Privacy statement

This is a translation of the Dutch text. If the two differ, the Dutch text applies. The Dutch text: Privacyverklaring.

Version 1.0, 05-10-2026. Last changed: 5 October 2026.

1. Who we are

Stamboom Compleet is a trade name of Studio Stuurman, Bieremalaan 79, 2497 AX Den Haag (The Hague), the Netherlands. Chamber of Commerce (KvK) number 27314126, VAT number NL001980897B18. We are responsible for what is described in this statement.

You can contact us about privacy through the intake form, by replying to an email you received from us, or by letter to the address above.

2. Who this statement is for

Visitors of stamboomcompleet.nl and of the example site.
People who fill in the intake or the acceptance page.
Customers and the visitors of their family tree site.
Family members about whom a customer gives us details.

The GDPR (General Data Protection Regulation, in Dutch: AVG) does not apply to details of people who have died. We still handle these with care. For example, we never mention suicide or euthanasia as a cause of death.

3. Which details we process

When you visit this site. This site does not use cookies for tracking and no statistics program. The fonts are on our own server, so your browser does not fetch anything from other parties. Like every web server, our server keeps a log with, among other things, your IP address, the time and the page requested. We only use that log in case of failures or abuse and we keep it as briefly as possible.

When you fill in the intake. Your name, email address and, if you fill it in, your phone number. Whether it is a gift and for whom. The details of the starting person, the parents and the four grandparents (name, year of birth, place of birth, country). Your choice of package, the advice from the form, what else you tell us, the names of people who must stay hidden and a GEDCOM file if you send one. Also the time you sent it.

When you accept a proposal. Your name, your email address, the reference and the package from the proposal, the time, the text of the boxes you ticked, the version of the terms and a hash of your IP address (see below). This lets us show later what was agreed.

With both forms we do not store your IP address. We only store a hash of it: an encrypted code from which the IP address cannot easily be recovered. We use it to make sure that no more than 5 forms per hour come from the same address.

During the assignment. Photos, scans and documents you send us, the details about your family, what we find in archives, our emails with you and the details that must be on an invoice.

On a family tree site. After you enter the PIN code, a family tree site sets a cookie, so you do not have to enter the PIN code again every time. Settings, such as who you are in the family tree, are only kept by the site in your own browser.

4. What for and on what basis

Assessing your intake and sending you a proposal. Basis: you ask us for a proposal (steps before an agreement).
Doing research and building, hosting and managing your family tree site. Basis: the assignment (agreement).
Putting details of living family members on the site. Basis: their consent, which you ask for on our behalf (see article 5).
Keeping in touch with you about your assignment. Basis: the assignment.
Keeping proof of your acceptance. Basis: the assignment and our interest in being able to show what was agreed.
Invoicing and keeping the accounts. Basis: legal obligation.
Protecting the site and the forms against abuse (log, hash of the IP address). Basis: our legitimate interest in a secure site.

We do not use your details for advertising, we do not sell them and we do not use them for someone else's family tree without your permission.

5. Living people

A family tree site often also shows people who are still alive. For them, the following applies:

You only give details of living people if they know about it and agree. You ask for their permission, not us.
If someone does not want to be visible, you say so. That person then appears as "Hidden person".
A family tree can say something about origin or religion. We only include such details of a living person if that person expressly agrees.
Family tree sites are behind a PIN code and cannot be found by search engines. The customer decides who gets the PIN code.

Who is responsible for what. For our own administration (intake, contact, invoices), we are responsible. For the research and the family tree site, we are ourselves responsible for how we search, store and secure. The customer is responsible for the permission of the living people whose details they give us, and for who gets the PIN code.

Are you on a family tree site yourself? Then you can ask us to see your details, to correct them or to hide you. We let the customer know that we are doing this, but not what else you ask.

6. How long we keep details

Intake without an assignment: 6 months after it was sent. After that we delete it.
During the assignment and the hosting: as long as needed for the assignment.
After an assignment stops or the hosting ends: within 30 days we delete the family tree site, your files and the backups, unless you ask us to keep the site online.
Invoice details: 7 years, because the law requires it.
Proof of your acceptance of a proposal: 7 years, together with the invoice details.
Hash of your IP address for the rate limit: at most one day. When you accept a proposal, we also keep the hash with the proof of your acceptance.

7. Who we share details with

We only share details with parties we need to deliver the service:

TransIP BV: our own server is at TransIP in Amsterdam (the Netherlands). This site, the forms and the family tree sites are on it.
mijn.host: the domain name is registered there and the DNS is there (the setting that points the domain name to our server). mijn.host gets no details that you fill in.
ntfy.sh: when a new form comes in, Harry gets a notification through ntfy.sh. It contains no personal details, only a number and the package.
Email: after an intake and after an agreement we automatically send you an email from info@stamboomcompleet.nl, and we receive a copy with the details from the form. Our own server sends these emails. What arrives at info@stamboomcompleet.nl is forwarded to the email address of Harry Stuurman at Google (Gmail). For the proposal and the invoices we use the same email address.
Anthropic (Claude): to read scans and organise details, we use tools with artificial intelligence from Anthropic. The details needed for this are then processed on Anthropic's servers, also outside the European Union.
Archives and sources: they only see our searches, such as the name of an ancestor, not your contact details.
The Dutch Tax Administration (Belastingdienst), if the law requires it.

Example site and family tree sites. The example site (voorbeeld.stamboomcompleet.nl, with the made-up Verhoeven family) is public. The example site and the family tree sites load maps from OpenStreetMap, the map program Leaflet from unpkg.com and fonts from Google Fonts. In doing so, these parties see the visitor's IP address. This is needed to show the map and the fonts. Some of these parties may process details outside the European Union.

8. Security

All pages use a secure connection (https).
What you fill in on a form, we store in a folder outside the public web folder. It cannot be requested through the internet.
Of your IP address, we only keep a hash.
Family tree sites are behind a PIN code and cannot be found by search engines.
There is no more software on the server than needed.

9. Cookies

This site (stamboomcompleet.nl) does not set cookies. A family tree site only sets a cookie for the PIN code (see article 3). We do not use cookies for tracking or advertising.

10. Your rights

You have the right to:

ask which details we have about you (access);
have incorrect details corrected (correction);
have details deleted (deletion), except what we must keep by law;
object to the use of your details (objection);
have the use temporarily stopped (restriction);
get your details in a common file format, for example to give them to someone else (portability);
withdraw your consent. What we already did on that basis stays valid.

Ask us through the intake form, by replying to our email or by letter. We answer within one month. We may ask you to show that the details are about you.

If you do not agree with how we handle your details, please tell us first. You can also file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

11. Changes

We can change this statement. The date of the last change is at the top. If something important changes for an ongoing assignment, we let you know.