Beware of privacy issue when buying/selling a .si domain name

The .si registry’s transfer confirmation email includes the new holder’s postal and email addresses. Email addresses are already public in .si WHOIS, so the material change is the physical address. That is the detail worth acting on.

The seller is the counterparty to the transfer and receives the confirmation. A buyer is therefore handing their home address to a stranger. This is not a data breach; it is the registry’s standard process. The exposure is structural, not accidental.

Buyers should use a P.O. Box or a commercial mail address for registrant and WHOIS contacts. That is the practical fix. Sellers should also expect to receive this data and handle it carefully, because receiving personal data carries its own obligations.

It is not known whether the buyer also sees the seller’s address. The article does not establish that. Until the registry changes the process or clarifies the rule, the safe assumption is that any address in the transfer chain may be visible to the other party.

This matters beyond .si. Any ccTLD with a similar transfer confirmation process can expose contact data. Domain holders should review their contact details before initiating a transfer and consider whether a postal address needs to be a home address at all.