Privacy Policy - The Irish Genealogist
Privacy Policy for The Irish Genealogist
1. About this privacy policy The Irish Genealogist respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how I collect, use, store and protect personal data when you: • make an enquiry or book a consultation; • attend an online or in-person consultation; • book a consultation taking place at Kildare Village or another partner location; • purchase a genealogy research service; • provide family information, documents or DNA-related information; • communicate with The Irish Genealogist; or • otherwise use my services.
I process personal data in accordance with the General Data Protection Regulation (“GDPR”), the Data Protection Act 2018 and other applicable Irish data-protection legislation.
2. Who is responsible for your information? The data controller responsible for the processing described in this policy is: Kayleigh Bealin, trading as The Irish Genealogist Email: contact@theirishgenealogist.com Business address: The Farmhouse, Crookstown Lower, Kildare, Ireland
As the data controller, I determine why and how your personal information is used.
Access to client information within The Irish Genealogist is strictly limited. Kayleigh Bealin is the principal person responsible for processing client and family-history information. Where another authorised member of The Irish Genealogist team assists with a particular element of a service, they will receive access only to the information reasonably necessary for that purpose and will be required to treat it as confidential.
Certain trusted technology, payment, accounting and storage providers may process or securely store limited information on my behalf. More information about this is provided below.
3. Information I may collect Depending on the service you request, I may collect: • your name, address, email address and telephone number; • booking details, appointment times and attendance information; • billing, payment and transaction information; • correspondence between you and The Irish Genealogist; • the names, dates, places and relationships contained in your family history; • family trees, certificates, photographs, letters and other documents; • information about your parents, grandparents, ancestors and other relatives; • information found in civil, church, census, military, immigration, probate, land, newspaper and other historical records; • information you voluntarily provide about your family’s origins, religious background, ethnicity, health or biological relationships; • DNA test information that you voluntarily choose to share; • notes made during consultations; • research objectives, family stories and areas of particular interest; and • limited technical information generated when you use my website or online services.
I do not require more personal information than is reasonably necessary to provide the service you have requested.
Information concerning deceased people is not normally personal data for GDPR purposes. However, family-history information may also identify or reveal information about living people, so I continue to treat client research material carefully and confidentially.
4. How I receive your information I may receive personal information: • directly from you; • from someone making a booking or purchasing a service on your behalf; • from Kildare Village or another venue or travel partner arranging your consultation; • through an enquiry, booking or client-information form; • during an in-person, telephone or online consultation; • through email or another communication service; • from documents and family trees supplied by you; • from publicly available archives, databases, websites and record collections; or • from genealogy and DNA platforms where you have authorised or enabled access.
If another person books a consultation on your behalf, I may initially receive your name, contact details and booking information from that person or organisation.
5. How and why I use your information I may use your information to: • respond to enquiries; • arrange, confirm or change your booking; • contact you about attending your consultation; • prepare for and conduct your consultation; • understand your family-history objectives; • carry out genealogical and historical research; • prepare family trees, research reports and heritage documents; • provide recommendations for further research; • process payments and maintain business records; • provide client support and respond to questions; • protect the security and integrity of my business systems; • establish, exercise or defend legal claims; and • comply with legal, tax and accounting obligations.
I will not use information supplied for a consultation or research project for unrelated advertising or marketing without your permission.
6. My legal bases for processing Under the GDPR, I must have a lawful basis for processing personal data. Depending on the circumstances, I rely on the following bases:
Contract: Processing is necessary to arrange or provide the consultation, research project or other service you have requested.
Steps taken before entering a contract: This applies when I use information to answer an enquiry, assess a potential project or prepare a quotation.
Legal obligation: I may need to retain invoices, transaction details and other limited information to comply with Irish tax, accounting and legal requirements.
Legitimate interests: I may process information where reasonably necessary to operate and protect my business, communicate with clients, maintain appropriate records, prevent misuse, improve my services or manage legal claims. I will only rely on this basis where my interests do not override your rights and freedoms.
Consent: I will rely on consent where you voluntarily provide certain sensitive information, request that I access a DNA account or test results, or agree to receive marketing communications. You may withdraw your consent at any time, although this will not affect processing that occurred before its withdrawal.
7. Sensitive personal data and DNA information Genealogy can occasionally involve information that GDPR describes as “special category data”. This can include information concerning: • racial or ethnic origin; • religious beliefs; • health; • genetic information; and • sexual orientation.
I will only process this kind of information where it is relevant to the service, there is a lawful exception under GDPR and, where required, you have given explicit consent.
You are not required to provide DNA information. If you choose to share DNA results or grant access to a DNA account, I will use that access only for the research you have authorised.
Please avoid providing sensitive information about living relatives unless it is necessary and you are entitled to share it. Where possible, obtain the person’s permission before giving me sensitive information about them.
I will not download, disclose or retain raw DNA data unless this has been specifically agreed as part of the service.
8. Consultations at Kildare Village Where your consultation is arranged through Kildare Village, Kildare Village may provide me with limited information needed to deliver the appointment. This may include your name, contact details, appointment time and relevant booking information.
I may use this information to: • confirm the consultation; • contact you about attendance or changes; • prepare for the appointment; and • provide the consultation you have booked.
Kildare Village and The Irish Genealogist are generally separate data controllers. Each organisation is independently responsible for the personal data it processes. I will not provide your private family-history information, consultation notes or research findings to Kildare Village unless you specifically authorise this or disclosure is required by law.
Information processed separately by Kildare Village is governed by the Kildare Village Privacy Notice.
9. Who can access your information? Within The Irish Genealogist, I am ordinarily the only individual who accesses and processes substantive client family-history information.
I may nevertheless use carefully selected service providers for essential business functions, such as: • secure email and cloud storage; • website hosting and booking forms; • video consultations; • payment processing; • accounting and professional advice; and • technical support and data security.
These providers may process limited information on my behalf. They are not permitted to use it for their own unrelated purposes and must protect it in accordance with their contractual and legal obligations.
I may also disclose information where required by law, regulation, court order or a lawful request from a public authority.
I do not sell, rent or trade client information.
10. Genealogy websites, archives and databases Research may involve searching third-party archives, libraries, record repositories and genealogy databases.
Where possible, searches are conducted without identifying the client commissioning the research. Any personal data processed directly by an archive, website or database will also be subject to that organisation’s own privacy terms.
I will not publish your family tree or research findings online without your permission.
11. International transfers Some technology providers, genealogy databases and record repositories may store or process information outside Ireland or the European Economic Area.
Where personal data is transferred internationally, I take reasonable steps to ensure that an appropriate legal safeguard is in place. This may include an adequacy decision approved by the European Commission, Standard Contractual Clauses or another lawful GDPR transfer mechanism.
12. How I protect your information I use appropriate organisational and technical measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure or misuse.
These measures may include: • password-protected devices and accounts; • access controls and multi-factor authentication; • secure cloud storage and backups; • careful handling of paper and digital records; • limiting access to client files; • keeping software and devices updated; and • securely deleting information when it is no longer required.
While no system can be guaranteed completely secure, I take the confidential nature of genealogical information seriously and review my security arrangements as necessary.
13. How long I keep information I keep personal data only for as long as reasonably necessary for the purpose for which it was collected.
Unless a longer period is required by law or necessary in connection with a dispute: • general enquiries that do not proceed may be retained for up to 12 months; • booking and consultation administration records may be retained for up to two years; • consultation notes and completed research files may be retained for up to six years after the service is completed, allowing me to answer follow-up questions and maintain an appropriate record of the work undertaken; • invoices, payments and relevant accounting records are generally retained for six years in accordance with Irish record-keeping requirements; and • marketing information is retained until you unsubscribe, withdraw consent or the information is no longer required.
Information may be deleted earlier where appropriate. In limited circumstances, it may be retained for longer where required by law or for the establishment, exercise or defence of legal claims.
The Irish Data Protection Commission states that identifiable personal data should not be held for longer than necessary, while Irish Revenue generally requires relevant business records to be retained for six years. DPC retention guidance and Revenue record-keeping guidance.
14. Your GDPR rights Depending on the circumstances, you may have the right to: • be informed about how your information is used; • request access to personal data held about you; • request correction of inaccurate or incomplete information; • request deletion of your information; • ask me to restrict how your information is used; • object to certain processing; • receive certain information in a portable format; • withdraw consent where processing is based on consent; and • object to direct marketing at any time.
These rights are not absolute, and legal or record-keeping obligations may sometimes prevent me from immediately deleting information.
I may need to verify your identity before responding to a request, particularly where a file contains sensitive family information or information about several people.
The Irish Genealogist does not use personal data to make decisions based solely on automated processing or profiling.
15. Making a request or raising a concern To ask a question, exercise a GDPR right or raise a concern about how your information has been handled, please contact: Kayleigh Bealin The Irish Genealogist Email: contact@theirishgenealogist.com
I will aim to respond without undue delay and within the time required by GDPR.
You also have the right to raise a concern with the Irish Data Protection Commission. The Commission recommends contacting the data controller first, as many concerns can be resolved directly. You can subsequently use the Data Protection Commission’s complaint process.
16. Children’s information The Irish Genealogist’s services are intended for adults. I do not knowingly enter into contracts directly with children under 18.
Family-history research may contain historical or family information relating to a child. Where this occurs, I will only process what is reasonably necessary for the agreed purpose and will take particular care to protect the child’s privacy.
17. Changes to this policy I may update this Privacy Policy occasionally to reflect changes to my services, business practices or legal obligations. The most recent version will be identified by the “last updated” date at the beginning of the policy.