GDPR Privacy Notice

                                                                                           OVERMIFT OPERATING COMPANY, LLC.
                                                            GENERAL DATA PROTECTION REGULATION (GDPR) PRIVACY NOTICE

Effective Date: 04 May 2025


Article 1 – Data Controller

This GDPR Privacy Notice is issued by Overmift Operating Company, LLC. ("Overmift", "we", "our"), registered in the State of Delaware, USA, acting as the Data Controller for personal data processed from the European Economic Area ("EEA").

EU Representative (Art. 27 GDPR):

Address: Friedrichstraße 171, 10117 Berlin, Germany
Email: legal@overmift.net


Article 2 – Purpose of Processing

We process personal data to:

• Provide and administer web‑hosting, domain, server and software services;

• Authenticate users and secure our infrastructure;

• Execute payments, invoicing and accounting obligations;

• Deliver technical support and customer care;

• Comply with legal obligations and defend legal claims.

Article 3 – Lawful Bases (Art. 6 GDPR)

Processing operations rely on one or more of the following legal grounds:

1. Contract Performance (Art. 6 §1 b) – to conclude and execute service agreements;

2. Legal Obligation (Art. 6 §1 c) – to meet bookkeeping, tax, AML/KYC and other statutory duties;

3. Legitimate Interests (Art. 6 §1 f) – to ensure network security, prevent fraud and improve services;

4. Consent (Art. 6 §1 a) – for optional features such as marketing e‑mails or non‑essential cookies.

Article 4 – Categories of Personal Data

• Identification Data: name, surname, ID/passport copy;

• Contact Data: postal address, telephone, e‑mail;

• Payment Data: IBAN, card tokens, billing details;

• Technical Data: IP address, device/browser fingerprints, access logs;

• Service Data: domain names, server identifiers, licence keys.

Madde 5 – International Transfers (Art. 44 ff.)

Data may be transferred to Overmift’s US servers and subcontractors in third countries. All such transfers are safeguarded by:

• Standard Contractual Clauses (2021/914/EU); or

• An adequacy decision by the European Commission.

Article 6 – Data Retention

Personal data are stored for the duration of the contractual relationship plus 10 years for legal archiving, unless a longer period is mandated or a shorter period is exercised via erasure rights.

Article 7 – Data Subject Rights

Under GDPR Articles 12‑22, you may:

• Request access to your personal data;

• Obtain rectification or erasure (“right to be forgotten”);

• Restrict or object to processing;

• Receive data in portable format;

• Withdraw consent at any time without affecting prior processing;

• Lodge a complaint with a Supervisory Authority (see Art. 9 below).

Requests can be submitted to legal@overmift.net or the EU Representative. We answer within 30 days.

Article 8 – Automated Decision‑Making

Overmift does not employ automated decision‑making or profiling with legal or similarly significant effects on individuals.


Article 9 – Supervisory Authority

Overmift does not employ automated decision‑making or profiling with legal or similarly significant effects on individuals.

You may complain to the authority of your habitual residence. Our lead authority is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt‑Moabit 59‑61, 10555 Berlin, Germany
www.datenschutz‑berlin.de


Article 10 – Cookies & Tracking

Essential cookies are set for session management. Non‑essential analytics cookies are deployed only with prior consent (Art. 6 §1 a). Full details are provided in our Cookie Policy.


Article 11 – Data Security

We implement ISO 27001‑aligned technical and organisational measures including 256‑bit TLS encryption, strict access controls, regular penetration testing and continuous monitoring.


Article 12 – Updates to this Notice

Overmift may revise this GDPR Privacy Notice at any time. The latest version is always available at https://www.overmift.net/en/gdpr-privacy-notice.html and is effective upon publication.

If you have questions about this Notice, please contact our Data Protection Officer.