Data Processing Agreement

Last Updated: October 2026

This Data Processing Agreement (the "DPA") is incorporated by reference into the Domainee Terms of Service or any other agreement governing the use of the Domainee services (the "Agreement"), entered into by and between you, the customer using the Domainee Custom Domains API, dashboard and related services (the "Customer", "you", "your"), and Domainee by Common Ninja Ltd., a company incorporated under the laws of the State of Israel ("Common Ninja", "Domainee", "we", "us", "our"). It reflects the Parties' agreement regarding the Processing of Personal Data by Domainee solely on behalf of the Customer. Each of Customer and Domainee is a "Party" and together the "Parties". Capitalized terms not defined in this DPA have the meanings given to them in the Agreement.

By using the Services, Customer accepts this DPA, and you represent and warrant that you have full authority to bind the Customer to it. If you do not agree to this DPA, or do not have authority to bind the Customer, please do not use the Services to Process Personal Data.

If there is any conflict between this DPA and the Agreement, this DPA prevails, solely with respect to the Processing of Personal Data. This DPA applies to the Domainee Services only. Other Common Ninja products are covered by their own terms and data processing agreements.

A countersigned copy of this DPA is available on request at privacy@domainee.dev. It does not change the terms below.

1. Definitions

"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity, where "control" means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
"CCPA" means the California Consumer Privacy Act of 2018, Cal. Civ. Code §§ 1798.100 et seq., and its implementing regulations, as amended from time to time.
The terms "Controller", "Member State", "Processor", "Processing" and "Supervisory Authority" have the meanings given to them in the GDPR. The terms "Business", "Business Purpose", "Consumer" and "Service Provider" have the meanings given to them in the CCPA. Where the CCPA applies, "Controller" also means "Business", "Processor" also means "Service Provider", and a Processor's Sub-processor also refers to the concept of a Service Provider.
"Data Protection Laws" means all applicable and binding privacy and data protection laws and regulations, including those of the European Union, the European Economic Area and their Member States, Switzerland, the United Kingdom, Israel and the United States of America, including (without limitation) the GDPR, the UK GDPR, the FADP and the CCPA, in each case as applicable to the Processing of Personal Data under the Agreement.
"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
"End-User" means a person who owns or operates a hostname that Customer registers with, routes through or purchases via the Services, and any visitor whose requests to such a hostname pass through the Domainee edge network.
"FADP" means the Swiss Federal Act on Data Protection of 25 September 2020, as amended.
"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation).
"Personal Data" means any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable natural person or Consumer, to the extent that such information is Processed by Domainee solely on behalf of Customer under the Agreement and this DPA. Personal Data relating to Customer's own account users, billing contacts and representatives, which Domainee processes as a Controller, is governed by the Domainee Privacy Policy and not by this DPA.
"Services" means the Domainee Custom Domains API, edge network, dashboard, MCP server, domain purchase and related services that Domainee provides to Customer under the Agreement.
"Sensitive Data" means Personal Data that is subject to special protection under Data Protection Laws, including "special categories of data" or "sensitive data" (or materially similar terms), government identifiers, payment card numbers, financial, health, genetic or biometric information, and account passwords in unhashed form.
"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
"Sub-processor" means any third party that Processes Personal Data under the instruction or supervision of Domainee.
"UK GDPR" means the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, together with the UK Data Protection Act 2018.
"UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A(1) of the UK Data Protection Act 2018, as amended from time to time.

2. Processing of Personal Data

Roles of the Parties. With regard to the Processing of Personal Data solely on behalf of Customer, (i) Customer is the Controller and (ii) Domainee is the Processor. Where Customer Processes Personal Data as a Processor on behalf of another Controller (for example, where Customer offers custom domains to its own customers), Domainee acts as Customer's Sub-processor.
Customer's Processing of Personal Data. Customer, in its use of the Services and in its instructions to Domainee, shall comply with Data Protection Laws. Customer is responsible for establishing all legal bases required to collect Personal Data, to make it available to Domainee, and to authorize Domainee's Processing of it under this DPA.
Domainee's Processing of Personal Data. Domainee shall Process Personal Data only: (i) in accordance with the Agreement and this DPA; (ii) as needed to provide the Services to Customer; (iii) to comply with Customer's reasonable and documented instructions, which include Customer's configuration and use of the Services and API; (iv) to render Personal Data fully anonymous and non-personal in accordance with the standards recognized by Data Protection Laws; and (v) as required by applicable law or by a competent court or authority, in which case Domainee shall inform Customer of that legal requirement before Processing, unless the law prohibits doing so on important grounds of public interest.
Unlawful Instructions. Domainee shall inform Customer without undue delay if, in its opinion, an instruction from Customer infringes Data Protection Laws. If Domainee cannot comply with an instruction, it shall inform Customer and may, without liability to Customer, suspend the affected Processing (other than securely storing the data) and/or Customer's access to the affected Services.
Details of the Processing. The subject matter of the Processing is the performance of the Services under the Agreement. The duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects are set out in Schedule 1 (Details of the Processing).
Sensitive Data. The Services are not designed for the storage of Sensitive Data. Customer shall not use the Services to store Sensitive Data in Domainee's systems (for example, in hostnames, metadata or registrant fields) without Domainee's prior written consent. Content that passes through the edge network in transit between visitors and Customer's origin is handled as described in Schedule 1.
CCPA. Domainee does not receive or Process any Personal Information as consideration for the Services. Domainee shall not sell or share (as those terms are defined in the CCPA) Personal Information Processed on Customer's behalf, shall not retain, use or disclose it for any purpose other than the Business Purposes specified in the Agreement and this DPA, and shall not combine it with Personal Information it Processes on behalf of other parties, except as permitted by the CCPA.

3. Data Subject Requests

Domainee shall, to the extent legally permitted, promptly notify Customer, or refer the Data Subject to Customer, if it receives a request from a Data Subject or Consumer to exercise their rights under Data Protection Laws, including the rights of access, rectification, restriction, erasure, data portability, objection, not to be subject to automated decision-making, and to opt out of the sale or sharing of Personal Information (a "Data Subject Request"). Taking into account the nature of the Processing, Domainee shall assist Customer, by appropriate technical and organizational measures insofar as possible and reasonable, in responding to Data Subject Requests. Most Personal Data can be viewed, updated and deleted directly by Customer through the dashboard and API.

4. Confidentiality

Domainee shall ensure that its personnel and advisors authorized to Process Personal Data are bound by appropriate obligations of confidentiality.

5. Sub-processors

Authorization. Customer agrees that (a) Domainee's Affiliates may be engaged as Sub-processors, and (b) Domainee and its Affiliates may engage third-party Sub-processors in connection with the provision of the Services. The Sub-processors listed in Schedule 2 (the "Sub-processor List") are authorized as of Customer's first use of the Services.
Changes. Domainee shall notify Customer by email to the workspace owner's address at least fourteen (14) days before authorizing any new Sub-processor to Process Personal Data, and shall update Schedule 2 accordingly. No notice is required to remove a Sub-processor. Customer may object to a new Sub-processor, on reasonable grounds relating to the protection of Personal Data, by notifying Domainee in writing at privacy@domainee.dev within ten (10) days of receiving the notice. The Parties shall then discuss Customer's concerns in good faith. If they cannot resolve them, Customer may terminate the affected Services by written notice, as its sole and exclusive remedy.
Sub-processor Obligations. Domainee or its Affiliates have entered into a written agreement with each Sub-processor that imposes data protection obligations no less protective than those set out in this DPA, to the extent applicable to the nature of the services that Sub-processor provides. Domainee remains responsible to Customer for the performance of each Sub-processor's data protection obligations.

6. Security and Audits

Security Measures. Domainee shall maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data, as described in Schedule 3 (Technical and Organizational Measures). Domainee may update these measures from time to time, provided that the updates do not materially reduce the overall level of protection.
Assistance. Upon Customer's reasonable request, Domainee will reasonably assist Customer, at Customer's cost, in ensuring compliance with Articles 32 to 36 of the GDPR (and the equivalent provisions of the UK GDPR), taking into account the nature of the Processing and the information available to Domainee.
Audits. Upon Customer's written request, made at least fourteen (14) days in advance and no more than once every twelve (12) months, and subject to strict confidentiality undertakings, Domainee shall make available to Customer (or to Customer's independent, reputable third-party auditor, subject to the same confidentiality undertakings) the information necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including inspections. Domainee may first respond with written answers, documentation and its Sub-processors' third-party audit reports (such as SOC 2 or ISO 27001 reports of its infrastructure providers), and an on-site inspection shall take place only where these are not sufficient to demonstrate compliance. Audit information and results shall be used by Customer solely to assess compliance with this DPA. Customer shall ensure that any audit causes no (or, if unavoidable, minimal) disruption to Domainee's business, premises, equipment and personnel. This Section applies only to the extent the Agreement does not otherwise provide Customer with audit rights that meet the requirements of Data Protection Laws, including Article 28(3)(h) of the GDPR or the UK GDPR.

7. Data Incident Management and Notification

Domainee maintains security incident management procedures and shall notify Customer without undue delay, and in any case within seventy-two (72) hours, after becoming aware of any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data Processed by Domainee on Customer's behalf (a "Data Incident"). The notice will include, to the extent then known, the nature of the Data Incident, the categories and approximate number of Data Subjects and records concerned, its likely consequences, and the measures taken or proposed. Domainee shall take the steps it reasonably deems necessary to remediate and mitigate the Data Incident, to the extent within its reasonable control. These obligations do not apply to incidents caused by Customer or by anyone using the Services on Customer's behalf.

Customer shall not make or publish any notice, statement or report concerning a Data Incident that directly or indirectly identifies Domainee without Domainee's prior written approval, unless and only to the extent that Customer is required to do so under Data Protection Laws. In that case, unless the law prohibits it, Customer shall give Domainee reasonable prior written notice and limit the disclosure to the minimum required.

8. Return and Deletion of Personal Data

Customer may delete hostnames, domains and related data at any time through the dashboard or API. Following termination of the Agreement, Domainee shall, at Customer's choice (indicated through the Services or by email to privacy@domainee.dev), delete or return all Personal Data Processed solely on Customer's behalf, and delete existing copies unless Data Protection Laws require otherwise. Copies held in backups are deleted as the backups expire in the ordinary course. Domainee may retain one copy of Personal Data where required or permitted by law, solely for evidence purposes, for the establishment, exercise or defense of legal claims, or for compliance with legal obligations. Data that a registry or registrar must keep for a domain purchased through the Services (such as registrant records) is held by the registrar in accordance with its own obligations.

9. Data Locations and Cross-Border Transfers

Data Locations. Domainee Processes Personal Data in the locations listed in Schedule 2. Visitor requests are handled by the edge region closest to the visitor, which today includes Frankfurt, Germany for visitors in Europe. Service data, such as domain configuration, certificates and usage counters, is stored in the United States. If an edge region becomes unavailable, traffic may be served from another region to keep Customer's domains online.
Transfers to Adequate Countries. Common Ninja Ltd. is established in Israel, which benefits from an adequacy decision of the European Commission, the UK and Switzerland. Personal Data may be transferred from the European Economic Area ("EEA"), the United Kingdom ("UK") and Switzerland to Israel, and to any other country that benefits from an adequacy decision (including transfers to recipients in the United States certified under the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. Data Privacy Framework), without any further safeguard being necessary.
Transfers to Other Countries. If the Processing of Personal Data includes a transfer (directly or by onward transfer) from the EEA, the UK or Switzerland to a country that does not benefit from an adequacy decision, and no other recognized transfer mechanism applies, then:
1. for transfers from the EEA, the SCCs are incorporated into this DPA by reference and apply, with Customer as "data exporter" and Domainee as "data importer", as follows: Module Two (controller to processor) applies where Customer is a Controller, and Module Three (processor to processor) applies where Customer is a Processor; Clause 7 (docking clause) applies; under Clause 9, Option 2 (general written authorization) applies, with the notice period set out in Section 5.2 of this DPA; the optional wording in Clause 11 does not apply; under Clauses 17 and 18, the SCCs are governed by the laws of, and disputes are resolved by the courts of, Ireland; and Annexes I and II of the SCCs are completed by Schedules 1 to 3 of this DPA, with the competent Supervisory Authority determined in accordance with Clause 13;
2. for transfers from the UK, the SCCs apply as amended by the UK Addendum, which is incorporated into this DPA by reference, with Tables 1 to 3 completed by the information in this DPA and its Schedules, and with either Party able to end the UK Addendum as set out in its Section 19; and
3. for transfers from Switzerland, the SCCs apply with the following changes: references to the GDPR are read as references to the FADP; the competent Supervisory Authority is the Swiss Federal Data Protection and Information Commissioner; the term "Member State" does not exclude Data Subjects in Switzerland from enforcing their rights in their place of habitual residence; and the SCCs are governed by Swiss law where the FADP so requires.
Onward Transfers. Where Domainee transfers Personal Data to a Sub-processor in a country without an adequacy decision, it does so under the Standard Contractual Clauses or another recognized transfer mechanism in its agreement with that Sub-processor.

10. Authorized Affiliates

By entering into this DPA, Customer does so on behalf of itself and, where applicable, its Affiliates that are permitted to use the Services under the Agreement and for which Domainee Processes Personal Data as a Processor ("Authorized Affiliates"). Each Authorized Affiliate is bound by Customer's obligations under this DPA, and any breach by an Authorized Affiliate is deemed a breach by Customer. Customer remains responsible for coordinating all communication with Domainee under this DPA on behalf of its Authorized Affiliates.

11. Other Provisions

Data Protection Impact Assessments. Upon Customer's reasonable request, Domainee shall provide reasonable cooperation and assistance needed for Customer to carry out a data protection impact assessment under the GDPR or the UK GDPR, and for any related prior consultation with a Supervisory Authority.
Modifications. Either Party may, by at least forty-five (45) days' prior written notice, request changes to this DPA where they are required as a result of a change in Data Protection Laws, or a decision of a competent authority under them, so that the Processing of Personal Data can continue without breaching those laws.
Liability. Each Party's liability arising out of or related to this DPA is subject to the limitations of liability in the Agreement, except where such limitations are not permitted under Data Protection Laws or the SCCs.

Schedule 1: Details of the Processing

Nature and Purpose of Processing

Registering, verifying, routing and serving Customer's End-User hostnames, including terminating TLS at the Domainee edge network and forwarding requests to Customer's origin;
Issuing, renewing and storing TLS certificates for those hostnames;
Purchasing, registering and renewing domain names through a registrar, where Customer uses the domain purchase features;
Measuring bandwidth and request volumes for billing, capacity and abuse prevention;
Sending webhook events to endpoints configured by Customer;
Providing support, maintaining security and preventing abuse of the Services;
Acting on Customer's documented instructions, including Customer's configuration and use of the dashboard, API and MCP server;
Complying with applicable laws and regulations; and
All tasks related to any of the above.

Types of Personal Data

Visitor traffic (in transit only): IP addresses, request headers (such as user agent, cookies and referrer), URLs and request and response content of visitors to Customer's End-User hostnames. This data passes through the edge network in transit to and from Customer's origin. Domainee does not keep per-request access logs of visitor traffic; it retains only aggregated byte and request counts per workspace, and operational error logs, which may include the affected hostname;
Hostname and configuration data: End-User hostnames, origin URLs, DNS records, metadata and webhook payloads supplied by Customer, to the extent they relate to an identifiable person;
TLS certificate data: hostnames included in TLS certificates. Certificate authorities publish issued certificates, including their hostnames, in public Certificate Transparency logs, as required by industry rules;
Domain registrant data: where Customer purchases a domain through the Services, the registrant's name, organization, email address, phone number and postal address, as supplied by Customer, which are passed to the registrar and, as required by ICANN and registry rules, may be shown in WHOIS/RDAP records unless WHOIS privacy is enabled; and
Any other Personal Data that Customer chooses to include in data it submits to the Services.

Categories of Data Subjects

Customer's End-Users, including owners and operators of hostnames routed through the Services, domain registrants, and visitors to Customer's End-User hostnames.

Sensitive Data

None intended. See Section 2.6.

Frequency of Transfer

Continuous, for the duration of the Agreement.

Duration of Processing and Retention

Domainee Processes Personal Data for the duration of the Agreement, unless otherwise agreed in writing, and then deletes or returns it in accordance with Section 8. Visitor traffic is Processed only for as long as needed to serve each request. Hostname, configuration and certificate data are kept until Customer deletes them or the Agreement ends.

Schedule 2: Sub-processors

Sub-processor	Purpose	Location of Processing
Amazon Web Services, Inc.	Cloud infrastructure: edge network (TLS termination and routing), control plane, certificate storage	Germany (Frankfurt) and United States
MongoDB, Inc. (MongoDB Atlas)	Database hosting for hostname, configuration and registrant data	United States
Namecheap, Inc.	Domain name registration and renewal (domain purchase features only)	United States
Internet Security Research Group (Let's Encrypt)	TLS certificate issuance	United States
ZeroSSL	TLS certificate issuance (fallback certificate authority)	European Union and United States

The following Sub-processor is being removed as Domainee completes its move to Amazon Web Services. It is listed until the move is complete:

Sub-processor	Purpose	Location of Processing
Railway Corporation	Application hosting (routing layer and control plane)	United States

Domainee's Affiliate Common Ninja Ltd. (Israel) provides the Services, support and engineering.

Schedule 3: Technical and Organizational Measures

Encryption in transit: all traffic to the Services, and between Domainee's components over the public internet, is encrypted with TLS. Traffic between components inside Domainee's cloud environment stays on private networks. Traffic between the edge network and Customer's origin is encrypted where Customer's origin supports HTTPS.
Encryption at rest: databases and certificate storage are encrypted at rest by the infrastructure providers.
Access control: access to production systems and data is limited to authorized personnel who need it, using individual accounts and least-privilege roles. Production credentials are never stored in source code.
API security: API keys are stored only as one-way hashes, and API access is authenticated and rate-limited.
Data minimization: visitor traffic is processed in transit only, and no per-request access logs of visitor traffic are kept. Only aggregated usage counters are stored.
Tenant isolation: each request is resolved to a single workspace's configuration, and workspace data is scoped to that workspace in every API and dashboard request.
Certificate issuance controls: certificates are issued only for hostnames that Customer has registered and that pass Domainee's verification checks.
Availability and resilience: the edge network runs in multiple regions behind an anycast network, and the database is a replicated cluster with automated backups.
Monitoring and incident response: production systems are monitored and alert Domainee's engineering team, and Data Incidents are handled under Section 7.
Sub-processor management: Sub-processors are selected for their security practices and bound by written data protection terms, as described in Section 5.

For any questions about this DPA, or to request a countersigned copy, please contact us at privacy@domainee.dev.

Last Updated: October 2026