Privacy Policy.

1. About this Privacy Policy

domains123.com.au is a specialist marketplace for Australian .com.au domain names, including premium, expired and previously registered domains relevant to casino, pokies, betting, iGaming and related digital projects.

This Privacy Policy describes the kinds of personal and transaction information we may collect, how we collect and use it, when it may be disclosed, how it is protected and how you may contact us about access, correction or a privacy concern.

Where the Privacy Act 1988 (Cth), the Australian Privacy Principles or another privacy law applies to our handling of personal information, we will handle that information subject to the applicable legal requirements.

Nothing in this Policy is intended to reduce any privacy right or remedy that cannot lawfully be excluded.

2. What we mean by personal information

Personal information generally means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Whether particular information is personal information can depend on the circumstances and on whether it can reasonably be connected with an identifiable person.

Some marketplace information, such as a public blockchain transaction, may be publicly visible but may still become associated with an account or invoice when you provide it to us.

3. Information we may collect

Depending on how you use domains123.com.au, we may collect or hold the following categories of information.

Account information

• full name;
• email address;
• password hash and authentication-related records;
• email verification status;
• account status;

Business and .com.au eligibility information

• company or business name;
• ABN or ACN where supplied;
• registrar name;
• registrar account email;
• transfer email;
• eligibility confirmations and related notes.

Marketplace and transaction information

• cart and favourite selections;
• selected domains;
• order numbers and order status;
• invoice numbers and invoice status;
• prices and expected payment amounts;
• payment status;
• transfer status;
• transaction and support notes.

Blockchain and payment information

• Ethereum transaction hash;
• token and network information;
• receiving wallet address;
• expected and received USDC amount;
• transaction receipt status;
• blockchain confirmations;
• publicly available transaction data used for verification.

Technical and security information

We may receive ordinary technical information generated when the website is used, such as IP address, browser or device information, timestamps, session information, request data, security events, error logs and similar operational records.

Communications

If you contact us, we may keep the information you provide, including your email address, message, attachments and information relating to the account, order, invoice or transfer concerned.

4. Information we do not need you to provide

You should never send us:

• cryptocurrency wallet seed phrases;
• wallet private keys;
• exchange passwords;
• banking passwords;
• registrar passwords;
• authentication codes that are not specifically required by a legitimate domains123.com.au workflow.

domains123.com.au does not need a wallet seed phrase or private key to verify a USDC payment.

5. How we collect information

We usually collect information directly from you when you:

• create or update an account;
• verify your email address;
• add a domain to cart or favourites;
• complete checkout;
• provide .com.au eligibility or registrar details;
• submit a blockchain transaction hash;
• contact support;
• otherwise communicate with the marketplace.

We may also collect or generate information automatically through the operation of the website, such as session records, security logs and order-status history.

Some payment information is obtained from public Ethereum blockchain data after you provide a transaction hash or after the system checks a transaction associated with an invoice.

6. Why we collect and use information

We may collect, hold and use information for purposes including:

• creating and administering customer accounts;
• verifying email addresses;
• maintaining carts and favourites;
• checking domain availability;
• creating orders and invoices;
• validating server-side prices;
• reserving a domain to the relevant order;
• verifying USDC payment information;
• reviewing submitted transaction hashes;
• detecting duplicate, invalid or suspicious payment claims;
• coordinating registrar transfers;
• providing customer support;
• sending transactional communications;
• maintaining transaction and security records;
• detecting, preventing and investigating fraud or misuse;
• maintaining and improving website reliability;
• complying with legal or regulatory obligations where applicable.

7. Account passwords and authentication

Passwords should not be stored by us in readable plain-text form. The platform is designed to store password hashes used for authentication.

Email verification and password-reset functions may use time-limited security tokens. Security-related records may be retained as needed to protect accounts and investigate abuse.

You are responsible for keeping your login credentials secure and for notifying us if you believe your account has been compromised.

8. Cookies

The website may use cookies that are necessary for functions such as session management, login state, security controls and account workflows.

A session cookie allows the website to recognise the same browser during an authenticated or transactional session.

Blocking essential cookies may prevent login, checkout, verification or other account functions from operating correctly.

9. Browser localStorage

Guest cart and favourite selections may be stored temporarily in your browser using localStorage or similar browser storage.

If you later log in, eligible guest selections may be synchronised to your account so that your marketplace state can persist in the database.

Browser storage is controlled by your device and browser. Clearing site data may remove guest-only cart or favourite information that has not yet been synchronised to an account.

10. Logged-in carts and favourites

When you are logged in, cart and favourite information may be associated with your customer account and stored in the marketplace database.

This allows the marketplace to display selections across sessions and to use authoritative server-side domain information during checkout.

Adding a domain to a cart or favourite list does not itself reserve or transfer the domain.

11. Orders and invoices

When an order is created, we may store information linking the customer account, selected domains, buyer details, price, eligibility information, invoice and order status.

Invoices may contain a secure public token used to access the relevant invoice page. Invoice URLs and tokens should be treated as transaction information and should not be posted publicly.

12. Blockchain information

Ethereum is a public blockchain. Information recorded on the Ethereum network may be visible to anyone and may be retained independently of domains123.com.au.

When you submit a transaction hash, we may retrieve and process public blockchain information to verify:

• that the transaction exists;
• the network and chain;
• the USDC token contract;
• the receiving wallet;
• the transferred amount;
• transaction receipt status;
• confirmation information.

Public blockchain records cannot generally be edited or deleted by domains123.com.au.

Even where a wallet address or transaction hash is public, the association between that information and your customer account or invoice may be handled by us as transaction information and, where applicable, personal information.

13. Automated payment and security checks

Software may be used to assist with payment verification, duplicate transaction detection, security checks, reservation logic and transaction-state management.

For example, software may compare a submitted Ethereum transaction against the expected token, network, wallet, amount and confirmation requirements for an invoice.

Automated checks may flag a transaction for further review. Payment and transfer workflows may also include administrative or manual review before a transaction is approved or completed.

We may update this section if our use of automated decision-making changes or if additional disclosure obligations become applicable.

14. Registrar and domain transfer information

To process a .com.au domain transfer, we may use information such as:

• buyer name;
• company or business information;
• ABN or ACN where provided;
• registrar name;
• registrar account email;
• transfer email;
• eligibility confirmations;
• information needed to coordinate the transfer.

Transfer-related information may be disclosed to or used with the relevant registrar, registry-related service or other party where reasonably necessary to complete the transfer, verify eligibility or satisfy applicable domain requirements.

15. .com.au eligibility information

.com.au domains can be subject to eligibility and allocation requirements. Information you provide for eligibility purposes may be retained with the order or transfer record where reasonably necessary to process or document the transaction.

We ask that you provide only information that is accurate, relevant and reasonably necessary for the transaction.

16. Transactional email

We may send emails necessary to operate your account or transaction, including:

• email verification;
• account-created notifications;
• invoice notifications;
• payment-submitted notifications;
• payment approval or rejection notifications;
• transfer status notifications;
• password-reset emails;
• security or support communications.

Transactional emails are sent because they are relevant to the operation or security of your account or transaction. They are different from optional promotional marketing.

17. Marketing communications

If domains123.com.au introduces promotional email or other direct marketing, we will handle personal information for those activities in accordance with applicable requirements.

Where an unsubscribe mechanism is required, we will provide one and process valid opt-out requests.

Opting out of marketing will not necessarily stop essential account, security, invoice, payment or transfer communications.

18. Service providers

We may use third-party service providers to operate or support the marketplace. Depending on the service, these providers may process information for functions such as:

• website hosting and infrastructure;
• database hosting;
• email delivery;
• security and abuse prevention;
• blockchain data access;
• technical monitoring and logging;
• registrar or domain-transfer processing.

We seek to limit information shared with service providers to what is reasonably necessary for the relevant service.

19. Overseas processing and disclosure

Internet, hosting, email, blockchain and infrastructure services can involve systems or service providers located outside Australia.

As a result, information may in some circumstances be processed, stored or disclosed outside Australia.

The particular locations can depend on the infrastructure and service providers in use at the relevant time. Where it is practicable and required by applicable privacy law, we will provide further information about likely overseas disclosures and take steps required by that law.

You may contact us if you want current information about the service-provider locations relevant to your information.

20. Public information and third-party websites

The marketplace may link to external services such as registrars, blockchain explorers or other websites.

Third-party websites have their own privacy practices and are responsible for information they collect directly from you.

This Privacy Policy applies to information handled by domains123.com.au and does not control an independent third party's privacy practices.

21. Legal, fraud and security disclosures

We may use or disclose information where reasonably necessary to:

• investigate suspected fraud or misuse;
• protect an account or transaction;
• protect the rights, property or security of users or the marketplace;
• respond to lawful requests, legal process or court orders;
• comply with applicable legal obligations;
• establish, exercise or defend legal claims where permitted.

22. Security

We use administrative, application and technical controls intended to protect information against unauthorised access, misuse, interference, loss, alteration or disclosure.

Depending on the information and system, controls may include secure sessions, password hashing, access restrictions, database controls, CSRF protections, transaction-state checks, security headers, logging and other application-level measures.

No internet service can guarantee absolute security. You should use a strong, unique password and protect your account, email address, registrar account and cryptocurrency wallet independently.

23. Data breaches

If we become aware of a security incident involving personal information, we may investigate, contain and assess the incident and take steps appropriate to the circumstances.

Where the Notifiable Data Breaches scheme or another applicable law requires notification, we will take the steps required by that law.

24. Data retention

We retain information for as long as reasonably necessary for the purposes for which it was collected and for legitimate operational, transaction, security, accounting, dispute, fraud-prevention and legal record-keeping purposes.

Different records may be retained for different periods. For example, a temporary browser session may be short-lived, while completed order, invoice, payment and transfer records may need to be retained longer.

Where information is no longer reasonably required and no legal or operational reason requires continued retention, we may delete, anonymise or otherwise dispose of it as appropriate.

Public Ethereum blockchain data is outside our control and cannot generally be deleted by domains123.com.au.

25. Access to your personal information

You may contact us to request access to personal information we hold about you.

We may need to verify your identity before providing access. In some circumstances, access may be limited or refused where permitted or required by applicable law, security obligations or the rights of another person.

Where applicable law gives you a right of access, we will handle the request in accordance with that law.

26. Correction of information

If you believe personal information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you may ask us to correct it.

Some account details may also be editable through your account profile.

We may retain a record of previous transaction details where reasonably necessary to preserve the integrity of historical orders, invoices, payments, transfers, fraud reviews or legal records.

27. Deletion requests

You may ask us to delete information associated with your account where appropriate.

A deletion request does not necessarily require deletion of information that we must or reasonably need to retain for completed transactions, security, fraud prevention, dispute handling, accounting, legal obligations or the establishment, exercise or defence of legal claims.

Information recorded on a public blockchain cannot generally be deleted or altered by domains123.com.au.

28. Account closure

You may contact us if you want to close your customer account.

Account closure may remove or disable ordinary account access, but it may not erase transaction records that must be retained for legitimate operational, security or legal reasons.

29. Children

domains123.com.au is intended for people and organisations capable of entering marketplace transactions and satisfying the relevant domain-registration requirements.

The service is not designed as a children's service and we do not knowingly seek personal information from children for marketplace purchases.

If you believe a child has provided personal information improperly, contact us so we can review the circumstances.

30. Anonymous browsing

You can browse many public areas of the marketplace without creating an account.

However, certain functions cannot reasonably be provided anonymously. For example, account verification, checkout, invoices, payment review, eligibility checks and domain transfers require information that can be linked to a buyer and transaction.

31. Privacy complaints

If you have a concern about how domains123.com.au has handled your personal information, please contact us first so we can investigate the issue.

Please include enough information for us to understand the concern, identify the relevant account or transaction and respond appropriately. Do not send passwords, wallet private keys or seed phrases.

We aim to acknowledge and investigate privacy complaints within a reasonable period. Where the Australian Privacy Act applies, you may also have the right to complain to the Office of the Australian Information Commissioner after giving us a reasonable opportunity to respond.

32. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in the marketplace, technology, legal requirements, service providers, payment verification or domain-transfer processes.

The current version will be published on this page and the “Last updated” date will be revised when appropriate.

We encourage users to review the Policy periodically, particularly before completing a significant transaction.

33. Contact and privacy requests

To ask a privacy question, request access or correction, request account closure or raise a privacy complaint, contact:

domains123.com.au
Email: contact@domains123.com.au

For a request concerning an account, order, invoice or transfer, please provide enough identifying information for us to locate the relevant record. We may request reasonable identity verification before disclosing or changing account information.