Privacy Policy

The controller responsible for the processing described here is Roots by Vera, established in Germany, founded and operated by Vera Tasistro.

Roots by Vera is established in Germany. For privacy and security reasons, the founder's residential business address is not publicly displayed. Official correspondence may be sent via hello@rootsbyvera.eu.

For any question about this policy or your personal data, write to hello@rootsbyvera.eu.

Roots by Vera currently does not require the appointment of a Data Protection Officer under applicable legislation. For any privacy or data protection enquiries, please contact hello@rootsbyvera.eu.

• Contact details you provide in an enquiry: name, email address and country of residence.
• Research context you choose to share: family origins, ancestors, existing materials, desired timeframe and the meaning the research holds for you.
• Documents and records you send us, which may include information about living and deceased relatives.
• Technical data collected for security and abuse prevention: IP address and browser user agent, recorded with your enquiry.
• Billing information when payments are enabled through a third-party payment provider.

• Responding personally to your enquiry and advising on the appropriate research scope.
• Carrying out and delivering the agreed genealogical research.
• Administering the professional relationship, including invoicing and record keeping.
• Protecting the site from spam and abuse.

• Consent (Art. 6(1)(a) GDPR) — for responding to your enquiry and for processing documents you send us.
• Performance of a contract (Art. 6(1)(b)) — for delivering an accepted research project.
• Legal obligation (Art. 6(1)(c)) — for accounting and tax records.
• Legitimate interests (Art. 6(1)(f)) — for the security of this website and our records.

Your information is never sold and never shared for purposes unrelated to your research. It may be processed by carefully selected service providers acting on our instructions:

• Website hosting and application infrastructure.
• Email delivery for enquiry notifications and correspondence.
• Secure database storage of enquiries.
• Payment processing through a third-party provider when a commission is confirmed.
• Archives, registries or local record agents contacted for your project, and only with the minimum information required.

Where a provider or archive is located outside the European Economic Area, transfers are made on the basis of an adequacy decision or Standard Contractual Clauses.

Personal data is kept only as long as necessary for the purpose it was collected for, or as long as a legal obligation requires. Specific periods are set out in the Data Retention Policy.

Only cookies essential to the functioning of this site are used before consent. Anything further is enabled only if you allow it, and can be changed at any time. Details are in the Cookie Policy.

• All traffic to this website is encrypted in transit over HTTPS.
• Enquiries are stored in a private database that is not publicly readable.
• The administrative dashboard is passphrase protected and excluded from search engine indexing.
• Enquiry submissions are rate limited and screened for automated abuse.
• Access to family documents is limited to authorised personnel working on your project.

• Right of access — to obtain confirmation of processing and a copy of your data.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure — to have data deleted where no legal or contractual reason to keep it remains.
• Right to restrict processing — to limit how data is used while a matter is resolved.
• Right to object — to processing based on legitimate interests.
• Right to data portability — to receive data you provided in a structured, machine-readable form.
• Right to withdraw consent at any time, without affecting processing already carried out.
• Right to lodge a complaint with the competent supervisory authority.

Write to hello@rootsbyvera.eu stating what you would like. We will respond within one month, as required by the GDPR, and may ask for information to confirm your identity before acting on a request.

This policy may be updated as our services or providers change. The date of last review is shown at the top of this page, and material changes will be communicated to active clients.