NPRD Disclosure Policy

What non-public registration data is

Non-public registration data (NPRD) is the personal contact information of a domain owner that is hidden from public RDAP and WHOIS records, such as their name, email address, phone number and postal address. It is hidden to protect the owner's privacy, but it can be disclosed when there is a valid reason.

Who can make a request

• Law enforcement and other public authorities
• Owners of trademarks or copyrights, and their lawyers
• Security researchers investigating abuse
• Anyone else with a lawful and legitimate interest in the data

How to make a request

Email legal@hostelevate.com with "NPRD request" in the subject. Please include:

• the domain name or names;
• your name, organization and contact details;
• the exact data you need;
• why you need it and the legal basis for your request;
• evidence that supports your request; and
• your confirmation that you will use the data only for the purpose you describe.

Authorities should send requests from an official email address and include the case reference number and the legal authority they are acting under.

How we review requests

• We check who is asking and whether the request is complete.
• We weigh the requester's interest against the privacy rights of the domain owner.
• We disclose only the data that is necessary for the stated purpose.
• Where the decision belongs to the registrar that sponsors the domain, we pass the request to them and tell you.

How long it takes

• We acknowledge requests within 2 business days.
• We aim to decide without undue delay and normally within 30 days.
• Urgent requests involving a threat to someone's life or safety, critical infrastructure or child exploitation are reviewed first.

Possible outcomes

• Approved: we send the data securely.
• Partly approved: we send only part of the data requested.
• More information needed: we explain what is missing.
• Declined: we explain why, for example no legal basis or a conflict with privacy law.

Telling the domain owner

Unless the law does not allow it, or telling them would harm an investigation, we tell the domain owner that their data has been requested.

Conditions for using disclosed data

Disclosed data must be kept confidential, used only for the purpose given in the request, not shared with anyone else and deleted when it is no longer needed.

Fees

We do not charge for NPRD requests.

Questions or concerns

If you have questions about this policy, or believe your data was disclosed wrongly, email legal@hostelevate.com.