Data & Removal Requests

We research the public web. That means our datasets can contain information about you even though you have never been our customer — most often because you registered a domain name and your details appear in its registration record. This page is how you get that looked at.

If your personal data is in our research data

Domain registration records (WHOIS and RDAP) frequently contain a person's name, email address, postal address or telephone number — particularly for individuals and sole traders, who do not always get the redaction that companies do. Where those details relate to a living person, they are personal data and UK GDPR applies to our handling of them.

You can ask us to:

tell you what we hold about you and where we obtained it (right of access, Article 15);
correct it if it is wrong (rectification, Article 16);
delete it (erasure, Article 17);
stop or limit our use of it (restriction, Article 18);
object to our processing it, including for direct marketing (Article 21).

Email [email protected] with enough detail for us to find the record — normally the domain name and the details you believe relate to you. We will confirm receipt and respond within one month, as Article 12(3) requires. If a request is complex we may extend that, and we will tell you why.

We will be straight with you about limits: some of these rights have statutory exceptions, and some registration data is published by registries independently of us, so removing it from our copy does not remove it from theirs. Where we cannot do what you have asked, we will say so and explain which exception applies rather than simply not replying.

If you are unhappy with how we handle it, you can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. You do not need our permission to do that.

If you run a website and would rather we did not include it

Website operators can ask us to exclude their domains from our active crawling and from datasets we compile. Email [email protected] from an address at the domain in question, or from the contact address in its registration record, listing the domains concerned.

Two honest caveats. First, exclusion applies going forward — it does not retract datasets already delivered to a client. Second, some of what we hold comes from registry and registrar feeds rather than from visiting your site, and we cannot suppress the registry's own publication of it.

What we do not do

We do not attempt to circumvent authentication, paywalls or access controls.
We do not collect data from areas of a site that require an account to reach.
We do not sell datasets assembled for the purpose of marketing to individuals.