Privacy Notice

This Privacy Notice explains how personal data is collected, used, shared and protected when you use the get.art website and services (the "Site", "Services") — the online storefront for registering .ART domain names. Please read it together with our Cookie Policy and Terms of Service. It is designed to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Isle of Man Data Protection Act 2018 (Applied GDPR), the California Consumer Privacy Act as amended by the CPRA, and other applicable laws.

1. Who we are & the parties involved

get.art involves two companies that are each an independent data controller, together with the domain-registration partners. it.com Domains LTD is the merchant of record — the seller you contract and pay for your purchase — and controls the sales, billing, tax, payment and fraud-prevention side. UKCI Holdings Limited operates the platform and owns and controls the customer accounts and databases. This Notice tells you who does what with your data:

it.com Domains LTD and UKCI Holdings Limited are independent controllers, each for its own purposes; they are not in a controller-to-processor relationship (see §5). Contact for privacy matters: [email protected] — you may use it for either controller and your request will be routed to the right party. Neither company has appointed a Data Protection Officer.

2. Scope

This Notice covers personal data collected through the get.art Site and related sales, support and marketing, for users located in the EU/EEA, the UK, the Isle of Man, California, the wider United States and elsewhere. Registration of a .ART domain also involves the registry and PDR/LogicBoxes as described in §6.

3. Personal data we collect

4. How we use your data & legal bases

Where we rely on consent you may withdraw it at any time (see the Cookie Policy / "Cookie settings", or unsubscribe) without affecting prior processing.

5. Who controls your data

Your customer account and the associated databases are owned and controlled by UKCI Holdings Limited (Isle of Man), which operates the platform. it.com Domains LTD is the merchant of record and controls the data it needs to sell to you and to meet its own legal duties (billing, VAT/tax, payment processing and fraud prevention). The two companies are independent controllers, each for its own purposes, and share the personal data needed to provide the Services under a data sharing agreement — not a controller-to-processor arrangement. You can exercise your rights (see §11) through the contact in §1 regardless of which company holds the data.

6. Domain registration & registrant data

When you register a .ART domain, the registration is carried out through PublicDomainRegistry (PDR) / LogicBoxes and the .ART registry (UK Creative Ideas Limited). The registrant data required to register a domain (such as name, address, email and phone) is processed under their own policies — the PublicDomainRegistry legal terms & policies and the LogicBoxes Privacy Policy — and the registry's rules, and may be published or disclosed as required by ICANN and applicable registration policies (for example in WHOIS/RDAP directories). These registration services are provided under the UKCI Holdings Ltd Customer Master Agreement, and registrant data is held on the registration platform's infrastructure (datacenters operated by UKCI Holdings and/or its partners). Registration-related processing is separate from the storefront/account processing described above.

7. Cookies, consent & tracking

We use the Usercentrics consent platform with Google Consent Mode. Strictly necessary and functional technologies run the Site; analytics and advertising load only after you consent, and Google Tag Manager and its tags are not loaded before consent. We honour the Global Privacy Control (GPC) signal. Details and how to change your choice: Cookie Policy.

8. Sharing & processors

We share personal data with the other controller described in §1 under a data sharing agreement, with service providers acting on our documented instructions under a data processing agreement, with the other parties described here, and where required by law. We operate a strict no-spam policy, do not sell personal data for money and do not sell your contact information to third parties. We may disclose personal data where reasonably necessary to comply with applicable law, regulation or legal process; to enforce our Terms; to detect, prevent or address fraud, security or technical issues; or to protect the rights, property or safety of our users, us or the public.

9. International transfers

Some parties are outside your region (e.g. UKCI in the Isle of Man; PDR/LogicBoxes, Cloudflare, Google and X in India/the US). Transfers from the EU/EEA, the UK or the Isle of Man rely on appropriate safeguards — Standard Contractual Clauses (with the UK Addendum / Isle of Man equivalent) and, where applicable, the EU–US Data Privacy Framework. We keep data processing agreements with our processors.

10. Retention

11. Your rights

EU / EEA / UK / Isle of Man. You have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw consent. Contact [email protected]; we respond within one month. You may complain to a supervisory authority — in the EU your national DPA, in the UK the ICO (ico.org.uk), in the Isle of Man the Information Commissioner (inforights.im).

California (CCPA / CPRA). You may know, delete and correct your personal information and opt out of its "sale" or "sharing". We do not sell personal information for money; our use of advertising technology (the X/Twitter Pixel) may constitute "sharing". Opt out via the cookie banner "Reject", our "Do Not Sell or Share My Personal Information" / "Your Privacy Choices" control, or a GPC signal, which we honour.

12. Representatives

Because UKCI Holdings Limited is established in the Isle of Man, outside the EU and the UK, it has appointed DataRep as its representative in the EU/EEA and the UK under GDPR Art. 27 / UK GDPR. You may contact the representative about the processing UKCI Holdings Limited controls:

• by email: [email protected] (please quote "UKCI Holdings Ltd");
• by web form: www.datarep.com/data-request;
• by post: DataRep has an address in every EU/EEA country, the UK and Switzerland. Full list: How to contact us via our Data Protection Representative →. Please mark all letters for "DataRep".

it.com Domains LTD is established in the United Kingdom and is responsible for its own representation obligations where applicable.

13. Children

The Services are not directed to children under 16, and we do not knowingly collect their personal data.

14. Security

We use appropriate technical and organisational measures (TLS/HTTPS, secure cookies, access controls, Cloudflare protections). No method is fully secure; we cannot guarantee absolute security.

Contact & Changes

We may update this policy; the "Last updated" date will change. it.com Domains LTD, 20 Hammersmith Broadway, London, England, W6 7AB (company no. 14872503) · The get.art contact for data control and processing questions is [email protected]. The company contact for all other questions about the site and our offerings is [email protected].