High value domain taken by registrar I registered a domain name with a large domain registrar. The domain is very unique. The transaction went through. My credit card was billed. I received an invoice. I set up the domain with my website. I used CloudFlare for DNS and still have the domain listed in Cloudflare. Google has cached copies of the website pages on the domain. I verified the domain on Google search console and it is still listed under my properties. Four days after the registration I received an email from the registrar saying that there had been an error. They said the domain is a premium domain and the actual price for the domain is $1,000,000. They took my domain down and removed the whois information. They refunded me with in-store credit plus $25 "for any inconvenience". My credit card was never refunded it's all in-store credit. I never agreed to the refund. I have all the bank invoices and other documents. I want my domain back. What are my options?
You need to look at the domain registrar's TOS to determine their polices for canceling a domain after the fact in the way they did, i.e. claiming the domain is "premium" and as such allowing them to cancel and raise the price and re-offer the domain. The registrar may, in fact, have such a policy in their TOS that you agreed to when you opened an account with them and registered a domain. "Clicking through" and accepting a TOS is a binding contract. Their policy may hinge on an "escrow" hold on the domain for a certain time until your payment clears, they do due diligence, or other reasons, and by agreeing to the TOS you allowed them to reserve the right to cancel or re-offer the registration. However, such a policy is at least (I think) ethically challenged and at most could be illegal - US and local laws in your your jurisdiction may come into play - in terms of ICANN's policies. You may have success opening a complaint with ICANN, the international organization that oversees domain registrars and works to resolve complaints such as cyber-squatting, issues with the way registrars operate, etc. See Registrant Rights and Responsibilities Under the 2009 Registrar Accreditation Agreement - ICANN. If the registrar doesn't have a clear policy on the form of cancellation and re-offer you have been subjected to, your next step is definitely looking at Dispute Resolution Options - ICANN. Keep all your documents and emails, and log all phone calls or chats with the registrar. Make screenshots of your Cloudflare account and Google's web cache. And, it might be helpful to do a Google search for that registrar and "domain cancellation" or more relevant keywords to see if anything similar has happened in the past and the outcomes; those stories may give you ideas for other options. You may also need to find a local lawyer to advise you on your next steps, or talk to a free legal aid clinic in your area.
The CEO wants to "fool" users You are essentially admitting that the company you are working for is about to deceit its customers and asking whether that is legal. The relevant set of laws is rather sparse and does not give direct answers in regards to oAuth tokens or other details of that level (which is probably making your CEO think he can "handle" the arising questions). Probably the most relevant bit of legislation that applies here is The Federal Trade Commission Act (15 U.S.C. §§41-58) which prohibits unfair or deceptive practices and has been applied to online privacy and data security policies. I am pretty sure that, in practice, if the users take your company to court, it will be held liable because: users are allowing us to read their CRM data and once we get the data, the data become ours, and we can do whatever we want with it. Is this true? While the users are still allowing you to read their data it is completely up to the Terms/EULA what you can do with it. However, once you have made the users think that they have withdrawn your access (e.g. they "deleted" oAuth tokens), you are no longer authorized to read the current data (although the Terms may still allow you to use the old data you obtained when you had access). Silently continuing to access their data without their knowledge/approval is definitely a deceit. The CEO wants us to download all of their emails and store them in our database There would be nothing wrong with that if it was in the Terms. But if it is not, that would be a blatant (and easily punishable) breach of privacy. Note that you may also be held personally liable for this wrongdoing (if/when proved so). "Just doing your job" claim will not work.
DMCA applies as long as the the website is being hosted inside the U.S. The location of the copyright holder is irrelevant. For step-by-step help drafting a valid DMCA notice, see Step 2 of https://nppa.org/page/5617. If the site fails to comply with a valid notice, they lose the benefit of DMCA's safe harbor provisions and become themselves liable for continuing to host the infringing work, and you can sue them. (Prior filing suit, though, I imagine a letter from a lawyer that says, "Hey, my client sent you a valid DMCA notice a while ago; kindly comply at once, or we will actually sue you," should be sufficient.) The requirement to submit a photo appears to be totally unnecessary. A valid DMCA notice includes a signature (electronically including your name in an email is sufficient) and an assertion, under penalty of perjury, that the writer is authorized to control the copyright work and that the work is being used illegally. Beyond a signature and contact information, no further identity verification is necessary. The DMCA handles this by opening the submitter to perjury charges if the takedown was submitted illegally. Of course, any site might choose to ignore your DMCA takedown, at their own peril. They might bet that you won't actually hire a lawyer and follow through on your legal right to file suit, or they might not understand that identity verification is not a legal requirement listed in 17 U.S.C. § 512(c)(3). Your options are either: follow the law as written and file a valid takedown notice, and then hire a lawyer when they don't don't comply with the rules written in 17 U.S.C. § 512 follow their additional rules to get them to comply, which may be more difficult but might not require hiring a lawyer
The critical part is the nature of the relationship between you, the website provider, and the provider of the material you embed. If the embed-provider acts as your data processor, then things are generally fine. The GDPR does not really distinguish between personal data processing activities that you perform yourself versus activities that you've outsourced to third parties. However, you would remain responsible for compliance. This also means that per Art 28 GDPR, you will need a contract with that embed-provider (sometimes called a “Data Processing Agreement”, DPA). This contract stipulates that the processor will only use the personal data as instructed by you, but not for their own purposes. With the Google Fonts case, it must be highlighted that Google does not act as a processor for this service. Google does not offer a DPA that covers the Fonts CDN. While Google promises that it doesn't use the personal data collected in this context in any nefarious way, there are zero contractual guarantees for website providers. So we have to consider the scenario when the embed-provider is an independent data controller. We as the website provider have no control over what the embed-provider does with the collected data, our control only extends to whether or not we cause the website to disclose data to that third party. But this is still processing as personal data (see also the CJEU Fashion ID case), and we need a legal basis for this data sharing. In the Google Fonts case, the court in Munich found that there was no legal basis for using Google's CDN. There was no consent, no contractual necessity, and no necessity for a legitimate interest. After all, these fonts could all be self-hosted. (Technical remark: and given how modern browsers enforce cache isolation and provide HTTP/2, serving fonts from your main domain is probably faster anyway). Consent management services will typically act as your data processor. You don't need a legal basis for “sharing” data with them, because the processing remains under your control. As far as the GDPR is concerned, loading a script from your processor's servers is equivalent to loading a script from your own servers (which you're probably hosting via a another data processor anyway). Sometimes, the necessary data processing agreement is already part of the standard terms of service, sometimes it's a separate document that has to be signed. Figuring this out is your responsibility as the data controller, before deploying the service. Art 6 GDPR doesn't say that you always need consent. It says that you need a legal basis, for which paragraph 1 enumerates six choices. For a lot of use cases, a “legitimate interest” will be appropriate, though it requires a balancing test. Sometimes, other laws mandate that you use a particular legal basis. For example, the ePrivacy Directive says that you must get GDPR-consent when accessing or storing information on the user's device (such as cookies), unless that access/storage is strictly necessary to provide a service explicitly requested by the user.
There is not necessarily a contradiction. Information that they may keep may be: Account information Subscriber information Information on breaches of the Terms of Service or Agreement So yes, they might certainly not keep any logs &ndash; although that claim is doubtful, since they almost certainly keep at least error-level logs of their services &ndash; but that doesn't mean that they have no information to disclose to law enforcement. It's also questionable what "logs" refers to &ndash; would aggregate statistics be considered a log, by law? Would your last known IP address be considered a log, provided they don't keep any other history?
Is this how it works? Am I supposed to pay the full quote regardless? No. The contractor is plain wrong. Your agreed commitment to obtain materials directly from the retailer supersedes the initial agreement that totaled 30K. In other words, you two amended the contract. Since then, your obligations under the amended contract were to provide the materials he requested and to pay for labor costs. the contractor is insisting on the full amount, claiming that had I not paid the material I wouldn't have known the difference in cost and he was taking the risk with the quote. That is inaccurate. Once he delegated to you the task of obtaining materials directly from retailer, he exempted himself from any and all risks of giving an inaccurate estimate of the cost of materials. In fact, he shifted to you that risk.
So I suppose we basically need to disclose the exact geolocation of the datacenters that store this kind of content. That is incorrect. You need to identify a place of business where federal investigators may inspect the records without first making an appointment for access. The location of cloud storage is not particularly relevant. is it possible in any way to achieve compliance with 18 USC 2257A while using Google Cloud Storage (Or perhaps any other cloud storage service)? Yes. You must store the records as required by the statute and by the regulations issued under the authority of that statute, 28 CFR Part 75. I only scanned the regulations, but it seems that the &quot;location&quot; of the records is the place where they are available for inspection, not necessarily the place where digital files are stored. (The regulations also provide that you may indeed keep the records in digital form.) But consider, for example, what would happen if the FBI came knocking for an inspection and a local utility company accidentally severed the fiber cable on the next block. Such a network outage happened at my company a few years ago, and the incident disabled all of our redundant networking, so we had no internet access whatsoever for several hours. The investigators would probably tolerate such a disruption, but it is probably better to have a copy on site in addition to any off-site copies you might have. Regardless, you should hire a lawyer with relevant experience, because you need advice from someone who can find out whether there has been any litigation that may have a bearing on your rights and obligations, and you should find out what state and local law have to say about this, if anything. This is a criminal statute, and trying to protect yourself from criminal liability without qualified legal advice is quite possibly going to leave you vulnerable.
Probably not, because you should be in a position to rely on the Safe Harbor provision of the DMCA. Safe Harbor protects service providers who provide open, non-moderated spaces for users to directly contribute content. Safe Harbor means you do not need an army of moderators to inspect every message posted to the site or system. It is essential for sites like Twitter, Youtube or StackExchange to exist. You are not liable for that content if you provide a means for IP owners to report copyright violations, and promptly take down any content which an IP owner reports as violating. You don't need to get in the middle of whether that's really true; there's a mechanism for the user and IP owner to &quot;duke it out&quot; directly at no risk to you. However you must take the required steps. For instance you must register an agent, and respond timely to DMCA takedown notices, which means you must be reachable as per the law. Your designated agent address must be staffed 9-5. Note that the &quot;Designated Agent&quot; can be the same person as the &quot;Registered Agent&quot; that you already must have when you are an LLC or corporation. And you'll want to be an LLC or corporation by the time you get big enough to worry about copyright lawsuits.