Vestigee — GDPR

Your rights under the GDPR when we process personal data for genealogy research, including access, erasure and how to contact us.

General Data Protection Regulation Information

Last updated: January 1, 2025

1. Introduction

vestigee.com is committed to protecting your personal data and complying with the General Data Protection Regulation (GDPR). This page explains your rights under GDPR and how we handle your personal information in accordance with EU data protection laws.

2. Legal Basis for Processing

We process your personal data based on the following legal grounds:

Consent:

When you explicitly agree to processing for specific purposes

Contract:

When processing is necessary to fulfill our service agreement with you

Legitimate Interest:

When we have a valid business reason that doesn't override your rights

Legal Obligation:

When required by law to process your data

Vital Interests:

When processing is necessary to protect someone's life or safety

3. Your Rights Under GDPR

3.1 Right to Information

You have the right to be informed about how your personal data is collected and used. This information is provided in our Privacy Policy and this GDPR page.

3.2 Right of Access

You have the right to request copies of your personal data. You can export your family tree data, account information, and other personal data through your account settings or by contacting us.

3.3 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data. You can update most information through your account settings.

3.4 Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of your personal data in certain circumstances:

The data is no longer necessary for the original purpose

You withdraw consent and there's no other legal basis

You object to processing and there are no overriding legitimate grounds

The data has been unlawfully processed

3.5 Right to Restrict Processing

You have the right to request restriction of processing in certain situations, such as when you contest the accuracy of data or object to processing.

3.6 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used format and to transmit this data to another service provider.

3.7 Right to Object

You have the right to object to processing of your personal data for direct marketing purposes or when processing is based on legitimate interests.

3.8 Rights Related to Automated Decision-Making

You have the right not to be subject to automated decision-making, including profiling, that produces legal effects or significantly affects you. Our AI services provide suggestions and insights but do not make automated decisions with legal or significant effects.

4. How to Exercise Your Rights

You can exercise your GDPR rights through the following methods:

Account Settings:

Many rights can be exercised directly through your account dashboard

Email Request:

Send requests to hello@vestigee.com

Support Chat:

Use our support chat feature for immediate assistance

Written Request:

Send a letter to our Data Protection Officer

We will respond to your request within one month of receipt. In complex cases, we may extend this by two additional months with notification.

5. Data Processing for Genealogy Services

5.1 Special Categories of Data

Genealogy research may involve processing special categories of personal data (health data, religious beliefs, ethnicity). We only process such data when:

You provide explicit consent

Data relates to deceased individuals

Data is manifestly made public by you

Processing is necessary for archiving purposes in the public interest

5.2 Living vs. Deceased Individuals

GDPR applies only to living individuals. For deceased family members, we follow ethical genealogy practices and respect family wishes regarding data sharing.

6. International Data Transfers

When we transfer personal data outside the European Economic Area (EEA), we ensure adequate protection through:

European Commission adequacy decisions

Standard Contractual Clauses

Binding Corporate Rules

Certification schemes

7. Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected:

Account Data:

Until account deletion plus 30 days for security purposes

Family Tree Data:

Until you delete it or close your account

Payment Data:

7 years for tax and legal compliance

Analytics Data:

Up to 26 months in anonymized form

8. Data Protection Officer

Our Data Protection Officer (DPO) oversees our GDPR compliance efforts. You can contact our DPO regarding:

Questions about your rights

Data protection concerns

Complaints about data processing

Requests for information about our practices

9. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

Notify supervisory authorities within 72 hours

Inform affected individuals without undue delay

Provide information about the nature of the breach

Describe measures taken to address the breach

10. Supervisory Authority

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority. For EU residents, you can find your local authority at:

European Data Protection Board:

11. Children's Data

Under GDPR, we require parental consent to process personal data of children under 16 years old. We do not knowingly collect data from children without appropriate consent and verification.

12. Contact Information

For GDPR-related questions, requests, or complaints, please contact us:

Data Protection Officer:

GDPR Requests:

General Privacy:

Address:

EU Representative: