Who is responsible
Overspill Technologies operates this website and decides why and how website personal information is used. Use the contact form for privacy questions or rights requests.
Information we collect
- Business enquiries: name, email address, organisation, topic, message, status, and submission timestamps.
- Newsletter requests: email address, subscription status, and relevant timestamps.
- Browser preferences: theme choice, a versioned optional-analytics setting, the time of that setting, and promotional display counts. These records are stored in the browser and are not linked to a named contact record by the public site.
- Article readership: only when optional Analytics is enabled, article identifier, unique or repeat view status, aggregate view totals, confirmed share-action totals, and timestamps. The server derives a keyed one-way reader identifier from the article ID and connection IP address. The raw IP address is not written to the Blog analytics tables.
- Security and delivery: IP address, browser and request metadata, human-verification results, hosting and function logs, error details, and one-way hashed rate-limit keys. Rate-limit hashes do not store the raw email or raw IP address.
- Third-party media: when an embedded provider loads, it may receive technical information such as IP address, browser details, device information, and the page being viewed.
- Advertising: advertising may load by default. Advertising vendors may collect or receive browser, device, interaction, cookie, beacon, IP-address, page-context, and other identifier information under their own policies and applicable controls.
Purposes and lawful bases
- Responding to enquiries: to review, answer, and take steps requested before a possible business relationship. The basis may be steps taken at your request and legitimate interests in managing genuine business communications.
- Newsletter: to send requested company updates and keep a record of the subscription choice. This relies on consent, which can be withdrawn.
- Preferences: to remember the presentation and optional-analytics settings you request and show the compact privacy bar when no valid setting exists.
- Article measurement: to understand lifetime unique and repeat readership, maintain aggregate Blog statistics, reduce automated-count noise, and measure confirmed share actions. The browser sends these requests only after Analytics is enabled.
- Security and reliability: to prevent abuse, investigate incidents, enforce access controls, diagnose errors, maintain availability, and protect users and systems. This relies on legitimate interests and may also support legal obligations or legal claims.
- Advertising, personalisation, and measurement: Google and other configured vendors may use information to serve, select, personalise where permitted, limit, and measure advertising, prevent fraud, and report performance. Consent, legitimate interests, or another lawful basis is used only where permitted and required for the relevant activity and location.
- Promotional frequency: to limit how often a configured Overspill promotional message is displayed.
- Legal and records: to comply with applicable law and establish, exercise, or defend legal claims.
Advertising technologies and disclosures
Advertising is enabled by default and may load automatically. Overspill's Cookie settings control optional Blog analytics only and cannot be used to disable advertising.
When advertising runs, third parties may place and read cookies in users' browsers. Third parties may use web beacons, IP addresses, or other identifiers because of ad serving, including browser or device information and page context. Google and other vendors may use collected information for contextual or personalised ad selection where permitted, frequency control, fraud prevention, measurement, and reporting.
The compact Overspill privacy bar is not a Google-certified IAB Transparency and Consent Framework platform. Before personalised ads are served to users in the EEA, UK, or Switzerland, Overspill must additionally configure Google's consent-management platform or another Google-certified platform where required. That regional platform may present choices required by applicable law or Google policy.
Additional controls may include browser cookie controls, privacy extensions, device advertising settings, Google Ad Settings, and participating-industry opt-out tools. Disabling personalised advertising does not necessarily remove contextual or non-personalised advertising.
Required and optional information
Fields marked as required are needed to process the relevant request. You do not have to submit an enquiry, subscribe, or enable optional Blog analytics. If required information or human verification is not provided, the form cannot be accepted. Do not submit secrets, credentials, payment-card information, health information, or other highly sensitive material through public forms.
Service providers and recipients
Information may be processed by service providers that support hosting, delivery, databases, storage, human verification, operational logging, media embeds, and advertising. Information may also be disclosed to professional advisers, authorities, courts, or counterparties where reasonably necessary and lawful.
International processing
Some providers operate infrastructure in more than one country. Where applicable law requires safeguards for an international transfer, Overspill and its providers should use an approved transfer mechanism or another lawful safeguard. Provider locations and safeguards can change, so current provider documentation should be checked for a specific request.
Retention
- Enquiries are retained only while reasonably needed to respond, manage the relationship, maintain appropriate records, or resolve a dispute. They should normally be reviewed for deletion within 24 months after the last meaningful interaction.
- Newsletter details are retained until unsubscribe or withdrawal, plus any minimal suppression record reasonably needed to honour that choice.
- The browser privacy-setting record remains until it is removed, replaced by a later choice, cleared through browser controls, or invalidated by a settings-version change.
- Blog readership is lifetime per article unless the Blog post or its analytics is deleted or the keyed hashing secret is deliberately rotated. Aggregate counters and the pseudonymous per-article reader state contain no raw IP column. Disabling Analytics stops new requests from that browser but does not retrospectively rewrite aggregate totals already produced.
- Rate-limit hashes are automatically removed after they become older than approximately two days when the limiter next runs.
- Hosting, function, advertising, and security logs are retained according to provider configuration and operational need and should not be kept longer than reasonably necessary.
Your rights and choices
Depending on the law that applies and the processing involved, you may have rights to be informed, access a copy, correct inaccurate information, erase information, restrict processing, receive portable information, object, and withdraw consent. Some rights have conditions or exemptions. We may need to verify identity and clarify the request before acting.
Use Cookie settings in the footer to allow or disable optional Blog analytics. That site control does not disable advertising. Advertising-related choices may instead be available through browser or vendor controls and, where required, a Google-certified regional consent platform. You may withdraw newsletter consent through the contact route and may complain to the data-protection regulator that applies where you live or where the relevant processing occurs.
Automated decisions
The website uses automated security checks, request classifiers, rate limits, and advertising-delivery systems, but Overspill does not use website personal information to make solely automated decisions that produce legal or similarly significant effects about a person.
Children
This corporate website is not directed to children and is not designed to knowingly collect children's personal information. Do not submit a child's information through the forms.
Security and limits
Controls include server-side validation, access restrictions, database security rules, managed secrets, keyed hashing, rate limiting, human verification, content sanitisation, optional-analytics controls, and managed third-party loading. No internet service can guarantee absolute security. Report a suspected security or privacy issue promptly and avoid including sensitive material in the initial report.
Changes
We will update the displayed date when this notice materially changes. If a new use of personal information is incompatible with the information previously provided, updated privacy information should be presented before that new processing begins.