1. Who is responsible
Catch Fast Limited operates Catch.Fast from Hong Kong and is responsible for the personal data described here. Our registered address is Flat D07, 8/F, Kai Tak Factory Building Stage 2, 99 King Fuk Street, San Po Kong, Hong Kong. We act as the data user under Hong Kong’s Personal Data (Privacy) Ordinance and, where applicable, as a controller under other data-protection laws.
This policy applies to visitors, account holders, bidders, customers and people who contact us. It explains our own processing. Registries, receiving registrars and payment providers may also process data for their own purposes under their notices.
2. The data we collect
- Account and contact data: name, email, company details where supplied, account type, verification status, password hash and account preferences. We store a password hash rather than your readable password.
- Billing and tax data: customer or company name, billing address, country, contact details, VAT or tax identifiers, validation results and the billing information used for each invoice.
- Transaction data: backorders, domains, timestamps, auction participation, private maximum bids, public prices, account limits, winning orders, invoices, payment references, payment status, tax calculations, refunds and disputes.
- Delivery data: the domain, transfer method, receiving registrar TAG or other necessary destination details, transfer codes held securely, delivery status, code access and transfer-completion records.
- Technical and security data: IP addresses, request times, browser/device and request information, authentication activity, security checks and service error or audit records. Some security identifiers are hashed.
- Communications: support requests, messages, information you choose to include, email delivery outcomes and our replies. Please do not send passwords, full card details or unnecessary identity documents in a support message.
3. Where data comes from
We receive information from you when you register, maintain billing details, place orders, bid, pay or contact us, and from your use of the service. We also receive payment and tax results from Stripe, email delivery and security signals from our service providers, and domain status and transfer information from registries, registrars and cooperating registration companies.
Required fields support the particular action. Without essential account, billing, security or delivery information, we may be unable to create an account, accept an order, process payment or transfer a domain. Optional information is voluntary. If you supply someone else’s details, you must be entitled to do so and tell them how those details will be used.
4. How we use data
Where GDPR or a similar law requires a legal basis, we rely on taking steps at your request and performing our contract; applicable legal obligations; and legitimate interests in proportionate security, administration and dispute handling, balanced against your rights. Where consent is required for a separate activity, we will request it and explain how to withdraw it. Using our service is not blanket consent to unrelated uses.
- Create and verify accounts, authenticate users and maintain correct customer details.
- Accept backorders, allocate acquired domains, operate proxy bidding and enforce account capacity and bidding limits.
- Issue invoices, calculate applicable taxes, reconcile payments, handle refunds and respond to payment disputes.
- Obtain transfer codes, record destination instructions and arrange and verify domain delivery.
- Send verification, security, invoice, payment, delivery and other necessary service messages, and respond to support requests.
- Detect abuse and unauthorized activity, resolve errors and disputes, keep accounting evidence and meet legal requirements.
5. Service providers and other recipients
Access is limited to the information needed for the relevant purpose. Authorized staff and cooperating providers may process data to operate the service. We do not sell customer personal data or give auction participants your contact details or private maximum bids.
- Amazon Web Services: hosting, database infrastructure and transactional email delivery.
- Cloudflare: delivery and protection of website traffic, network security and Turnstile anti-abuse checks. These services process technical data such as IP addresses and browser signals.
- Stripe: checkout, payment processing, fraud checks, refunds, payment disputes and tax calculation/transaction records. We send the billing and transaction information needed for those tasks. Stripe may act independently for some of its legal, security and financial functions.
- Registries, registrars and cooperating registration companies: information necessary to acquire, hold, release or transfer the domain. Initial registration may be in our company’s or a partner’s name; your information is supplied where needed for delivery, a holder change, eligibility or a lawful registry requirement.
- Professional advisers, accountants, tax-service providers where engaged, and authorities: relevant records where needed for advice, accounting, tax filings, lawful requests or legal claims. We may provide relevant evidence in a payment dispute or lawful debt-recovery process.
6. Public information and payment details
Auction pages can display domain names, public prices, bid counts, timing and auction-specific bidder aliases. Those aliases are not your account name. Private maximum bids, billing information and transfer codes are not public auction data. Domain registration information may be published or disclosed by a registry or registrar under its own rules; check those rules before transfer.
You enter full card details on Stripe’s hosted checkout. Catch.Fast does not store full card numbers or card security codes. We receive the payment references, status and other transaction information needed to account for payment, delivery, refunds and disputes. Stripe may process additional information directly under its own policy.
7. Cookies and service messages
We use essential cookies and similar mechanisms to maintain login sessions, protect forms and prevent abuse. Our login session cookie is normally named __Host-catchfast_public and is configured as a session cookie. Security and payment providers may use their own necessary cookies or device signals when their services are used.
You can manage cookies in your browser, but blocking essential cookies may prevent login, form submission or checkout. We do not currently use optional audience analytics, advertising trackers or marketing email campaigns. If we introduce optional tracking or direct marketing, we will update the information and obtain consent where required before using it.
Verification, security, invoice, payment, support and delivery emails are service communications. They are distinct from marketing, and some are necessary for an active account or outstanding transaction.
8. International processing
We are a Hong Kong company and use international infrastructure and partners. Data may be processed in Hong Kong, the United States and other locations used by AWS, Cloudflare, Stripe, or the registry and registrar handling your domain. Their locations can differ from your country, and local laws may provide different protections.
We limit transfers to relevant purposes and use applicable contractual, organizational and security safeguards. Where a restricted international transfer requires a specific legal mechanism, that mechanism must be in place; accepting this policy alone is not a waiver of those requirements. Contact us for information about safeguards applicable to your data.
9. Retention and security
We keep information for as long as reasonably needed for its purpose, including an active account, an outstanding order, service support, security, accounting or a dispute. Financial and related supporting records are normally retained for at least seven years to meet Hong Kong business-record requirements, and longer where another applicable tax rule or a legal claim requires it.
Other retention periods depend on the record’s purpose, sensitivity, remaining obligations and legal requirements. Closing an account does not immediately remove invoices or evidence we must retain. When a purpose and any required retention period end, data should be deleted or anonymized, including through the applicable backup lifecycle. Contact us to request closure or to ask about a particular record.
We use access controls, encrypted connections, password hashing and protected storage for transfer codes, with access limited to relevant functions. No system is perfectly secure. Protect your account and transfer codes, and contact us immediately if you suspect unauthorized access.
10. Your choices and privacy rights
You can review and update available account and billing details in My Account. For access to or correction of personal data, account closure or another privacy request, email [email protected] or write to the address below. We may request proportionate evidence of identity or authority so we do not disclose another person’s information.
Under Hong Kong law, you can request access to and correction of personal data, subject to the applicable conditions and exemptions. We respond within the statutory time limits; a permitted access fee, if any, will be explained before it is charged. You may also raise a concern with Hong Kong’s Privacy Commissioner for Personal Data.
Where EU/EEA, UK or other applicable law gives additional rights, these may include erasure, restriction, portability, objection to certain processing, withdrawal of consent and a complaint to your local supervisory authority. Rights depend on the circumstances and can be limited by legal retention or other valid grounds. Withdrawing consent does not affect processing already lawfully carried out.
Proxy bidding, account-limit checks and some security or overdue-payment restrictions use automated rules. If you believe a result or restriction is wrong, contact us for human review. We will explain and address any rights concerning automated decisions that apply to your circumstances.
11. Children
The account and transaction service is intended for adults aged 18 or over. We do not knowingly invite children to create accounts or submit orders. If you believe a child has supplied account data, contact us so we can investigate and take appropriate action.
12. Updates and contact
We may revise this policy as our service or legal obligations change. The date above identifies this version. For a material new use of data, we will provide the notice and seek any consent required by law; publishing a change does not itself authorize an incompatible use.
For privacy enquiries, access or correction requests, contact [email protected]. For order or payment assistance, contact [email protected]. Please identify the relevant account or transaction without sending unnecessary sensitive documents.