Legal

Privacy Policy

Last updated 2026-04-23

We only collect the data we need to sell you a domain and keep the books. No ad trackers, no sale of personal data, no newsletters you didn't ask for. This notice tells you exactly what, why, and how long.

1. Who is responsible

The data controller is AVOSS DEVELOPMENT DBA SURFNAME.COM, registered in the Republic of Serbia. For any privacy question, email domains@surfname.com.

2. What we collect

Information you give us on the qualification form:

  • Full legal name
  • Email address (verified by a one-time code we email you)
  • Direct phone number with country code
  • Country
  • Company name, VAT / tax ID, and company country — only if you indicate the purchase is for a company
  • Buyer type (direct buyer, or agency acting for a client)
  • Intended use of the domain (investment, project, agency client, other) and a short optional description
  • Preferred payment method (bank transfer or Escrow.com)

Information captured automatically when you interact with the site:

  • IP address and approximate country (used for fraud prevention)
  • Browser user agent, request timestamp, page URL, referrer
  • Anonymized per-listing view count aggregated by week
  • Cookies: an essential sn_verify HMAC cookie during email verification, sn_currency for your currency preference, sn_consent to remember that you've seen this notice, and a Cloudflare Turnstile cookie for spam protection on the form

Information we generate about your order:

  • Order number, date, amount, currency, FX rate
  • Invoice PDF with the above plus your billing details
  • Optional review flags (for example, when an IP country and stated country disagree) that prompt a human eye before we invoice

3. Why we collect it

We process this data to:

  • Qualify you as a legitimate buyer and accept your order (contract)
  • Issue a compliant invoice and transfer the domain (contract and legal obligation)
  • Meet our accounting and tax-record retention obligations under Serbian law (legal obligation)
  • Prevent and investigate fraud, trademark abuse, and other misuse of the service (legitimate interest)

4. Who sees it

The data is accessed by SurfName.com staff and, where required, our accountant and the Serbian tax authority. Limited data is shared with:

  • Cloudflare for Turnstile bot protection on the qualification form. Cloudflare processes your IP address and a short-lived challenge token.
  • Google Workspace for sending invoice emails and notifications. Gmail receives your email address and message contents.
  • Raiffeisen Banka a.d., the bank where your payment is received, if you pay by bank transfer.
  • Escrow.com, if you choose escrow, processes the transaction under their own privacy terms. You will receive an invitation directly from them.
  • VIES (EU Commission), if you supply an EU VAT number, to confirm it is valid.
  • ipapi.co, a geolocation service, to compare your stated country against the country of your IP for fraud prevention. We send only your IP address.

We do not sell personal data. We do not share personal data with advertising networks.

5. International transfers

Because most of the processors named above are based in the United States or operate globally, data may leave the European Economic Area. When that happens, transfers are covered by the EU-U.S. Data Privacy Framework, standard contractual clauses, or an equivalent mechanism maintained by the processor.

6. Retention

Order records, invoices, and related accounting data are retained for at least 10 years as required by Serbian accounting and tax law. Unsubmitted form drafts and short-lived verification cookies are discarded as soon as they expire. Aggregate per-listing view counts carry no personal data and are kept indefinitely.

7. Your rights

Depending on where you are, you may have the right to:

  • Access the personal data we hold about you
  • Ask us to correct data that is wrong or incomplete
  • Ask us to delete data we no longer need (subject to the 10-year retention on order records)
  • Ask us to restrict or object to our processing
  • Receive a portable copy of data you provided
  • Lodge a complaint with your local data protection authority — in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs)

To exercise any of these, write to domains@surfname.com from the email address associated with your order.

8. Cookies

We use only functional cookies (email verification, currency preference, consent record, Turnstile bot protection). We do not run Google Analytics, Facebook Pixel, or any other third-party analytics on the public site. If we ever introduce analytics, we will update this notice and the consent banner before doing so.

9. Changes

We will post updates to this notice on this page and bump the "Last updated" date at the top. Material changes will be flagged via email where we have a recent order contact for you.

10. Contact

Questions: domains@surfname.com.