FamilyTreeDNA - Privacy Statement

Introduction

To provide the Services and improve the Website, we collect information that directly or indirectly identifies, describes, relates to, or is reasonably capable of being associated with or linked to you, including your Genetic Data (as defined below) (“Personal Information”). This Privacy Statement applies to Personal Information that we collect, use, store, process, and share when you access or operate the website https://www.familytreedna.com, including our software applications and other electronic messages between you and this website (our “Website”), and/or through your use of our products and related services (collectively, the “Services”). This Privacy Statement outlines what we do with the information we collect and how you can manage your Personal Information within our Services.

This Privacy Statement does not apply to information collected by: (i) us offline or through any other means, including on any other website operated by us or any third party or (ii) any third party (including our affiliates and subsidiaries), including through any application or content that may link to or be accessible from or through the Website.

By using our Services, you understand and agree to our collection, processing, and use of your Personal Information, including your Genetic Data, as described in this Privacy Statement. Should you disagree with our practices as outlined in this Privacy Statement, please refrain from accessing or using our Services or any other aspect of our business. Please see Section 8, “Retention and Deletion,” for details about deleting your account and Personal Information.

Information We Collect and How We Collect It

Depending on how you interact with us, we collect the following types of Personal Information. Please refer to Section 7 for your privacy rights.

Personal Information you share with us:
1. Account Registration: Information provided when you create a FamilyTreeDNA account or when purchasing the Services, such as your name, email address, phone number, shipping address, and password that you create. If you purchase a DNA kit as a gift, we will collect the recipient’s name, shipping address, and the necessary purchase information to complete the gift and notify the recipient.
2. Payment Information: Information provided when purchasing a DNA test kit or other Services, such as credit card or debit card number and billing address(es).
3. Kit Activation Information: When you activate a DNA test kit, we collect the kit number, which is the multi-digit number associated with your DNA Sample (as defined below) and Genetic Data, your sex assigned at birth, and your date of birth.
4. Sample Information: The cheek swab (“DNA Sample”) that you submit for us to process and analyze so that we can provide your Genetic Data.
5. Genetic Data: After receiving your DNA Sample, we extract your DNA or use your uploaded or transferred DNA results, process and analyze them, and provide you with reports (“Genetic Results”) as part of our Services (collectively “Genetic Data”). Your DNA Sample and any information derived from it as well as self-reported health information is referred to as Genetic Data.
6. Profile Information: In addition to the information provided during account registration, we collect the information you provide when setting up your profile, such as your date of birth, place of birth, profile image, personal biography, and/or ancestral surnames and their location. Additionally, in circumstances where a kit is not managed by the test taker, we collect the information of the person managing the kit (“Kit Manager”), such as the name, address, and contact information of the parent or guardian of an eligible minor. In addition, we collect the name and contact information of individuals you wish to designate ownership and management of your FamilyTreeDNA account upon your passing (“Account Beneficiary”). You should keep Kit Manager and Account Beneficiary information up-to-date and current. Please note that some profile information may be visible to other Users. For example, if you opt in to Matching, you and your matches will see each other’s name and email. You may opt out of the Matching feature under your Account Settings at any time. You may also control certain privacy preferences under the Privacy & Sharing tab in your Account Settings. To protect your privacy, please consider limiting the information you share on your profile as well as with other Users.
7. User Content: Information, messages, content, or other materials you voluntarily post, submit, publish, transmit, or display on or through the Services, including Group Projects or Forums, as further described in the Terms.
8. Self-Reported Information: Information that you provide to us, including your family history, sex assigned at birth, ethnicity, health-related information, and any other information you provide.
9. Communications with Customer Service: When you contact our customer service center, whether by phone, email, or correspond with us through the chat feature on the Website, we collect information such as your kit number, name, email, and phone number to respond to your query.
Information we collect through your use of the Website:

When you visit, use, and interact with the Website, we may receive the following information about your visit, use, or interactions (collectively, “Web-Behavior Information”):
1. Location: Information about your location when you access the Website.
2. Log Data: Information that your browser automatically sends whenever you use the Website (“Log Data”). Log data includes your Internet Protocol address, browser type and settings, the date and time of your request, and how you interacted with our Website.
3. Usage Data: We may automatically collect information about your use of the Website, such as the types of content that you view or engage with, the features you use and the actions you take, as well as your search criteria, time zone, country, the dates and times of access, user agent and version, type of computer or mobile device, computer connection, IP address, and the like.
4. Device Information: Includes the name of the device, operating system, and browser you are using. Information collected may depend on the type of device you use and its settings.
5. Cookies: We use cookies to operate and administer our Website and improve your experience on it. A “cookie” is a piece of information sent to your browser by a website you visit. You can set your browser to accept all cookies, to reject all cookies, or to notify you whenever a cookie is offered so that you can decide each time whether to accept it. But, refusing a cookie may, in some cases, preclude you from using, or may negatively affect, the display or function of a website or certain areas or features of a website. For more details on cookies please see our Cookie Policy.
6. Analytics: We use data analytics tools which use cookies to help us analyze how users use our Website and enhance your experience when you use the Website. We may use the content you provide us to improve our Services, for example, to train analytics models. Click here for instructions on how you can opt out of our use of your content to train our models.
Information We Collect from Other Sources:

Service Providers: We may collect information through service providers that use a variety of technologies, such as cookies, analytics tools, software development kits, application program interfaces, web beacons, pixels, and tags when you visit, use, or interact with our Services.
De-identified or Aggregated Information:

We use aggregated information to analyze the effectiveness of our Website, to improve and add features to our Website, to conduct research, and for other similar purposes. In addition, from time to time, we may analyze the general behavior and characteristics of Users of our Website and share aggregated information (like general User statistics) with third parties, publish such aggregated information, or make such aggregated information generally available. We may collect aggregated information through the Website, through cookies, and through other means described in this Privacy Statement. We may show User information in an aggregated form as part of the Services or our marketing or in scientific publications published by our research partners or us.

We will maintain and use de-identified Genetic Data in anonymous or de-identified form, and we will not attempt to re-identify such information.

How We Use Your Information

We do not share your Genetic Data with third parties for marketing purposes and will not use your Genetic Data for third-party marketing or personalized third-party advertising without your consent. We may use your information for one or more of the following purposes:

Personal information

We use your Personal Information to fulfill the reason you provided the information and to personalize, develop, and improve the Services, including to:
1. create, maintain, customize, and secure your registered account with us.
2. process orders and payments and deliver our products and Services that you request from us.
3. communicate with you about the Services, provide support, and respond to your inquiries, as well as monitoring and improving our responses.
4. assess and measure usage of the Services.
5. improve and develop our Website, products, and Services
6. improve your user experience, such as by distributing surveys and questionnaires about the Services.
7. personalize, market, or advertise products and campaigns from us or, with your consent, from our third-party business partners to you.
8. provide targeted third-party advertising, with your consent. Please see our Cookie Policy to learn more about analytics and targeting by third parties and Managing Your Privacy in Section 6 (below) to understand the controls we provide to you.
9. maintain and enhance the safety, security, and integrity of our Services and our users.
10. comply and respond to Law Enforcement or other government bodies’ requests, as required by applicable law and valid legal process, or upon your opting in under our Investigative Genetic Genealogy Matching feature. Please see Section 5 (below) for more information.
11. perform internal research for technological development and demonstration.
Genetic Data

If you are using our products or Services, we use your Genetic Data to:
1. process your DNA Sample.
2. conduct genetic analysis and deliver information about your ancestry and ethnic origins, such as identifying common ancestors and information about your family history.
3. if enabled, provide you with genetic matches found in our database through our Matching feature or to enable you to connect with your matches.
4. provide insights into your DNA based on data in our database to assist you to create a family tree (“Family Tree”).
5. provide you with other insights in relation to your DNA, such as personalized health and wellness insights.
6. if enabled, connect you with other Users who share an interest in exploring a specific aspect of their genealogy in our various group projects (the “Group Projects”). Group Projects are administered by volunteers (“Administrators”) who must abide by our Group Project Administrator Terms and Policies. Because Group Projects are based on your Genetic Results and/or Genetic Data with your express consent, Administrators and members will have access to such data, including your name and contact information.
7. to conduct internal research to improve features and functionality in our existing DNA-related products, enhance the customer experience across our products, improve the quality of our laboratory technology and processes, and build new products and services, including services related to personal health and wellness.

Our Research

We conduct research projects to improve/expand the Services and to perform quality control activities on existing offerings. Our Research can be segmented into 4 categories: i) FamilyTreeDNA Internal Research, ii) FamilyTreeDNA Collaborative Research, iii) FamilyTreeDNA Statistical Research, and iv) FamilyTreeDNA Sequence Publications.

About Our Research Projects:
1. Internal Research: We conduct Internal Research using Genetic Data and certain elements of your Personal Information, which includes self-reported personal, ancestral, genealogical, and geographical information.
2. Collaborative Research: Genetic Data and certain elements of your personal information contribute to: scientific research on historical, anthropological, and population genetics, traits, and health nature and enhance our products and reports. Your Genetic Data may be privately compared with third-party Genetic Data. If applicable, you (or your designated kit administrator) may be contacted and invited to share your information with external researchers. Your Genetic Data and Personal Information are never shared with external parties without your explicit consent.
3. Statistical Research: This research uses de-identified aggregated Genetic Data, including Shared variants and certain elements of your Personal Information, self-reported ancestral, genealogical, and geographical information.
4. Sequence Publications: We have a research program that is entirely voluntary for eligible users (“Voluntary Research”). You can participate in Voluntary Research by contributing your Genetic Data, Self-Reported Information, and other data as further described below (collectively, “Research Data”), which may allow for genetic discoveries and help with other scientific insights. We share de-identified genetic information with research partners only when you give us your express consent through our Informed Consent to Research. Sequence Publications are conducted using pseudonymized Genetic Data from a specific DNA test, as covered by a specific Release Form, and certain elements of your Personal Information, including (optional) self-reported ancestral, genealogical, and geographical information.
How we use your information:
1. Internal Research: Genetic Data and certain elements of your Personal Information, as outlined in Section 4(B) above, are used to enhance and expand our products, services, tools, and reports. This includes but is not limited to constructing and publishing phylogenetic trees based on your Genetic Information.
2. Collaborative Research: Genetic Data and certain elements of your Personal Information are used to contribute to scientific research of historical, anthropological, population genetic, traits, and health nature, and to enhance our products and reports. Your Genetic Data may be privately compared with third-party Genetic Data, and you (or your designated kit administrator) may be contacted and invited to share your information with external researchers. Your Genetic Data and Personal Information are never shared with external parties without your explicit consent.
3. Statistical Research: De-identified aggregated Genetic Data and certain elements of your Personal Information are used for scientific, historical, and anthropological research and reporting. The aggregated information may be published in scientific papers, website reports (including annotations to phylogenetic trees), and articles.
4. Sequence Publications: Following completion of the optional Sequence Release Form for a specific DNA test, the pseudonymized Genetic Data and certain elements of your Personal Information, as provided in the Sequence Release Form, may be released to a public genome repository as part of a scientific publication. The terms are outlined in the separate release forms.
How your privacy is protected: Customers who choose to participate in our Voluntary Research are protected under the same privacy terms as our other customers. We ensure your data is protected by using only de-identified Genetic Data and the minimum Personal Information necessary to conduct scientifically sound research.
Consent process for research: Users wishing to participate in our Voluntary Research may indicate so through functionality provided on the Website and will be included in a candidate pool for future research projects.
If you change your mind about participating in our Voluntary Research: You may withdraw your consent at any time by contacting Customer Service. Once you withdraw your consent, we will stop using your Research Data within 90 days from the date we receive your request, and you will be removed from participating in future research. Please note, however, Research Data cannot be withdrawn if your Research Data has already been published in a scientific study or if a study is already underway.

Sharing Personal Information

We will not disclose your Personal Information, including your Genetic Data, with third parties except as described in this Privacy Statement or with your consent. We will not disclose information about individuals who we know are under the age of 16.

We will not disclose your Genetic Data with insurance companies, employers, or third-party marketers without your prior consent.

We may disclose Personal Information to the following specified third parties only in the following circumstances:

To our Law Enforcement partners:

In specific situations, we may collaborate with Law Enforcement agencies or their authorized representatives (collectively referred to as “Law Enforcement Agencies”) to facilitate Investigative Genetic Genealogy Matching (“IGGM”). This collaboration may involve the creation and utilization of a designated access mechanism, such as a “Law Enforcement Account”, which, if necessary, could be provided access to relevant information for the purpose of conducting investigative genetic genealogy matching.

Please refer to our Law Enforcement Guide to learn more about Investigative Genetic Genealogy Matching and the searches permitted for such purposes. Each Law Enforcement Agency should refer to our Law Enforcement Guide before contacting us regarding the service.

Your information may only be viewable by Law Enforcement Agencies through a Law Enforcement Account if:
1. You have opted in to Matching;
2. You have opted in to Investigative Genetic Genealogy Matching; and
3. You and the Genetic Results uploaded to a Law Enforcement Account result in a Match.
Please be aware that Law Enforcement Agencies may be granted access to information for Investigative Genetic Genealogy Matching either directly through us or via our third-party licensees. Your “opt in” to Investigative Genetic Genealogy Matching extends to, and acts as consent to, access and searches to your information to or by our third-party licensees and disclosures of search results to or by such third-party licensees. All such third-party licensees will be required to comply with the Law Enforcement Guide, where applicable. In addition, we ensure our third-party licensees are subject to privacy standards and confidentiality and data protection obligations in accordance with applicable laws. We take the security of your data seriously. We implement strict confidentiality measures and ensure our licensees adhere to industry-standard security practices to safeguard the information.
To our Service Providers:

We use the services of our service providers and contractors to help us provide the Services to you. As a result, these partner companies will have some of your Personal Information in their systems. Our partners act only at our direction and are subject to contractual obligations governing data security and confidentiality consistent with this Privacy Statement and applicable laws. For example, our service providers and contractors assist us with:
1. order fulfillment and DNA test kit shipping,
2. processing payments, including BrainTree, PayPal, and American Express Merchant Services,
3. marketing and advertising,
4. consumer research and analytics,
5. processing User support requests,
6. cloud storage services, and
7. IT and security.
To our analytics and advertising vendors:

We work with third parties to conduct analytics and advertising. By collecting and sharing certain Personal Information, these vendors help us to personalize advertisements that match your interests. They also help us to measure the effectiveness of ad campaigns.

Under the laws of certain U.S. jurisdictions, you may have the right to opt out of our sharing of your Personal Information for purposes of targeted advertising. For example, under the CCPA, this use of your data for cross-context behavioral advertising may constitute a “sale” or “sharing” of personal information. We let advertising providers collect identifiers (IP addresses and mobile IDs), activity data (browsing, clicks, app usage), device data, and geolocation data through the use of cookies on our sites and apps when you use our online service. In the past 12 months, these categories of personal information may have been “sold” or “shared” as defined under CCPA. We do not have actual knowledge of selling or sharing personal information of users under the age of 16.

You can learn more about our practices and the opt-out controls we provide to you by visiting our Cookie Policy. To change your preferences around targeted advertising, please visit the “Do Not Sell or Share My Personal Information” link in the footer of our website.
To our affiliates or commonly owned entities:

We may disclose Personal Information about you to our corporate parent, affiliates, or subsidiaries to help operate and improve our Services.
To a buyer or other successor:

We may disclose Personal Information in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding. This Privacy Statement will apply to your Personal Information as transferred to the new entity.
To other Users or those you choose to share with:

Information you share on your profile with us may be visible to other users, depending on your account settings. We give you the ability to share information with our other users through myOrigins®, our Matching and related tools, as well as through our community forums, Group Projects, and research. For example, the information you upload on your Family Tree will be available to all your Matches if enabled. If you opt in to “Origins Sharing” your ethnicity origins will be visible to your Matches.

Matches are a core aspect of our Services. If you use the Services when Matches are enabled, your Results will be matched with other users and may be associated with your profile. Each of your Matches will be able to see the markers they share with you, the degree of relatedness between you, and some of your Personal Information, such as your name, email, and other profile information. Similarly, if a Match is found between you and another User in our database, if enabled, you and the other User will be notified of the Match. Please visit our Help Center to learn more or go to your Account Settings to view and manage your information and Matching preferences under the Privacy & Sharing tab.

In addition, if you choose to participate in a Group Project, Administrators and other Group Project members may be able to view or have access to some of your Personal Information, such as your name and contact information, as well as your Results, such as your Y-DNA and mtDNA markers. Pseudonymized DNA marker information may also be viewed and shared in Group Projects. Please visit our Help Center to learn more or go to your Account Settings to view and manage your Group Project preferences. To voluntarily share details of your family history, Results, or other Genetic Data in Group Projects or outside of the Services means to do so at your own risk. We shall not be liable for any such disclosures.

You may choose to disclose your Personal Information to family members or other individuals outside of our Services, including through third-party services such as social media networks or other third-party applications that connect to the Services through our application programming interfaces. These third parties may use your Personal Information differently than we do under this Privacy Statement. Please carefully review the privacy policies of all other third parties that may be linked through our Website or Services. We shall not be responsible for how these third parties are processing your Personal Information.

Personal Information, once disclosed or shared, can be difficult or even impossible to contain. We will have no liability for any consequences that may result from your decision to release or share your Personal Information, including your Genetic Data, with others. If you have access and control over the Personal Information of a User through an account you manage, we urge you to recognize your responsibility to protect the privacy of such person’s account. It is the responsibility of all Users to share Personal Information and account access only with people they know and trust. Users managing multiple accounts should use caution in selecting profile settings.
To a designated Account Beneficiary:

In the unfortunate event that you pass away, once we are notified and able to verify your beneficiary, ownership and management of your account will be transferred to your designated beneficiary. To learn more about managing beneficiary settings, please click here.
To comply with a legal or regulatory request or process:

We may disclose your Personal Information to comply with a valid court order, law, or legal process, including to respond to a government or regulatory request. If we are compelled to disclose your Personal Information, we will try our best to notify you unless we are legally prohibited from doing so.
To enforce our Terms of Service and for protection:

We may disclose your Personal Information to enforce or apply our Terms of Service or if we believe that disclosure is reasonably necessary or appropriate to protect the rights, property, or safety of us, our customers, or others.

Managing Your Privacy

Account Access: You can view, change, and correct your Personal Information by signing in to your account and clicking “Account Settings.” You can also control your privacy, sharing, and notification preferences in Account Settings. To learn more about how to manage your privacy settings, please visit our Help Center here.
Communication Preferences: You have the option to control and opt out of receiving certain notifications from us by visiting the Notification Preferences in your Account Settings. Please note that you may not opt out of receiving certain non-promotional notifications from us regarding your account, such as product service experience, billing, or purchase confirmations.
Promotional Communications from Us: If you no longer wish to receive email notifications promoting our own or third parties’ products or services, you can opt out by signing in to your account and adjusting your Notification Preferences in your account profile by checking or unchecking the relevant boxes or by clicking “unsubscribe” at the bottom of promotional email communications from us.
Third-Party Advertising: To serve you targeted ads, we use cookies and similar tracking technologies and integrations with third-party marketing and advertising partners to collect data about your interests or behaviors. You may adjust your settings by visiting our “Do not Sell or Do not Share” link on our Webpage. Please also see our Cookie Policy for additional information.
Group Project Participation: You can opt in to participate in Group Projects by signing in to your account, and you may also control how your information is shared under Project Sharing in your Account Settings. You can withdraw from a Project at any time through the Group Project tab in your Account Settings. Please contact the Administrator(s) to request removal of any information you might have shared outside of the Services.

Your Privacy Rights

In addition to the mechanisms referenced in Section 6 (above), depending on your place of residence, you may have additional rights and choices with respect to your Personal Information which we will respect:

Right of Access (also known as the “Right to Know”) and Data Portability: The right to access the Personal Information that we hold about you and to be provided with the specific pieces of Personal Information we collect and disclose. You may also have the right to receive certain pieces of your Personal Information in a format that can be transmitted to another entity. To request a copy of your Personal Information, please contact Customer Support via our Website or send an email to privacy@genebygene.com. If you would like a copy of your Genetic Data, you always have the option of downloading your data. Please click here for step-by-step instructions.
Right to Correct/Rectify: The right to request that we correct or rectify inaccurate Personal Information about you.
Right of Deletion: The right, subject to certain exceptions, to request we delete Personal Information that we collected from you and retained, provided there are valid grounds for doing so and subject to applicable law. See Retention and Deletion in Section 8 for information on how to delete your Personal Information, including your Genetic Data
Right to Withdraw Consent for Certain Processing: Where you have consented to processing for a specific purpose (such as targeted advertising), you may withdraw your consent at any time, and we will cease any further processing for that purpose.
Right to Object: In certain situations, such as when we process your Personal Information based on our legitimate business purposes, you have the right to object to such processing. In the event of unjustified opposition, we are entitled to further process your Personal Information.
Right to Restrict Certain Processing: The right to limit our use and disclosure of sensitive personal information to statutorily permitted purposes.
Right Not to be Subject to Decisions Based Solely on Automated Processing: If the applicable legal provisions are met, you have the right not to be subject to a decision based solely on automatic processing, including profiling, which has legal effects on you or affects you similar to a significant extent.
Right to Opt Out of Selling Personal Information: The right to request the opt out of sale of your Personal Information.

California Privacy Rights

If you elect to exercise any of your rights under the California Consumer Privacy Act (“CCPA”), we will not discriminate against you for exercising any of your CCPA rights. Unless otherwise permitted by the CCPA, we will not: deny you goods or services, charge you a different price or rate for our goods or services, or provide you a different level or quality of goods or services because you exercised such rights.

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Service who are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please send an email to privacy@genebygene.com or write us at: 1445 N Loop W, Suite 820, Houston, TX, 77008.

California residents may lodge a complaint for violation of the California Genetic Information Privacy Act with any of the following California state government agencies: the California Attorney General’s Office, a district attorney, an authorized county counsel, city attorney, or city prosecutor.
European Union Privacy Rights

In accordance with the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”), we have designated Mr. Alexandru Ganea as our representative in the European Union.

If you elect to exercise any of your rights under GDPR, please contact our representative in European Union at eurep@genebygene.com.

European Union residents have the right to address the Supervisory Authority from their place of residence. The corresponding contact details are to be found at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.
Exercising Your Rights

You can exercise these rights as described in this Section 7 or as specified in Section 6 (above) by using the tools available in your account or by contacting Customer Service. Only you, or someone legally authorized to act on your behalf, may make a request to know or delete your Personal Information, and you will be required to authenticate yourself before we respond to your request. To designate an authorized agent, please contact Customer Service or send an e-mail to privacy@genebygene.com.
Verification Process

You may only submit a Right of Access (as described above) twice within a 12-month period, and your request to know or delete must provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative, which may include a request for identity verification or parent or guardian verification.

Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

You do not need to create an account with us to submit a request to know or delete. However, we do consider requests made through your password protected account sufficiently verified when the request relates to Personal Information associated with that specific account.

We will only use Personal Information provided in the request to verify the requestor’s identity or authority to make it.
Response Timing and Additional Information

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact us at privacy@genebygene.com.

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

We will deliver our response via the same channel from which you submitted your original request.

The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Retention and Deletion

We will retain your Personal Information for as long as necessary to fulfill the purposes we collected it for or otherwise as permitted by applicable law. We may also retain your information during the period needed to complete our legitimate business operations, including for the purposes of satisfying any legal, accounting, or reporting requirements. We may retain certain information, including cached or archived copies, as necessary for legitimate business purposes. Specific examples include, however, are not limited to the following:

DNA Sample

With your consent, after initial testing, all DNA Samples are stored in our lab in Houston, Texas. We store DNA Samples without names or other identifying information. DNA Samples may be stored by us unless circumstances require or you request the destruction of your DNA Sample, which you can do at any time by contacting Customer Service. We will honor your request and destroy your DNA Sample within 60 days of receipt of your request.
Genetic Data

To request the deletion of your Genetic Data, including your Genetic Results, please contact Customer Service, and we will delete all Genetic Data in our possession within the required timeframe as set forth by the applicable law (typically, within 30 days). In addition, please note that if you request we delete your Genetic Data, we will delete all derivative Genetic Data from our database. Also, if you have opted in to Our Research, we will not be able to remove your Genetic Data from research projects that are completed or are underway, but we will not use your data for any new FamilyTreeDNA Research.
Personal Information

You can delete your Personal Information from our database by submitting a written request to Customer Service.

If you have shared information through the Services, such as sharing your results directly with other Users or a Group Project Administrator, we will not have the ability to delete any copies of information other members or users may have received, nor will we be obligated to delete posts from the Activity feed.
Closing your account

You may request that we close your account at any time by contacting Customer Service.
More information

If you would like more information about our retention periods, please contact us at privacy@genebygene.com.

Other Important Information about Your Privacy

Security

We place great importance on the security of our customers’ information. We have reasonable and commercially appropriate security measures in place to protect against the loss, misuse, or alteration of Personal Information, including Genetic Data, under our control. For example, our security and privacy practices are periodically reviewed and enhanced as necessary and only authorized personnel have access to Personal Information. We use secure server software to encrypt financial information you input before it is sent to us, and we only work with third parties who have met and commit to our security standards. While we cannot guarantee that loss, misuse, or alteration of data will not occur, we use commercially reasonable efforts to prevent this.
EU-U.S. and Swiss-U.S. Data Privacy Framework

We comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. We have certified to the U.S. Department of Commerce that we adhere to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. We have certified to the U.S. Department of Commerce that we adhere to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

We commit to process only the types of personal data which are adequate and limited to what is necessary for the purposes for which the personal data are to be processed, as mentioned in Section 3 above, and to ensure the strict application of the DPF Principles to processing involving the respective types of personal data. Any disclosure, passing on or making available of personal data by us is subject to the terms mentioned in Section 5 above. We shall remain liable under the DPF Principles if our agent processes personal data in a manner inconsistent with the DPF Principles, unless we prove that we are not responsible for the event giving rise to the damage. We grant individuals the right to access their personal data by contacting Gene by Gene at privacy@genebygene.com.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, we commit to resolve DPF Principles-related complaints about our collection and use of your Personal Information. EU individuals with inquiries or complaints regarding our handling of Personal Information received in reliance on the EU-U.S. DPF should first contact us through the designated representative in the European Union, at eurep@genebygene.com. UK and Swiss individuals with inquiries or complaints regarding our handling of Personal Information received in reliance on the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact us at privacy@genebygene.com.

We have further committed to refer unresolved complaints related to the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF to a U.S.-based independent dispute resolution mechanism, BBB NATIONAL PROGRAMS. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit http://www.bbbprograms.org/dpf-complaints for more information and to file a complaint. This service is provided free of charge to you. In compliance with the Swiss-U.S. DPF, we commit to cooperate and comply with the advice of the panel established by the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the Swiss-U.S. DPF.

If you consider that your complaint was not resolved under the DPF mechanism, you may have the possibility, under certain conditions, to invoke binding arbitration through the Data Privacy Framework Panel for some residual claims not resolved by other redress mechanisms. For additional information related to binding arbitration, please visit https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf.

In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or Law Enforcement requirements.
Children’s Privacy

We are committed to protecting the privacy of children as well as adults. Neither us nor any of our Services are designed for, intended to attract, or directed toward children under the age of 18. A parent or guardian, however, may collect a DNA Sample from, create an account for, and give information related to his or her child if they are between the age of 13 and 18. The guardian or parent assumes full responsibility for ensuring that the information that he/she shares with us about his or her child is kept secure and that the information submitted is accurate.
Changes to Privacy Statement

We may modify this Privacy Statement at any time. We will provide advance notice of any material changes to this Statement, such as sending you an email or posting a notice on our Website to allow you the opportunity to review the changes and decide whether to continue using our Services.

Non-material changes to this Statement will be notified as of their effective date by posting a notice through the Services on our Website or by sending you an email.

After notice of such changes, your continued use of our Services means you confirm that you were informed regarding the updated Privacy Statement.
Contact Information

If you have questions about this Privacy Statement or have a complaint or inquiry, please email us at privacy@genebygene.com, call us at +1.713.868.1438 or send a letter to:

FamilyTreeDNA Customer Service
1445 North Loop W
Suite 820
Houston, TX 77008

FamilyTreeDNA Privacy Statement

Summary of Changes

Introduction

Information We Collect and How We Collect It

How We Use Your Information