Crossings & Traces processes personal data in accordance with the Swiss New Federal Act on Data Protection (nouvelle Loi sur la Protection des Données, nLPD) and, where applicable to EU-resident clients, the General Data Protection Regulation (Règlement Général sur la Protection des Données, RGPD/GDPR). Anya Gass acts as data controller (responsable du traitement) for all data processed in connection with client engagements. The lawful basis for processing standard personal data is contractual necessity (Art. 6(1)(b) GDPR / nLPD). The lawful basis for processing special category data is your explicit consent (Art. 9(2)(a) GDPR / nLPD).

Genealogical research frequently involves special category data (données sensibles) — including racial or ethnic origin, religious affiliation, and health information. This data is processed only with your explicit consent and only for the purpose of your family history research. Research may also surface information about living family members who have not directly engaged with Crossings & Traces. By commissioning research, you confirm that you have appropriate authority to share such third-party information and accept responsibility for doing so.

Client files are stored securely in Google Drive, access-controlled and password-protected. Data is not shared with third parties and is not retained beyond five years after the conclusion of an engagement without your explicit consent. In the event of a personal data breach, Anya Gass will notify the Federal Data Protection and Information Commissioner (PFPDT) within 72 hours where required by law, and will notify affected clients without undue delay.

You have the following rights in respect of your personal data:

• —Right of access (droit d'accès) — you may request a copy of the personal data held about you at any time
• —Right of rectification (droit de rectification) — you may request correction of inaccurate data
• —Right to restriction of processing (droit à la limitation du traitement) — you may request that processing of your data be restricted in certain circumstances
• —Right to erasure (droit à l'effacement) — you may request deletion of your data
• —Right to data portability (droit à la portabilité) — you may request your data in a structured, commonly used, machine-readable format
• —Right to withdraw consent (droit de retrait du consentement) — you may withdraw consent at any time without affecting the lawfulness of prior processing
• —Right to lodge a complaint — you may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (PFPDT) or your local supervisory authority at any time

To exercise any of these rights, contact Anya Gass directly. Requests will be addressed within 30 days. Data transfers to Google LLC (US) are covered by EU Standard Contractual Clauses and the EU-US Data Privacy Framework.