1. Scope
ENARTIA SINGLE-MEMBER SOCIÉTÉ ANONYME (“Enartia”), operating under the Papaki and Top.Host brands, headquartered in Heraklion, Crete, at 66 Ionias Avenue, Postal Code 71306, General Commercial Registry (G.E.MI.) No. 077785727000, Tax Identification Number 999082935, Heraklion Tax Office (“we“), provides domain name registration services as accredited registrar or as reseller of upstream registrars. This notice sets out how we ensure accurate and complete registration data, how we publish it and how we disclose it, in accordance with Article 28 of Directive (EU) 2022/2555 (NIS2) and Αrt.20 L.5160/2024. It applies to all domain names we manage, under any top-level domain.
2. Registration data
We collect and maintain in a dedicated database: the domain name, the date of registration, the registrant’s name, e-mail address and telephone number, and, where different, the e-mail address and telephone number of the point of contact administering the domain name. We also record whether the registrant is a natural or a legal person. Registries may require additional data.
Registrants must provide accurate data and keep it up to date via their Customer Panel.
3. Verification
Verification is carried out on our behalf through a central verification system operated by team.blue NV as well as by registries or registrar suppliers. The same procedure applies to all domain names we manage. Its depth depends on the rules of the relevant registry and on the assessed risk of the registration.
3.1 Levels of verification
- Validation: every data element is checked automatically for completeness, correct format and consistency (for example e-mail syntax, international telephone format). Data that fails validation is not submitted to the registry.
- Contact verification: we confirm that a contact channel exists, is active and reaches the registrant.
- Identity verification: we confirm that the registrant is the person or organisation it claims to be.
3.2 When we verify
|
Event |
What we do |
|
Registration |
Validation, risk assessment and the verifications required for the domain name, either before or shortly after the domain registration |
|
Change of registrant or of contact details |
The requester is authenticated, the new data is validated and, where it concerns a verified element or a new registrant, verified again |
|
Transfer to us |
The registration data is verified, unless an existing verification can be reused |
|
Transfer away from us |
Not obstructed by the verification procedure |
|
Indication of inaccuracy |
Inaccuracy reports, abuse reports and notices from registries or authorities are reviewed and may lead to re-verification |
3.3 Risk assessment
Each registration is subject to an automated risk assessment of the domain name. It evaluates linguistic, structural and reputational indicators, such as similarity to existing domain names or trademarks, patterns typical of automatically generated names and links to known malicious activity. Where the assessment indicates elevated risk, identity verification is required. No other personal data is used for the risk assessment.
3.4 Methods
|
Check |
When |
Method |
|
E-mail address |
Always |
Link with a one-time code sent to the e-mail address, valid for a limited time and a limited number of attempts |
|
Telephone number |
Where the registry requires it |
One-time code by SMS or voice call, at the registrant’s choice |
|
Identity |
Where the risk assessment indicates elevated risk, or where a registry or authority requires it |
Verification of an official identity document for authenticity and validity on a page operated by our verification provider |
No biometric data is processed.
3.5 Reuse
A successful verification may be reused for the same person and the same data within the validity period set by the applicable rules. A new verification is required once that validity period has expired or the data has changed.
3.6 Registries and upstream registrars
Where a registry or our upstream registrar performs a verification itself, we do not collect the same data twice. We support the registrant through that procedure and keep our data aligned with its outcome. Where a registry requires the verification status to be reported, we report it.
3.7 Failed verification
Registrants are informed of the verification required and of the consequences of not completing it. If verification is not completed, a domain may be suspended, deleted or both. For active domain names, we notify the registrant and set a deadline for remediation; once it has passed, the domain name may be suspended or deleted. Immediate measures may be taken where the law or an imminent risk of abuse requires it. Stricter registry rules prevail.
3.8 Evidence
Each verification produces a record of its outcome, method, time and scope. We provide this evidence to registries, our upstream registrar or competent authorities on request.
4. Publication
Without undue delay after registration, we make publicly available the registration data that is not personal data, via the registration data directory service of the registry or of our upstream registrar. For legal persons, this includes the registrant’s name, telephone number and e-mail address. Data of natural persons is not published unless registry rules require it and a lawful basis exists.
5. Access for legitimate access seekers
Legitimate access seekers, such as competent authorities, law enforcement authorities and CSIRTs, may request registration data that is not publicly available. Requests must be sent to Customer Care and state the requester and its legal nature, the domain name, the data requested, the purpose and the legal basis.
We assess each request under applicable data protection law and reply without undue delay and in any event within 72 hours of receipt, either by disclosing the data in full or in part, or by refusing with reasons. Data is transmitted through a secure channel.
6. Data protection and contact
Details on the processing of personal data in the verification process, including service providers, retention and your rights, are set out in our Privacy Notice – Domain names registration
Questions about this policy: dpo@enartia.com