When we disclose registrant data, and to whom

What registrant data does PanamaRegistrar hold?

Very little, and that limits what any order can obtain. We hold:

• one email address per domain, which you confirm; ICANN requires registrars to verify it within 15 days;
• a random account number that we generate;
• your domains, their DNS settings and your balance;
• payment records: the amount, coin and network of each crypto top-up;
• messages you send us, and the complaints and orders received about your domains.

The email is the only contact data we collect: we do not ask for a name, a postal address, a phone number or an identity document. Where a registry requires a name and address, the domain is sold with Domain protection, and the registry receives our company's details. The full inventory is on what we hold.

When does registrant data leave PanamaRegistrar?

Our rule, in the words we use on every page: We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. Our registrar partner and the registry hold their own records, under their own rules.

In detail, three routes, each one written down here:

1. A Panamanian court order. Our rule: we confirm every order with the court or prosecutor's office that issued it, through its official contact details, before acting. Article 24 of Law 81 of 2019 obliges controllers to give the competent judicial authorities the information duly requested.
2. A prosecutor's order, from Panama's Ministerio Público. Today that means an order under article 338-A (preservation) or 338-C (production) of the Code of Criminal Procedure, both added by Law 478 of 2025. We check it like a court order and count it separately.
3. A UDRP or URS provider, which receives the registrant details of record for the disputed domain, as ICANN's dispute rules require.

A foreign court, a foreign police force or a foreign lawyer reaches us through the first or second route only. That means exequatur for a civil judgment, or a treaty request turned into a Panamanian order. The routes are on the court orders page.

What happens to an ordinary disclosure request?

It gets an answer on time, and without Panamanian process that answer is a refusal. The Registration Data Policy (§10.5) asks registrars to acknowledge a reasonable disclosure request within 2 business days. A response follows within 30 calendar days of acknowledgement at most. Our accredited registrar partner is bound by those limits, and we answer within them. The refusal explains which Panamanian route would work for the requester.

ICANN ran a voluntary lookup service, the Registration Data Request Service (RDRS), as a two-year pilot from November 2023 to November 2025. ICANN reports more than 3,700 requests: 32 % for intellectual property, 16 % from law enforcement, and about a quarter approved overall. If a request reaches us through RDRS, the same rule applies.

What does RAA §3.7.7.3 mean for Domain protection?

It means our company carries a liability that you would otherwise carry, and we say so plainly. With Domain protection, DomaineGoat LLC is the registrant of record and you are the beneficial owner.

ICANN's 2013 Registrar Accreditation Agreement, §3.7.7.3, deals with this case. A registrant of record that licenses a name to someone else accepts liability for harm caused by its wrongful use. The exception: it discloses the licensee's contact details and identity within 7 days to a party that gives reasonable evidence of actionable harm.

Three honest points follow.

• The clause sets who is liable; it does not order disclosure. Our rule stays the same: a Panamanian court or prosecutor's order, or a UDRP case. When we do not disclose, our company is the one exposed to the claim.
• The clause is not a shield for you. A Panamanian court can still order disclosure, and the strict exceptions still apply to protected domains.
• The contact we would disclose is one verified email. It is the only contact data we hold for you.

For domains without Domain protection, you are the registrant of record, and the clause concerns you, not us. ICANN's specification on privacy and proxy registrations asks providers to publish when they reveal a customer. This page is that publication.

Why does PanamaRegistrar refuse bulk data requests?

Because Panamanian law forbids them: article 24 of Law 81 of 2019 says bulk requests are never admitted ("no admitiéndose en ningún caso solicitudes masivas"). The same article obliges us to answer requests from competent judicial authorities that are duly made.

A bulk request asks for data not tied to named domains: every customer paying in a given coin, every domain with a keyword, every account created in a month. Each request must name the domains concerned. A Panamanian order covering many named domains is still possible; a fishing expedition is not.

Do you tell the customer when their data is disclosed?

Yes: we tell you before any action on your domain, unless the law or the court order forbids it. The notice names the requester, the legal basis, the data released and the date.

Three cases delay or prevent notice:

• a court order that forbids it, for the period it sets;
• a Ministerio Público preservation order under CPP article 338-A, which the custodian must keep confidential;
• a UDRP case, where the rules bar notifying the respondent before the lock is applied; we tell you once it is.

The transparency report, published every quarter, counts data requests by origin country and outcome. The first one covers launch to 31 December 2026. No figure exists yet.

What do the registry and our registrar partner disclose?

They answer to the law of their own countries, not to our policy.

• Our registrar partner. Domains are registered through our ICANN-accredited registrar partner, shown in the RDAP record. It keeps the registration record, its own legal duties and its own abuse contact, and a court of its own country can order it directly.
• The registry. Each registry keeps its own copy of the registration. A thick registry, such as .org (Public Interest Registry, United States) or .io (Identity Digital), receives the registrant record: built from your verified email, or our company's details with Domain protection. The .com and .net registries (Verisign, United States) are thin: they receive no registrant contact data. DENIC, which runs .de, is in Germany.

The registry jurisdiction index lists the country of each of our 43 extensions. Their prices, with or without Domain protection, are on the price list.