18. Privacy Notice for Residents of California

This Privacy Notice for California Residents supplements the information contained in Findmypast’s Privacy Policy and applies solely to all visitors, users, and others who reside in the State of California (”consumers” or “you”). We adopt this notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and any terms defined in the CCPA have the same meaning when used in this Notice.

A. Personal Information We Collect

We collect a variety of personal information about our visitors, users and other people who reside in California. For the purpose of this Section 17, as defined by the CCPA, “personal information” means information that identifies, relates to, describes or references a particular consumer, household or device. It can also include information that could be associated or linked with a particular consumer, household, or device. However, personal information does not include:

• Publicly available information from government records, or
• Information that cannot be used to identify a consumer, household or device because it has been anonymised.

In particular, we have collected the following categories of personal information from our consumers within the last twelve (12) months:

B. Sharing Personal Information

We may disclose your personal information to a third party for a business purpose. When we do this, we enter into a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract or as otherwise permitted under the CCPA.

We share your personal information with the following categories of third parties:

• Analytics Partners. These parties provide analytics on web traffic or usage of the products or service. They include:
• Companies that track how users found or were referred to the products or services
• Companies that track how users interact with the product or services
• Companies hosting our technology such as our databases, customer relationship management system and document storage
• Companies who help us to keep our technology and services secure and to prevent and detect fraud
• Companies who process payments on our behalf
• Companies who support our marketing and advertising activity
• Companies who help us to conduct consumer surveys
• Our parent company (D.C. Thomson & Co. Ltd, a UK-registered company)
• Law enforcement agencies, if we are legally required to do so.
• Parties you authorise, access or authenticate

Disclosures of Personal Information for a Business Purpose

In the past 12 months, we have disclosed the following categories of personal information for a business purpose:

• Identifiers
• Information that relates to characteristics that are protected under California or federal law
• Commercial information
• Biometric information (limited to a summary of the geographical make-up and origins of your genes)
• Internet activity
• Geolocation data
• Sensory data
• Professional or employment-related information
• Inferences drawn from other personal information
• Personal information categories per The California Customer Records statute

For business purposes we disclose your personal information to the categories of third parties listed in the table under “Personal Information We Collect”, above – see the column “Third parties we share this information with”.

Sales of Personal Information

In the past 12 months, we have not sold personal information.

Based on our current understanding of the CCPA, we do not “sell” your personal information as defined in the legislation. However, like many companies that operate online, we do use services provided by Google, Facebook and other advertising companies that track website visitor activity to help deliver interest-based ads to you (known as behavioural advertising). Behavioural advertising is described in more detail here. Use of these services could constitute a “sale” of personal information under the CCPA if you did not consent to your activity being tracked in this way. If you wish to withdraw your consent, you can change your browser settings to disable cookies - please see our cookie policy for information on how to do this.

Data that is not personal information

We may create aggregated, de-identified or anonymised data from the personal information we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymised data and share it with third parties for our lawful business purposes, including to analyse, build and improve our products and services and promote our business, provided that we will not share such data in a manner that could identify you.

Security and Retention

We seek to protect your personal information from unauthorised access, use and disclosure using appropriate physical, technical, and administrative security measures and storage and processing practices based on the type of personal information. For example, our website uses industry standard HTTPS protocols which encrypt your connection to us and the personal information you provide to us using Transport Layer Security (TLS) technology. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data or storing data over the Internet is completely secure. We cannot guarantee the complete security of any data you share with us, and except as expressly required by law, we are not responsible for the theft, destruction, loss or inadvertent disclosure of your information or content.

We retain personal information about you in accordance with Section 15 of this privacy notice, to comply with our legal obligations, resolve disputes, or as otherwise permitted or required by applicable law, rule or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally.

C. Your Rights and Choices

The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

Your Right to Know

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive your request and verify that it’s from you (see “How to exercise your rights”), we will disclose to you:

• The categories of personal information we have collected about you
• The categories of sources from which we collected the information
• Our purposes for collecting the information
• The categories of third parties with whom we share the information
• The specific pieces of personal information we collected about you
• If we sold or disclosed your personal information for a business purpose, two separate lists showing:
• Sales we made, identifying the personal information categories that each category of recipient purchased; and
• Disclosures we made for a business purpose, identifying the personal information categories that each category of recipient received.

Your Right to Request Deletion

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive your request and verify that it’s from you (see “How to exercise your rights”), we will delete your personal information from our records, unless an exception applies. We will also ask our service providers to delete any personal information we have disclosed to them.

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the personal information, provide a product or service that you requested, take actions you would reasonably expect as part of our ongoing relationship with you (e.g. resolving a question or complaint), fulfil the terms of a written warranty or product recall, or do anything else required to honour our contract with you
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities
• Debug products to identify and repair errors that adversely affect how they function
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.)
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, if you have previously consented to this and if deleting the information would significantly affect the research
• Comply with a legal obligation
• Make internal use of the information for purposes that are lawful and that you would reasonably expect when you provided the information (e.g. quality control)

Your Right to Non-Discrimination

At Findmypast we are committed to treating consumers fairly and we will not discriminate against you for exercising any of your rights under the CCPA, for example by charging you a higher price or denying you access to our products and services.

How to Exercise your Rights

To exercise your rights as described above, please submit your request to us by:

• Calling us at +1 (855) 246-8234, or
• E-mailing us at privacy@findmypast.com

Only you, or someone legally authorised to act on your behalf, may make a request related to your personal information and you may only make two requests within a 12-month period.

To help us respond to your request, please ensure it is clear, specific and detailed enough that we can understand it and provide what you require. Please also note that we will be unable to respond or provide any personal information unless we can verify that your request is genuine (and if you are making the request on someone else’s behalf, that you are legally authorised to do so). To enable us to act on your request, we will need you to provide sufficient information to verify your identity. For Findmypast users, this may include the following:

• If we are able to verify your request through a password-protected account, we may do so, and we will ask you to re-authenticate yourself before we disclose or delete your data.
• If we are not able to verify your request through a password-protected account, we will require additional information to verify your identity. Such information will depend on the type of request and the sensitivity of the personal information. For example, we may ask you to confirm your current subscription plan and details, information from your family tree, and/or other identifying information associated with your use of Findmypast that allows us to verify your identity before we act on your request.
• If your request is for specific pieces of personal information, we may also require a signed declaration under penalty of perjury to verify your identity.
• If you have an account with Findmypast, you can also access personal information associated with your account through your account settings once you are logged in.

You may also authorize an agent (an “Authorized Agent”) to exercise your rights on your behalf. To do this, you must provide your Authorized Agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your Authorized Agent when they make a request on your behalf. We may deny requests from Authorized Agents if we do not receive sufficient proof of authorization on your behalf.

When and How we will Respond

We will endeavour to respond to a request we have been able to verify within 45 days of receiving it. If for any reason we are unable to comply or if we need more time (up to additional 45 days), we will let you know and explain why in writing. We will deliver our response electronically unless you ask us otherwise; please note that as we are UK-based, a postal response will take longer to reach you. If you are requesting personal information from your family tree(s), we will provide you with instructions so you can download the information in a GEDCOM file, which is a standard file format used by genealogical organisations.

We will not charge you a fee for making a request unless your request(s) is excessive, repetitive or manifestly unfounded.

Other California Rights

California residents are entitled to contact us to prevent disclosure of personal information to third parties for such third parties’ direct marketing purposes, under California Civil Code Sections 1798.83-1798.84. If you would like to submit such a request, please contact us at support@findmypast.com.

Further contact methods can be found on the following page: 
https://www.findmypast.com/help/contact