Legal

Privacy Policy

What we collect

Information you give us. When you complete an enquiry form on this site, we collect what you enter into it: your name, your email address, and whatever you write in the message field. If you add anything else, such as a phone number, a company name or detail about your business, we collect that too.

Information collected automatically. This site uses Google Analytics 4, deployed through Google Tag Manager, to understand how people find and use it. It only runs if you accept analytics cookies. When it does run, it collects your IP address, device and browser information, the pages you look at, and how you arrived, including any campaign tags on the link you followed.

The site also uses Framer's built-in analytics, which counts visits and page views without cookies. It creates no persistent identifier: visits are counted by hashing your IP address and browser user agent against a secret that is regenerated and deleted every day, so the numbers work but cannot be traced back to an individual.

We do not collect special category data and we do not ask for it. Please don't include sensitive personal information in an enquiry form.

Why we use it, and our lawful basis

We use enquiry form data to read and answer your enquiry, to discuss a possible project, and to keep a record of the conversation. Our lawful basis is legitimate interests. You have contacted us and expect a reply, and answering enquiries is necessary to run the business. You can object to this at any time.

If you become a client, we use your data to carry out the work, to invoice, and to keep the records we are legally required to keep. The lawful basis is performance of a contract, and legal obligation for accounting and tax records.

For analytics, our lawful basis is your consent. Nothing non-essential is set until you accept it in the cookie banner, and you can withdraw consent at any time by reopening the banner or clearing cookies in your browser.

We do not use your data for automated decision-making or profiling. We do not sell it, and we do not share it for anyone else's marketing.

Who we share it with

We use a small number of providers who process personal data on our behalf, under our instructions:

Framer B.V. hosts this website and handles enquiry form submissions.

Notion Labs, Inc. is where we keep project and contact records.

Google Ireland Limited provides our email and file storage through Google Workspace, so your enquiry and any project documents such as proposals and contracts are held in Gmail and Google Drive. Google also provides Google Analytics and Google Tag Manager, described under Cookies below.

Specialists and contractors. Some projects need a skill OVERTONE doesn't cover. Where that happens we bring in an independent specialist, who may see material relating to your project, including your contact details and anything you have told us about your business. We share only what they need to do the work, and they are bound by confidentiality terms before they start.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

Where your data is stored

Framer B.V. is based in the Netherlands, which is covered by UK adequacy regulations, so no additional safeguard is required for that transfer.

Notion Labs, Inc. is based in the United States. Transfers to Notion are made under the UK International Data Transfer Addendum, or under the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it.

Google Ireland Limited is based in Ireland, which is covered by UK adequacy regulations. Where Google transfers data onward to Google LLC in the United States, those transfers are made under the UK Extension to the EU–US Data Privacy Framework and Google's standard contractual clauses.

You can ask us for details of the safeguards applying to any particular transfer.

How long we keep it

Enquiries that do not lead to work are deleted after 12 months.

Client records are kept for the length of the project and for two years afterwards, so we can answer questions about work we have done.

Records we are required to keep for tax and accounting purposes are held for six years from the end of the financial year they relate to, as HMRC requires.

Analytics cookies last up to two years from your most recent visit. Browsers cap this in practice: Chrome allows a maximum of 400 days and Safari seven days if you don't come back in between. The event data behind the reports is deleted by Google at the end of the retention period set on our Analytics property.

Your rights

Under UK data protection law you can ask us for a copy of the personal data we hold about you, ask us to correct it if it is wrong, ask us to delete it, ask us to restrict how we use it, object to us using it where our basis is legitimate interests, and ask us to transfer it to another provider where that right applies.

To make a request, email the address above. We will respond within one month. There is no charge.

Complaints

If you are unhappy with how we have handled your personal data, tell us first and we will try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator. You can reach them at ico.org.uk, on 0303 123 1113, or at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.