Your information

Privacy Notice

Contact details

Email: hello@toldandtraced.co.uk

What information we collect, use, and why

We collect or use the following information to provide services and goods, including delivery:

Names and contact details; addresses; date of birth; purchase or account history; payment details (including card or bank information for transfers and direct debits); health information (including dietary requirements, allergies and health conditions); photographs or video recordings; call recordings; names, dates, places and family relationships of living relatives of our clients, supplied to us by the client or gathered from public records; transcripts of recorded interviews; information about religious or political affiliation and about criminal offences or alleged offences, where a person chooses to disclose it during an interview or where it appears in a public record.

We also collect or use the following special category information to provide services and goods. This information is subject to additional protection due to its sensitive nature: racial or ethnic origin; political opinions; religious or philosophical beliefs; health information.

We collect or use names and contact details, addresses, payment details and purchase history for the operation of customer accounts and guarantees; name, contact information and financial transaction information to comply with legal requirements; and names and contact details, address, payment details, purchase or service history, customer records and correspondence for dealing with queries, complaints or claims.

Lawful bases and your data protection rights

Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. Which lawful basis we rely on may affect your rights, set out in brief below. You can find out more about your rights and the exemptions which may apply on the ICO's website.

Your right of access — you can ask us for copies of your personal information. Your right to rectification — you can ask us to correct or delete information you think is inaccurate or incomplete. Your right to erasure — you can ask us to delete your personal information. Your right to restriction of processing — you can ask us to limit how we use your information. Your right to object to processing. Your right to data portability — you can ask that we transfer information you gave us to another organisation, or to you. Your right to withdraw consent — where consent is our lawful basis, you may withdraw it at any time.

If you make a request, we must respond without undue delay and in any event within one month. To make a request, contact us using the details at the top of this notice.

Our lawful bases

To provide services and goods: contract — we have to collect or use the information so we can enter into or carry out a contract with you; and legitimate interests, as follows:

Our client commissions a family history, so some of the people whose information we handle are not our client: living relatives named in the tree, and the interview subject whose recollections are recorded. Researching and recording a family's history cannot be done without holding information about those relatives, and the work benefits them and their descendants by preserving an account of their family that would otherwise be lost. We keep the impact proportionate: we record only what the family history itself requires, we ask the interview subject for their agreement on the recording at the start of every call, we do not publish anything without the subject's approval, and we delete a subject's recording on request regardless of what our client wants. Nobody is contacted for marketing on this basis and no information is sold or shared beyond the suppliers listed in this notice.

For the operation of customer accounts and guarantees: contract. For legal requirements: legal obligation. For dealing with queries, complaints or claims: contract, and legal obligation.

Where we get personal information from

Directly from you; councils and other public sector organisations; publicly available sources; our client's own relatives, who may supply names, dates, photographs and recollections about other members of the family; the interview subject, who is recorded with their agreement; genealogical record subscription services such as Ancestry and FindMyPast; and public record offices and civil registration bodies, including the General Register Office for Northern Ireland and the Public Record Office of Northern Ireland.

How long we keep information

We keep your research file, recordings and transcripts for seven years from the date we deliver your finished work, so that we can answer questions about it and supply further copies. After that they are permanently deleted.

You may ask us at any time to delete them sooner, or to hand over the complete file, and we will do so within 30 days. Where we have recorded an interview with someone other than you, that person may ask us to delete their recording at any time, and we will do so regardless of your wishes.

Payment and accounting records are kept for six years from the end of the relevant tax year, as UK tax law requires.

Who we share information with

Stripe Payments Europe Limited — payment services, Republic of Ireland and United States. They take card payments from our clients and hold the payment record for each booking.

Google Ireland Limited (Google Workspace) — business email and file storage, Republic of Ireland and United States. They provide our business email and store our client research files, documents and interview recordings.

Mixam UK Limited — print production, United Kingdom. They print and bind the finished books, which contain the names, photographs and family details in your commissioned work.

We also share personal information with organisations we are legally obliged to share it with.

Sharing information outside the UK

Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

Google LLC — cloud email and file storage provider, United States — the country or sector has been assessed as providing adequate protection to data subjects (Adequacy Regulations, the UK data bridge).
Stripe, Inc. — payment services provider, United States — the country or sector has been assessed as providing adequate protection to data subjects (Adequacy Regulations, the UK data bridge).

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us: hello@toldandtraced.co.uk.

If you remain unhappy after raising a complaint with us, you can complain to the ICO: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · helpline 0303 123 1113 · ico.org.uk/make-a-complaint.