CALIFORNIA CONSUMER PRIVACY ACT (CCPA) NOTICE
This Notice describes our practices regarding the collection, use, disclosure, and sale of personal information when you use our Website, mobile or desktop applications (collectively, the "Applications") and when you engage with us offline. It addresses legal obligations and rights that apply to "personal information," which is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household.
Capitalized terms used but not defined in this Notice will have the meaning ascribed to them in our Terms and Conditions.
By accessing the Applications, you agree to our collection and use of personal information as described in this Notice. If you are a California resident and do not agree to this Notice, do not use the Applications or the Service and delete your account.
The Categories and Sources of Personal Information We Collect
In the 12 months preceding the date of this Notice, we have collected personal information, and will continue to collect personal information, in the following circumstances:
- when you sign up for and use any aspect of our Service;
- when you purchase a subscription or other product from us;
- when you use the Service to build your family tree, conduct family research on the Applications, or invite others to view or edit your family tree;
- when you use our DNA Services, i.e., when you purchase our DNA test kit, or upload your DNA data that was generated by another DNA testing service;
- when you post messages or comments on our blogs or Facebook accounts, or our message boards;
- when you communicate with other users through the Service’s features (e.g., MyHeritage Inbox);
- when you communicate with our customer support team (e.g., support tickets) or other representatives;
- when you participate in any Surveys or questionnaires on the Service;
- when you link an account from Facebook or Google to your account on our Service, for authentication;
- when you use our Service via an integration from our genealogy partners such as Roots Magic and Family Historian;
- from public and historical records.
In the 12 months preceding the date of this Notice, we have collected the following categories of personal information, and will continue to collect such information:
1) Personal identifiers, such as names, postal and email address, phone number, account id, IP address, names of relatives and their relationships to the account owner, birth dates, marriage date and similar information you may provide us with.
2) Credit card or payment card information, such as credit card numbers and information required to facilitate payments through our payment service providers.
3) Protected class information, should you voluntarily share such with us, such as: gender, marital status, ancestry, national origin information and, if you use the DNA Services, also genetic and genetic-health information, ethnic origin information and self-reported health history information.
4) Commercial information, such as records of MyHeritage products or services obtained, purchased, or considered.
5) Internet or other electronic network activity information, such as web log information, "clickstream" data (for example, the type of computer and browser you use, the address of the web site from which you linked to the Applications), page views.
6) Audio, electronic, and visual information, such as information provided telephonically to our customer service representatives; identifying information included in comments provided by users in emails sent to us, messages or comments on our blogs, social media accounts, or our message boards; photographic images.
The Purposes for Which We Collect Personal Information
We use personal information for the following purposes:
1) To provide the Service to You: We primarily use your personal information to fulfill the purposes for which you provided the personal information to us. These include displaying your family tree, re-running family history searches made to find more records for you, processing your subscription and providing you with customer support. We also use your personal information to serve you Smart Matches™ and Record Matches for your family tree, or to enable you and other members of the MyHeritage community to contact each other, and so on.
If you are using our DNA Services: We will process and store your DNA samples, conduct genetic analysis, and provide you with the DNA Results and DNA Reports. If DNA Matching is enabled, we will compare your DNA data to other users to serve you DNA Matches. If you are interested in the DNA Health Reports, the Health Questionnaire Information will allow us to determine your eligibility to receive them. For U.S. customers, the DNA Health Reports are provided pursuant to a physician’s order. We may add new DNA Health Reports for you as they become available.
2) To communicate with you: We may communicate with you for the purpose of informing you of updates or additions to the Service, or to seek feedback from you about the Service. Our communications with you will be conducted primarily via email, but may also be made via telephone, direct mail, or another method of communication in some circumstances. If you do not want to continue to receive emails from us, you may opt out at any time by using the unsubscribe link listed in the email or by setting your Email Preferences. If you wish to opt out of other methods of communication, contact us at firstname.lastname@example.org.
3) To market our services: By signing up to the Service, you agree that we may use your contact information as well as information about your use of the Service, to offer you complementary MyHeritage products or services. Such promotional offers may be made via email, telephone, or direct mail. We will never send you promotional offers by Text Message (SMS); The only Text Messages (SMS) you may receive from us are messages about upcoming birthdays and wedding anniversaries of close family members in your family if you opted-in to that specific feature.
If you do not want to receive marketing offers via emails, you may opt out at any time by using the unsubscribe link listed in the email or by setting your Email and Communication Preferences. See the section on Email Preferences below. If you do not want to receive marketing offers via telephone, you can also do that via the Email and Communication Preferences. You can also instruct us to stop communicating with you by contacting us at email@example.com or request this whenever you are speaking with any representative of MyHeritage.
The aggregated information gathered from you and other users through the Surveys may be used in our marketing, and such emails or promotional offers may be presented to you.
4) For internal business purposes: In order to improve the Service and to develop new products and services, we may use your personal information for internal data analysis, for studying how the Applications are used, to help us diagnose problems and secure the Service, identifying usage trends and determining the effectiveness of promotional campaigns. For example, we may examine how much time you spend on each page of the Applications and how you navigate through the Applications. We will only use this information to improve the Applications.
We use your IP address or equivalate to deliver the Applications and our Service to you and to help diagnose problems with our servers. Your IP address is also used to gather broad demographic information such as geographic distribution of our members. When you use the Service for the first time, we use your IP address to suggest the Service to you in the language deemed most appropriate for the geographical region from which it originates.
5) To perform research: If you voluntarily agreed to the DNA Informed Consent Agreement, we may use your information (such as Survey Research information, DNA Results, and other DNA information) for the purposes of research as specified in the Informed Consent. Your Informed Consent may be revoked at any time through the Applications. Your identity and the identity of your family members will never be disclosed by us in any publication of any research results.
Disclosure of Personal Information for Business Purposes in the Past 12 Months
The following chart describes the categories of personal information that we disclosed to third parties for a business purpose in the 12 months prior to the date of this Notice:
|Categories of Consumers’ Personal Information||Categories of Third Parties With Which We Shared Personal Information for a Business Purpose|
|Personal identifiers such as name, email address, address of the property for inspection, home or billing address, telephone numbers, customer number, account password, and IP address or other unique identifier you may provide us with.||Service providers that process payments, verify customer information, manage customer information and provide customer service (including through our call center), ship DNA kits, facilitate email communications, provide security services and cloud-based data storage, host our Applications and assist with other IT-related functions, advertise and market our Services, provide analytics services.|
|Credit card or payment card information, such as credit card numbers and information required to facilitate payments.||Service providers that process payments.|
|Protected class information, should you share such with us, for example: gender, marital status, ancestry, national origin information, and, if you use the DNA Services, also genetic and genetic-health information, ethnic origin information and self-reported health history information.||Non genetic/health info: If Smart Matches™ are enabled- other users of MyHeritage and users of MyHeritage’s Genealogy Partners.
With respect to DNA services:
-The DNA sample is shipped by you to our DNA lab;
-if you purchased our DNA Health Upgrade– information is shared with PWNHealth, LLC. - an independent network of fully licensed, board certified physicians and genetic counselors.
-DNA Matches – if your DNA Matches are enabled- other users who are potential relatives, based on DNA.
|Internet or other electronic network activity information.||Third party marketing services.|
|Audio, electronic, and visual information, including information provided telephonically to our customer service representatives; identifying information included in comments provided by users in emails sent to us, messages or comments on our blogs, social media accounts, or our message boards; photographic images.||Service providers that manage customer information and provide customer service (including through our call center or emails), provide cloud-based data storage services, and with regards to the information you published on our social media accounts, with the social media platform.|
Additionally, we may share your Personal Information to a third party in the following situations:
2) In legal or privacy circumstances:
if required of us by law or during legal proceedings, or to prevent fraud and cybercrime. We will not provide information to law enforcement unless required by a valid court order or subpoena for genetic information.
Your Right to Request Disclosure of Information We Collect and Share About You
If you are a California resident, the CCPA grants you the right to request certain information about our practices with respect to your personal information. In particular, you have the right to request that we disclose any or all of the following information to you about our processing of your personal information during the 12 month period prior to our receipt of your request:
- Specific pieces of your personal information that we’ve collected
- The categories of personal information we have collected
- The sources from which we collected personal information
- The business or commercial purposes for which we collected personal information
- The categories of third parties with which we disclosed personal information
- The categories of personal information that we’ve disclosed to third parties for business purposes
We Do Not Sell Your Personal Information
In the past 12 months, we have not sold your Personal Information to any other entity; and we do not and will not sell Personal Information to third parties.
Your Right To Request The Deletion Of Personal Information We Have Collected From You
Upon your request, we will delete the personal information we have collected from you, except for situations when that information is necessary for us to: provide you with a product or service that you requested; perform a contract we entered into with you; maintain the functionality or security of our systems; comply with or exercise rights provided by the law; or use the information internally in ways that are compatible with the context in which you provided the information to us, or that are reasonably aligned with your expectations based on your relationship with us.
Children’s Personal Information
Our Services are not directed to minors under the age of 16 and we do not sell the personal information of minors under 16.
Other California Privacy Rights
California residents are entitled to ask us for a notice describing what categories of personal customer information we share with third parties or corporate affiliates for those third parties or corporate affiliates’ direct marketing purposes. We do not share your personal information with third parties or corporate affiliates for their direct marketing purposes.
How We Respond to Do Not Track Signals
We make use of browser cookies and similar automated means of data collection technologies to enhance your experience of using the Applications, and for our own marketing purposes.
Although we do our best to honor your privacy preferences, we do not currently respond to Do-Not-Track signals from your browser because a uniform technological standard has not yet been developed.
Exercising Your Rights
To exercise any of the rights described in this Notice, email firstname.lastname@example.org, call us at +1-844-994-1888 (toll-free number in the USA) or complete this form for the right to request deletion or this form for the right to request information we collect and share about you. All requesters will be required to authenticate themselves before we respond to their request.
California residents can lodge a complaint for violation of the California Genetic Information Privacy Act with any of the following California prosecutorial entities: the California Attorney General’s Office, a district attorney, authorized county counsel, a city attorney or an authorized city prosecutor.
You may designate an agent to submit requests on your behalf. If you do so, we will require your written authorization to release your personal information to your agent. The agent must be a natural person or a business entity that is registered with the California Secretary of State.
Requests for Household Information
There may be some types of personal information that can be associated with a household (a group of people living together in a single dwelling). Requests for access or deletion of household personal information must be made by each member of the household. We will verify the identity of each member of the household using the verification criteria explained above and will also verify that each household member is currently a member of the household.
If we are unable to verify the identity of each household member with the degree of certainty required, we will not be able to respond to the request. We will notify you to explain the basis of our denial.
If you have an account with us, you will be asked to log in to your account. If you do not have an account with us, you may be asked to provide us with personal information to be matched with information we already have. The number and scope of such personal information will depend on the sensitivity of personal information involved and the risk of harm due to any unlawful disclosure or deletion of such personal information. Such information may include your date of birth, place of birth, and information relating to the family tree you appear in. If we do not have a reasonable method by which we can verify your identity to the degree of certainty required, then your request may be denied.
Response Timeline and Additional Information
For requests for access or deletion, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.
We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.
If you wish to receive further information on our CCPA compliance or have any questions or concerns, email us at email@example.com.
Right to Non-Discrimination
If you exercise any of the rights explained in this Notice, we will continue to treat you fairly. Consumers who exercise their rights under this Notice will not be denied or charged different prices or rates for goods or services, or provided a different level or quality of goods or services than other Consumers.
Changes to This Notice
If we decide to modify this Notice, we will issue an updated version of this Notice with an updated date legend and display the label "updated" next to the "California Privacy Notice" link in the footer of the Website. The "updated" label will be removed after 30 days. If the changes are material, we will also notify you via email.
Use of the Applications or the Service following any changes constitutes your acceptance of the revised Notice then in effect.