Who is responsible

The controller of personal data on Name Atlas is Patryk Cicbowski, Iława, Poland. Contact: cihypatryk@gmail.com.

What we do not do

Name Atlas has no accounts or advertising. Visit statistics are collected, without the surname in the address, by Vercel Web Analytics (without cookies) and Google Analytics (below), and page loading speed is measured, also without the surname and without cookies, by Vercel Speed Insights (below). The forms on the offer page send nothing to the site: they prepare an email in your own mail program, and you send it yourself. Without your consent the site stores no cookies in your browser; it only remembers your choice about Google Analytics (below). We do not profile anyone and make no automated decisions.

What data we process

Each time a page is opened, the server receives, as on any website:

• the device's IP address;
• the address of the page, and so any surname that is in the address or was typed into the search;
• technical details of the request: time, browser type, response code.

Why, and on what basis

This data is needed to show the page, to protect the site from abuse (a limit on requests from one address) and to find errors. The basis is our legitimate interest in running the site and keeping it secure (Article 6(1)(f) GDPR).

If you email us or write through the contact form, we process your address, your name (if you give it), the topic you choose, your message and the page's language to reply and deal with the matter, on the same basis. The form does not store the message on the site: it passes it through Resend to our mailbox. The “Report a problem” link prepares an email in your own mail program with the page's address and the surname it concerns; you send it yourself.

Visit statistics (which pages are viewed, how often and from where) rest on the same basis. Vercel Web Analytics collects them: no cookies; visitors are told apart by a hash computed from the request, discarded after 24 hours. For each page view it records the time, the page address, the referring page, the country, region and city, the operating system, the browser and the device type. Before the address reaches the statistics, our code replaces the surname in it with [slug] and removes the query parameters, so the statistics never contain the surname searched for.

Page loading speed is measured on the same basis, to know which pages load too slowly. Vercel Speed Insights measures it: no cookies, and, as Vercel states, the measurements are not tied to any visitor or IP address. With each measurement it records the page address and its pattern (such as /pl/nazwisko/[slug]), the result (such as how long the main content took to appear) with a description of the page element it concerns, the time, the connection type (such as 4g), the browser, the device type, the operating system and the country. As with the visit statistics, our code replaces the surname in the address and in the pattern with [slug] and removes the query parameters.

We also use Google Analytics, to understand better how the site is read. Google's script is loaded on every page, and with each page view Google receives the device's IP address, the page address, the referring page, an approximate location, details of the device and browser, and events on the page. Without your consent (the banner at the bottom of the page) Google stores no cookies in your browser; the basis is then our legitimate interest in knowing which pages are read (Article 6(1)(f) GDPR). If you agree, Google also stores the cookies _ga and _ga_<id>, which recognise a returning device; their basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with the button at the end of this page: we then delete those cookies, and page views go on being counted without them. Withdrawing does not affect what happened before. As with the Vercel statistics, our code replaces the surname in the page's address and title with [slug] and removes the query parameters. Google's advertising signals are switched off. We remember your choice in your browser's storage (localStorage), so as not to ask on every page.

If you join the waiting list or ask about genealogy research, we process your address and what you write to reply and to tell you when the service starts. The basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). Do not send us DNA results or health information: they are specially protected data, and a first reply does not need them.

Before we pass your details to the genealogists who carry out the research, we will ask for your consent and tell you who they are.

How long

For the request limit, the IP address is held in the server's memory only, for the limit's one-minute window, and our code never writes it anywhere. The site's own logs contain neither the IP address nor the surname searched for.

The hosting provider (Vercel) keeps a request log, including the page address, for between one hour and one day, depending on the service plan.

Emails are kept as long as needed to deal with the matter. A place on the waiting list is kept until the service starts or until you ask to be taken off.

Vercel keeps the visit statistics for one month (our plan's reporting window), and may keep them longer.

Vercel shows the speed measurements for the last 7 days (the longest range in the free version of Speed Insights, which we use); its documentation does not say how long it keeps them.

The Google Analytics cookies expire 2 years after the last visit, unless you withdraw consent first (we then delete them) or clear your browser. Data in Google Analytics is kept for the period set in the service, 2 months by default.

Who processes data for us

• Vercel Inc. (USA): hosting, visit statistics (Vercel Web Analytics) and page speed measurements (Vercel Speed Insights); pages are generated in Frankfurt. Transfers to the USA rely on the EU-U.S. Data Privacy Framework and standard contractual clauses.
• Oracle: the database server, in Frankfurt. It receives the query for a surname, not the visitor's IP address.
• Google: the mailbox that receives email.
• Google Ireland Limited and Google LLC (USA): Google Analytics, page views without cookies, and its cookies only after your consent. Transfers to the USA rely on the EU-U.S. Data Privacy Framework and standard contractual clauses.
• Resend, Inc. (USA): delivering the contact form's messages to our mailbox. The transfer to the USA rests on Resend's certification under the EU-U.S. Data Privacy Framework and on standard contractual clauses, as Resend states.

Your rights

You have the right to access your data, to have it corrected, erased or its processing restricted, to data portability for data you gave us under a contract or before entering into one (Article 6(1)(b) GDPR), and to object to processing based on legitimate interest. Write to the address above. An IP address alone usually does not tell us who you are; in that case we may be unable to identify your data (Article 11 GDPR).

You may complain to the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or to the authority where you live.

Whether you must give data

You need to give no data to read the site. Giving an email address is up to you, but without one we cannot reply to a message or put you on the waiting list.

The data the site shows

The figures on surname pages come from public PESEL register summaries and other published sources. They are aggregate figures, such as how many people bear a surname.

The only people named are well-known bearers of a surname, from Wikidata (a free knowledge base under CC0): only those with a Wikipedia article, and only what Wikidata states publicly: name, a short description, years of birth and death, and a link to the article. Some of them may be living. The basis is the controller's legitimate interest (Article 6(1)(f) GDPR): showing who well known bears the surname a reader asks about. Any of these people may object by writing to the address on the contact page. We remove them from the site at the next data refresh.