Privacy Policy
Last updated: 26 August 2026
Information We Collect
When you take our eligibility check, we collect your first and last name, email address, country of residence, an optional phone number, and your answers about your family history: which ancestor you believe was German, roughly when they left Germany, whether they acquired another citizenship and when, and whether certain historical circumstances apply to your line. We also receive the campaign parameters in the link you arrived through (utm_source, utm_medium, utm_campaign, utm_content, utm_term). Your answers are stored even if you do not finish the check, and you can request deletion at any time. When you book a call, we collect your name, email address, phone number, chosen time and time zone. If you become a client, we additionally collect genealogical and vital records, identity documents, and related family papers.
How We Use Your Information
We use your information to work out which route to German citizenship may apply to your family, to send you your result, to answer your enquiry, to carry out our services if you become a client, to measure which advertisements lead to enquiries where you have consented, and to meet our legal, tax and accounting obligations. The legal bases are Art. 6(1)(b) GDPR for steps taken at your request before a contract and for performing one, Art. 6(1)(a) GDPR for analytics, advertising and the question described below, Art. 6(1)(f) GDPR for the secure operation of this website, and Art. 6(1)(c) GDPR for statutory retention.
Special Category Data
One question in our eligibility check asks whether anyone in your family line was persecuted between 1933 and 1945, with religious and political persecution among the options. If you become a client in a restitution case, the documents you send us may reveal the same. This can reveal religious or philosophical beliefs, or political opinions, which Art. 9 GDPR treats as a special category of personal data with stricter protection. We process it only with your explicit consent under Art. 9(2)(a) GDPR. The question is optional, it appears only where your earlier answers point to the relevant period, and you can complete the check without it. We use it for one purpose: to determine whether the restitution routes under § 15 StAG or Article 116(2) of the German Basic Law may apply. We do not use it for advertising, we build no profiles from it, and we transmit it to no one beyond the processors listed at the end of this policy. You can withdraw your consent at any time and we will delete it.
Cookies and Your Choices
Cookies strictly necessary for this website to function are set without asking, under § 25(2) TDDDG. Everything else loads only after you actively agree through our consent banner, under § 25(1) TDDDG and Art. 6(1)(a) GDPR. This applies to every visitor wherever you are, because we are established in Germany. Google Analytics 4 sets the first-party cookies _ga and _ga_* and measures aggregate sessions, pages viewed, traffic source and conversion events. IP anonymisation is enabled, Google Signals is switched off, and advertising personalisation and ad-data sharing are disabled in our property settings. The Meta, TikTok and Google advertising pixels record page views and conversion events, and each receives a pseudonymous browser identifier, your IP address, the page URL and the event type. If you decline, none of these load and nothing is transmitted. The site works normally. You can change or withdraw your choice at any time through the cookie settings in our footer, and we honour the Global Privacy Control signal from your browser as a valid objection where you have not made an explicit choice.
Your Rights Under the GDPR
You can ask us to provide a copy of the data we hold about you (Art. 15), correct it (Art. 16), erase it (Art. 17), restrict how we use it (Art. 18), or transfer it to you in a portable format (Art. 20). You can object to processing we base on legitimate interests (Art. 21), and you can withdraw any consent at any time with effect for the future (Art. 7(3)). Write to office@german-heritage.com and we will respond within one month. You may also lodge a complaint with a supervisory authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany.
US State Privacy Rights
Most of our clients are in the United States. We are unlikely to meet the thresholds at which US state privacy laws become binding on us, but we extend the following rights voluntarily to all US residents. Under the California Consumer Privacy Act you have the right to know what we collect, to delete it, to correct it, to limit our use of sensitive personal information, and not to be discriminated against for exercising these rights. We do not sell your personal information. However, when the advertising pixels are active, sending pseudonymous identifiers to Meta, TikTok and Google for conversion measurement is classified under California law as sharing personal information for cross-context behavioural advertising. You can opt out by declining on our consent banner, by changing your cookie settings, or by sending a Global Privacy Control signal. For California residents who do consent, we transmit Meta's Limited Data Use signal, which instructs Meta to apply CCPA-restricted processing. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Delaware, New Hampshire, New Jersey, Maryland, Minnesota, Rhode Island, Kentucky, Nebraska and Indiana have substantially similar rights, and we honour them for all US residents regardless of whether the statute applies to us.
Minors and Data Security
Our services are not directed at anyone under 16 and we do not knowingly collect their data. Under Art. 8 GDPR as implemented in Germany, 16 is the age at which a person can consent to information society services on their own. If we learn we have collected data from someone younger, we delete it promptly. Under the CCPA, personal information of consumers under 16 is automatically treated as sensitive personal information. We use appropriate technical and organisational measures to protect your information against unauthorised access, alteration, disclosure and loss, and all transmissions to and from this site are encrypted with TLS. No transmission over the internet is completely secure, however, and we cannot guarantee absolute security. Where a breach is likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours under Art. 33 GDPR, and we notify you directly where the risk is high under Art. 34 GDPR.
International Data Transfers
Most of the providers listed at the end of this policy have an EU establishment and process data within the European Economic Area. One does not: You Scale LLC, which operates iClosed and handles our call scheduling, is based in the United States and processes your data there. Where data leaves the EEA we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework if the recipient is certified under it, and otherwise on Standard Contractual Clauses under Art. 46(2)(c) GDPR. You should know that US authorities can in certain circumstances access data held by US providers, and that enforcing your rights against such access may be difficult in practice. If you would rather not have your data processed in the United States, contact us at office@german-heritage.com and we will arrange a call by another route.
How Long We Keep Your Data
We keep eligibility check answers for 12 months from submission if you do not become a client. Your answer to the persecution question is deleted together with the rest of your response, or earlier on request. Enquiry correspondence is kept for 12 months after the matter is closed. Client records and case files are kept for six years under § 257 HGB and up to ten years under § 147 AO. Server log files are kept for 30 days. A record of your consent is kept while the consent is active plus three years as evidence that it was given. Providing your data is neither legally nor contractually required, but we cannot assess your eligibility or send you a result without your name, email address and answers. The persecution question and your phone number are optional.
Controller
The controller responsible for the processing described in this policy is Benjamin Baumann, trading as Archive & Co., Seestadt 2, 84130 Dingolfing, Germany. For any request under this policy, including access, correction, deletion, or withdrawal of consent, write to office@german-heritage.com.
Service Providers
Framer B.V.
Netherlands. Website hosting and delivery. Receives site content and standard server logs (IP address, user agent, requested URL).
IONOS SE
Germany. Domain registration and DNS. Receives domain records only, no visitor data.
Tally BV
Belgium. Runs our eligibility check. Receives all your answers, name, email address, phone number, country of residence and campaign parameters.
You Scale LLC
United States, operating as iClosed. Call scheduling. Receives your name, email address, phone number, chosen time and time zone. Data is processed in the United States.
Google Ireland
Ireland. Workspace for business email and document storage, Meet for consultation calls, Analytics 4 and Ads conversion tracking (both only after consent). Receives correspondence, client records, meeting metadata and pseudonymous identifiers.
Meta Platforms
Ireland. Advertising and conversion tracking, only after consent. Receives a pseudonymous browser identifier, your IP address, the page URL and the event type. Joint controller with us under Art. 26 GDPR. For California residents we transmit the Limited Data Use signal.
TikTok Technology
Ireland. Advertising and conversion tracking, only after consent. Receives a pseudonymous browser identifier, your IP address, the page URL and the event type. Joint controller with us under Art. 26 GDPR.
Automated Decisions and Changes
Our eligibility check applies a set of fixed rules to your answers and shows you a result page. This is not automated decision-making with legal effect within the meaning of Art. 22 GDPR: the result is a preliminary indication, it carries no legal consequence for you, and every case we take on is reviewed by a person. We update this policy when our services or the law change, and we review it at least once every twelve months. The version published here always applies, and the date at the top of this page shows when it last changed.