GDPR and Your Data Rights
The rights you have over your personal data, and how to use them
Which Laws Apply
Ancestral Lineage is run by Faciotech Foundation in Ghana. We handle personal data under Ghana's Data Protection Act, 2012 (Act 843). If you are in the European Union or the United Kingdom, the EU General Data Protection Regulation (GDPR) or the UK GDPR also gives you rights over your data.
We give the rights on this page to every user, wherever they live, because family records often describe living relatives as well as you.
Your Data Rights
You can ask us to do any of the following with your personal data
Right of Access
You can ask for a copy of the personal data we hold about you, including your account details, your family trees and what you have posted or sent on the platform.
Right to Rectification
You can correct or update inaccurate personal data in your account settings, or ask us to do it for you.
Right to Erasure
You can ask us to delete your account and the personal data linked to it. Our team handles deletion at present, so email us from the address on your account. We will reply within 5 business days and finish the deletion within 30 days, except where the law requires us to keep something.
Right to Data Portability
You can download any family tree as a GEDCOM file at any time from the tree's page. GEDCOM is the format most genealogy software reads. For a copy of your other data, email us and we will send it in a machine-readable format.
Right to Restrict Processing
You can ask us to limit how we process your data while a concern is being investigated or resolved.
Right to Object
You can object to processing we carry out on the basis of our legitimate interests, such as keeping server logs for security. We do not send marketing emails or build profiles of users.
Lawful Basis for Processing
We process your personal data under the following legal bases:
- Contract: Processing necessary to provide our services (account management, family tree features, records, stories, media, and collaboration).
- Consent: We do not rely on consent for any processing at present, because we use no analytics or advertising cookies and send no marketing emails. If we add a feature that needs your consent, we will ask first, and you will be able to withdraw it at any time.
- Legitimate Interest: For platform security, fraud prevention, and service improvements where our interests do not override your rights.
- Legal Obligation: Where we are required to retain data by law.
Data Protection Measures
- Connections use HTTPS, which encrypts data between your browser and our server
- Passwords are stored only as bcrypt hashes
- Access to personal data is limited to Faciotech staff who need it to run the service
- Changing or resetting a password signs out every other session
International Data Transfers
Our server is hosted on Microsoft Azure. If you live in a different country from the one where your data is held, using the service means your data is sent to that country. If you sign in with Google, Google may process your data in other countries under its own terms, and so may our email provider and, when file uploads are available, our storage provider.
Data Retention
We retain your data only as long as necessary for the purposes described in our Privacy Policy. When you ask us to delete your account, we remove your personal data within 30 days, except data the law requires us to keep.
Exercising Your Rights
To use any of your data protection rights, email us from the address on your account:
We will reply within 5 business days and complete your request within 30 days. If you are not happy with our answer, you can complain to the data protection authority where you live. In Ghana, that is the Data Protection Commission.