Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Further details are given in the imprint. We have not appointed a data protection officer, as we are not legally required to do so.

This policy explains which personal data we process when you visit this website and when you request access to Overlink, for what purposes, on which legal basis, and which rights you have. Personal data is any information relating to an identified or identifiable person.

The website does not use cookies, analytics, tracking pixels, advertising networks, social media plugins or fonts and videos from other companies. Everything shown on the website is served from our own server.

1. When you open the website, your browser automatically sends information to our server: the IP address of your device, the date and time of the request, the page or file requested, the amount of data transferred, the referring page, and the browser type and operating system.
2. We process this information to deliver the website, to keep it stable and secure and to prevent abuse. To protect the sign-up form against automated mass requests, our server keeps your IP address for a few minutes to count requests. It is not stored with your application and is deleted afterwards.
3. Our hosting provider processes this connection data to deliver the website and to protect it against attacks. We do not keep our own access logs.
4. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in delivering a secure and working website.

1. The website stores one entry in your browser's session storage noting that you have already seen the intro animation, so that it does not play again while you browse. The entry contains no personal information, is never sent to us and is deleted automatically when you close the browser tab.
2. This storage is strictly necessary to provide the website you have asked for in the way you expect (§ 25 (2) no. 2 German Telecommunications Digital Services Data Protection Act, TDDDG). Consent is therefore not required. No other information is stored on or read from your device.
3. If you start a license application, your answers are kept in your browser's local storage until you send the application, so you can continue later. This is strictly necessary for the service you asked for. You can delete it at any time in your browser settings.

1. When you apply for a license, we process:
   • your name, email address, country and, if you give it, your phone number;
   • the license and billing you choose and, for organisations, whether you apply for the Beta;
   • for organisations also: your job title and the organisation's legal name, legal form, register number and register court, VAT ID, registered address, website and number of employees;
   • your answers about how you will use Overlink: number of computers, AI services and purpose;
   • your confirmations, your typed name as signature, and the date and time of your application.
2. While you fill in the form, your answers are kept only in your own browser (local storage) so you can continue later. They are deleted from it when you send the application. After that, your browser keeps only the reference number, your email address and the date, so the page can show you that you already applied; you can remove this at any time by clearing the site data in your browser. Nothing is sent to us before you press Submit application.
3. We use this data to review your application, to check organisations in public registers (such as the commercial register or the EU VAT check), to contact you about the application (by email: a confirmation that we received it and our decision) and, if you are accepted, to issue your license and prepare the contract.
4. The legal basis is Art. 6 (1) (b) GDPR (steps prior to entering into a contract at your request). Checking organisations is also based on our legitimate interest in giving licenses and Beta access only to real, verified organisations, Art. 6 (1) (f) GDPR.
5. If your application is not accepted, we delete your data six months after our decision, unless you agree to longer storage or the law requires us to keep it. If you are accepted, the data becomes part of your contract and is kept as long as the contract and statutory retention periods require.
6. Providing the data is voluntary, but without it we cannot review your application.

1. We only send emails about your invitation and the launch of Overlink.
2. Every email contains a link or instructions to unsubscribe.

If you email us, we process your email address, your name if given and the content of your message to answer your request. The legal basis is Art. 6 (1) (b) GDPR where your request relates to a contract, and otherwise Art. 6 (1) (f) GDPR, our interest in answering enquiries. We delete the data once your request has been dealt with, unless statutory retention obligations apply.

1. We do not sell personal data and do not pass it to third parties for their own purposes.
2. We use the following service providers, who process data only on our instructions under a data processing agreement pursuant to Art. 28 GDPR:
   • Hosting: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Data may be transferred to the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework and the transfer is also covered by the EU standard contractual clauses in Cloudflare's data processing agreement.
3. We may disclose data to authorities where we are legally obliged to do so.

Where a service provider processes data in a country outside the European Economic Area, such as the USA, the transfer is based on an adequacy decision of the European Commission, in particular the EU-U.S. Data Privacy Framework where the provider is certified under it, or otherwise on the EU standard contractual clauses (Art. 46 (2) (c) GDPR). You can request a copy of these safeguards from us.

We store waitlist data until you withdraw your consent or ask us to delete it, and at the latest until six months after the public launch of Overlink. After that, we delete it, unless you have become a user, in which case the privacy information for the app applies. Data we must keep for legal reasons is restricted and deleted when the retention period ends.

Under the GDPR you have the right:

• to obtain access to the personal data we hold about you (Art. 15);
• to have inaccurate data corrected (Art. 16);
• to have your data deleted (Art. 17);
• to have the processing restricted (Art. 18);
• to receive your data in a structured, commonly used and machine-readable format and to have it transmitted to another controller (Art. 20);
• to withdraw consent at any time with effect for the future (Art. 7 (3)).

To exercise your rights, email overlinkapp@gmail.com, ideally from the address you signed up with, so we can find your entry.

Where we process your data on the basis of Art. 6 (1) (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live, work or where the alleged infringement took place (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

The website is only delivered over an encrypted connection (HTTPS). Applications are stored in a database that is not publicly accessible. We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access.

To protect the website against attacks, we block an IP address for 24 hours when a request from it clearly looks like an attack, for example a request for a well-known break-in page, program code entered into a form, a flood of requests or repeated wrong owner keys. For this we store the IP address, the time, the reason and the requested address for 24 hours and then delete them automatically. The legal basis is our legitimate interest in keeping the website and your data secure (Art. 6(1)(f) GDPR). If you were blocked by mistake, write to us.

The website links to our profile on X. Data is only transferred to X when you click the link. From then on, the privacy policy of X Corp. applies.

This policy covers the website. The Overlink app has its own privacy information, which you receive with your invitation before you install it.

We update this policy when the website or the law changes. The version published here applies. If changes affect consent you have given, we will ask you again.