Privacy

OOVERT is a brand identity studio operating in the United Kingdom and the United States. For the purposes of United Kingdom data protection law we are the data controller for the information described here, which means we decide what is collected and why, and we are the ones answerable for it.

You can reach us about anything on this page at support@oovert.com.

One form on this site collects anything at all. It is the brand diagnostic, and when you submit it we store:

• Your name, as you typed it.
• Your email address, so we can send the result.
• Your brand name, which the diagnostic scores.
• Your four answers: the industry you are in, your typical price band, who buys from you, and which brand this is for.
• The score we calculated from those answers, and the band it falls into.
• Whether you asked for a call, which is a single yes or no.
• The date and time you submitted it.

We do not ask for a phone number, a postal address, a company registration, or anything about your finances beyond the price band you pick from a list of five. There is no free-text box in which you could accidentally tell us something sensitive.

Server logs

Our hosting provider records ordinary web server information when a page is requested, including the IP address the request came from, the page asked for, and the time. This is how any web server on the internet works, it is needed to serve the site and to keep it available, and we do not combine it with the diagnostic answers or use it to build a profile of you.

Under United Kingdom data protection law we have to name a lawful basis for holding your information rather than simply asserting that we would like to. Ours are:

• Consent, for the diagnostic. You typed your details into a form and pressed send in order to get a result back. You can withdraw that consent at any time and we will delete the record.
• Legitimate interests, for following up about the work. You asked a brand studio to assess your brand, so an email from that studio about that assessment is the outcome you were reasonably expecting. If it is not, one reply saying so ends it.
• Legitimate interests, for server logs, in keeping the site running and defending it against abuse.

We do not use your information to make any automated decision that has a legal or similarly significant effect on you. The diagnostic score is a calculation from four answers, it is offered as an opinion to think about, and it decides nothing on its own.

Policies tend to be vague here, so this list is deliberately specific. None of the following happens on this site:

• We do not sell your personal information. We never have.
• We do not share it with advertising networks or data brokers, and we do not share it for cross-context behavioural advertising.
• We do not set analytics cookies or identify you without consent. Google Analytics 4 loads on every page but stays in cookieless consent mode until you allow it; allow it and it measures your visit, anonymised, with Google advertising signals off.
• The typefaces and video are served from our own domain. Your browser does contact Google on every page to load Google Analytics; before you consent it sends only anonymous, cookieless measurement, and it sets cookies only once you allow it.
• We do not add you to a mailing list you did not ask for, and we send no newsletter.

Your information is handled by us. A small number of suppliers process it on our behalf because running a business requires them, and each is bound to use it only for the task we give them:

• Our hosting provider, which serves the site and stores the submissions.
• Our email provider, which carries the message when we reply to you.

Because we operate in both the United Kingdom and the United States, your information may be stored or accessed in either country. Where it leaves the United Kingdom we rely on the safeguards the law provides for such transfers, including the International Data Transfer Agreement or the United Kingdom addendum to the European Commission standard contractual clauses.

We would also disclose information if a court or a regulator lawfully required it. That has not happened.

Diagnostic submissions are kept for 24 months from the day you send them, and then deleted. Two years is roughly how long a founder takes to come back to a rebrand they were weighing up, and past that the record is of no use to you or to us.

If you become a client, the records connected to your project are kept for as long as the engagement runs and for six years afterwards, which is the period we are expected to be able to produce accounting and contract records for.

Server logs are held for a short operational period by our hosting provider and then rotate away.

You do not have to wait for any of these periods. Ask us to delete something and we will.

The site is served over an encrypted connection, so what you type into the diagnostic is encrypted in transit. Submissions are stored on our hosting provider infrastructure, and access is limited to the people at OOVERT who need it in order to reply to you.

We are a small studio and we are not going to claim a security programme we do not run. What we can tell you honestly is that we collect very little, we keep it in one place, and we do not copy it into third party marketing tools, which removes most of the ways this kind of information usually escapes.

If you are in the United Kingdom or the European Economic Area, you have the right to:

• Ask what we hold about you, and get a copy of it.
• Have anything inaccurate corrected.
• Have it deleted.
• Ask us to restrict what we do with it while a question is settled.
• Object to us using it, including for our own legitimate interests.
• Receive it in a portable format, or have it sent to someone else.
• Withdraw consent at any time, without affecting what came before.

Email support@oovert.com and say which one you want. We will answer within one month, and we will not charge you or make you explain yourself.

If we handle it badly, you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can put it right, but that is your right and not conditional on asking us.

If you are a California resident, the California Consumer Privacy Act as amended gives you the right to know what personal information we have collected and why, to get a copy of it, to have it corrected, and to have it deleted. Several other states now give residents comparable rights, and we apply this section to them too rather than sorting requests by postcode.

Two of the standard disclosures are short in our case. We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in that Act. There is therefore no opt out for you to exercise, because there is nothing to opt out of.

We will not discriminate against you for exercising any of these rights. Make a request the same way, by emailing support@oovert.com.

This site sells brand identity work to businesses and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has sent us something, tell us and we will delete it.

When this policy changes we will update the date at the top of the page. If a change materially affects what we do with information we already hold, we will contact the people it affects directly rather than relying on you to notice a new date on a page you have no reason to revisit.