Privacy and Information Processing Policy · Genealab

Effective Date: April 2026

This policy establishes the terms under which Genealab processes the information and documentation provided by you, hereinafter "the Client," for the execution of genealogical research services, document management, editorial design, and travel consultancy.

1. Scope of Services and Data Processed

Our company acts as a data processor for the following purposes:

• Research and Documentation: We process vital records and historical logs for ancestor searches and the assembly of citizenship folders.

• Editorial Design: We handle family data and photographs for the creation of albums and genealogical trees.

• Travel Consultancy: We collect preferences, dates, and destinations of interest for the preparation of travel itineraries.

Note: Our work is strictly planning and advisory. We do not make reservations, sell tickets, or enter into direct contracts with tourism providers.

Legal Basis for Processing (GDPR)

Consent for Processing Special Categories of Data: By contracting our genealogical research and citizenship folder services, the Client provides express and informed consent for Genealab to process personal data that may reveal racial or ethnic origin, filiation, and other sensitive data of ancestors and living relatives. This processing is carried out solely to fulfill the object of the contract and under strict confidentiality measures.

Legal Grounds

We process your information based on:

• Performance of a contract: To provide the requested services.

• Compliance with legal obligations: Especially regarding civil registries and consulates.

• Explicit consent: For the processing of sensitive data and the use of family images in design products.

2. Confidentiality and Limited Use

All documentation (physical or digital) is the exclusive property of the Client. Genealab commits to:

• Using the information solely for the fulfillment of the contracted service.

• Not sharing, selling, or transferring personal or family data to massive genealogical databases, marketing companies, or third parties unrelated to the project.

• Maintaining professional secrecy regarding any sensitive findings derived from the historical research.

3. International Data Transfer

To obtain records and manage citizenship procedures, Genealab performs international data transfers between the Argentine Republic and European Union countries (primarily Italy). It is guaranteed that these transfers are made to jurisdictions that have adequate levels of data protection in accordance with GDPR standards and current adequacy decisions.

4. Security in Document Management

• Physical Documentation: Original documents for citizenship procedures will be guarded with physical security measures and returned to the Client once the contracted service is completed.

• Digital Storage: Data processing is carried out on restricted-access equipment. Data is not stored on open-access platforms.

• Mandatory Third Parties: Information will only be delivered to official bodies (civil registries, consulates, archives) when strictly necessary for obtaining records or managing citizenship procedures requested by the client.

5. ARCO Rights (Access, Rectification, Cancellation, and Opposition)

ARCO rights are a set of powers that guarantee individuals control over their personal data. This acronym is a standard in data protection in Argentina (Law 25.326) and the European Union (GDPR).

In addition to the rectification and erasure of your data, the client has the right to:

• Access: Request a copy of all personal data in our possession.

• Portability: Receive your data in a structured and readable format to transmit it to another provider.

• Opposition and Limitation: Request that we suspend the processing of certain data if you consider its use to be excessive or unnecessary.

4. Consent of Living Third Parties

Given that travel planning and the creation of family trees often include living relatives, the Client assumes the responsibility of obtaining consent from such individuals to provide their data or images to our company.

5. Data Retention

Once the service has been completed and delivered:

• Digital work files will be kept for a maximum of 180 days as a backup, after which they will be deleted.

• We do not maintain client databases for purposes other than billing and service history.

6. Contact for Data Subject Rights

You may request the immediate rectification or deletion of your data by contacting:

• Responsible Party: Ileana Versace

• Email: info@mygenealab.com