1. Who we are

‍Pro-Gen Research Ltd is a genealogical research company specialising in the tracing of beneficiaries, executors and heirs in connection with estate administration. We act on instruction from solicitors, legal professionals and other authorised parties.We are registered as a data controller with the Information Commissioner's Office (ICO). Our registration number is [ICO REGISTRATION NUMBER].Our registered office is [REGISTERED ADDRESS]. You can contact us at [EMAIL ADDRESS] or [TELEPHONE NUMBER], or by writing to us at the address above.Our website is www.pro-gen-research.co.uk. 2. What this notice coversThis notice explains how Pro-Gen Research Ltd collects, uses, stores and shares personal data in the course of our work. It applies to individuals whose personal data we process in connection with genealogical research and estate administration, including beneficiaries, executors, heirs and other persons whose details are relevant to a matter on which we have been instructed.This notice also applies to individuals who contact us directly, visit our website, or engage with us in connection with our services. 3. The personal data we collectIn the course of our work, we may collect and process the following categories of personal data:•  Full name•  Date of birth and, where relevant, date of death•  Current and historical addresses•  Contact details, including telephone numbers and email addresses•  Family relationships and genealogical information•  Information contained in public records, including the electoral register, probate records, civil registration records and other publicly available sources•  Information provided to us directly by instructing solicitors or other authorised partiesWe do not routinely collect special category data. If special category data is relevant to a particular matter, we will handle it in accordance with UK GDPR and will identify an appropriate additional lawful basis for its processing. 4. How we obtain personal dataWe obtain personal data from a number of sources, depending on the nature of the matter. These include:•  The electoral register, accessed via Trace IQ on our paid professional account for permitted purposes under the Representation of the People (England and Wales) Regulations 2001•  Probate records, including Grants of Probate and Letters of Administration, obtained via HMCTS and the Government's online probate search service•  Civil registration records, including birth, marriage and death certificates, obtained via the General Register Office and supplementary sources including FreebieMD•  Genealogical databases and record collections, including Ancestry, FindMyPast, FamilySearch and MyHeritage•  People search services, including Intelius, used for tracing purposes in accordance with the platform's terms of use•  The CRS Portal, used in connection with matters referred through that service•  Information provided directly by instructing solicitors or other authorised parties•  Information provided directly by individuals themselvesWe access these sources solely for the purpose of carrying out legitimate genealogical research and estate administration work on instruction from authorised professionals. 5. Why we process personal data and our lawful basisWe process personal data for the following purposes:5.1 Tracing beneficiaries, executors and heirsWe process personal data to locate individuals in connection with the administration of estates. Our lawful basis for this processing is legitimate interests under Article 6(1)(f) UK GDPR. The legitimate interest pursued is the proper administration of estates in accordance with the law, on instruction from regulated legal professionals. We have assessed that this processing is necessary for that purpose and that it does not disproportionately override the interests or rights of the individuals concerned.5.2 Contacting individualsWhere our instruction includes making contact with a located individual, we process personal data for the purpose of that communication. Our lawful basis is legitimate interests as described above.5.3 Providing our servicesWe process personal data to fulfil our obligations to instructing solicitors and other clients, to issue invoices and manage our business relationships. Our lawful basis is the performance of a contract or the taking of steps prior to entering into a contract under Article 6(1)(b) UK GDPR, or legitimate interests where no direct contractual relationship exists.5.4 Legal and regulatory complianceWe may process personal data where necessary to comply with a legal obligation, including responding to regulatory enquiries or complying with data subject requests. Our lawful basis is compliance with a legal obligation under Article 6(1)(c) UK GDPR. 6. Systems and storageWe use a number of systems in the course of our work. Personal data may be held or processed in the following:•  Casefox - case management•  Xero - accounting and invoicing•  Dropbox - file storage and document management•  Microsoft Outlook - email communications•  Google - search and supplementary tools•  Webflow - website platformWhere personal data is held in cloud-based systems, we take steps to ensure that the relevant providers operate under data processing terms compatible with UK GDPR. [ACTION: confirm Dropbox Business DPA and Google Workspace or Gmail terms are in place - see Actions section.] 7. Who we share personal data withWe share personal data only where necessary for the purposes described in this notice. Recipients may include:•  Instructing solicitors and other authorised legal professionals who have engaged us in connection with a matter•  Overseas researchers and genealogical research agencies acting as our sub-contractors in connection with specific matters, where the tracing work extends to other jurisdictions. Where data is transferred outside the UK, we take appropriate steps to ensure adequate protection in accordance with UK GDPR•  Regulatory bodies, including the ICO, where we are required to do so by law or in connection with a regulatory enquiryWe do not sell personal data to third parties. We do not share personal data for marketing or commercial purposes unrelated to the matter in connection with which it was obtained.We are in the process of formalising written data processing agreements with all third-party sub-contractors with whom we share personal data. 8. How long we keep personal dataWe retain personal data for as long as is necessary for the purpose for which it was collected, and in accordance with our data retention policy. As a general principle:•  Personal data collected in connection with a specific matter is retained for six years following the conclusion of that matter, after which it is securely deleted or destroyed•  Business and financial records are retained for a minimum of six years in accordance with HMRC requirements•  Correspondence and records relating to complaints or regulatory matters are retained for a minimum of six yearsPersonal data is not retained for longer than is necessary. We review our retained data periodically and delete data that is no longer required. 9. Your rightsUnder UK GDPR, you have the following rights in relation to your personal data:•  The right to be informed about how your personal data is used - this notice fulfils that obligation•  The right of access - you may request a copy of the personal data we hold about you•  The right to rectification - you may ask us to correct inaccurate data•  The right to erasure - in certain circumstances you may ask us to delete your personal data•  The right to restrict processing - in certain circumstances you may ask us to limit how we use your data•  The right to object - you have the right to object to processing based on legitimate interests•  The right to data portability - where applicable, you may ask us to transfer your data in a structured formatTo exercise any of these rights, please contact us at [EMAIL ADDRESS]. We will respond within one month of receiving your request.If you are not satisfied with our response, you have the right to complain to the ICO at www.ico.org.uk, by telephone on 0303 123 1113, or by post at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. 10. SecurityWe take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure. Access to personal data is limited to those who need it for the purposes described in this notice. 11. Changes to this noticeWe may update this notice from time to time. The current version will always be available on our website at www.pro-gen-research.co.uk.