Legal information

Privacy Policy

How MIRAKL SRL (DomeniuLiber.ro) processes your data under the GDPR: domain holder data, WHOIS, payments, how long we keep it and your rights.

Updated: 7 November 2026
Seller: MIRAKL SRL
Romanian and EU law

This is a translation, provided for information only. The Romanian version is the one that applies. Read the Romanian version

In short

This policy explains what personal data we process when you visit DomeniuLiber.ro, create an account, register, transfer or renew a domain or contact us, why we process it, how long we keep it and what rights you have. The policy has been drawn up in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and with Romanian Law no. 190/2018.

Who the controller is

The controller of your data is MIRAKL SRL, a limited liability company that operates the DomeniuLiber.ro brand:

registered office: Str. Buciumului nr. 52, bl. 51-41, sc. 1, ap. 13, 200813 Craiova, Dolj County, Romania;
Trade Register number: J2006002203166;
Romanian tax ID (CUI) 19276334, VAT code RO19276334;
e-mail: [email protected].

MIRAKL SRL also operates other brands, with the same billing and support system. Your data is used only for your relationship with DomeniuLiber.ro.

We have not appointed a data protection officer (DPO) because, given the nature and volume of the processing, an appointment is not mandatory under Article 37 GDPR and Law no. 190/2018. For any question about your data you can write to us at [email protected].

What data we process and where it comes from

Depending on your relationship with us, we process the following categories of data:

identification and contact data: first name and surname, company name (where applicable), postal address, e-mail address, telephone number, tax code (for legal entities);
account data: the sign-in e-mail address, password (stored only in irreversibly encrypted form), sign-in history; if you use them: two-step sign-in settings, the public key of your passkeys (the private key stays on your device) and the identifier of the Google, Microsoft or Facebook account you sign in with, together with the e-mail address received from that provider;
billing and payment data: the domains ordered, invoices, payments, the transaction status, and possibly the last digits and type of the card, as passed to us by the payment processor. We never see or store your full card details;
domain data: the details of the holder and of the contact persons (administrative, technical, billing), the name servers and the history of operations (registration, transfer, renewal);
the personal numeric code (CNP), only if you register a .ro domain in the name of a natural person: ROTLD requires the CNP of a natural-person holder;
data from communications: the content of messages, support tickets, contact, withdrawal and abuse report forms, and any attachments you send us;
technical data: IP address, date and time of access, browser type, pages visited, security events, site logs;
strictly necessary cookies, described in the Cookie Policy.

As a rule, we collect data directly from you. In certain cases we receive it from third parties: from NETOPIA Payments (payment status), from the domain registries and the partner registrar (domain status, transfer codes), from ANAF, the Romanian tax authority (a company’s name and address, based on the Romanian tax ID (CUI) you enter when ordering, from ANAF’s public data), from Google, Microsoft or Meta (Facebook), if you choose to sign in with one of their accounts (see below), or from people who send us a report about a domain registered by you (Article 14 GDPR). If you provide us with data about other people (for example contact persons for a domain), you must inform them about this policy beforehand.

Signing in with Google, Microsoft or Facebook. If you choose one of these options, the relevant provider (Google Ireland Ltd., Microsoft Ireland Operations Ltd. or Meta Platforms Ireland Ltd., independent controllers) sends us, with the consent you give on its page, the account identifier, your name and e-mail address. We use them only to recognise you when you sign in and, when a new account is created, to fill in the form (legal basis: performance of the contract, Article 6(1)(b) GDPR). We do not receive your account password from these providers and we do not post anything on your behalf. We keep the link until you remove it in My account › Profile › Sign-in › Disconnect or until the account is closed. You can also ask for this data to be deleted at any time by writing to us at [email protected].

Purposes, legal bases and retention periods

The legal bases are those set out in Article 6(1) GDPR: (b) performance of the contract or steps taken before entering into it, (c) compliance with a legal obligation and (f) our legitimate interest.

Purpose	Data	Legal basis	Retention period
Creating and managing the account; concluding and performing the contract (registration, transfer, renewal, expiry reminders)	Identification and contact, account data, domains ordered	Art. 6(1)(b) – performance of the contract	For the duration of the contract and a further 3 years after it ends (the general limitation period), for any complaints or disputes
Invoicing, accounting records and sending invoices through the Romanian national RO e-Factura system	Name/company name, address, tax code (legal entities), services, amounts, payment details	Art. 6(1)(c) – legal obligation (Accounting Law no. 82/1991, the Tax Code, Government Emergency Ordinance (OUG) no. 120/2021)	5 years from 1 July of the year following the year in which the financial year in which the documents were drawn up ended (Article 25 of Law no. 82/1991); longer if the law requires a longer period
Online card payments through NETOPIA Payments; prevention of payment fraud; refunds	Transaction identifier, amount, payment status, masked card details (if passed to us by the processor)	Art. 6(1)(b) – performance of the contract; Art. 6(1)(c) – accounting obligations; Art. 6(1)(f) – fraud prevention	As for accounting documents (see the row above)
Registration, renewal and transfer of domains; sending data to registries and to the partner registrar; ensuring the accuracy of registration data	The details of the domain holder and contact persons, including the CNP of a natural-person holder of a .ro domain, the domain name, the name servers, the history of operations	Art. 6(1)(b) – performance of the contract; Art. 6(1)(c) – legal obligations concerning the accuracy of and access to registration data (Article 19 of Government Emergency Ordinance (OUG) no. 155/2024, which transposes the NIS2 Directive)	For the duration of the domain registration and a further 3 years after its expiry or transfer, in compliance with the policies of the competent registry and the statutory time limits
Automatically filling in a company’s details based on its Romanian tax ID (CUI) (when ordering and in the profile)	The CUI you enter; the name, address and registration number received from ANAF’s public data	Art. 6(1)(b) – steps taken before entering into the contract, at your request	The data remains in your account, like the billing details; the query itself is not stored separately
Support and replies to messages sent through the contact form, by e-mail or from the client account	Identification and contact, content of the message and of the ticket, attachments	Art. 6(1)(b) – for clients and for pre-contract requests; Art. 6(1)(f) – the legitimate interest in replying to requests	For the duration of the contract and a further 3 years; for people who are not clients, up to 3 years after the ticket is closed
Exercising the right of withdrawal through the online function and sending the acknowledgement of receipt	Name, identification of the contract/order, e-mail, date and time of submission, content of the statement	Art. 6(1)(c) – legal obligation (Government Emergency Ordinance (OUG) no. 34/2014, Article 11¹)	3 years from resolution; if a refund has been made, the related documents are kept as accounting documents
Receiving and handling reports about domains used abusively, notifying decisions and handling appeals	The details of the person making the report (name, e-mail – optional for reports concerning child sexual abuse), the domains and URLs reported, explanations and evidence, the details of the client concerned, the decision and the reasons for it	Art. 6(1)(c) – legal obligations; Art. 6(1)(f) – protection of the services and of third parties	3 years from closure of the case; longer if necessary for ongoing proceedings
Security of the site and of the client account, prevention of attacks and abuse, diagnosis of technical problems	IP address, access and error logs, security events, security cookies	Art. 6(1)(f) – the legitimate interest in ensuring the security and functioning of the services	Usually up to 90 days; longer only for logs relating to a specific security incident, for as long as needed for the investigation
Complying with legal obligations towards the authorities; establishing, exercising or defending a legal claim in court	The data actually needed for the authority’s request or for the dispute	Art. 6(1)(c) – legal obligation (for example Article 16 of Law no. 365/2002); Art. 6(1)(f) – defending our rights	For the duration of the proceedings and until the applicable limitation periods have expired

Where we rely on legitimate interest, we have assessed that it (security of the services, fraud prevention, replying to requests, defending our rights) does not override your rights and freedoms. You can object to this processing at any time (see section 8).

We do not send newsletters or marketing communications. We only write to you about your orders, domains and invoices.

CNP. We do not ask for your personal numeric code (CNP) for invoicing; for invoices issued to natural persons through RO e-Factura we use, as required by law, the generic code provided for cases where the buyer does not provide their CNP. We ask for the CNP only for the natural-person holder of a .ro domain, because ROTLD requires it for registration. We send it only to ROTLD, we do not publish it and we do not process it on the basis of legitimate interest.

Domain registration data (WHOIS / RDAP)

To register a domain, we must send the details of the holder and of the contact persons to the registry responsible for the chosen extension and, where applicable, to the accredited registrar we work with. Without this data the domain cannot be registered. Registries act as independent controllers and apply their own privacy and publication policies.

.ro – ROTLD (managed by the National Institute for Research and Development in Informatics – ICI Bucharest): the holder’s details are kept by ROTLD in accordance with its Registration Rules. ROTLD’s standard WHOIS service (port 43) does not display the holder’s details; the information that can be viewed through the WHOIS web interface is determined by ROTLD’s policy.
.eu – EURid: for natural-person holders, the public WHOIS shows only the e-mail address and the language; for legal entities it also shows the name, city and country. Other data is provided only in response to justified requests, in accordance with EURid’s policy.
.com, .net and other generic extensions (for example Verisign for .com/.net): ICANN’s registration data policy applies; as a rule, the holder’s personal data is not shown publicly (it is redacted) in WHOIS / RDAP, but it is kept by the registrar and the registry.
other extensions: the rules of the relevant registry apply, as shown when ordering or on the registry’s website.

Accuracy of data (NIS2). Under the cybersecurity legislation (Government Emergency Ordinance (OUG) no. 155/2024, which transposes Directive (EU) 2022/2555 – NIS2), entities providing domain name registration services, including resellers, must collect and maintain accurate and complete registration data, apply verification procedures and provide access to this data to access seekers who have a legitimate interest and a justified request, usually within 72 hours at most. We may therefore ask you to confirm or correct your details (for example by verifying your e-mail address). Inaccurate data may lead to the suspension or deletion of the domain, in accordance with the registry’s rules. Data that is not personal data (for example the data of a legal entity) may be published.

Recipients

We do not sell or rent out your data. We disclose it only to the extent necessary, to the following recipients:

the domain registries – ROTLD / ICI Bucharest (.ro), EURid (.eu), Verisign (.com/.net) and the registries of other extensions – as well as the accredited partner registrar through which we register certain domains (independent controllers);
NETOPIA Financial Services S.A. (Romania) – the card payment processor (NETOPIA Payments), which processes card data as an independent controller, in accordance with its own privacy policy;
the provider of the servers on which the site and our billing and support system run, based in the European Union (processor);
the e-invoicing provider through which we issue tax invoices (processor);
our transactional e-mail provider, which delivers automated messages (confirmations, invoices, reminders) (processor);
Cloudflare, Inc. (USA), if the site is served through the Cloudflare network (DDoS protection and security, processor);
the National Agency for Fiscal Administration (ANAF), the Romanian tax authority, through the RO e-Factura system, and other public authorities (courts, prosecutors’ offices, police, ANPC, ANSPDCP, ANCOM), when the law requires us to;
professional advisers (accountant, lawyer, auditor), bound by confidentiality, only to the extent necessary.

Transfers outside the European Union

Our servers are located in the European Union. Some data may nevertheless reach countries outside the European Economic Area:

registries and registrars outside the EEA (for example Verisign for .com/.net or the partner registrar for generic extensions): the transfer is necessary for the performance of the domain registration contract you requested (Article 49(1)(b) GDPR) or is made on the basis of the applicable appropriate safeguards (adequacy decision or standard contractual clauses);
Cloudflare, Inc. (USA), if used: the transfer takes place on the basis of the European Commission’s adequacy decision on the EU-US Data Privacy Framework, under which Cloudflare is certified, and, additionally, standard contractual clauses.

You can obtain further information about the applicable safeguards by writing to us at [email protected].

Is providing the data mandatory?

Identification, contact and billing data is necessary to conclude the contract and to meet tax obligations; without it we cannot register the domain. The details of a domain holder are required by the registries and by law. Technical data (logs, IP address) is collected automatically when you use the site.

Your rights and how to exercise them

Under Articles 15–22 GDPR, you have the following rights:

the right of access – to find out whether we process data about you and to receive a copy of it;
the right to rectification – to correct inaccurate or incomplete data (you can update much of it directly from the client account);
the right to erasure – in the cases provided for in Article 17 GDPR, except for data the law requires us to keep (for example invoices) and data needed while the domain is registered;
the right to restriction of processing, in the cases provided for in Article 18 GDPR;
the right to data portability – to receive the data you have provided, processed on the basis of a contract, in a structured, machine-readable format;
the right to object – to object to processing based on legitimate interest, on grounds relating to your particular situation.

To exercise your rights, write to us at [email protected] or open a ticket from the client account. We will reply without undue delay and within one month of receipt at the latest; this period may be extended by a further two months for complex or numerous requests, in which case we will inform you. Exercising your rights is free of charge. We may ask you for additional information to confirm your identity, so that we do not disclose another person’s data.

The right to lodge a complaint with ANSPDCP

If you believe that we process your data in breach of the law, you have the right to lodge a complaint with the supervisory authority:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) (the Romanian National Supervisory Authority for Personal Data Processing)
B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, 010336 Bucharest, Romania
E-mail: anspdcp@dataprotection.ro
Website: https://www.dataprotection.ro

We encourage you to contact us first, so that we can resolve the issue directly. You also have the right to bring proceedings before a court.

Automated decisions

We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). Automated security tools (for example temporarily blocking an IP address after repeated failed sign-in attempts) serve to protect the services; if they affect you, you can ask at any time for a review by a person.

Data security

We apply appropriate technical and organisational measures (Article 32 GDPR), including: encrypted connections (HTTPS/TLS), passwords stored only in hashed form, access to data limited to the people who need it, keeping systems up to date, a firewall and protection against attacks, and logging of administrative access. Full card details are entered exclusively on NETOPIA Payments’ secure page. No measure guarantees absolute security; in the event of a personal data breach, we will notify ANSPDCP and, where the law requires it, the data subjects.

Minors

Our services are intended for persons aged at least 18 and for legal entities. We do not knowingly collect data about minors. If you find out that a minor has provided us with data, write to us and we will delete it, except for data the law requires us to keep.

Changes to this policy

We may update this policy when our processing, providers or the legislation change. The version in force is published on this page, with the date of the last update. We will inform you by e-mail or in the client account about important changes before they take effect. The policy applies from 6 November 2026.