limitation of the processing that Gandi carries out;

- to object to the processing of your data on grounds relating to your particular situation or, regardless of your particular situation, to the use of your data for canvassing purposes;

- to receive the data you have provided and/or to request that it be passed on to another data controller;

- if you reside in France, to determine the status of your data after your passing away.

You may at any time revoke your consent to the processing of your data when this has your consent as its legal basis (e.g. sending the newsletter, publishing your information in the whois of Gandi, etc.).

If you have any questions about your rights or wish to exercise them, you can contact our Data Protection Officer:

- By email at the following address: "dpo@gandi.net";

- Via the online form available at the following address: https://helpdesk.gandi.net/hc/en-us;

- By post to the following address

• Data Protection Officer
• Gandi SAS
• 63-65 Boulevard Masséna
• 75013 Paris

You have the right to file a complaint with a supervisory authority. In France, the supervisory authority is the Commission Nationale de l'Informatique et des Libertés (CNIL).

CNIL’s contact information :

• 3 place de Fontenoy - TSA 80715
• 75334 Paris Cedex 07
• Telephone: +33.1.53.73.22.22
• Website: https://www.cnil.fr/

Your browsing on Gandi's Websites may result in the use of "cookies".

Cookies are files that a website or app sends to a user's device. They allow us to collect and store information relative to your actions on our Websites and mobile applications.

These cookies serve several purposes, as detailed below.

The maximum storage period for cookies is 13 months from the day you gave your consent to the integration of the cookie. At the end of this period, your consent will again be required.

8.1 Cookies used on the Websites

Gandi uses two types of cookies:

- Session or preference cookies, which are essential to the navigation and proper functioning of the Websites,

- Audience measurement cookies and other tracers that can be used to establish audience statistics for our Websites, to improve the navigation on our Websites, and to offer you targeted promotional offers according to your browsing habits.

These cookies are configured according to the criteria for exemption from consent as defined by the CNIL.

Gandi's news website uses embedded Youtube videos. By default, your refusal to accept the use of a cookie is assumed and this cookie is not deposited. You can consent to the deposit of this cookie via a contextual consent request, before playing a video. If you agree, these third party cookies are deposited directly by this service. Through these cookies, this third party will also collect and use your browsing data on its own behalf to provide targeted advertising and content based on your browsing history. For more information, we encourage you to read their privacy policy.

Concerning audience measurement cookies (Piano): these are configured according to the recommendations of the CNIL so as not to require the user's consent.

Nevertheless, you have the option of refusing the deposit of the Piano audience measurement cookies by clicking on the button below:

8.2 Other information stored on the user's terminal

8.2.1 Local storage and indexed databases.

Some of Gandi's Websites use the "local storage" and "Indexed DB" methods of the browser to store certain preference data that does not allow you to be identified. It is not technically possible to define an expiration date for this data, but you can delete it by deleting the data from the site in your browser.

8.2.2 pixel

Gandi takes all the necessary precautions, as well as the appropriate technical and organizational measures, to preserve the security of your personal data and, in particular, to prevent it from being damaged or accessed by unauthorized third parties.

In the event of a data breach, Gandi has adopted mitigation and recovery procedures, as well as alerting the persons concerned and the authorities (notably the CNIL) if necessary.

Gandi's Websites may contain links to third party websites such as Facebook, Twitter, LinkedIn, as well as to the websites of certain registries.

Gandi informs users that it has no control over the content of third-party websites or over the practices of these third parties in terms of protection of personal data that they may collect.

Consequently, Gandi declines all responsibility concerning the processing of your personal data by these third parties.