.pl Domain Name Registry Policy on Data in the DNS Database

1. This Policy (the "Policy") has been introduced by the Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy, seated in Warsaw, Poland, which maintains the .pl domain name Registry (the "Registry"). The Policy is introduced pursuant to Article 16b of the Act of 5 July 2018 on the National Cybersecurity System (hereinafter referred to as “Act on NCS”) in conjunction with Article 28(3) of Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures to promote a high common level of cyber-security within the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972 and repealing Directive (EU) 2016/1148 (NIS Directive 2), taking into account the provisions on the processing of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: "GDPR").

2. The Policy applies to the services, Subscribers (“Registrants”) and Partners ("Registrars") referred to in the .pl Domain Name Regulations, available on the Registry’s website, with the exception of the “.gov.pl” and “.mil.pl” zones. Terms not defined in the Policy shall be understood in accordance with the .pl Domain Name Regulations.

Data in the DNS database

3. This Policy is designed to contribute to the security, stability and resilience of the worldwide internet domain system (DNS) in collecting and maintaining, with due diligence, accurate and complete data in the .pl domain name database ("DNS Database"), and making such data available, in accordance with applicable law.
4. DNS database shall include data on the Registrants and the names in the .pl domain, including in particular: the .pl domain name, the date of its registration, the Registrant's name and address, telephone number and e-mail address of the Registrant, as well as an indication of the current Registrar.
5. Party to the agreement on maintenance of the .pl domain name is an identifiable entity or natural person - the Registrant of the .pl domain name, who is represented before the Registry by the Registrar. The Registrar represents the Registrant regardless of the status of the Registrant's data in the DNS Database concerning their verification status.
6. The identifiability of the Registrant is ensured in particular through the collection in DNS Database of data concerning the .pl domain name and its Registrant, the verification of such data within the framework of the applicable procedures and their ongoing updating.
7. Collecting and maintaining of complete and accurate data in DNS Database requires cooperation between the Registrant, the Registrar and the Registry, on the basis of legal regulations and mutual obligations, including on the grounds of this Policy, .pl Domain Name Regulations and relevant agreements, regulations and procedures. Data entry and modification in DNS Database is performed in an automated manner, based on data content of and representations provided to the Registrars by the Registrants.
8. Collecting of data in DNS Database is a process generally initiated by the Registrant, who indicates in particular the status, thus informing whether the data identifying him/her benefits from the protection under the GDPR.
9. The Registrar shall be responsible for entering the Registrant and the Registrant status data into DNS Database. The Registry keeps the data entered by the Registrar into DNS Database.
10. The Registrar shall process data concerning the Registrant and the service provided to the Registrant to the extent arising from the formal relationship between it and both the Registrant and the Registry. The Registrar may, in particular, correct data based on the content of records in public registers, collect evidence of data verification, financial and billing data and other information which are not required to be entered into DNS Database.

Data verification

11. In accordance with applicable regulations and obligations, the Registrant provides and updates as necessary any data required to be entered into DNS Database by the Registrar. The Registrant is obliged to participate in the required verification activities concerning such data, in particular to provide the required responses to the Registrar's enquiries or requests in a timely manner ("Responsiveness"). The tandards for Responsiveness, and the consequences of failing to comply with them, shall be set out by Registrars in documentation binding on Registrants, including contracts, regulations, policies and relevant procedures. The Registrant acknowledges that a breach of such standards may result, in particular, in the Registrar deleting the .pl domain name from the .pl Domain Registry.
12. The Registrar shall perform basic verification of the Registrant's data entered into DNS Database and, in justified cases, also their additional verification, and shall be responsible for making an appropriate labeling in DNS Database concerning the verification and keeping an appropriate confirmation of its performance. The Registry may initiate additional verification of, the Registrant's data in justified cases and through the Registrar. Detailed rules on verification are published in.pl Procedure on verification of DNS Database data available on the Registry website.
13. Registrars' verification procedures adhere to the requirements incorporated in the .pl Procedure on verification of DNS Database data, ensuring appropriate balance of high verification standards and respect for the principle of avoiding undue burden on the Registrant. The Registrant's change of Registrar may involve the need to re-verify the data.

Data sharing

14. To the extent permitted by applicable law, the Registry and the Registrars shall provide access to data concerning .pl domain name registrations. The Registry shall make available the data provided by the Registrars and the Registrars shall make available the data provided by the Registrants.
15. The Registrant’s data that has not been restricted by the Registrar during entry into DNS Database as requiring protection under the GDPR is published in a publicly available Whois database on the Registry's website. The Registry strives to ensure the uninterrupted availability of this database, subject to necessary maintenance and technical interruptions.
16. The Registrant’s Data that has been restricted by the Registrar during entry into DNS Database as requiring protection under the GDPR shall not be published in the Whois database and shall be provided upon lawful and duly justified request in accordance with the GDPR. A Registrant who does not benefit from such protection shall first indicate to the Registrar a contact email address that does not include personal data, and in the absence of this, they shall ensure that there is an appropriate legal basis for the processing of such data, including consent to the publication in the Whois database.
17. Detailed principles of providing legitimate access seekers, pursuant to the provisions of the Act on NCS, with access to specific data concerning the .pl domain name registration are prescribed in the Procedure and Policy for Disclosing Data from the .pl Domain DNS Database, published on the Registry website. Responding in such cases may require participation of the Registrar, in particular when it is necessary to initiate an additional data verification procedure.
18. The Registry shall not restrict Registrars from lawfully disclosing data that benefits from the protection under the GDPR, or data that is not subject to transfer to the DNS Database, including billing data between Registrars and Registrants, history of activities on Registrars' systems, other services provided by Registrars.

Remedying irregularities

19. In the event that it is suspected or established that the Registrant's data may not comply with the requirements, referred to in the provisions of law or the Policy, in particular in the event that the data is incomplete, inaccurate, e.g. out of date, or has been entered in an unauthorized manner, appropriate verification procedures shall be initiated.
20. Additional verification of data entered into DNS Database includes the order in which they were submitted, while the lack of due Responsiveness of the Registrant does not exempt the Registrar from its verification obligations.
21. In case the verification procedure does not lead to ensuring or confirming the fulfilment of requirements referred to in the provisions of law or in the Policy, it is assumed that the data entered may not enable the fulfilment of obligations resulting from the provisions of law concerning DNS Database. In such cases, irrespective of the Registrar's rights resulting from the documentation referred to in paragraph 11, the following in particular are possible: withholding of the provision of services concerning the .pl domain name or functionalities related thereto, withholding of publication of data in the Whois database, deleting of the .pl domain name from the .pl Domain Name Registry by the Registrar and other appropriate actions aimed at assuring or confirming that the requirements referred to in the provisions of law or the Policy are met.

Effectiveness

22. This Policy shall come into force upon publication on NASK's website intended exclusively for Registrars (the so-called Registrar Panel), with effect as of 3 April 2027. Until that date, the Policy shall only have the status of a good practice recommendation concerning its subject matter.
23. Polish law shall apply to this Policy and its subject matter, and any disputes that may arise shall be settled by the common courts having jurisdiction over the registered office of the Registry.
24. Any changes to this Policy shall be implemented by publishing an updated version of the Policy on the Registry's website and, prior to such publication, - on the NASK’s website intended exclusively for Registrars (the so-called Registrar Panel), and shall take effect from the date of publication, unless otherwise specified.