Privacy Policy
Effective date: 01/01/2026
ReFrench My Memory (“Company,” “we,” “us,” or “our”), treat your personal information with the same care and dedication we bring to unearthing your French heritage.
This Privacy Policy describes how we collect, use, disclose, and protect your personal information whenever you use our services. It complements the Cookie Policy and Terms and Conditions.
This Privacy Policy is primarily governed by French privacy laws (“Informatique et Libertés”) and the General Data Protection Regulation (GDPR). Although these laws focus on protecting individuals within the European Union (EU) and the European Economic Area (EEA), we extend these same safeguards to all our users, no matter where they live.
By using our services, you agree to the practices described in this Privacy Policy.
What Is Personal Data?
Personal data refers to any information that can directly or indirectly identify a natural person, including, but not limited to:
- An identifier such as a name, identification number, location data, or an online identifier.
- Specific attributes of a person’s physical, genetic, psychological, economic, cultural, or social identity.
Data protection principles
ReFrench My Memory is committed to respecting your privacy and ensuring that all personal data processing adheres to the six data protection principles set forth in the GDPR.
Lawfulness, Fairness, and Transparency
We process your data only if we have a valid legal basis (e.g., your consent or a contractual need). We strive for clarity and honesty in how and why we use your data, avoiding all deceptive practices.
Purpose Limitation
We collect your data for specific, legitimate purposes related to your genealogical or cultural research needs. We will not use it for any unrelated purpose without a valid legal basis (such as consent).
Data Minimisation
We only gather the personal data we truly need. We do not retain any information that is not essential to our services.
Accuracy
We take reasonable measures to keep your data accurate and updated. We promptly correct or remove any information found to be inaccurate.
Storage Limitation
We retain your data only as long as needed to achieve the purpose for which it was collected or to meet legal requirements. After that, we securely delete or anonymize it.
Integrity and Confidentiality
We use robust technical and organizational safeguards to protect your data from unauthorized access or disclosure.
Purposes of Data Processing
We collect and process personal data for the following purposes:
Service Delivery
- To provide and personalize the genealogy, cultural, or historical services you request.
- To create and manage your user account.
Communication
- To respond to your inquiries or support requests (via our “Contact Us” form or by email)
- To send administrative messages (order confirmations, invoices, account updates).
Marketing and Insights
- To send newsletters or promotional offers (only if you have opted in)
- To analyze user behavior and improve our website and services.
Compliance and Security
- To detect and prevent fraud, abuse, or security breaches.
- To comply with applicable laws and regulations (e.g., financial or tax obligations)
Legal Basis for Data Processing
We rely on the following legal bases:
Consent
Where you provide clear, informed consent (e.g., subscribing to our newsletter)
Contractual Necessity
Where processing is needed to perform a contract with you (e.g., fulfilling purchases or booking services)
Legitimate Interests
Where our interest in using your data is balanced against your own rights (e.g., improving security or website functionality), unless your fundamental rights override these interests
Legal Obligations
Where processing is required by law (e.g., financial or tax regulations in France)
Categories of Data Collected
In keeping with the data minimization principle, we only request information strictly necessary to provide our services. All fields on our website are mandatory because they enable order processing, account management, communication, and genealogical research. If you choose not to provide this information, certain services may be unavailable.
The categories of data we collect include:
Contact Information
First and last name, email address, phone number, mailing address (street, city, state, and ZIP code)
Payment Information
Credit/Debit Card Details (processed by third-party provider and not stored), Additional Information/Order Notes.
Account Information
Username, password, and profile preferences for your online account.
Technical Data
IP address, browser type, operating system, and usage patterns (collected automatically).
For further details on how cookies and other tracking technologies may collect Technical Data, please refer to our Cookie Policy.
Data Recipients
We do not sell your personal data. However, your data may be shared with Service Providers and Legal or Regulatory Authorities.
Service Providers
We work with trusted providers who help operate our website, process payments, schedule appointments, or enhance security. All third-party vendors must comply with GDPR standards and use strict data protection measures such as encryption, access controls, and regular security audits.
Below are key third-party service providers we use:
| PROVIDER | DATA SHARED | PURPOSE OF SHARING |
| Stripe | Payment details, name, billing address, email, IP address. Credit card information is not stored on our site but transmitted directly to Stripe via an encrypted connection. | Payment processing |
| Cal.com | Name, email, booking details Cal.com uses Twilio for SMS/email reminders and Daily.co for encrypted video conferencing. | Scheduling and managing bookings |
Legal or Regulatory Authorities
We may disclose personal data if required by law or if necessary to comply with a legal process (e.g., subpoenas, court orders, tax authorities).
International Data Transfers
The personal data we process is primarily stored and handled within France, where our servers are located. However, some data may be processed by third-party providers located outside the EU/EEA, such as Stripe and Cal.com.
These providers are contractually obligated to comply with GDPR standards through mechanisms such as Standard Contractual Clauses (SCCs) or equivalent safeguards. For further details, please refer to their privacy policies:
Stripe: https://stripe.com/privacy
Cal.com: https://cal.com/privacy
Data Retention
We keep your personal data only as long as necessary for the purposes outlined in this Policy, or to comply with legal obligations. Once the retention period expires, we will delete or anonymize your data.
Below is an overview of retention times:
| Data Category | Examples | Retention Period | Purpose |
|---|---|---|---|
| Contact Information | Name, email address, phone number, and mailing address. | Retained for 3 years after the last interaction, in accordance with CNIL recommendations. | To manage communication and maintain customer relationships. |
| Account Information | Username, password, profile preferences, and saved genealogical research. | Retained until the account is deleted or after 3 years of inactivity. | To provide account access and personalized services. |
| Comments Data | Comment text, timestamp, user IP address, and browser user agent. | Retained indefinitely, along with metadata, to facilitate moderation and maintain discussion history. | To ensure proper comment moderation and preserve discussion threads. |
| Booking Data | Appointment date and time, service type, and any associated notes or correspondence. | Retained for 3 years after the booking date. | To handle operational needs and resolve potential disputes. |
| Payment Data | Billing name, billing address, payment method, transaction ID, and invoice details. | Retained for 10 years to comply with French financial and tax regulations. | To ensure compliance with legal and financial obligations. |
| Genealogical Research Data | Family trees, historical records, research reports, biographical narratives, and translations. | Retained indefinitely, unless deletion is requested. | To preserve family history and enable follow-up research opportunities. |
| Technical Data | IP address, browser type, operating system, and usage logs (e.g., pages visited or links clicked). | Retained for 1 year. | For website analytics, fraud prevention, and security purposes. |
| Marketing Preferences | Newsletter subscription status, promotional email preferences, and opt-in consent timestamps. | Retained until you unsubscribe or after 3 years of inactivity. | To manage and respect user preferences for marketing communications. |
Your Rights
To exercise any of these rights, please contact us. We may require you to provide certain information to verify your identity before we can process your request.
Right of Access
You have the right to obtain confirmation of whether we are processing your personal data, and if so, request a copy of that data.
Right to Rectification
If your personal data is inaccurate or incomplete, you have the right to ask us to correct or update it without undue delay.
Right to Erasure (“Right to be Forgotten” )
You can request the deletion of your personal data where there is no compelling reason for us to continue processing it, subject to certain legal or contractual obligations.
Right to Restrict Processing
You have the right to request the restriction or suppression of your personal data in certain circumstances (e.g., if you contest the accuracy of the data).
Right to Data Portability
You can ask for your data in a format that can be easily moved to another service.
Right to Object
You may object to the processing of your personal data if you believe your fundamental rights and freedoms override our legitimate interests. You can also object to processing for direct marketing purposes at any time.
Right to Withdraw Consent
If we rely on your consent, you have the right to withdraw that consent at any time, which will not affect the lawfulness of prior processing.
Right to Lodge a Complaint
If you believe we have infringed upon your rights, you may lodge a complaint with the CNIL (Commission nationale de l’informatique et des libertés) or with the data protection authority in your country of residence.
Your Choices
In addition to the legal rights described above, you also have choices regarding how your personal data is used:
Marketing Preferences
You may unsubscribe from promotional emails by clicking the “unsubscribe” link in our messages or by contacting us..
Account Settings
You can access, update, or delete certain personal data by logging into your account on our website. For further changes, contact us directly.
Cookie Management
For details on how we use cookies and how to manage or disable them, please see our Cookie Policy. Most browsers also allow you to manage or block cookies at any time through your settings.
Data Security
We implement administrative, technical, and physical safeguards to protect your personal data:
- Hosting: Our website is hosted on servers provided by O2switch, a secure and GDPR-compliant hosting provider based in France, using robust security measures, including encryption, firewalls, and regular monitoring.
- Access Controls: Only authorized personnel can access sensitive information.
- Solid Security Plugin: We have integrated Solid Security to continuously monitor our website for suspicious or malicious activities. This specialized plugin automatically: Tracks and blocks suspicious IP addresses in real time; Monitors potential vulnerabilities to ensure prompt mitigation; Alerts us to unusual traffic patterns so we can proactively respond.
However, no method of transmission over the internet or electronic storage is completely secure.
In the event of a data breach, we will notify affected users and relevant authorities within 72 hours of becoming aware of the breach, where feasible.
Additional Notice on Genealogical Data
Because the GDPR applies only to living data subjects, our genealogical research focuses on deceased individuals, whose data does not fall under the GDPR’s scope.
French ‘Informatique et Libertés’ Law
French law extends certain protections if processing a deceased person’s data could affect the privacy of living heirs or relatives. We discuss this aspect individually with each client and address it further in our Terms and Conditions.
While we handle every research request with the utmost respect, we may not always be aware of every living relative connected to the individual in question. Rest assured that we remain committed to addressing any concerns raised by those affected.
Updates to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in data privacy regulations or our practices. Updates will take effect immediately upon posting on our Website, and the “Last Updated” date at the top of this page will be revised accordingly. We encourage you to review this Privacy Policy regularly to stay informed about how we handle your data.
