US STATE PRIVACY NOTICE

Last Updated: April 9, 2024

This US State Privacy Notice (this "Notice") supplements the information contained in the Privacy Policy of Geni.com ("Geni", the "Company", "we", "us", or "our").

Geni is an online service that allows members to create family trees and profiles in order to collaborate on the construction of a single, shared family tree of the world, including photo and video sharing, contacting family members and other Geni users, connecting DNA test results to verify or refute the connections in the family tree, and participating in projects and discussions about these activities (the "Geni Service").

This US State Privacy Notice ("Notice") describes our practices regarding the collection, use, and disclosure of personal information when US residents use our Website, use or obtain our Service, or engage with us offline. It addresses legal obligations and rights that apply to "personal information" or "personal data" which is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.

Capitalized terms used but not defined in this Notice or our Privacy Policy will have the meaning ascribed to them in our Terms of Use.

Notice at Collection - The Personal Information We Collect

We collect the following categories of personal information and collected the same categories in the 12 months preceding the date of this Notice:

1. Personal identifiers, such as names, postal and email address, phone number, IP address, names of relatives and their relationships to the account owner, birth dates, marriage date and similar information you may provide us.
2. Credit card or payment card information, such as credit card numbers and information required to facilitate payments through our payment service providers.
3. Protected class information, should you voluntarily share such with us, such as: gender, marital status, ancestry, national origin information and religion.
4. Commercial information, such as records of Geni products or services obtained, purchased, or considered.
5. Internet or other electronic network activity information, such information relating to how you interact with our Website and advertisements. IP addresses and basic log file information (such as address, browser type and language, number of clicks, domain names of websites visited, pages viewed, the amount of time spent on particular pages, and the date and time).
6. Professional information we collect from vendors or other businesses, such as the name of your employer or entity that you represent, your job title, names of your supervisors or those who you supervise, and other information you voluntarily provide to us regarding your professional life.
7. Audio, electronic, and visual information, such as information provided telephonically to the customer service representatives and information provided using our automated virtual assistant; identifying information included in comments provided by users in emails sent to us, messages or comments in our discussions, blogs or social media accounts; photographic images; audio and video recordings you upload or add to a profile in your family tree.
8. Sensitive personal information: if you use the DNA services: personal information that reveals genetic information.

Notice at Collection – Purposes for Which We Collect Personal Information

We collect personal information for the following purposes:

Categories of Personal Information	Purposes for Collection
Personal identifiers: names, email addresses, telephone numbers, home addresses, account password, names of relatives and their relationships to you, birth dates, marriage dates and similar information you may provide us. Protected class information, should you voluntarily share such with us: gender, marital status, ancestry, national origin information and, if you use the DNA services, also genetic information*. Internet or other electronic network activity information: information relating to how you interact with our Website and advertisements, IP addresses and basic log file information (such as address, browser type and language, number of clicks, domain names of websites visited, pages viewed, the amount of time spent on particular pages, and the date and time). Audio, electronic, and visual information: information provided telephonically to our customer service representatives and information provided using our automated virtual assistant; identifying information included in emails sent to us, messages or comments posted on our blogs, social media accounts, or our message boards; audio and video recordings you add to a photo or a profile in your family tree; photographs and videos.	To provide our Service
Personal identifiers: name, email address, home or billing address, telephone numbers, account ID. Credit card or payment card information: credit card numbers, billing addresses and information required to facilitate payments through our payment service providers. Commercial information: records of Geni products or services obtained or purchased.	To process payments
Personal identifiers: names, email addresses, telephone numbers, home addresses, names of relatives and their relationships to you, birth dates, marriage dates, and similar information you may provide us. Commercial information: records of Geni products or services obtained, purchased, or considered. Professional information we collect from vendors or other businesses: name of your employer or entity that you represent, your job title, names of your supervisors or those who you supervise, and other information you voluntarily provide to us regarding your professional life. Audio, electronic, and visual information: information provided telephonically to our customer service representatives and information provided using our automated virtual assistant; identifying information included in emails sent to us, messages or comments posted on our blogs, social media accounts, or our message boards; audio and video recordings you add to a photo or a profile in your family tree; photographs and videos.	To communicate with you
Personal identifiers: names, email addresses, home addresses, telephone numbers. Commercial information: records of MyHeritage products or services obtained, purchased, or considered. Internet or other electronic network activity information: information relating to how you interact with our Website and advertisements, IP addresses and basic log file information (such as address, browser type and language, number of clicks, domain names of websites visited, pages viewed, the amount of time spent on particular pages, and the date and time).	For advertising and marketing
Personal identifiers: names, email addresses, telephone numbers, home addresses, account password, names of relatives and their relationships to you, birth dates, marriage dates and similar information you may provide us. Protected class information, should you voluntarily share such with us: gender, marital status, ancestry, national origin information and, if you use the DNA services, also genetic information*. Commercial information: records of Geni products or services obtained, purchased, or considered. Internet or other electronic network activity Information: information relating to how you interact with our Website and advertisements, IP addresses and basic log file information (such as address, browser type and language, number of clicks, domain names of websites visited, pages viewed, the amount of time spent on particular pages, and the date and time). Audio, electronic, and visual information: information provided telephonically to our customer service representatives and information provided using our automated virtual assistant; identifying information included in emails sent to us, messages or comments posted on our blogs, social media accounts, or our message boards; audio and video recordings you add to a photo or a profile in your family tree; photographs and videos.	To operate, analyze, and improve our Website and Geni Services
Personal identifiers: names, email addresses, telephone numbers, home addresses, account password, names of relatives and their relationships to you, birth dates, marriage dates and similar information you may provide us. Credit card or payment card information: credit card numbers, billing addresses and information required to facilitate payments through our payment service providers. Commercial and financial information: payment information and records of Geni products or services obtained or purchased. Internet or other electronic network activity information: information relating to how you interact with our Website and advertisements, IP addresses and basic log file information (such as address, browser type and language, number of clicks, domain names of websites visited, pages viewed, the amount of time spent on particular pages, and the date and time). Audio, electronic, and visual information: information provided telephonically to our customer service representatives and information provided using our automated virtual assistant; identifying information included in emails sent to us, messages or comments posted on our blogs, social media accounts, or our message boards; audio and video recordings you add to a photo or a profile in your family tree; photographs and videos.	To prevent fraud, activities that violate our Terms and Conditions or that are illegal; and to protect our rights and the rights and safety of our users or others

*Sensitive personal information

Notice at Collection – Sale/Sharing/Targeted Advertising

We do not sell, share with third parties for cross-context behavioral advertising, or process for targeted advertising (as those terms are defined in the CCPA and other state data privacy laws) the personal information of residents of California, Virginia, Colorado, or Connecticut. We have not sold or shared California residents’ personal information in the 12 months prior to the date of this Notice.

Notice at Collection - Retention Periods

We retain the categories of personal information we collect for the length of time necessary to provide our Service and to comply with legal obligations or to protect our legal rights. For more information, see section 9, "Data Retention," in our Privacy Policy.

Categories of Sources from Which We Collect Personal Information

• when you sign up for and use any aspect of Geni Services;
• when you purchase a subscription or other product from us;
• when you use the Geni Services to to create your profile, add information to a family tree, conduct family research on the Website, or invite others to your Family Group;
• when you use our DNA services, i.e., when you purchase a DNA test kit, or upload your DNA data that was generated by another DNA testing service;
• when you post messages or comments on our site social media accounts, or our discussions or message boards;
• when you communicate with other users through the Geni Service’s features (e.g., Geni Inbox and Discussions);
• when you communicate with our customer support team or other representatives;
• when you engage with our automated virtual assistant;
• when you are taking advantage of promotions, responding to surveys, or subscribing to newsletters or other lists;
• when you link an account from Facebook or Google to your account on Geni, for authentication;
• when you use our Service via an integration from our API application partners;
• from public and historical records;
• when you visit or interact with our Website;
• when you interact with us in your capacity as a representative of another entity or individual with whom we are doing business.

Use of Cookies and Tracking Technologies

Geni uses cookies to collect information for record keeping purposes and to make it easier to navigate the Website. Cookies are small text files that are stored on Users' hard drives. Geni uses both "session ID cookies" and "persistent cookies." Session ID cookies are used to store information while a User is logged into the Website and expire when the User closes their browser. Persistent cookies are used to make tasks like logging into the Website easier for returning Users by remembering a User's login information. Persistent cookies stay on a User's hard drive from one session to the next. You may choose not to receive cookies from Geni by following instructions in your web browser's "help" file, but this may make certain features of the Geni services inaccessible to you. We employ a Web Application Firewall that uses mandatory cookies to detect and intercept malicious activity that poses a security risk to our Services.

Geni does not serve any third-party cookies.

You may set your browser to notify you when you receive a cookie. Many web browsers also allow you to block cookies. You can disable cookies from your computer system by following the instructions on your browser or at www.youradchoices.com. For more information about cookies, please go to www.allaboutcookies.org.

Use or Disclosure of Sensitive Personal Information

We do not use or disclose sensitive personal information to create inferences or profiles about individuals or for any purposes other than providing our Service.

No Profiling to Facilitate Decisions with Legal or Other Significant Effects

We do not engage in the automated processing of personal information to create profiles about individuals that are used in furtherance of decisions with legal or other similarly significant effects, such as the provision or denial of financial or lending services, housing, insurance, or access to essential goods or services.

Disclosure of Personal Information for Business Purposes in the Past 12 Months

The following chart describes the categories of personal information that we disclosed to third parties for a business purpose in the 12 months prior to the date of this Notice:

Categories of Consumers' Personal Information	Categories of Third Parties With Which We Shared Personal Information for a Business Purpose
Personal identifiers such as name, email address, home or billing address, telephone numbers, customer number, and IP address or other unique identifier you may provide us with.	Geni service providers that process payments, verify customer information, manage customer information and provide customer service (including through our call center), ship DNA kits, facilitate email communications, provide security services and cloud-based data storage, host our Website and assist with other IT-related functions, advertise and market our Geni Services, provide analytics services.
Credit card or payment card information, such as credit card numbers and information required to facilitate payments.	Geni service providers that process payments.
Protected class information, should you share such with us, for example: gender, marital status, ancestry, national origin information, and, if you use the DNA Services, also genetic information*.	Service providers that provide cloud-based data storage, host our Website, assist with customer support, provide analytics services and provide legal services. If you use the DNA services, service providers that process the DNA sample
Commercial information: records of Geni products or services obtained,or purchased.	Service providers that process payments or provide accounting services.
Internet or other electronic network activity information: information relating to how you interact with our Website and advertisements, IP addresses and basic log file information (such as address, browser type and language, number of clicks, domain names of websites visited, pages viewed, the amount of time spent on particular pages, and the date and time).	Geni service providers that assist us in marketing to those who visit our Website.
Professional information we collect from vendors or other businesses, such as the name of your employer or entity that you represent, your job title, names of your supervisors or those who you supervise, and other information you voluntarily provide to us regarding your professional life.	Geni service providers that manage vendor information, contract management, and payment processing.
Audio, electronic, and visual information: information provided telephonically to our customer service representatives and information provided using our automated virtual assistant; identifying information included in emails sent to us, messages or comments posted on our blogs, social media accounts, or our message boards; audio and video recordings you add to a photo or a profile in your family tree; photographs and videos.	Geni service providers that manage customer information and provide customer service (including through our call center or emails), provide cloud-based data storage services, and with regards to the information you published on our social media accounts, with the social media platform.

* Sensitive personal information

Additionally, we may share your Personal Information to a third party in the following situations:

1. In an acquisition of Geni: In the event that Geni is acquired by or merged with a third party entity or of our bankruptcy, insolvency, reorganization, receivership, or similar situation.
2. In legal or privacy circumstances: With our regulators and with law enforcement if required to do so by law, or in the good-faith belief that such action is necessary to comply with state or federal laws or respond to a court order, subpoena, law enforcement or regulatory request, or search warrant. We may collect and share any information in order to investigate, prevent, or take action regarding suspected or actual illegal activities; as appropriate or necessary to enforce our Terms of Use or investigate potential or actual violations of the Terms of Use or this Notice; take precautions against liability; to protect the security or integrity of our Website; to exercise or protect the rights, property, or the rights and personal safety of Geni affiliates, Users or others; or for other legitimate purposes.

Children's Personal Information

Our Geni Services are not directed to minors under the age of 13.

Third Party Websites and Social Media Buttons

Our Website may contain links to third party websites, including social media buttons that link to social media platforms. This Notice does not govern how those third parties or social media platforms collect or use personal information when you are redirected to their websites/apps or social media platforms, and we do not endorse or have control over their practices. The privacy policies and terms of use for those third parties websites/apps or social media platforms govern those companies’ privacy practices. We are not responsible for the content or privacy practices of any third-party websites or platforms.

How We Keep Your Personal Information Secure

Geni takes its data protection and privacy responsibilities seriously. We have implemented commercially reasonable technical and organizational measures designed to secure your Personal Information from accidental loss and from unauthorized access, use, alteration or disclosure. However, we cannot guarantee that unauthorized third parties will never be able to defeat those measures or use your Personal Information for improper purposes. Although guaranteed security does not exist either on or off the Internet, we make commercially reasonable efforts to make the collection and security of such information consistent with this Privacy Policy and all applicable laws and regulations. Where Geni has given you (or where you have chosen) a Username, login or password which enables you to access certain parts of the Website you are responsible for keeping this information confidential. Geni asks you not to share a Username, login or password with anyone.

Additional Information

For additional information about our privacy practices, how to manage your privacy, delete information about yourself or your family, security measures etc., see our general Privacy Policy.

Changes to This Notice

We may update this Notice from time to time, and when we do so, we will update the date. If the changes are material, we will notify you by email or on our Website.

Use of the Website or the Service following any changes constitutes your acceptance of the revised Notice then in effect.

State Data Privacy Rights and Other State-Specific Disclosures

Laws in certain US states give residents of those states specific rights with respect to the personal information collected about them. See below for more information about those rights and other state-specific disclosures.

CALIFORNIA

If you are a California resident, the California Consumer Privacy Act ("CCPA") and other California laws grant the rights described below with respect to their personal information we collect about you.

Your Right to Request Disclosure of Information We Collect and Share About You

California residents have the right to request certain information about our practices with respect to their personal information. In particular, you have the right to request that we disclose any or all of the following information to you about our processing of your personal information since January 1, 2022:

• Specific pieces of your personal information that we've collected
• The categories of personal information we have collected
• The sources from which we collected personal information
• The business or commercial purposes for which we collected personal information
• The categories of third parties with which we disclosed personal information
• The categories of personal information that we've disclosed to third parties for business purposes

We Do Not Sell Your Personal Information

As defined in the CCPA, we do not sell or share California residents’ personal information to third parties, including the personal information of California residents under the age of 16.

Your Right To Request The Deletion Of Personal Information We Have Collected From You

Upon your request, we will delete the personal information we have collected from you, subject to exceptions under the law.

Your Right to Request to Correct Personal Information We Hold About You

You have the right to request that we correct personal information we hold that you believe is not accurate. We will take steps to determine the accuracy of the personal information that is the subject of your request to correct, and in doing so will consider the totality of the circumstances relating to the personal information you have identified as being incorrect. We may ask that you provide documentation regarding your request to correct in order to assist us in evaluating the request.

Shine the Light

California residents are entitled to ask us for a notice describing what categories of personal customer information we share with third parties or corporate affiliates for those third parties or corporate affiliates for those third parties or corporate affiliates' direct marketing purposes. We do not share your personal information with third parties or corporate affiliates for their direct marketing purposes.

How We Respond to Do Not Track Signals

We do not currently respond to Do-Not-Track signals from your browser because a uniform technological standard has not yet been developed.

Exercising Your Rights

To exercise any of the rights described in this Notice, email privacy@geni.com, call us at +1-833-401-0999 (toll-free number in the USA). To exercise the right to delete or the right to request information we collect and share about you, you can also complete this form for the right to request deletion or this form for the right to request information we collect and share about you. All requesters will be required to authenticate themselves before we respond to their request.

California residents can lodge a complaint for violation of the California Genetic Information Privacy Act with any of the following California prosecutorial entities: the California Attorney General's Office, a district attorney, authorized county counsel, a city attorney or an authorized city prosecutor.

Authorized Agents

You may designate an agent to submit requests on your behalf. If you do so, we will require your written authorization to release your personal information to your agent. The agent must be a natural person or a business entity that is registered with the California Secretary of State. The agent will need to provide us with your signed permission indicating the agent has been authorized to submit the request on your behalf. We will also require that you verify your identity directly with us or confirm with us that you provided the agent with permission to submit the request.

Verification Process

If you have an account with us, you will be asked to log in to your account. If you do not have an account with us, you may be asked to provide us with personal information to be matched with information we already have. The number and scope of such personal information will depend on the sensitivity of personal information involved and the risk of harm due to any unlawful disclosure or deletion of such personal information. Such information may include your date of birth, place of birth, and information relating to the family tree you appear in. If we do not have a reasonable method by which we can verify your identity to the degree of certainty required, then your request may be denied.

Response Timeline and Additional Information

For requests for access or deletion, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

If you wish to receive further information or have any questions or concerns, email us at privacy@geni.com.

Right to Non-Discrimination

If you exercise any of the rights explained in this Notice, we will continue to treat you fairly. Consumers who exercise their rights under this Notice will not be denied or charged different prices or rates for goods or services, or provided a different level or quality of goods or services than other Consumers.

COLORADO

If you are a Colorado resident, the Colorado Privacy Act ("CPA") grants the rights described below with respect to personal information we collect about you.

• Right to Know: Colorado residents have the right to confirm whether or not we are processing their personal information and to access such data.
• Right to Access: Colorado residents have the right to a portable copy of the personal information we have collected from them.
• Right to Delete: Colorado residents have the right to request deletion of the personal information that we have collected about them and to have such information deleted, subject to certain exceptions.
• Right to Correct: Colorado residents have the right to ask that we correct inaccuracies in their personal information, taking into account the nature of personal data and purposes of processing such information.

Please note that for the purpose of this section of this Notice, we consider "personal information" to have the same meaning as "personal data" as defined under the CPA.

Exercising Your Rights and How We Will Respond

To exercise your rights to know, delete or correct, or to ask a question, email privacy@geni.com. We will respond to such requests within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

Our Commitment to Honoring Your Rights

If you exercise any of the rights explained in this Notice, we will continue to treat you fairly. If you exercise your rights under this Notice, you will not be denied or charged different prices or rates for goods or services or provided a different level or quality of goods or services than others.

Verification of Identity – Requests to Know, Delete, Correct

If you have an account with us, you may be asked to log in to your account. If you do not have an account with us, you may be asked to provide us with personal data to be matched with data we already have. The number and scope of such personal data will depend on the sensitivity of personal data involved and the risk of harm due to any unlawful disclosure or deletion of such personal data. Such information may include your date of birth, place of birth, and information relating to the family tree you appear in.

If we cannot reasonably verify your identity to the degree of certainty required, then your request may be denied.

When We Do Not Act on a Request – Appeal Process

In some cases, we may not act on your requests (e.g., if we cannot do so under other laws that apply). When this is the case, we will explain our reasons for not providing you with the information or taking the action (e.g., correcting data) you requested.

Additionally, you have the right to appeal our decision by contacting us at privacy@geni.com within 30 days after your receipt of our decision. Please provide us with an email address to identify your original request. We will respond to your appeal within 60 days of our receipt of the request.

CONNECTICUT

If you are a Connecticut resident, the Connecticut Data Privacy Act ("CTDPA") grants the rights described below with respect to personal information we collect about you.

• Right to Know: Connecticut residents have the right to confirm whether or not we are processing their personal information and to access such data.
• Right to Access: Connecticut residents have the right to a portable and technically feasible copy of the personal information we have collected from them.
• Right to Correct: Connecticut residents have the right to ask that we correct inaccuracies in their personal information, taking into account the nature of personal data and purposes of processing such information.
• Right to Delete: Connecticut residents have the right to request deletion of the personal information that we have collected about them and to have such information deleted, subject to certain exceptions.

Please note that for purpose of this section of this Notice, we consider "personal information" to have the same meaning as "personal data" as defined under the CTDPA.

Exercising Your Rights and How We Will Respond

To exercise your rights to know, delete or correct, or to ask a question, email privacy@geni.com. We will respond to such requests within 45 days from when we receive your request. If we expect your request is going to take us longer than normal to fulfill, we will extend the response period by another 45 days and will inform you of such extension.

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

Our Commitment to Honoring Your Rights

If you exercise any of the rights explained in this Notice, we will continue to treat you fairly. If you exercise your rights under this Notice, you will not be denied or charged different prices or rates for goods or services or provided a different level or quality of goods or services than others.

Verification of Identity – Requests to Know, Delete, Correct

If you have an account with us, you may be asked to log in to your account. If you do not have an account with us, you may be asked to provide us with personal data to be matched with data we already have. The number and scope of such personal data will depend on the sensitivity of personal data involved and the risk of harm due to any unlawful disclosure or deletion of such personal data.

If we cannot reasonably verify your identity to the degree of certainty required, then your request may be denied.

When We Do Not Act on a Request – Appeal Process

In some cases, we may not act on your requests (e.g., if we cannot do so under other laws that apply). When this is the case, we will explain our reasons for not providing you with the information or taking the action (e.g., correcting data) you requested.

Additionally, you have the right to appeal our decision by contacting us at privacy@geni.com within 30 days after your receipt of our decision. Please provide us with an email address to identify your original request. We will respond to your appeal within 60 days of our receipt of the request.

NEVADA

Pursuant to Nevada law, you may direct a commercial operator of a website not to sell certain personal information a business has collected or will collect about you. Geni does not sell personal information as it is described in Nevada law. For more information about how we handle and share your personal information or your rights under Nevada law, contact us at privacy@geni.com.

UTAH

If you are a Utah resident, the Utah Consumer Privacy Act ("UTCPA") grants the rights described below with respect to personal information we collect about you.

• Right to Know: Utah residents have the right to confirm whether or not we are processing their personal information and to access such data.
• Right to a Copy: Utah residents have the right to obtain a portable and readily usable copy of the personal information that they previously provided to us that, where the processing is automated, can be transmitted to another data controller without impediment.
• Right to Delete: Utah residents have the right to request deletion of the personal information that we have collected about them and to have such information deleted, subject to certain exceptions.

While the UTCPA provides the right to opt out of the sale of personal information, we do not sell personal information consistent with the definition of "sale" under Utah law.

Please note that for purpose of this section of this Notice, we consider "personal information" to have the same meaning as "personal data" as defined under the UTCPA.

Exercising Your Rights and How We Will Respond

To exercise your rights to know, obtain a copy of, delete, or to ask a question, email privacy@geni.com. You can also complete this form for the right to request deletion or this form for the right to know, obtain a copy or to correct. We will respond to such requests within 45 days from when we receive your request although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

Verification of Identity – Requests to Know, Obtain a Copy, Delete

If you have an account with us, you will be asked to log in to your account. If you do not have an account with us, you may be asked to provide us with personal information to be matched with information we already have. The number and scope of such personal information will depend on the sensitivity of personal information involved and the risk of harm due to any unlawful disclosure or deletion of such personal data.

If we cannot reasonably verify your identity to the degree of certainty required, then your request may be denied. We will notify you to explain the basis of the denial.

VIRGINIA

If you are a Virginia resident, the Virginia Consumer Data Privacy Act ("VCDPA") grants you the following rights with respect to the personal data we collect about you:

• Right to Know: Virginia residents have the right to confirm whether or not we are processing their personal data and to access such data, including by obtaining a copy of data that they previously provided to us.
• Right to Delete: Virginia residents have the right to request deletion of their personal data that we have collected about them and to have such personal data deleted.
• Right to Correct: Virginia residents have the right to ask that we correct inaccuracies in their personal data, taking into account the nature of personal data and purposes of processing such information.

To exercise any of the rights described in this Notice, or for additional information about how to exercise your rights, email privacy@geni.com, call us at +1-833-401-0999 (toll-free number in the USA). To exercise the right to delete or the right to request information we collect and share about you, you can also complete this form for the right to request deletion or this form for the right to request information we collect and share about you. All requesters will be required to authenticate themselves before we respond to their request.

Verification Process

If you have an account with us, you will be asked to log in to your account. If you do not have an account with us, you may be asked to provide us with personal data to be matched with data we already have. The number and scope of such personal data will depend on the sensitivity of personal data involved and the risk of harm due to any unlawful disclosure or deletion of such personal data. Such information may include your date of birth, place of birth, and information relating to the family tree you appear in.

If we do not have a reasonable method by which we can verify your identity to the degree of certainty required, then your request may be denied.

Response Timeline and Additional Information

For requests to know, delete or correct personal data, we will provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

If you wish to receive further information or have any questions or concerns, email us at privacy@geni.com.

When We Do Not Act on a Request – Appeal Process

In some cases, we may not act on your requests (e.g., if we cannot do so under other laws that apply). When this is the case, we will explain our reasons for not providing you with the information or taking the action (e.g., correcting data) you requested.

Additionally, you have the right to appeal our decision by contacting us at privacy@geni.com within 30 days after your receipt of our decision. Please provide us with your email address to identify your original request. We will respond to your appeal within 60 days of our receipt of the request.