Wymark Ancestral ("I," "me," "my") is a sole trader based in England, providing genealogical research, family history storytelling, and ancestral travel planning services. This policy explains what personal information I collect, why, and how it's handled — both as a visitor to this website, and as a client.

1. Website analytics

This website collects information to power site analytics, including your browser, network, and device details; pages visited before arriving here; your IP address; and how you interact with the site (clicks, internal links, pages visited, scrolling, searches, timestamps). This is provided to Squarespace, my website analytics provider, to understand site traffic and activity.

2. Cookies

This site uses cookies and similar small files or pieces of text that download to your device when you visit. Necessary cookies are always used, allowing Squarespace, my hosting platform, to securely serve this website. Analytics and performance cookies are only used once you acknowledge the cookie banner. For details on the specific cookies used, see Squarespace's own cookie documentation.

3. Webform submissions

When you submit information via a webform on this site (enquiry, blog signup), I collect the data you provide to track and respond to your submission. This is provided to Squarespace, my website hosting provider, to deliver these services and help manage our relationship. I also store this information via iCloud and Crunch Accounting (for anything relevant to invoicing or bookkeeping). If you contact me directly via Instagram instead of the website, I collect and use that information on the same basis — see Section 9 for Meta as a processor of that communication.

4. Hosting

This website is hosted by Squarespace, which collects personal information when you visit, including your browser, network, and device details; pages visited before and during your visit; and your IP address. Squarespace needs this data to run the website and to protect and improve its own platform. You can read more in Squarespace's own Privacy Policy.

5. Marketing emails

If you've signed up for blog updates, I may send you occasional marketing emails (around four times a year). You can unsubscribe at any time via the link at the bottom of every email. Your contact information is provided to Squarespace, my email marketing provider, so they can send these on my behalf.

6. Legal basis for processing

Under UK GDPR, I rely on the following legal bases:

• Website analytics and hosting (Sections 1 and 4): legitimate interests — understanding site traffic and keeping the site secure and running.

• Cookies (Section 2): necessary cookies rely on legitimate interests; analytics and performance cookies rely on your consent, given via the cookie banner.

• Webform submissions (Section 3): legitimate interests, to respond to your enquiry; where this leads to a booking, contract performance covers anything necessary to deliver the service.

• Marketing emails (Section 5): consent, which you can withdraw at any time.

• Client and family history information (Section 7 below): contract performance, to deliver the research, storytelling, or travel planning service you've commissioned; and legitimate interests, where processing information about living relatives who are not my client is reasonably necessary to complete that research.

• Payment information: contract performance, and legal obligation, for UK tax record-keeping.

Where I rely on legitimate interests, I've considered that the processing is proportionate and expected, and doesn't override your rights. You can ask for details of this at any time.

7. Client and family history information

Beyond website visitor data, delivering genealogical research, storytelling, and ancestral travel planning services involves collecting more detailed personal information from and about you and your family, including:

• Contact details: name, email, and any other details you provide when booking a service.

• Family history information: names, dates, locations, and other details about your relatives — living and deceased — that you share with me, or that I discover during research on your behalf.

• Payment information: processed directly by Stripe; I don't store your card details myself.

Genealogical research necessarily involves information about people other than you — relatives, living and deceased. Where this concerns living individuals other than yourself, I collect and use it only as reasonably necessary to deliver your research, and I don't use it for any other purpose or share it beyond what's needed to complete your project unless you give explicit permission for me to do so.

8. Special category data and deceased individuals

Genealogical research can surface what data protection law calls "special category data" — details revealing racial or ethnic origin, religious belief, or health information. A parish register showing religious affiliation, or a death certificate recording cause of death, are typical examples. This information relates almost entirely to your deceased ancestors, though it may occasionally touch living relatives.

UK data protection law only protects living individuals — it doesn't apply to the deceased. Where information concerns your ancestors, this policy describes it for transparency, not because a legal right attaches to them.

Where special category data does concern a living person, I process it on the basis of historical research purposes, which UK law recognises as including genealogical research. I only use it for the purpose of your commissioned research, don't use it to make decisions about any individual, and apply the confidentiality and security standards described elsewhere in this policy.

9. Who I share information with

I use the following third-party services to run my business, each processing data on my behalf under their own privacy and security terms: Squarespace (hosting, analytics), Stripe (payments), Cloudflare (domain, DNS, and email routing), Apple/iCloud (file storage), Crunch Accounting (bookkeeping), and Meta (if you contact me via Instagram). I don't sell your personal information to anyone, or share it with third parties for their own marketing purposes.

10. International transfers

Some of the services above may process or store data outside the UK, including in the US. If you're contacting me from Canada, the EU, or elsewhere, your information may be processed in the UK and via these providers' infrastructure as described.

11. How long I keep information

Client research files and correspondence are retained for as long as needed to deliver the service, plus a reasonable period afterward for follow-up queries, and as required for UK tax record-keeping (generally 5 years from the relevant tax year). Enquiries that don't lead to a booking are retained for a limited period, then deleted.

12. Your rights

Depending on where you're based, you may have the right to access a copy of what I hold about you, correct inaccurate information, request deletion where I'm not legally required to keep it, object to or restrict certain uses, and withdraw consent for anything based on consent (such as marketing emails). To exercise any of these, contact me at wymarkancestral@icloud.com I'll respond within one month.

13. Where to complain

Contact me directly first — I'll do my best to resolve any concern. You also have the right to complain to your relevant authority: the Information Commissioner's Office (UK, ico.org.uk), your national data protection authority (EU), the Office of the Privacy Commissioner of Canada (priv.gc.ca), or Ireland’s Data Protection Commission.

14. Changes to this policy

I may update this policy from time to time. The date at the top of this page shows when it was last revised.

Contact
Wymark Ancestral
wymarkancestral@icloud.com