This Privacy Statement explains how Italian Roots Finder collects, uses, and protects your personal data when you use our services or visit italianrootsfinder.com. We comply with the EU General Data Protection Regulation (GDPR) 2016/679 and applicable data protection laws.

1. Data Controller

2. About Our Service

Italian Roots Finder is a professional genealogy research and document retrieval service. We retrieve official Italian civil records (birth, marriage, and death certificates) from Italian municipalities and state civil archives on behalf of clients — primarily individuals residing in the USA, Australia, Canada, and the United Kingdom — who are pursuing Italian citizenship by descent (jure sanguinis) or conducting family genealogy research.

3. Personal Data We Collect

3.1 Data you provide directly

• Identity data: first name, last name
• Contact data: email address, phone number (optional)
• Geographic data: country and city of residence, preferred currency
• Case data: name of Italian ancestor, municipality, approximate year, type of record requested, purpose (citizenship or genealogy research)
• Identity documents: copy of your identity document (collected only at the mandate formalisation stage, required for the delegation to Italian municipalities)
• Payment data: processed exclusively via Wise or PayPal; Italian Roots Finder does not collect or store credit card details or bank account information

3.2 Data collected automatically

The website collects technical data automatically via cookies and analytics tools (see Section 9), including IP address, browser type, pages visited, and visit duration.

4. Purposes and Legal Bases

We do not intentionally process special categories of personal data as defined under Art. 9 GDPR (health data, racial or ethnic origin, religious beliefs, etc.). However, in the context of genealogy research, certain information provided by you may indirectly reveal such data (e.g. ethnic origin or family relationships). In such cases, data is processed solely for the purpose of providing the requested service and in accordance with applicable data protection laws. Please note that genealogical records relate primarily to deceased ancestors and are largely outside the personal scope of Art. 9 GDPR.

5. Recipients and Data Processors

5.1 Institutional recipients

• Italian municipalities and Civil Registry Offices — recipients of the PEC certified emails sent on your behalf to retrieve the requested records
• Italian tax and fiscal authorities — where required by law

5.2 Technology service providers (Data Processors under Art. 28 GDPR)

5.3 Use of Artificial Intelligence

6. International Data Transfers

Some providers listed in Section 5.2 are based in the United States (a third country with respect to the EU). Transfers of personal data to these providers are carried out in compliance with the safeguards required by Arts. 44–49 GDPR, specifically through the adoption of Standard Contractual Clauses (SCC) approved by the European Commission under Implementing Decision (EU) 2021/914 of 4 June 2021. Where applicable, certain providers may also rely on the EU–US Data Privacy Framework (DPF) as an additional legal basis for data transfers. Upon request, we will provide a copy of the safeguards adopted for each transfer.

7. Data Retention

• Completed cases: data is retained for 10 years from case closure, in accordance with Italian tax and accounting obligations
• Contact requests without a concluded contract: data is retained for 24 months from the date of contact
• Website navigation data: retained for the periods set out in the Cookie Policy
• Marketing data: retained until consent is withdrawn

Upon expiry of retention periods, personal data is permanently deleted or irreversibly anonymised.

8. Your Rights

To exercise your rights, please contact us at privacy@italianrootsfinder.com. We will respond within 30 days, with a possible extension of 60 days for complex requests.

9. Cookies and Tracking Technologies

The website uses cookies and tracking technologies managed via the Complianz plugin. Non-essential cookies are blocked by default and are only activated after you have provided explicit consent through the cookie banner displayed on your first visit.

You can modify or withdraw your cookie consent at any time via the cookie management panel in the footer of the website. For details on specific cookies used, please refer to our Cookie Policy.

Moreno Brusauro participates in the IAB Europe Transparency & Consent Framework and complies with its Specifications and Policies. Consent Management Platform ID: 332.

10. Minors

Our service is intended exclusively for adults (18 years of age or older). We do not knowingly collect personal data from minors. If we become aware of any inadvertent processing of a minor's data, we will delete it immediately.

11. Security

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Secure authentication and access limited to authorised personnel
• File storage on private storage with time-limited signed URLs
• Pseudonymisation of personal data before transmission to AI systems
• Data stored on EU-based servers (Germany)
• Regular backups and recovery procedures

In the event of a personal data breach posing risks to your rights and freedoms, we will notify the Italian Garante within 72 hours of discovery and affected individuals without undue delay, in accordance with Arts. 33–34 GDPR.

12. Third-Party Websites

This Privacy Statement does not apply to third-party websites linked from our website. We cannot guarantee that those third parties handle your personal data reliably or securely. We recommend reading their privacy statements before using those websites.

13. Amendments

We reserve the right to amend this Privacy Statement at any time to reflect legal or operational changes. Material changes will be communicated via a notice on the website or by email. We recommend consulting this page periodically.

14. Contact Details and Data Requests