Privacy Notice

Effective date: September 2026

1. About This Privacy Notice

Heritage & Lineage provides bespoke genealogical research, historical research, narrative family-history writing and family-history book creation.

In carrying out this work, we may collect, use and store personal information about our clients and other living individuals connected with the families we research.

Heritage & Lineage is responsible for deciding how and why personal information is processed for the purposes described in this Privacy Notice and acts as the data controller for that information.

We also research and hold historical information relating to deceased individuals. Information relating solely to deceased individuals is not personal data for the purposes of UK data protection law. Nevertheless, we recognise the private and sensitive nature of family-history material and treat such information with care and discretion.

This Privacy Notice explains:

• what personal information we may collect;
• where that information comes from;
• why we use it;
• the lawful bases on which we rely;
• who information may be shared with;
• how long information is retained;
• how we protect it; and
• the rights available to individuals.

We process personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018.

2. The Personal Information We May Collect

The information we process will depend on the nature and scope of the individual commission.

Information about our clients

This may include:

• name;
• postal address;
• email address;
• telephone number;
• payment and invoicing information;
• correspondence with us;
• information about your family and ancestry;
• family stories and memories;
• photographs;
• certificates;
• letters;
• diaries;
• family trees;
• historical documents; and
• other material supplied for the purposes of the commission.

Information about living family members and other individuals

Genealogical research may also involve personal information about living relatives or other identifiable individuals.

This may include:

• names;
• dates or approximate dates of birth;
• marriage or civil partnership information;
• family relationships;
• locations;
• occupations;
• biographical information; and
• information relevant to establishing or understanding a family connection.

We aim to collect and use only the information reasonably necessary for the research and commissioned work.

3. Special-Category and Other Sensitive Information

Family-history research can occasionally reveal information of a particularly private or sensitive nature.

Where information relates to a living individual, this may include special-category personal data such as information concerning:

• racial or ethnic origin;
• religious or philosophical beliefs;
• health;
• genetic information;
• sex life; or
• sexual orientation.

Research may also occasionally reveal information relating to criminal allegations, convictions or offences, which is subject to additional legal protections.

We do not intentionally collect or include such information about living individuals unless it is relevant and there is an appropriate lawful basis for doing so.

Where we process special-category information about a living person, we will identify both an appropriate lawful basis under Article 6 of the UK GDPR and an appropriate condition under Article 9.

Where appropriate, this may involve obtaining the individual’s explicit consent. Where no valid legal condition applies, we will not intentionally process or include the special-category information.

4. Information About Deceased Individuals

A substantial proportion of our genealogical work concerns individuals who are deceased.

Although information relating solely to deceased individuals does not fall within the definition of personal data under the UK GDPR, we recognise that family-history research may contain information that is private, sensitive or emotionally significant to living family members.

We therefore treat historical family information and research material with care and discretion regardless of whether data protection legislation applies to the individual concerned.

5. Where We Obtain Information

Information used during a commission may come from you, your relatives, historical sources or other legitimate research sources.

These may include:

• civil registration records;
• census returns;
• parish and religious records;
• electoral registers;
• wills and probate records;
• historical newspapers;
• military records;
• immigration and travel records;
• historical directories;
• maps and land records;
• libraries;
• archives and record offices;
• local-history collections;
• publicly available records and sources;
• family documents supplied to us;
• other family members or individuals contacted during the research; and
• specialist genealogy, historical-record and archive platforms.

We may also purchase certificates or other historical records where appropriate to the research.

In carrying out genealogical research, we may enter limited information into specialist genealogy and historical-research platforms in order to search for, identify, compare or verify records.

This may include information such as names, dates, locations and family relationships. We seek to limit the information entered into third-party research services to what is reasonably necessary for the commissioned research.

6. How We Use Personal Information

We may use personal information to:

• communicate with you about your enquiry or commission;
• conduct genealogical and historical research;
• identify and verify family relationships;
• search historical records and archives;
• purchase relevant certificates and records;
• assess and cross-reference evidence;
• conduct archival and location-based research;
• interview family members where agreed;
• place ancestors and family events within their historical and social context;
• write and edit your family-history manuscript;
• incorporate approved photographs, documents and family material;
• design and produce the finished book;
• arrange printing and bookbinding;
• provide digital copies where applicable;
• manage payments and business records;
• comply with legal and regulatory obligations;
• establish, exercise or defend legal claims; and
• manage the operation and security of our business.

We do not sell personal information.

We do not use material supplied for a private family-history commission for unrelated advertising or marketing purposes without appropriate permission.

We will not publish identifying family information, photographs, manuscript extracts, testimonials or other private project material for promotional purposes without appropriate permission.

7. Our Lawful Bases for Processing

The lawful basis we rely upon depends on the information concerned and why we are using it.

Contract

We process information where it is necessary to:

• take steps at your request before entering into a contract; or
• provide the genealogical research, writing, editing and book-production services you have commissioned.

This generally applies to information concerning our client and the administration of the commission.

Legitimate interests

We may rely on our legitimate interests where processing is necessary for purposes such as:

• conducting appropriate genealogical and historical research requested by a client;
• investigating and verifying family relationships;
• maintaining accurate research records;
• responding to enquiries;
• operating and protecting our business;
• maintaining appropriate business records; and
• establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we consider whether our interests are necessary and proportionate and whether they are overridden by the rights and interests of the individual concerned.

Legal obligation

We may process or retain information where necessary to comply with legal requirements, including tax, accounting, regulatory or other statutory obligations.

Consent

We may rely on consent where we offer individuals a genuine choice over how their information is used.

Where consent is our lawful basis, it may be withdrawn at any time. Withdrawal of consent does not affect processing that was lawful before consent was withdrawn.

For certain special-category information, we may seek separate explicit consent where required.

8. Information About Living Relatives

A client may provide us with information about living relatives, or such information may arise during genealogical research.

Where appropriate, we ask clients to avoid providing unnecessary sensitive information about living people.

We only use information about living relatives where we have a lawful basis and where its use is reasonably necessary and proportionate to the commissioned work.

Where personal information about a living individual is obtained indirectly, we will provide privacy information where required by law.

There may be circumstances in which the law provides an exemption from directly contacting an individual, for example where doing so would involve disproportionate effort and the relevant legal conditions are satisfied.

9. Sharing Personal Information

We do not sell personal information.

We may share limited personal information where reasonably necessary to provide our services, conduct the commissioned research, operate our business or comply with the law.

Depending on the circumstances, this may include:

• specialist genealogy and historical-research platforms;
• archive and record providers;
• printers and bookbinders;
• IT, hosting, email and cloud-storage providers;
• accounting, payment and business-administration providers;
• professional advisers;
• public authorities; and
• legal or regulatory bodies where disclosure is required by law.

Where a third-party service provider processes personal information on our behalf, we take reasonable steps to use appropriate providers and require information to be handled only for authorised purposes.

Only information reasonably necessary for the relevant service should be shared.

10. Specialist Research Platforms

Genealogical research frequently requires the use of specialist online research services containing family trees, historical documents, civil records, newspapers, military records and other archival material.

When using these services, we may submit limited details such as:

• names;
• dates;
• locations;
• family relationships; and
• other relevant search information.

This is done only where reasonably necessary to identify or verify genealogical information connected with a commission.

These services operate under their own privacy terms and may act as independent data controllers for some of the information processed through their platforms.

11. International Transfers

Some technology providers, research platforms or other service providers we use may process or store personal information outside the United Kingdom.

Where the use of a service results in a restricted international transfer under UK data protection law, appropriate safeguards must be in place.

Depending on the circumstances, these may include:

• transfers to countries covered by UK adequacy regulations;
• approved contractual safeguards; or
• another lawful transfer mechanism permitted under UK data protection law.

You may contact us if you would like further information about the safeguards applicable to a particular transfer.

12. How We Protect Information

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Depending on the information involved, these measures may include:

• password-protected devices and accounts;
• access controls;
• encrypted storage or transmission where appropriate;
• secure cloud storage;
• appropriate backups;
• security protections on website and email systems; and
• locked storage for physical documents.

Access to project information is limited to those who require it for the relevant research, writing, administration or book-production purpose.

No method of electronic storage or communication can be guaranteed to be completely secure, but we take reasonable steps appropriate to the nature of the information we handle.

13. How Long We Keep Information

We do not retain personal information indefinitely.

Retention periods depend on the type of information and the reason it is held.

As a general guide:

Project working files: normally retained for up to 12 months after completion of the commission.

Purchased certificates and research material: normally retained for up to six months following completion, unless the material is transferred to the client or there is a legitimate reason to retain it for longer.

Draft manuscripts and working notes: securely deleted when they are no longer reasonably required.

Final manuscripts and books: retained only where agreed or reasonably necessary for the completion, correction, replacement or administration of the commission.

Client correspondence: retained for as long as reasonably necessary for project administration, contractual matters or legal purposes.

Contracts, invoices, payment and accounting records: normally retained for up to six years, or for any longer period required for applicable tax, accounting, contractual or legal purposes.

Where information is no longer required, we securely delete or dispose of it.

You may ask us to delete information earlier, although in some circumstances we may need to retain certain records for legal, contractual or legitimate business reasons.

14. Marketing and Portfolio Use

We do not use private family-history material for marketing simply because it was created as part of a commission.

We will seek appropriate permission before using identifiable client material for purposes such as:

• testimonials;
• portfolio examples;
• photographs of commissioned books;
• identifiable family photographs;
• quotations from commissioned manuscripts; or
• case studies.

Where permission has been given, you may contact us if you later wish to discuss its continued use.

15. Your Data Protection Rights

Depending on the circumstances and the lawful basis on which we process your personal information, you may have the right to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of personal information;
• request restriction of processing;
• object to particular processing;
• request transfer of your information in certain circumstances; and
• withdraw consent where we rely upon consent.

These rights are not absolute and may be subject to exemptions or limitations under data protection law.

Your right to object

Where we process your personal information on the basis of legitimate interests, you may have the right to object to that processing.

If you object, we will consider your circumstances and whether there are compelling legitimate grounds for the processing to continue.

To exercise any of your rights, contact us using the details at the end of this notice.

We may need to ask for information to verify your identity before responding to a rights request.

The ICO notes that the rights available can differ depending on the lawful basis used, so this qualified wording is preferable to promising that every right always applies.

16. Data Breaches

If we become aware of a personal data breach, we will investigate the circumstances and assess the potential risk to affected individuals.

Where a breach is notifiable under applicable data protection law, we will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of it.

Where a breach is likely to result in a high risk to the rights and freedoms of an individual, we will also notify the affected individual without undue delay.

17. Your Right to Complain

If you have concerns about how we have handled your personal information, we ask that you contact us first so that we have an opportunity to address the matter.

You also have the right to make a complaint to the Information Commissioner’s Office, the UK’s data protection regulator.

18. Children and Young People

Our services are commissioned by adults.

Family-history research may occasionally involve information relating to living children or young people. Where this occurs, we take particular care to minimise the information processed and only use it where there is an appropriate lawful basis and it is reasonably necessary for the purpose of the commission.

We do not intentionally seek sensitive personal information directly from children for genealogical commissions without appropriate adult involvement.

19. Automated Decision-Making

We do not use personal information to make solely automated decisions that produce legal or similarly significant effects on individuals.

20. Website and Enquiries

When you contact us through our website, by email, telephone or another communication method, we may process the information you provide in order to respond to your enquiry.

Our website and hosting services may also process limited technical information required for security and operation, such as IP addresses, device or browser information and server logs.

Where non-essential cookies or similar technologies are used, consent will be obtained where required by law.

21. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to our services, research practices, technology or legal obligations.

The latest version will be published on our website and the date at the top of the notice will be updated accordingly.

22. Contact Us

For questions about this Privacy Notice, the way we handle personal information or the exercise of your data protection rights, please contact:

Steven Williamson, trading as Heritage & Lineage Co
Email: enquiries@heritageandlineage.com