1. Who is responsible?
NameUK is operated by STEINBERG LTD, company number 17242845, at the address above. Contact support@nameuk.co.uk for privacy questions or requests.
2. Account, domain and order information
We collect your account name and email, a password hash, and the registrant name, organisation where applicable, address, phone and email needed for a domain registration. We retain your selected domains, registration term, reviewed prices, agreement version, order status, payment references and registrar confirmation. Accurate registrant details are required to register and maintain a domain. We use this information to provide the service you request and perform our contract with you.
3. Payments and service providers
Stripe supplies the payment form inside NameUK and processes your payment details directly. NameUK does not store your full card number or security code. We retain payment and refund references, amounts and status for order handling and reconciliation. Openprovider receives the registrant details and domain instructions needed to submit registrations to the relevant registry. Registry verification, registration-data disclosure and retention rules also apply.
Cloudflare hosts the website, API and database and provides Turnstile abuse protection. SiteGround supplies our support mailbox and SMTP delivery for account, security and order emails. These providers receive information necessary for their functions; their own privacy notices also explain their processing. See Cloudflare, Stripe, Openprovider and SiteGround.
4. Hosting, security and support
Requests may include an IP address, device headers, requested URL and technical diagnostics. We use these for delivery, abuse prevention and troubleshooting under our legitimate interests in operating a secure service. Support messages and relevant order/domain references help us respond to your request. Authorised support access requires a verified account and authenticator sign-in. Do not send us passwords, card details, authenticator codes or domain transfer codes by email.
5. Account verification and recovery
Verification links expire after 24 hours and password-reset links after one hour. Tokens are stored as hashes; queued email messages containing links are encrypted and cleared when no longer eligible for delivery. SiteGround receives the message needed to deliver your link. Authenticator setup secrets are encrypted; recovery codes are stored as hashes. Account security events, session times and delivery receipts help us investigate access and avoid duplicate messages. Resetting a password does not remove an enabled authenticator.
6. Domain controls and reminders
We pass your reviewed DNS, nameserver and contact instructions to Openprovider. Change receipts retain ownership identity, hashes, dates and checked outcomes. DNS values can include verification tokens; keep downloaded snapshots private. Optional reminder preferences use your verified account email and registrar renewal deadline. Required account, order and registry notices are separate from optional reminders. We send these service reminders under our legitimate interests in helping you meet renewal deadlines. You can turn optional NameUK reminders off in your dashboard.
7. Cookies and browser storage
Necessary storage keeps your sign-in session, basket and essential-storage preference. Turnstile and Stripe use security mechanisms for abuse and fraud prevention. We currently use no advertising or optional analytics trackers. You can clear browser storage in your browser settings; this signs you out and removes local basket or demo data. Explicitly labelled demo controls use fictional browser-local settings and never change a registered domain.
8. Retention
We retain active account and domain records while needed to provide and administer your service. Order, payment, agreement and support records may remain afterward where needed for accounting obligations, complaints, disputes, fraud prevention or registry requirements. We assess retention by the record's purpose, applicable obligation and any unresolved matter. Expired links cannot be reused; inactive email payloads are cleared by the scheduled service. Contact us to close an account or request deletion. We explain any records we must retain and why; deleting an account does not cancel a registry registration automatically.
9. International processing
Our providers and registries operate internationally, including in the European Economic Area and United States. Where information is processed outside the UK, applicable provider data-processing arrangements and recognised transfer safeguards apply, such as an adequacy arrangement or approved contractual safeguards. Contact us for the arrangements relevant to your information and how to obtain a copy. We do not sell your personal information.
10. Your rights and complaints
Depending on the applicable basis, you may request access, correction, erasure, restriction or portability. You may object to processing based on our legitimate interests and turn optional reminders off without stopping required registry notices. Email support@nameuk.co.uk; we may need to verify your identity without asking for your password. You can complain to the Information Commissioner's Office. We do not use solely automated profiling to decide your eligibility for credit, employment or similar matters.