GDPR Compliance

How we protect your data rights under the General Data Protection Regulation

Our Commitment to Data Protection

Ancestral Lineage is committed to protecting the personal data of all our users, including those in the European Economic Area (EEA), United Kingdom, and Switzerland. We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable local data protection laws.

Given the sensitive nature of genealogical and family data, we apply the highest standards of data protection to all users, regardless of location.

Your Data Rights

Under the GDPR, you have the following rights regarding your personal data

Right of Access

You can request a copy of all personal data we hold about you, including your family tree data, account information, and activity logs.

Right to Rectification

You can correct or update any inaccurate personal data through your account settings or by contacting our support team.

Right to Erasure

You can request the deletion of your account and all associated personal data. We will comply within 30 days, except where retention is legally required.

Right to Data Portability

You can export your family tree data, documents, and personal information in a machine-readable format at any time.

Right to Restrict Processing

You can ask us to limit how we process your data while a concern is being investigated or resolved.

Right to Object

You can object to certain types of data processing, including direct marketing and profiling.

Lawful Basis for Processing

We process your personal data under the following legal bases:

Contract: Processing necessary to provide our services (account management, family tree features, Susu transactions).
Consent: For optional features like analytics cookies and marketing communications. You can withdraw consent at any time.
Legitimate Interest: For platform security, fraud prevention, and service improvements where our interests do not override your rights.
Legal Obligation: Where we are required to retain data by law (e.g. financial transaction records).

Data Protection Measures

All data is encrypted in transit (TLS 1.3) and at rest
Access to personal data is restricted to authorized personnel only
Regular security audits and vulnerability assessments
Data processing agreements with all third-party service providers
Privacy by design and by default in all new features

International Data Transfers

Some of our service providers are located outside the EEA. When we transfer data internationally, we ensure adequate safeguards through:

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions where applicable
Supplementary measures as recommended by the EDPB

Data Retention

We retain your data only as long as necessary for the purposes described in our Privacy Policy. When you delete your account, we remove your personal data within 30 days, with the exception of data we are legally required to retain.

Exercising Your Rights

To exercise any of your data protection rights, contact our Data Protection team:

Data Protection Officer

FacioTech Foundation

Email: dpo@ancestrallineage.org

We will respond to your request within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.