Privacy Policy

1. Privacy at a glance

General information

The following notes give a simple overview of what happens to your personal data when you visit our website. Personal data is all data by which you can be personally identified.

2. Data collection on our website

Who is responsible for data collection?

The controller within the meaning of the GDPR is:
Manuel Grahammer (EuropaRoots), Reinhardtstraße 17, 10117 Berlin, Germany.
Email: datenschutz@europa-roots.org. Further contact details are in the legal notice. We are not legally required to appoint a data protection officer.

How do we collect your data?

Some of your data is collected because you provide it to us. This may, for example, be data you enter into an order form. Other data is collected automatically by our IT systems when you visit the website.

3. Special categories of data

In the course of our genealogical research service we process special categories of personal data, including:

• Genealogical data (family-tree data)
• Religious affiliations (where relevant to parish-record research)
• Historical places of residence and occupational details

This data is processed exclusively for the performance of the genealogical research commissioned and is not passed on to third parties. Since you contractually submit to us, as starting data, only data of already-deceased persons and your own data (section 3a, § 2 of our Terms), this concerns primarily your own information — e.g. where you state your own religious affiliation in the course of the order; the GDPR generally does not apply to information about deceased persons.

The legal basis for processing special categories of personal data, insofar as it concerns you yourself (in particular your religious affiliation), is your express consent under Art. 9(2)(a) GDPR, which you give separately during the ordering process. You may withdraw this consent at any time with effect for the future.

3a. Data of reference persons and other living persons

You contractually submit to us, as starting data for the research, exclusively data of already-deceased persons and your own data (§ 2 of our Terms). Genealogical research therefore predominantly concerns persons to whom the GDPR does not, in principle, apply (Recital 27 GDPR). In addition, our automated research process automatically stops the search for a direct ancestor once their birth year falls after the end of the online-accessible parish-register digitizations (generally around 1875–1915) — such persons are presumably still alive, and the relevant civil-status registers are sealed in any event.

Should the information you submit or the research results nonetheless contain data of living persons — for example because a researched person, contrary to assumption, is still alive, or because the reference person whose ancestors we research is not you yourself but another, still-living person —, by placing your order you warrant to us that you are entitled to transmit this data and that you have — where necessary — obtained the consent of the living persons concerned. We process this data on the basis of your warranty and of our legitimate interest in performing the service commissioned (Art. 6(1)(f) GDPR); we do not carry out an independent check of that entitlement.

Living persons concerned may object to the processing at any time and request access, rectification or erasure — informally by email to datenschutz@europa-roots.org.

4. Payment processing

We use the service Stripe (Stripe Payments Europe, Limited, Dublin / Stripe, Inc., USA) for payment processing. When you pay, your payment data is transmitted directly to Stripe. Stripe is PCI-DSS certified. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Further information on data protection at Stripe:https://stripe.com/privacy

4a. Processors and service providers used

To provide our service we use the following service providers as processors within the meaning of Art. 28 GDPR. Corresponding contracts are concluded with all processors. Where transfers to third countries (USA) occur, the data transfer takes place on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR) plus supplementary technical and organisational safeguards.

The legal basis for engaging these service providers is Art. 6(1)(b) GDPR (performance of a contract) and our legitimate interest in efficient, secure and high-quality service delivery under Art. 6(1)(f) GDPR.

4b. Certificate service — data transfer to registry offices

If you book the optional certificate service (registry-office research), we transmit personal data to the competent authorities (registry offices in Germany, Austria or Switzerland) under your express written power of attorney. Transmitted are:

• Your name, address and (anonymised) identity-card evidence as proof of entitlement
• Data of the target person (first/last name, date of birth and death, place)
• Your family relationship to the target person
• Your written power of attorney to file the application

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(e) GDPR in conjunction with § 62 of the German Civil Status Act (task carried out in the public interest for civil status registers). The receiving registry offices are not processors but independent controllers within the meaning of the GDPR.

You may revoke your power of attorney at any time; applications already sent cannot be withdrawn by us. Incoming certificate copies are stored in our encrypted storage (Supabase, EU Frankfurt) and incorporated into your digital chronicle.

5. Data storage and erasure

We store your personal data only for as long as is necessary for the provision of our services or as required by statutory retention obligations (in particular § 147 of the German Fiscal Code).

Research results and family-tree data are stored for a period of 2 years after completion of the order, so that follow-up questions and repeat orders can be handled. After that they are erased, unless statutory retention obligations prevent it.

Uploaded certificate scans and supporting documents remain available in the original for 12 months after completion of the order in our encrypted storage (Supabase, EU region). Signed download links are valid for 7 days each and are regenerated on demand. Accounting-relevant data (invoices, Stripe receipts) is retained for 10 years under § 147 of the German Fiscal Code.

6. Your rights

You have the right at any time:

• to obtain access to the data we hold about you (Art. 15 GDPR)
• to request rectification of inaccurate data (Art. 16 GDPR)
• to request erasure of your data (Art. 17 GDPR)
• to request restriction of processing (Art. 18 GDPR)
• to request data portability (Art. 20 GDPR)
• to object, on grounds relating to your particular situation, to processing we base on a legitimate interest (Art. 6(1)(f) GDPR) — Art. 21 GDPR
• to withdraw consent you have given at any time with effect for the future (Art. 7(3) GDPR)

To exercise your rights, send an informal email to datenschutz@europa-roots.org. We process requests within the statutory period of one month. For identification, please state the email address you used for the order and (if known) your order number.

Irrespective of this, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is the Berlin Commissioner for Data Protection and Freedom of Information.

7. Hosting

Our website is hosted by Vercel Inc. When you visit the website, information your browser transmits is automatically stored in what are known as server log files: truncated or processed IP address, date and time of access, page/file requested, referrer URL, and browser type and version. This data serves exclusively for secure, stable operation and the prevention of misuse. The legal basis is our legitimate interest in the error-free operation of the website (Art. 6(1)(f) GDPR).

Further information on data protection at Vercel:https://vercel.com/legal/privacy-policy

7a. Reach analysis with Vercel Web Analytics

For the statistical evaluation of the use of our website we use Vercel Web Analytics (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA). The solution works without cookies: no cookies are set and no information is stored on or read from your device. Visitors are not recognised via a persistent identifier but via an anonymised hash value derived from the respective request, which is discarded after 24 hours at the latest. No IP address is stored.

Only aggregated, anonymous data is collected, such as the page requested, referrer, approximate region of origin, device class and browser version. Individual persons are not re-identified, and no cross-site or cross-application tracking takes place.

The legal basis is our legitimate interest in a statistical reach evaluation without intruding on visitors' privacy (Art. 6(1)(f) GDPR). Since no information is stored on or read from your device, consent under § 25 of the German TDDDG is not required. Any processing in the USA takes place on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR). More information: https://vercel.com/docs/analytics/privacy-policy

7b. Advertising and referral identifiers

If you reach our site via an ad or a referral link, the destination URL may contain a technical identifier (for example gclid or a similar parameter). We do not set cookies, use localStorage, or load a third-party script for this purpose. The identifier is stored server-side only, together with the order, so we can attribute the order to an ad or referral.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in measuring where an order came from). The identifier is not transmitted to Google or any other third party. It is retained for as long as the related order record.