Domain Registration Data Policy

1. Scope

This policy applies to all domains that Brunner Webhosting registers and manages as an accredited registrar of nic.at GmbH (.at, .co.at, .or.at) or as a reseller of another registrar (gTLDs and other ccTLDs). It also applies to domains registered through resellers of Brunner Webhosting.

2. What data we collect

For each domain we collect and store:

Without complete mandatory information, we do not carry out any registration, transfer or change of holder.

3. How we ensure accuracy

3.1 At registration (ex ante)

• Mandatory-field and format validation of all data (email syntax, international phone format, postal code/city plausibility).
• Confirmation of the email address via a confirmation link.
• Comparison with already known customer data (contract, billing and payment data). A holder whose identity we have already verified does not have to prove it again for further domains.

3.2 Ongoing and event-driven (ex post)

• We evaluate the data-quality reports provided by the registry and request a correction in the event of irregularities.
• Verification is triggered in particular by: missing mandatory information, undeliverable emails, unreachable phone numbers, implausible addresses, complaints or abuse reports, a request by the registry or an authority, as well as on a random-sample basis.

3.3 Evidence for a verification

• Natural persons: official photo ID (passport, identity card, driving licence) or identification via ID Austria, as well as proof of address (e.g. registration certificate, utility bill, not older than 3 months).
• Legal entities and associations: commercial-register or association-register extract (or foreign equivalent) as well as proof of address.

3.4 Deadlines and consequences

• From our request, the domain holder has 14 days to correct the data and/or provide evidence.
• For .at domains, the nic.at deadlines additionally apply: after expiry, the domain is removed from the DNS (serverHold); if the data is then not corrected within 30 days, the domain is revoked.
• We may remove a domain from the DNS ourselves (clientHold) if the data is grossly incorrect, cannot be corrected in the foreseeable future, or no valid contract exists.

3.5 Documentation

The result, date, method and reference number of each verification are documented and reported to the registry. We keep copies of evidence until 1 year after the end of the domain contract and delete them thereafter.

4. Publication of data (Whois/RDAP)

• If the domain holder is a legal entity, name, email address and telephone number are made publicly accessible. We recommend using general contact details for this (e.g. office@…, head office).
• Data of natural persons is not published.

5. Disclosure to legitimate parties

Legitimate access seekers – in particular authorities, law-enforcement agencies, computer emergency response teams (CSIRTs) and persons with a demonstrated legal interest – will, upon a lawful and sufficiently justified request, be granted access to non-public registration data.

Submitting a request: by email to domain-auskunft@brunner.at with

1. name, organisation and contact details of the applicant,
2. the affected domain,
3. the requested data,
4. legal basis and justification (purpose, legitimate interest),
5. for authorities: file number or reference.

Processing: We confirm receipt and answer every request without undue delay, at the latest within 72 hours. We check lawfulness under the GDPR and disclose only the data necessary for the purpose. A rejection will be justified. Requests and decisions are documented.

6. Obligations of domain holders and resellers

Domain holders must keep their data correct, complete and up to date and cooperate with verifications. Resellers of Brunner Webhosting are contractually obliged to collect the same data, to answer verification requests within 5 business days, and to retain evidence.

7. Contact

Questions about this policy: office@brunner.at · +43 7252 41870
Abuse reports: abuse@brunner.at