OverlayOn
Privacy Policy

DATA PROTECTION

This Privacy Policy governs both the processing of personal data that WWW.OVERLAYON.COM performs as data controller, and the data protection regime applicable to the services provided by WWW.OVERLAYON.COM when it acts as data processor of the data that users process in its services.

In both cases, whether WWW.OVERLAYON.COM acts as controller or processor, it strictly complies with the requirements of the applicable personal data protection regulations, and maintains absolute respect for users' data and privacy.

This Policy is permanently accessible through the link enabled on the website, called “Data Protection”, and may be updated at any time, either as a result of a regulatory change or because the configuration of the services or the type of business carried out changes.

Changes that imply modifications to the contracted service, or require the consent of the data subjects, will be communicated with at least thirty (30) days' notice so that data subjects can express their opposition to the processing of their data according to the described change, or so that customers can take the measures they deem appropriate in relation to the communicated modification.

If, after the provided period, the user accesses their services again or does not communicate their opposition, the new conditions will be deemed accepted.

1.Data Controller

WWW.OVERLAYON.COM processes data fairly and lawfully; it only processes data that it considers adequate, relevant, and not excessive in relation to the scope and the specific, explicit, and legitimate purposes for which it is obtained, and it does not use it for purposes incompatible with those for which the data was collected.

1.1.Accuracy

Users of the WWW.OVERLAYON.COM website (hereinafter, the users) are responsible for the accuracy and currency of the data they provide to WWW.OVERLAYON.COM, and the data provided by them is considered accurate and up to date. Users may exercise their rights of access, rectification, cancellation, and opposition over their personal data in the manner established by law, that is, by sending their request along with a copy of their ID through one of the following means:

By email to [email protected].

1.2.Information

WWW.OVERLAYON.COM, as data controller, informs that both the personal data provided by users when registering and those they provide to contract any of the services offered on WWW.OVERLAYON.COM or to resolve any incident communicated through any of the available contact means (telephone, chat, or email), are incorporated or may be incorporated into a file owned by it, duly registered in the Registry enabled by the Spanish Data Protection Agency, and will be processed in accordance with the terms set out in this Privacy Policy.

To access and/or browse the WWW.OVERLAYON.COM website, it is not necessary to provide any data. The mandatory nature of the response to the questions posed, or of the data requested through the website, is indicated by the inclusion of an asterisk (*) following the question or form field. If the required data is not provided, it will not be possible to provide the requested service or functionality.

WWW.OVERLAYON.COM does not process data from minors in any case, since registration as a user and contracting services through the WWW.OVERLAYON.COM website is only permitted for adults with full legal capacity to act.

1.3.Purposes

WWW.OVERLAYON.COM will only process the personal data provided by users in accordance with the purposes described in this Policy and in the General Conditions of Contracting of the services contracted by users, which are listed below by way of example:

  • Users and Resellers: data collected by any of the contact means or channels identified on the websites (including chats or phone calls) is used to manage the account and services contracted by users, both at a technical and at an accounting, tax, or administrative level, and/or to notify them of incidents, updates, or any information of interest about their services.
  • WWW.OVERLAYON.COM uses the contact data provided by users to send them, electronically or otherwise, information about the improvements it is implementing in the services they have contracted, and to keep them informed about the developments it considers may be of interest to them (offers and promotions). WWW.OVERLAYON.COM is absolutely opposed to spamming: the user is the one who decides and authorizes whether they want to receive this type of communication, either by registering as a user on WWW.OVERLAYON.COM and therefore accepting the General Conditions of WWW.OVERLAYON.COM and this Policy, or by requesting information of this type through any of the contact means provided on the website.
  • WWW.OVERLAYON.COM retains the traffic and location data generated in the context of providing the electronic communications services contracted by users, available to the competent authorities for the legally established period, in accordance with Law 25/2007, of 18 October, on the retention of data related to electronic communications and public communications networks. This data is not used for commercial promotion purposes.
  • Suggestions, Complaints or Comments: the data collected is used to handle the communications received and provide the corresponding response.
  • Contact: the data received through any of the means and/or channels of contact indicated on the website is used to contact and/or manage the request or incident communicated. Calls received may be recorded, for security reasons and to improve the quality of services.
  • The cookies used by WWW.OVERLAYON.COM are anonymous and do not provide references that allow personal data to be deduced from the user. The only non-anonymous cookies, that is, those that allow the identification of the user, are those that the user voluntarily activates when accessing the “Downloads” section of the website. These cookies store the username on the user’s terminal device, as well as a hash of the username and password, for fifteen days, with the sole purpose of facilitating access to restricted areas without the need to manually enter access keys each time. To learn about our policy on the installation and management of storage and retrieval devices on terminal equipment, consult our Cookie Policy.
  • Social networks: users who use the automated posting service on social networks must provide their access credentials (username/email address and password) to those networks, which will be used with the sole purpose of publishing on behalf of users the content they provide. Such content must comply with both applicable law and the terms of use of the social networks themselves.
  • Other web forms (Sponsorships, new TLDs, etc.): the information is used for the purpose described in the web form itself.

1.4.Consent

Users consent to the processing of their data under the terms indicated above by accepting this Privacy Policy when registering as a user of WWW.OVERLAYON.COM, or by sending information or using any of the contact means provided on the WWW.OVERLAYON.COM websites, or by contracting the specific service that requires such processing in accordance with the General Conditions of Contracting for the relevant service. Users must refrain from providing personal data of other data subjects unless they have the relevant authorization, according to which those data subjects have been previously and duly informed about the content of this Privacy Policy and, specifically, that they consent to their data being provided to WWW.OVERLAYON.COM to be processed for the corresponding purposes, as well as that they can exercise the rights of access, rectification, cancellation, and opposition (hereinafter collectively referred to as ARCO) under the terms described in this Policy. In any case, WWW.OVERLAYON.COM will cancel the registered data once it is no longer necessary or relevant for the purpose for which it was collected, and may keep it properly blocked for the time during which some type of liability may be required arising from a relationship or legal obligation or from the execution of a contract or the application of pre-contractual measures requested by the data subject.

1.5.Transfer

WWW.OVERLAYON.COM does not transfer data to third parties, unless a law or a Community regulation provides otherwise, or if it is necessary for the provision of the contracted service. In such case, it only communicates those data that are essential to manage users’ requests and provide the contracted services, so that the transfer responds to the free and legitimate acceptance of an existing legal relationship between the data subjects and WWW.OVERLAYON.COM, the development, fulfillment, and control of which necessarily imply the connection of the data and include the necessary transmission thereof. In the event that a user leaves a comment or interacts socially with the WWW.OVERLAYON.COM websites or on the social networks in which it is present, the user should be aware that their data will be published in the environment in which they act, that is, they will be expressly authorizing the communication of their data associated with the action they perform to the rest of the users who access the website or social network.

1.6.Revocability

The consent given, both for processing and for transfer of the data of the data subjects, may be revoked at any time by notifying WWW.OVERLAYON.COM under the terms established in this Policy for exercising ARCO rights. This revocation will in no case have retroactive effect.

1.7.Rights

Data subjects may exercise their ARCO rights, and revoke the consent given for the processing and/or transfer of their data, at any time by requesting it by postal mail addressed to the Legal Department of WWW.OVERLAYON.COM, at the following address: [email protected]. In all cases, the request must be accompanied by a copy of the official document that proves the identity of the data subject.

2.Data Processor

It is not considered a transfer of data, the access and/or processing of personal data that are the responsibility of the users of WWW.OVERLAYON.COM when such data are necessary for the adequate provision of the services they have contracted. In such cases, WWW.OVERLAYON.COM will have the status of data processor in accordance with the applicable data protection regulations. The data protection regime applicable to these processing operations is regulated both in this Policy and in the General Conditions of Contracting of the corresponding Service and in the Particular Conditions that make up the final order or request (collectively referred to as the Main Contract).

2.1.Legitimacy

The user who contracts the service (hereinafter, the Contracting person), or where appropriate the third entity that decides on the purpose, content, use, and processing of personal data, are the only parties responsible for the data they host on the services of WWW.OVERLAYON.COM. WWW.OVERLAYON.COM processes the information hosted on its services exclusively on behalf of the Contracting person under the terms and conditions stipulated in the Main Contract. The Contracting person, or the third entity to which they are providing a service while processing data for which that entity is responsible, declares that they are the owners of files containing personal data collected legally and that, by virtue of the services contracted from WWW.OVERLAYON.COM, authorizes its processing to the extent necessary for the provision of those services.

2.2.Obligations

In those cases where WWW.OVERLAYON.COM could have access to the data, it undertakes not to apply, use, or disclose the processed data for purposes other than those derived from the Main Contract. WWW.OVERLAYON.COM will only process the data contained in its services to execute the services contracted on behalf of the Contracting person in accordance with the instructions provided and, in no case, will it use them for purposes other than those agreed in the Main Contract. WWW.OVERLAYON.COM will not communicate or allow access to the processed data to any third party, not even for its preservation, unless: the Main Contract establishes otherwise, or the communication is necessary for the provision of the contracted services or the transfer is imposed by a rule with the force of law. In this sense, the Contracting person expressly authorizes WWW.OVERLAYON.COM, when contracting any of the services available on the WWW.OVERLAYON.COM websites, to subcontract in their name and on their behalf as many entities as necessary for the proper provision of the services detailed in the Main Contract. The entities thus subcontracted will have the status of data processor, will be subject to the same data protection and confidentiality rules as WWW.OVERLAYON.COM, and will regulate their relationship with WWW.OVERLAYON.COM in accordance with data protection regulations. The identity of these subcontracted entities is published on the WWW.OVERLAYON.COM websites.

2.3.Subcontracting

In the event that the Contracting person acts as a data processor for a third entity responsible for the data, they must guarantee, before contracting any service that involves the processing of that data, that they have the express authorization of that entity to proceed with the subcontracting of the services that had been entrusted to them and that coincide with the object of the Main Contract. They also ensure that the relationship with the third entity responsible for the data is legally regulated in accordance with the requirements of the applicable data protection regulations prior to contracting the service through WWW.OVERLAYON.COM. Otherwise, they must refrain from subcontracting with WWW.OVERLAYON.COM, and if they breach this prohibition they will be responsible and will assume any sanction imposed as a consequence of this lack of legitimacy.

2.4.Security

WWW.OVERLAYON.COM has adopted the technical and organizational measures necessary to guarantee the security of personal data and prevent its alteration, loss, processing, or unauthorized access, in accordance with the applicable personal data protection regulations. Specifically, the measures associated with the medium security level for files and/or automated processing, in accordance with Title VIII of Royal Decree 1720/2007 of 21 December, which approves the Development Regulation of Organic Law 15/1999 of 13 December on the Protection of Personal Data. WWW.OVERLAYON.COM only provides the technical infrastructure and, if contracted, its administration, limiting its responsibility to the security measures provided in relation to these functions. Therefore, its responsibility will be limited to those tasks which, by the very nature of the Main Contract, must be carried out by WWW.OVERLAYON.COM directly in the services (such as, for example, restricting access to the premises where the resources hosting the data are located). WWW.OVERLAYON.COM declines any responsibility for the breach of the security systems of the Contracting person or the inviolability of the information when it is transported through any communications network. WWW.OVERLAYON.COM will also not be responsible for security incidents that occur as a result of an attack or unauthorized access to systems in such a way that it is impossible to detect or prevent it even when the necessary measures have been adopted according to the current state of technology, or due to a lack of diligence by the user or Contracting person regarding the safeguarding and custody of their access keys and/or personal data. The Contracting person acknowledges that such measures comply with the level of security applicable to the type of information processed as a result of the provision of the service that WWW.OVERLAYON.COM performs on behalf of the Contracting person, in accordance with the applicable data protection regulations. It is exclusively up to the Contracting person to assess whether the conditions of the Main Contract are adequate for their needs and comply with the legal requirements to which they are bound as Data Controller/Processor. In the event that the processing to be carried out requires any additional measure to those indicated in the Main Contract, the Contracting person must inform WWW.OVERLAYON.COM so that it can offer the possibility of contracting additional technologies and services necessary to implement said security measure. The contracting of the additional measure will be carried out by formalizing a specific document that will be annexed to the Main Contract. If WWW.OVERLAYON.COM cannot provide the additional measure required by the Contracting person, it will inform them as soon as possible. If the provision of the contracted service required an additional measure that was not communicated to WWW.OVERLAYON.COM or not contracted after offering such an option to the Contracting person, WWW.OVERLAYON.COM will not be responsible for the lack of implementation of the security measures required by the applicable data protection regulations. Likewise, in the event that the classification of the level of the file processed by WWW.OVERLAYON.COM for the provision of the contracted service is incorrect, WWW.OVERLAYON.COM will not be responsible for the lack of adequacy of the security measures to the provisions of the regulations.

The Contracting person must notify the identification of the files or processing operations for which WWW.OVERLAYON.COM is the data processor, indicating the name of the file, its level or security measures, and the data of the Data Controller/Processor, as well as notify any changes in the previous data. In the event that the Contracting person fails to comply with this obligation, they will be responsible for the sanctions that may be imposed on WWW.OVERLAYON.COM for this reason.

2.5.Retention

WWW.OVERLAYON.COM will keep the personal data to which it has had access due to the service provided, as well as any medium or document in which they appear, for as long as the Main Contract is in force or as long as a law requires. Once it ends, it will destroy the data and any media or documents in which they are incorporated, taking into account the characteristics of the contracted services and the retention periods stipulated, if applicable, in the Main Contract. However, WWW.OVERLAYON.COM may retain the data and processed information, duly blocked, in the event that liabilities could arise from its relationship with the Contracting person. The destruction of the information will be carried out without the need to issue any formal communication or certificate stating that it has been done.

2.6.Confidentiality

WWW.OVERLAYON.COM undertakes to maintain professional secrecy regarding the data it accesses by virtue of the Main Contract, and the duty to keep them, obligations that will subsist even after its relationship with the Contracting person has ended. The rest of the obligations provided in relation to processing data on behalf of third parties will terminate when the data have been deleted or removed from the data storage equipment or in some way destroyed or made inaccessible.