1. About this notice
Aha! Ancestry provides family-history and genealogical research services. This notice explains what personal information may be collected and used when you enquire about or commission research, how it is stored and shared, how long it is kept, and the rights available to you.
For data-protection purposes, Aha! Ancestry is responsible for deciding how and why personal information used in running the service is handled.
2. Information I may collect
Depending on the project, I may collect or use:
- your name and contact details;
- information you provide about your family, including names, dates, places, relationships, photographs, certificates and other family documents;
- correspondence about your enquiry, quote, instructions and research project;
- payment and transaction information needed to administer the project, but not full card details where payment is handled by a payment provider;
- research information found in genealogical, archival, historical, public or subscription sources; and
- limited information about living relatives where it is genuinely relevant and necessary to the agreed research.
Information about deceased people is generally outside the scope of UK data-protection law, but information that identifies or relates to living people is handled in accordance with this notice.
3. Where information comes from
Most customer information is provided directly by you. Genealogical information may also come from sources such as historical records, archives, indexes, family trees, record databases, publicly available sources and subscription research services such as Ancestry.
Where information about a living person is obtained from another source, I aim to use only what is necessary and proportionate for the research.
4. Why I use personal information
Personal information may be used to:
- respond to enquiries and prepare a research quote;
- agree, administer and carry out the research service you request;
- communicate with you about the project and deliver the finished research;
- keep appropriate business, payment and project records;
- investigate family relationships and historical evidence relevant to the agreed research; and
- deal with queries, complaints, legal obligations or the establishment, exercise or defence of legal claims where necessary.
5. Lawful bases
For information about you as the customer, the main lawful basis will usually be contract: the information is needed to take steps at your request, enter into the research agreement and provide the service.
Some information may need to be kept or used to meet legal obligations, for example where business or tax records are required by law.
Where limited personal information about another living person is genuinely necessary for genealogical research, Aha! Ancestry may rely on legitimate interests where appropriate. The interest is carrying out the family-history research commissioned by the customer. Before relying on this basis, the necessity and likely impact on the living person should be considered, and the information should not be used where their rights and interests override that interest.
If a project would require use of particularly sensitive personal information about a living person, additional data-protection requirements may apply and the information will not automatically be treated as covered by the statement above.
6. Ancestry and other research services
Aha! Ancestry may use Ancestry and other genealogy or archive services to conduct research. Customer research trees created on Ancestry will be kept private and unsearchable while they are needed for the project. Information about living people will be limited to what is reasonably necessary for the research.
External research services operate under their own privacy terms and may process information on their own systems, including outside the UK. Where a project would require unusually sensitive information about a living person to be uploaded to a third-party service, this will be considered separately.
7. Google Drive and delivery
Google Drive may be used to provide your completed report and supporting documents. The delivery folder will be shared only as needed for delivery and is intended to remain available for 90 days after the report is supplied.
You should download and securely save any files you wish to keep before the 90-day period ends. The delivery folder may then be removed.
8. Local storage and security
Working research files are primarily stored locally on a password-protected computer. Reasonable security measures are used to reduce the risk of unauthorised access, loss or disclosure.
Customer information will not be sold. It will only be shared where necessary for the research or service, where you have asked or authorised me to do so, or where there is a legal requirement.
9. How long information is kept
Customer and project files will normally be retained locally for up to two years after the project is completed. This allows time to answer follow-up questions or continue related research if requested.
At the end of that period, the files will be reviewed and personal information that is no longer required will be securely deleted or anonymised as appropriate. Information may need to be retained for longer where there is a legal, accounting or dispute-related reason to do so.
Google Drive delivery folders are normally removed after 90 days. Customer research trees held on Ancestry will be removed when they are no longer needed for the research.
10. Your data-protection rights
Depending on the circumstances and the lawful basis being used, you may have rights to ask for access to your personal information, correction of inaccurate information, deletion, restriction of use, portability of certain information, or to object to certain uses.
These rights are not all absolute and may not apply in every situation. If you make a request, I may need enough information to confirm your identity and understand the request.
11. Your right to object
Where Aha! Ancestry relies on legitimate interests to use your personal information, you have the right to object based on your particular situation. If an objection is received, the relevant use will be reviewed and stopped unless there are compelling legitimate grounds to continue or the information is needed for legal claims.
Aha! Ancestry does not currently use customer information for direct marketing without an appropriate basis. If direct marketing is introduced, you will be able to object to it at any time.
12. Complaints and questions
If you have a question, concern or request about your personal information, please email kim@ahaancestry.co.uk.
You also have the right to complain to the UK Information Commissioner's Office if you are unhappy with how your personal information has been handled.
13. Changes to this notice
This privacy notice may be updated if the way Aha! Ancestry handles personal information or uses research and delivery services changes. The latest version should be provided or made available to customers when appropriate.