Privacy Policy

This policy explains what personal data we process when you visit GazduireOnline.ro, create an account, buy hosting services or domains, or contact us; why we process it; how long we keep it; and what rights you have. It is drawn up in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.

The controller of your data is MIRAKL SRL, a Romanian limited liability company operating the GazduireOnline.ro brand:

• registered office: Str. Buciumului nr. 52, bl. 51-41, sc. 1, ap. 13, Craiova, Dolj County, postal code 200813, Romania;
• Trade Register number: J2006002203166;
• tax identification number (CUI) 19276334, VAT code RO19276334;
• e-mail: [email protected].

We have not appointed a data protection officer (DPO) because, given the nature and scale of our processing, an appointment is not mandatory under Article 37 GDPR and Law no. 190/2018. For any question about your data, write to [email protected], in Romanian or English.

Depending on your relationship with us, we process the following categories of data:

• identification and contact data: first and last name, company name (if applicable), postal address, e-mail address, phone number if you choose to provide it, tax code (for legal entities);
• account data: username, password (stored only in irreversibly hashed form), login history, preferences; if you use them: your two-step sign-in settings, the public key of your passkeys (the private key stays on your device) and the identifier of the Google, Microsoft or Facebook account you sign in with, together with the e-mail address it gives us;
• billing and payment data: services ordered, invoices, payments, transaction status and, where the payment processor sends them, the last digits and type of the card. We never see or store full card details;
• domain data: the registrant and contact (administrative, technical, billing) details you enter when registering or transferring a domain;
• communications data: the content of messages, live chat conversations, support tickets, the contact, withdrawal and abuse-report forms, and any attachments you send us;
• technical data: IP address, date and time of access, browser and operating system type, pages accessed, security events, server and service logs (web, e-mail, FTP, control panel);
• strictly necessary cookies, described in the Cookie Policy.

We normally collect data directly from you. In some cases we receive it from third parties: from NETOPIA Payments (payment status), from domain registries and the partner registrar (domain status, transfer codes), from Cloudflare (security events), from Google, Microsoft or Meta (Facebook) if you choose to sign in with one of their accounts (see below), or from people who send us a notice about content you host (Article 14 GDPR). If you give us data about other people (for example, contacts for a domain), you must inform them about this policy beforehand.

Signing in with Google, Microsoft or Facebook. If you choose one of these options, that provider (Google Ireland Ltd., Microsoft Ireland Operations Ltd. or Meta Platforms Ireland Ltd., independent controllers) sends us, with the consent you give on its page, your account identifier, name and e-mail address. We use them only to recognise you when you sign in and, when you create a new account, to fill in the form (legal basis: performance of the contract, Article 6(1)(b) GDPR). We never receive your password for these accounts and we never post anything on your behalf. We keep the link until you remove it in My account › Sign-in methods › Disconnect or until the account is closed. You can also ask us at any time to delete this data by writing to [email protected].

The legal bases are those in Article 6(1) GDPR: (b) performance of a contract or steps prior to entering into it, (c) compliance with a legal obligation, (f) our legitimate interests and (a) consent.

Where we rely on legitimate interests, we have assessed that those interests (service security, fraud prevention, answering requests, defending our rights) are not overridden by your rights and freedoms. You can object to this processing at any time (see section 9).

To register a domain, we must send the registrant and contact data to the registry responsible for the chosen extension and, where applicable, to the accredited registrar we work with. Without this data the domain cannot be registered. Registries act as independent controllers and apply their own privacy and publication policies.

• .ro – ROTLD (operated by the National Institute for Research and Development in Informatics – ICI Bucharest): ROTLD keeps the registrant data under its Registration Rules. ROTLD's standard WHOIS service (port 43) does not display registrant data; what can be viewed through the web WHOIS interface is set by ROTLD's policy.
• .eu – EURid: for registrants who are natural persons, the public WHOIS shows only the e-mail address and language; for legal persons it also shows the name, city and country. Other data is disclosed only on justified request, under EURid's policy.
• .com, .net and other generic extensions (for example Verisign for .com/.net): ICANN's registration data policy applies; as a rule, the registrant's personal data is not shown publicly (it is redacted) in WHOIS / RDAP, but it is kept by the registrar and the registry.
• other extensions: the rules of the relevant registry apply, as shown when ordering or on the registry's website.

Data accuracy (NIS2). Under cybersecurity legislation (GEO no. 155/2024, transposing Directive (EU) 2022/2555 – NIS2), entities providing domain name registration services, including resellers, must collect and maintain accurate and complete registration data, apply verification procedures and give access to that data to legitimate access seekers with a duly justified request, as a rule within 72 hours. We may therefore ask you to confirm or correct your data (for example, by verifying your e-mail address). Inaccurate data may lead to the domain being suspended or deleted under the registry's rules. Data that is not personal data (for example, a legal entity's data) may be published.

Personal data that our customers store on the services (websites, databases, mailboxes, files) is processed by the customer as controller. For that data, MIRAKL SRL acts as a processor (Article 28 GDPR) and processes it only to provide the service and on the customer's instructions, as described in the Data Processing Agreement.

If you visit a website we host, or receive an e-mail sent from our servers, and wish to exercise your rights, please contact the owner of that website first. If you contact us, we will pass your request on to the customer where possible.

We do not sell or rent your data. We disclose it only as far as necessary, to the following recipients:

• the providers of the data centres in the European Union where our servers are located (processors); they are listed on the List of sub-processors;
• Cloudflare, Inc. (USA) – content delivery network, DDoS protection and security for our website (processor);
• NETOPIA Financial Services S.A. (Romania) – card payment processor (NETOPIA Payments), which processes card data as an independent controller under its own privacy policy;
• domain registries – ROTLD / ICI Bucharest (.ro), EURid (.eu), Verisign (.com/.net) and the registries of other extensions – and the accredited partner registrar through which we register certain domains (independent controllers);
• our transactional e-mail provider, which delivers automated messages (confirmations, invoices, notifications) (processor);
• the National Agency for Fiscal Administration (ANAF), through the RO e-Factura system, and other public authorities (courts, prosecutors, police, ANPC, ANSPDCP, ANCOM) where the law requires it;
• professional advisers (accountant, lawyer, auditor), bound by confidentiality, only as far as necessary.

Our billing and support system is installed on our own servers; the software vendor does not receive your data through its use.

Our servers are located in the European Union. Some data may nevertheless leave the European Economic Area:

• Cloudflare, Inc. (USA): the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Cloudflare is certified, and additionally on the standard contractual clauses approved by the Commission;
• registries and registrars outside the EEA (for example Verisign for .com/.net): the transfer is necessary to perform the domain registration contract you requested (Article 49(1)(b) GDPR) or relies on the applicable appropriate safeguards (adequacy decision or standard contractual clauses).

You can obtain further information on the applicable safeguards by writing to [email protected].

Identification, contact and billing data are needed to conclude the contract and to meet our tax obligations; without them we cannot provide the services. Domain registrant data is required by the registries and by law. Providing data for the newsletter is entirely optional. Technical data (logs, IP address) is collected automatically when you use the website or the services.

Under Articles 15–22 GDPR, you have the following rights:

• right of access – to find out whether we process data about you and to receive a copy;
• right to rectification – to correct inaccurate or incomplete data (much of it you can update directly in the client area);
• right to erasure – in the cases set out in Article 17 GDPR, except for data the law requires us to keep (for example, invoices);
• right to restriction of processing, in the cases set out in Article 18 GDPR;
• right to data portability – to receive the data you provided, processed on the basis of contract or consent, in a structured, machine-readable format;
• right to object – to processing based on legitimate interests, on grounds relating to your particular situation, and at any time to direct marketing;
• right to withdraw consent at any time, without affecting the lawfulness of earlier processing (for example, through the unsubscribe link in every newsletter).

To exercise your rights, write to [email protected] or open a ticket in the client area. We reply without undue delay and within one month of receipt at the latest; this may be extended by two further months for complex or numerous requests, in which case we will tell you. Exercising your rights is free of charge. We may ask for additional information to confirm your identity, so that we do not disclose someone else's data.

If you believe we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority:

National Supervisory Authority for Personal Data Processing (ANSPDCP)
B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, postal code 010336, Bucharest, Romania
E-mail: anspdcp@dataprotection.ro
Website: https://www.dataprotection.ro

We encourage you to contact us first so that we can resolve the issue directly. You also have the right to go to court.

We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). Automated security tools (for example, traffic filtering by Cloudflare, or temporarily blocking an IP address after repeated failed login attempts) serve to protect the services; if they affect you, you can always ask for a review by a person.

We apply appropriate technical and organisational measures (Article 32 GDPR), including: encrypted connections (HTTPS/TLS), passwords stored only as hashes, access to data limited to those who need it, keeping systems up to date, firewalls and attack protection, and logging of administrative access. Full card details are entered only on the secure NETOPIA Payments page. No measure guarantees absolute security; in the event of a personal data breach, we will notify ANSPDCP and, where the law requires it, the data subjects.

Our services are intended for persons aged at least 18 and for legal entities. We do not knowingly collect data about minors. If you learn that a minor has given us data, write to us and we will delete it, except for data the law requires us to keep.

We may update this policy when our processing, providers or the law change. The version in force is published on this page with the date of the last update. We will inform you of significant changes by e-mail or in the client area before they take effect. This policy applies from 27 October 2026. In case of any discrepancy, the Romanian version prevails.

See also: Cookie Policy, Terms and Conditions, Data Processing Agreement, Legal information.