Who owns our domain if an agency registered it?

What counts is the entry in the register: whoever is recorded as the domain holder is the contracting party and may dispose of the domain (DENIC). If the supplier's name appears there, the care service uses the domain but does not own it. Transferring it to the operator is a common step and can usually be done without interrupting operations; it should be agreed in writing and verified in the register afterwards. It makes sense to move the invoicing and the mailbox for renewal reminders to the operator at the same time, so that reminders do not pile up in someone else's account.

How do we find out who is recorded in the register?

If the operator is a legal person, the shortest route is the public domain lookup: it shows the name and address of the domain holder, the email address and telephone number as well as the registration date. For natural persons those details stay protected (DENIC); then three routes remain: reading the contract and the invoice, asking the supplier that administers the domain, and approaching the registry while stating a legitimate interest. Anyone holding the credentials for the control panel can usually read the holder field there directly. Record the result in writing, with the date and the name of the person who checked, so the question does not resurface in two years' time.

What is an AuthInfo code and who receives it?

The AuthInfo code is the key to moving a domain to another supplier. The outgoing supplier generates it at the holder's request, and it is valid for a limited period (DENIC). It can be requested by the recorded domain holder, not by any user of the website. That is exactly why the holder field matters so much: whoever is not named there depends on a third party's cooperation. Plan the change with some lead time so the code does not expire before the new supplier uses it, and align the date with the switch of DNS and mailboxes.

Which credentials do we really need ourselves?

As a rule of thumb: everything that gets operations running again. That means the domain control panel, an administrator account with the host, access to files and database, the mailboxes and ownership of map and directory profiles (Google documentation). The service provider works with its own accounts, which can be revoked individually. Responsibilities stay cleanly separated without the operator giving up control. The supporting evidence belongs with it: contracts, the data processing agreement (**Article 28 GDPR**) and the documentation of the last restore test.

What if the previous supplier does not respond?

First, put the request in writing with a deadline, referring to the agreed duty to hand over and, where personal data is involved, to the obligations arising from processing on behalf (**Article 28 GDPR**). In parallel, a great deal can be saved without cooperation: content and images can be recreated, texts taken from the existing site and a new presence prepared. The critical items remain the domain and the mailboxes, because they are tied to contracts. That is why it pays to settle ownership while the relationship is intact rather than in a dispute.

Do credentials belong in the maintenance contract?

The contract holds the rules, not the passwords. Sensible clauses cover the domain holder, the release of access and data within a set period, the server location, the backup routine with a documented restore test (BSI) and the renewal of the TLS certificate, whose validity has been capped at **200 days** since 15 March 2026 (CA/Browser Forum). The passwords themselves belong in a protected store with named people authorised to open it. The emergency sheet then only points to where that store is kept and who may open it.

Who Owns Your Care Website? Domain and Access Rights

In short and in plain language

Who owns your website? That is what this article is about. If a former supplier holds the access, a switch gets hard.

The domain is the name of your site on the web. What matters is who is listed as the holder. Whoever is listed there has control.

You stay responsible for the site. This is true even if a firm runs the technology for you.

Write all access details in one list. This covers the domain, mailboxes, hosting and backups. Plan the handover before you need it.

We help you take back your access.

As long as the website works, hardly anyone asks who owns it. The question surfaces on the day something stops working: the service provider goes quiet, the administrator who held the credentials has left, or the care service wants to move to a new supplier after several years. That is when it becomes clear who is actually recorded as the domain holder, where the site is really hosted and who controls the mailbox that receives enquiries from relatives. This article is therefore not about technology or content, but about ownership and control: which items make up the digital infrastructure of a care service, how to record them in an auditable list, and what a handover should settle long before it is needed.

Key takeaways

The entry in the domain register decides who may act: whoever is recorded as the holder can transfer the domain, move it or let it lapse. In June 2026 the register passed 18 million .de domains for the first time (DENIC).
Responsibility does not move with the assignment. Provider identification under Section 5 DDG and accountability for personal data under Article 5 GDPR stay with the care operator, even when a service provider runs the technology.
Eight items belong in a written inventory: domain holder, name servers and DNS, hosting and database access, mailboxes, TLS certificate, directory and map profiles, the data processing agreement, and backups with a documented restore test.
Certificates expire more often than before: since 15 March 2026, new TLS certificates last at most 200 days, from March 2027 100 days and from March 2029 only 47 days (CA/Browser Forum). Without access to the renewal, visitors see a security warning.
Switching suppliers becomes plannable once a handover list and an emergency sheet exist. Redirects after a move should stay in place for at least one year (Google Search Central).

Whoever is on the register holds the rights

For domains ending in .de, the registry DENIC keeps the central register. In June 2026 the total passed the mark of 18 million domains for the first time (DENIC). For a care service, only one field of that register matters: the domain holder. This person or organisation is the contracting party and may dispose of the domain, meaning sell it, transfer it, move it to another supplier or terminate it. Alongside sits the administrative contact, the admin-c, who may initiate changes. In practice the problem starts exactly here: many small operators placed an order years ago, and the supplier registered the domain under its own name for convenience. Legally the care service is then a user, but not the holder.

The public domain lookup shows holder details again for legal persons: for a limited company, a charitable company or a registered association it lists the domain holder's name and address, the email address and telephone number as well as the registration date; for natural persons those details stay protected on data protection grounds (DENIC). For most care operators the ownership question is therefore settled within minutes. If the domain runs on a private individual, what remains is a look at the contract and the invoice, a question to the supplier that issues the invoice, or a request to the registry stating a legitimate interest. A change of supplier then runs through an AuthInfo code, which the outgoing supplier generates at the holder's request and which is valid for a limited period (DENIC). Without holder status, a routine step turns into a negotiation, and experience shows that such negotiations take longest precisely when the relationship has already soured.

Key figures at a glance

More than 18 million .de domains on the register (DENIC); a maximum validity of 200 days for newly issued TLS certificates since 15 March 2026, dropping to 100 days from March 2027 (CA/Browser Forum); fines of up to 50,000 euros for missing or faulty provider identification (Section 33 DDG); up to 20 million euros or 4 percent of worldwide annual turnover for serious breaches of the General Data Protection Regulation (Article 83 GDPR); 5.69 million people in Germany needing care in December 2023, 86 percent of them cared for at home (Federal Statistical Office).

Responsibility stays with the care operator

An assignment moves work, not duties. The website of a care service is a commercially offered digital service and needs complete provider identification; the details are covered in our article on the legally compliant care website with imprint and advertising law. At the same time, almost every care website processes personal data as soon as a contact form, an appointment request or an application arrives. That touches a sensitive area: in December 2023, 5.69 million people in Germany needed care, and 86 percent of them were looked after at home (Federal Statistical Office). Anyone who describes their situation in a form reveals far more than a phone number. How that data is protected technically is set out on our page about data protection for care services.

Provider identification: missing, incorrect or incomplete mandatory details are an administrative offence carrying up to 50,000 euros (Section 33 DDG), regardless of who built the site
The controller under the General Data Protection Regulation is the care operator who decides on purposes and means of processing, not the commissioned supplier (Article 24 GDPR)
Processing on behalf requires a written data processing agreement with the host and other parties involved (Article 28 GDPR)
The record of processing activities must cover the website and its forms and be produced on request by the supervisory authority (Article 30 GDPR)
Security of processing expressly includes the ability to restore availability and access swiftly after an incident (Article 32 GDPR)
Access requests are generally to be answered within one month (Article 12 GDPR) - which presupposes that the operator can reach the data at all

The inventory: eight items that belong on paper

An inventory is not a technology list, it is an ownership list. For each item it answers three questions: who is recorded, who has access, and where is the evidence kept? The following six items form the core; the next section covers two more. A simple sheet with a date and the initials of the person who checked is enough. Anyone planning a new site should draw up the inventory before the launch; the overview of a care website shows which building blocks belong to it.

Domain and holder field

The domain name with its ending, the recorded holder with a full postal address, the registrar and the customer number. Plus the answer to one question: which mailbox receives the renewal reminders? If the domain sits with a private individual, start the transfer to the care operator.

Name servers and DNS

Name servers decide where the domain name points. A printout or file listing every entry with a date saves hours during a move. If mail entries are missing, messages vanish after the switch while the website appears to carry on quietly.

Hosting and database

Supplier, contract number, server location and an administrator account in the name of the care operator. Plus access to files and database. If content, images and job ads are only reachable through someone else's account, the site is technically available but not under your control.

Mailboxes and forwarding

Work mailboxes belong to the organisation, not to a private person. Document the supplier, all mailboxes, forwarding rules and distribution lists. If the address in the imprint runs to a private account, the communication channel leaves with that person.

TLS certificate

The certificate secures the encrypted connection. Since 15 March 2026, newly issued certificates last at most 200 days, and from March 2027 100 days (CA/Browser Forum). Note the expiry date, the renewal route and the person allowed to act as a deputy.

Map and directory profiles

The business profile, the map service and care directories belong to the operator, not to the agency. Ownership can be transferred and provider access granted separately (Google documentation). How these entries work together is shown in our article on local SEO for care services.

The two quiet items: data processing and backups

Two items are missing from almost every folder because they leave no trace in daily work. The first is the data processing agreement: it settles who processes which data on behalf of the operator, which sub-processors are involved and where the servers stand (Article 28 GDPR). The second is the backup. A backup that has not been restored is an assumption rather than a recovery point; the Federal Office for Information Security recommends regular functional tests of the restore (BSI). How sensitive the data paths around forms are is described in the article on secure forms on the care website.

Is there a signed data processing agreement with the host, and does it reflect the services actually in use today (Article 28 GDPR)?
Are the sub-processors named, and is it agreed that changes will be announced in advance?
Is the server location stated in the contract, and does it lie within the European Union?
How often is data backed up, how long are the versions kept, and is the backup stored separately from the website?
When was a restore last tested, how long did it take and who was involved (BSI)?
Is the ability to restore availability and access documented rather than merely intended (Article 32 GDPR)?

The self-test in ten questions

The following self-test needs no technical background, just half an hour and a sheet of paper. Work through the ten questions in order and note for each who can prove the answer and where the evidence is kept. Every question that ends in a guess marks a gap. If more than two questions go unanswered, the clarification does not belong in the autumn plans but in the next management meeting. Ongoing support itself is covered in the article on website maintenance for care services; here the subject is ownership and access alone.

Who is recorded as the domain holder: the care operator with its legal name and address, or someone else?
Which address receives the registrar's notifications, and does anyone read that mailbox regularly?
Who pays for the domain, and is this year's invoice available in the office?
Which name servers are set, and who may change entries in the DNS?
Where is the website physically hosted, and is the server location recorded in the contract?
Who has access to files and database, and does an administrator account exist in the operator's name?
Who manages the mailboxes, and do work messages run through a private account?
Who renews the TLS certificate, and what happens if that person is unavailable for a longer period?
Who owns the map and directory profiles, and can management change opening hours without outside help?
When was a backup last restored, how long did it take and who confirmed the result?

The handover when changing supplier

Changing supplier is not a vote of no confidence, it is a routine step that can be prepared. What helps is a handover list that names not only what is to be delivered, but also how management can tell that it has arrived. An email promise is not yet access, and a delivered file is not yet a readable data set. The list below has proven useful as an annex to the notice of termination.

Item	What the previous supplier hands over	How you know it is done
Domain	AuthInfo code and release for the supplier change	The domain appears in the operator's account
DNS	A complete list of all entries as a dated file	Site, mail and subpages work after the move
Hosting and database	File set and database export in a common format	The copy opens on a test address
Mailboxes	Mailboxes including history, forwarding and lists	Older messages are present in the new mailbox
Editorial access	Accounts with administrator rights, old logins revoked	Only named people appear in the user list
Profiles	Ownership of map and directory entries	Management can change opening hours itself

If the address structure changes with the move, one more point applies: old addresses should point to the new ones permanently, and for at least one year (Google Search Central). That protects visibility built up over years as well as links from care portals, directories and press articles. How such a move works in practice is described in our service for the relaunch and migration of an existing care website; when the effort pays off is assessed in the article care website relaunch 2026.

What belongs in the maintenance contract and what does not

A good support contract describes not only the services but also the exit. It records who owns the domain, which documents are handed over on request and within which period. This is not a matter of distrust but of operational capability: if a small supplier ceases trading, a clear clause helps more than any personal assurance. Our website support for care services therefore works with documented access. Small operators with thin administration benefit most, for instance a hospice service that recruits volunteers and donations through its website and whose site is looked after by a handful of people.

Naming the domain holder: the operator is on the register, the supplier appears at most as the technical contact
Duty to hand over: credentials, DNS entries, database export and content are released on request within an agreed period
Data processing agreement under Article 28 GDPR with the server location and a list of sub-processors as an annex
Backup rule with frequency, retention period and at least one documented restore test per year (BSI)
Certificate management: who renews, who is notified and how far in advance, who acts as deputy (CA/Browser Forum)
Response times, availability and a named deputy for holidays and sickness

Clauses worth checking

Watch for wording that makes leaving expensive: the domain declared as the supplier's property, content tied to their system with no export option, automatic renewal with a long notice period, or the sentence that credentials will not be released for security reasons. Security is a good reason for separate accounts and strong procedures, but not a reason to deny an operator access to its own infrastructure. Equally critical is the quiet point in many contracts: a backup rule with no statement about whether a restore has ever been tested. Settle these questions before signing, because after termination the bargaining position is usually gone.

The emergency sheet for management

The inventory answers the ownership question, the emergency sheet answers the question of what to do. It fits on one page, is kept in a locked place and is reviewed once a year and whenever staff change. Two people should hold full access so that holidays, illness or a departure do not stall operations. Operators with several locations benefit from one version per site, for example when an assisted living scheme presents its apartments and services online and keeps its own addresses, mailboxes and profiles.

Domain name, registrar, customer number and the holder recorded in the register
Hosting: supplier, contract number, server location and the address of the control panel
Access: which accounts exist, who owns them and where the second factor for signing in is stored
Mailboxes: supplier, mailboxes, forwarding rules and the address named in the imprint
DNS: the current state as a printout or file, marked with the date of the last change
TLS certificate: expiry date, renewal route and the responsible person (CA/Browser Forum)
Backups: location, frequency, retention period and the date of the last successful restore test
Contacts: two people with full access, plus the storage location and the date of the last review

Once these points have been gathered properly, the bulk of the work is done; after that an annual review is enough. It makes sense to combine the clarification with a step that is due anyway, such as a migration or taking over ongoing website support with documented access. Which services work together here is shown in the overview of our services for the care sector; the requirements for handling sensitive contact data are set out on the page about data protection for care services. If you are unsure whose name is on the register today, we clarify it in a personal conversation and record the inventory together.

Sources and Studies

This article is based on data from DENIC, the CA/Browser Forum, Google Search Central and the Federal Statistical Office, as well as on the texts of the General Data Protection Regulation, the German Digital Services Act and the recommendations of the Federal Office for Information Security. The figures quoted refer to the status at the time of the respective publication.

Accessibility & operations

Buying a Care Service: What Happens to the Website

Domain, mailboxes and logins in the purchase agreement, liability when the name stays, redirects, legal texts on the cut-off day: the project plan for a change of owner.

16 min read