This Privacy Notice for California Residents supplements the information contained in Findmypast’s Privacy Policy and applies solely to all visitors, users, and others who reside in the State of California (”consumers” or “you”). We adopt this notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and any terms defined in the CCPA have the same meaning when used in this Notice.
A. Personal Information We Collect
We collect a variety of personal information about our visitors, users and other people who reside in California. For the purpose of this Section 17, as defined by the CCPA, “personal information” means information that identifies, relates to, describes or references a particular consumer, household or device. It can also include information that could be associated or linked with a particular consumer, household, or device. However, personal information does not include:
- Publicly available information from government records, or
- Information that cannot be used to identify a consumer, household or device because it has been anonymised.
In particular, we have collected the following categories of personal information from our consumers within the last twelve (12) months:
Category of personal information | Examples | Where we source this information | Why we process this information | Third parties we share this information with |
Identifiers | Your real name, for example your forename, surname or an alias you are known by Your postal address Your unique personal identifier(s) such as an online username, e-mail address or account name Your I.P. address |
From you, the consumer, when you register to use our products and services or you add information to your family tree From social media networks you may have used to interact with us (with your consent) |
To manage your account with us, including any free trial To fulfil your orders and requests To communicate with you To tailor our products and services to your needs and circumstances To administer our products and services and ensure they work correctly and securely To understand where our consumers are located To analyse and research how our products and services are used and can be improved To assist with marketing and advertising To enable us to send you surveys |
Companies who help to provide our technology such as our databases, customer relationship management system and document storage Companies who process payments on our behalf, Companies who help us with marketing campaigns, advertising and surveys Where required, law enforcement agencies |
Information that relates to characteristics that are protected under California or federal law |
Your age Your race or color Your nationality Your religion or creed Your marital status Your sex Your gender Your age Your race or color Your nationality Your religion or creed Your marital status Your sex Your gender Your medical condition or status (including pregnancy and related medical conditions) Your sexual orientation Your veteran or military status Your genetic information, limited to a summary of the geographical make-up and origins of your genes |
From you, the consumer, when you add information to your family tree |
To populate your family tree at your request To provide you with advanced website features such as record ‘hints’ To improve your search results on our site To communicate with you To tailor our products and services to your needs and circumstances |
Companies who help to provide our technology such as our databases, customer relationship management system and document storage |
Commercial information | Records of our products and services that you have purchased or considered | From you, the consumer, when you make or consider making a purchase from us |
To fulfil your orders and requests To communicate with you To administer our products and services and ensure they work correctly and securely To analyse and research how our products and services are used and can be improved To assist with marketing and advertising |
Companies who help to provide our technology such as our databases, customer relationship management system and document storage Companies who process payments on our behalf, Companies who help us with marketing campaigns, advertising and surveys Where required, law enforcement agencies Our parent company, for accounting and financial purposes |
Biometric information | Your genetic information, limited to a summary of the geographical make-up and origins of your genes | From you, the consumer, via our partner LivingDNA | To help you search for relevant content on our site | Companies who help to provide our technology such as our databases, customer relationship management system and document storage |
Internet activity |
Information about your activity on our website Information about how you use our products and services, including things you search for (such as particular records) Information about how you interact with Findmypast advertisements, for example on social media |
From you, the consumer, via cookies we place on your device, third party analytics providers (such as Google Analytics) and social media partners (such as Facebook) |
To communicate with you To tailor our products and services to your needs and circumstances To understand where our consumers are located To analyse and research how our products and services are used and can be improved To assist with marketing and advertising To provide you with advanced website features such as record ‘hints’ To improve your search results on our site |
Companies who help to provide our technology such as our databases, customer relationship management system and document storage Companies who help us with marketing campaigns, advertising and surveys Advertising partners including social media companies Where required, law enforcement agencies |
Geolocation data | Your I.P. address Your device identifier(s) |
From you, the consumer, via cookies we place on your device and third party analytics providers (such as Google Analytics) |
To understand where our consumers are located To analyse and research how our products and services are used and can be improved To assist with marketing and advertising |
Companies who help to provide our technology such as our databases, customer relationship management system and document storage Companies who help us with marketing campaigns, advertising and surveys Advertising partners including social media companies Where required, law enforcement agencies |
Sensory data (e.g. audio) | Recordings of conversations when you call us about our products and services | From you, the consumer, when you call us |
To manage your account with us, including any free trial To fulfil your orders and requests To administer our products and services and ensure they work correctly and securely |
Companies who help to provide our technology such as our databases, customer relationship management system and document storage software |
Professional or employment-related information | Details of your current or previous occupation(s) | From you, the consumer, when you add information to your family tree | To populate your family tree at your request | Companies who help to provide our technology such as our databases, customer relationship management system and document storage software |
Inferences drawn from other personal information | Information we have inferred about your preferences or characteristics, based on other information we hold about you |
From our internal records From you, the consumer, via cookies we place on your device and third party analytics providers (such as Google Analytics) |
To communicate with you To analyse and research how our products and services are used and can be improved To assist with marketing and advertising To enable us to send you surveys |
Companies who help to provide our technology such as our databases, customer relationship management system and document storage Companies who help us with marketing campaigns, advertising and surveys Advertising partners including social media companies Where required, law enforcement agencies |
Personal information categories per The California Customer Records statute (Cal. Civ. Code § 1798.80(e)) |
Some personal information included in this category may be covered in other categories. Examples include:
Your telephone number Your photo Details of your payment card |
From you, the consumer From social media networks you may have used to interact with us (with your consent) |
To manage your account with us, including any free trial To fulfil your orders and requests To communicate with you To tailor our products and services to your needs and circumstances To administer our products and services and ensure they work correctly and securely To understand where our consumers are located To analyse and research how our products and services are used and can be improved To assist with marketing and advertising To enable us to send you surveys |
Companies who help to provide our technology such as our databases, customer relationship management system and document storage Companies who process payments on our behalf, Companies who help us with marketing campaigns, advertising and surveys Where required, law enforcement agencies |
B. Sharing Personal Information
We may disclose your personal information to a third party for a business purpose. When we do this, we enter into a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract or as otherwise permitted under the CCPA.
We share your personal information with the following categories of third parties:
- Analytics Partners. These parties provide analytics on web traffic or usage of the products or service. They include:
- Companies that track how users found or were referred to the products or services
- Companies that track how users interact with the product or services
- Companies hosting our technology such as our databases, customer relationship management system and document storage
- Companies who help us to keep our technology and services secure and to prevent and detect fraud
- Companies who process payments on our behalf
- Companies who support our marketing and advertising activity
- Companies who help us to conduct consumer surveys
- Our parent company (D.C. Thomson & Co. Ltd, a UK-registered company)
- Law enforcement agencies, if we are legally required to do so.
- Parties you authorise, access or authenticate
Disclosures of Personal Information for a Business Purpose
In the past 12 months, we have disclosed the following categories of personal information for a business purpose:
- Identifiers
- Information that relates to characteristics that are protected under California or federal law
- Commercial information
- Biometric information (limited to a summary of the geographical make-up and origins of your genes)
- Internet activity
- Geolocation data
- Sensory data
- Professional or employment-related information
- Inferences drawn from other personal information
- Personal information categories per The California Customer Records statute
For business purposes we disclose your personal information to the categories of third parties listed in the table under “Personal Information We Collect”, above – see the column “Third parties we share this information with”.
Sales of Personal Information
In the past 12 months, we have not sold personal information.
Based on our current understanding of the CCPA, we do not “sell” your personal information as defined in the legislation. However, like many companies that operate online, we do use services provided by Google, Facebook and other advertising companies that track website visitor activity to help deliver interest-based ads to you (known as behavioural advertising). Behavioural advertising is described in more detail here. Use of these services could constitute a “sale” of personal information under the CCPA if you did not consent to your activity being tracked in this way. If you wish to withdraw your consent, you can change your browser settings to disable cookies - please see our cookie policy for information on how to do this.
Data that is not personal information
We may create aggregated, de-identified or anonymised data from the personal information we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymised data and share it with third parties for our lawful business purposes, including to analyse, build and improve our products and services and promote our business, provided that we will not share such data in a manner that could identify you.
Security and Retention
We seek to protect your personal information from unauthorised access, use and disclosure using appropriate physical, technical, and administrative security measures and storage and processing practices based on the type of personal information. For example, our website uses industry standard HTTPS protocols which encrypt your connection to us and the personal information you provide to us using Transport Layer Security (TLS) technology. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data or storing data over the Internet is completely secure. We cannot guarantee the complete security of any data you share with us, and except as expressly required by law, we are not responsible for the theft, destruction, loss or inadvertent disclosure of your information or content.
We retain personal information about you in accordance with Section 15 of this privacy notice, to comply with our legal obligations, resolve disputes, or as otherwise permitted or required by applicable law, rule or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally.
C. Your Rights and Choices
The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.
Your Right to Know
You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive your request and verify that it’s from you (see “How to exercise your rights”), we will disclose to you:
- The categories of personal information we have collected about you
- The categories of sources from which we collected the information
- Our purposes for collecting the information
- The categories of third parties with whom we share the information
- The specific pieces of personal information we collected about you
- If we sold or disclosed your personal information for a business purpose, two separate lists showing:
- Sales we made, identifying the personal information categories that each category of recipient purchased; and
- Disclosures we made for a business purpose, identifying the personal information categories that each category of recipient received.
Your Right to Request Deletion
You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive your request and verify that it’s from you (see “How to exercise your rights”), we will delete your personal information from our records, unless an exception applies. We will also ask our service providers to delete any personal information we have disclosed to them.
We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
- Complete the transaction for which we collected the personal information, provide a product or service that you requested, take actions you would reasonably expect as part of our ongoing relationship with you (e.g. resolving a question or complaint), fulfil the terms of a written warranty or product recall, or do anything else required to honour our contract with you
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities
- Debug products to identify and repair errors that adversely affect how they function
- Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law
- Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.)
- Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, if you have previously consented to this and if deleting the information would significantly affect the research
- Comply with a legal obligation
- Make internal use of the information for purposes that are lawful and that you would reasonably expect when you provided the information (e.g. quality control)
Your Right to Non-Discrimination
At Findmypast we are committed to treating consumers fairly and we will not discriminate against you for exercising any of your rights under the CCPA, for example by charging you a higher price or denying you access to our products and services.
How to Exercise your Rights
To exercise your rights as described above, please submit your request to us by:
- Calling us at +1 (855) 246-8234, or
- E-mailing us at [email protected]
Only you, or someone legally authorised to act on your behalf, may make a request related to your personal information and you may only make two requests within a 12-month period.
To help us respond to your request, please ensure it is clear, specific and detailed enough that we can understand it and provide what you require. Please also note that we will be unable to respond or provide any personal information unless we can verify that your request is genuine (and if you are making the request on someone else’s behalf, that you are legally authorised to do so). To enable us to act on your request, we will need you to provide sufficient information to verify your identity. For Findmypast users, this may include the following:
- If we are able to verify your request through a password-protected account, we may do so, and we will ask you to re-authenticate yourself before we disclose or delete your data.
- If we are not able to verify your request through a password-protected account, we will require additional information to verify your identity. Such information will depend on the type of request and the sensitivity of the personal information. For example, we may ask you to confirm your current subscription plan and details, information from your family tree, and/or other identifying information associated with your use of Findmypast that allows us to verify your identity before we act on your request.
- If your request is for specific pieces of personal information, we may also require a signed declaration under penalty of perjury to verify your identity.
- If you have an account with Findmypast, you can also access personal information associated with your account through your account settings once you are logged in.
You may also authorise an agent (an “Authorized Agent”) to exercise your rights on your behalf. To do this, you must provide your Authorized Agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your Authorized Agent when they make a request on your behalf. We may deny requests from Authorized Agents if we do not receive sufficient proof of authorization on your behalf.
When and How we will Respond
We will endeavor to respond to a request we have been able to verify within 45 days of receiving it. If for any reason we are unable to comply or if we need more time (up to additional 45 days), we will let you know and explain why in writing. We will deliver our response electronically unless you ask us otherwise; please note that as we are UK-based, a postal response will take longer to reach you. If you are requesting personal information from your family tree(s), we will provide you with instructions so you can download the information in a GEDCOM file, which is a standard file format used by genealogical organisations.
We will not charge you a fee for making a request unless your request(s) is excessive, repetitive or manifestly unfounded.
Other California Rights
California residents are entitled to contact us to prevent disclosure of personal information to third parties for such third parties’ direct marketing purposes, under California Civil Code Sections 1798.83-1798.84. If you would like to submit such a request, please contact us at [email protected].
Further contact methods can be found on the following page:
https://www.findmypast.co.uk/help/contact