GOpenCDR joint controller arrangement

What this arrangement is

Where Gelhaus Solutions hosts a TLD for a TLD operator, the two decide together why and how the registration data in that TLD is processed. Gelhaus Solutions sets the floors every TLD shares, runs the platform and the root abuse desk, and publishes RDAP and the transparency log. The operator sets the TLD's own registration policy, decides who may register, and looks after its registrants and the first response to abuse. For the processing described below they are therefore joint controllers under Art. 26 GDPR.

This arrangement is part of every TLD operator agreement for a hosted TLD. This page is its essence, published for registrants as Art. 26(2) GDPR requires.

What it covers

The data: registrant accounts, meaning the email address and the credentials; the names registered in the TLD, with their nameservers, DS records, statuses and dates; the audit records about them; abuse cases; requests for registration data; and anything further the TLD's own policy collects.

The purposes: registering, publishing and maintaining names in the TLD; securing the registry; handling abuse, disputes and legal requests; and publishing RDAP and the transparency log.

What it does not cover: each party's processing outside the TLD, such as the operator's own customer relationship, marketing or invoicing. For that, each is the controller alone.

What Gelhaus Solutions does

• Operates the platform and implements the technical and organisational measures of Art. 32 GDPR for it.
• Informs registrants under Arts. 13 and 14 GDPR: the GOpenCDR privacy notice covers registrants in every hosted TLD.
• Is the point of contact for registrants and answers their requests, involving the operator where a request concerns the TLD's own policy.
• Decides requests for registration data under the registration data disclosure policy.
• Keeps the records of processing for the platform and enforces the retention periods.
• Engages the processors named in the privacy notice, IONOS SE for hosting and Sentry on its EU data region for error reports, and answers for them.
• Notifies a personal data breach on the platform to the supervisory authority, and to registrants where the law requires, and tells the operator without undue delay.

What the TLD operator does

• Sets and publishes the TLD's registration policy, and gives registrants the information required for any data it collects beyond the floor.
• Collects nothing beyond the floor without a legal basis and a need for it.
• Answers registrants' questions about its policy, and passes any other request from a registrant to Gelhaus Solutions within three working days.
• Acts on abuse first, within the times of the acceptable use policy.
• Sees registration data only through the platform, with individual accounts secured by passkeys, uses it only for the purposes above, and exports none of it for any other purpose.
• Tells Gelhaus Solutions within 24 hours of any suspected breach on its side that affects registration data, such as a compromised operator account.

Registrants' rights

Registrants may exercise their rights under the GDPR against either party (Art. 26(3) GDPR). Gelhaus Solutions is the point of contact, at egelhaus@ennogelhaus.de. The parties help each other so that every request is answered within one month.

Liability between the parties

Towards registrants, each party is liable as Art. 82 GDPR provides. Between themselves, each bears a damage in proportion to its share of responsibility for what caused it (Art. 82(5) GDPR). Beyond that, the TLD operator agreement and the general terms of service apply.

Supervisory authority

The authority competent for Gelhaus Solutions is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover. Each party cooperates with any authority's inquiry into the processing covered here.

Term

This arrangement lasts as long as Gelhaus Solutions hosts the TLD. The duties concerning data continue until the data is deleted under the retention periods in the privacy notice.