Contact

Current version: 22 September 2026

Translation of the Polish privacy policy; in case of doubt the Polish version prevails.

1. Data controller

The controller of your personal data is Kinga Winnicka, conducting business under the name Kinga Winnicka Genealożka.pl, Tax ID (NIP) 8982138602, REGON 545687319. For matters concerning personal data contact me at info@genealozka.pl.

2. Why I process data and how long I keep it

• Replying to an enquiry and preparing a quote – the basis is action taken prior to entering into a contract (Art. 6(1)(b) GDPR). I keep the data until the correspondence ends and, if no engagement follows, for up to 12 months from the last contact.
• Carrying out the engagement (research, reports, invoicing) – the basis is performance of a contract (Art. 6(1)(b) GDPR), for the duration of that contract.
• DNA test results and match lists – processed solely on the basis of your explicit consent (Art. 9(1) and Art. 9(2)(a) GDPR), until the project is completed or consent is withdrawn. I then delete the data files, only the report remains.
• Invoices and tax records – a legal obligation (Art. 6(1)(c) GDPR); 5 years from the end of the year in which the tax payment deadline fell.
• Establishing, pursuing or defending claims – my legitimate interest (Art. 6(1)(f) GDPR); until the applicable limitation periods expire.
• Project archive (report, tree, records gathered) – legitimate interest, in case the research is continued or questions arise; five years after the project ends, unless I receive an earlier request for deletion.
• Anonymised project description in the Examples section – solely on the basis of consent (Art. 6(1)(a) GDPR), until it is withdrawn.

3. Third-party data

Genealogical research inherently concerns other people as well: the Client’s relatives, individuals named in records and, in genetic genealogy, people appearing on DNA match lists. Data of deceased persons falls outside the GDPR. Data of living persons is processed to the minimum extent necessary to carry out the engagement, on the basis of legitimate interest (Art. 6(1)(f) GDPR), and data from match lists only to the extent that those individuals have themselves made it available in genealogical services (Art. 9(2)(e) GDPR – data manifestly made public by the data subject).

I contact people from match lists only where this is necessary for the outcome of the research, in agreement with the Client, and limited to the information needed to establish the relationship. I do not pass information about those individuals to anyone other than the Client.

4. Recipients of data

Data may be shared only with entities providing me with technical or accounting support (my accountant, my bank), in particular the website hosting provider (through the contact form), Google (Gmail and Google Drive), Meta (WhatsApp, where we communicate that way) and Anthropic (Claude), an AI tool used as an aid in analysing genealogical and genetic data, solely on data stripped of identifiers. I do not submit raw DNA data files to AI tools.

I provide data to archives and institutions only where a commissioned record search requires it, and only with the Client’s consent.

5. Transfers outside the European Economic Area

I use Gmail and Google Drive (Google Ireland Limited / Google LLC), the WhatsApp messenger (Meta Platforms Ireland Limited), where we communicate that way, and Claude (Anthropic PBC) – as described in section 4. These providers may process data outside the EEA, including in the United States. Such transfers are based on the European Commission’s adequacy decision of 10 July 2023 concerning the EU-US Data Privacy Framework and, additionally, on standard contractual clauses.

I do not send DNA test results, raw genetic data or records concerning living persons via messengers – these are exchanged by e-mail or through a shared folder.

6. Rights of data subjects

The data subject has the right to access their data, to have it rectified or erased, to restrict its processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting the lawfulness of processing carried out before the withdrawal). The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland).

7. Voluntary nature of providing data

Providing data is voluntary but necessary in order to reply to an enquiry and to enter into a contract. Providing genetic data is entirely voluntary – without it, however, genetic genealogy services cannot be carried out.

8. No profiling

I do not make automated decisions and I do not profile users.

9. Cookies

The home page stores no cookies other than those necessary for it to function. I use no analytics, statistics, marketing tools or embedded social media plugins (the Facebook and Instagram links are ordinary links).

The contact form is protected against spam by Google reCAPTCHA (Google Ireland Limited). As a result, on the page containing the form Google may store its own cookies from the google.com domain on the user’s device, including SEARCH_SAMESITE (protection of requests sent between websites) and __Secure-ENID (remembering preferences in Google services and analytics, stored for up to 13 months). reCAPTCHA also processes technical browser data in order to distinguish submissions made by people from automated ones.

These practices are described by Google: https://policies.google.com/technologies/cookies and https://policies.google.com/privacy.

Users may delete cookies or block them at any time in their browser settings. Blocking the cookies used by reCAPTCHA may make it impossible to submit the form.

10. Changes to this policy

I announce any material changes on the website. The current version is always available at https://genealozka.pl/contact/#privacy-policy.