Privacy Policy | Overmap

1. Who we are

Overmap is operated by:

Company: [OVERMAP LEGAL ENTITY]
Registered office: [ADDRESS]
Registration number: [SIREN / RCS]
Privacy contact: privacy@overmap.fr

Depending on the processing activity, Overmap may act either as a data controller or as a data processor acting on behalf of an organization using the Service.

2. Data processed by Overmap

The categories of personal data processed by Overmap depend on how the Service is used.

Account data

This may include:

name;
username;
email address;
profile picture;
account identifier;
organization membership;
roles and permissions;
authentication information.

Organization and event data

This may include:

organization information;
event information;
event staff and member information;
zones and floor plans;
exhibitor information;
contacts imported by an organization;
event configuration and settings.

Location data

Where an event uses Overmap's location features, the Service may process device or user location data.

This may include:

geographic coordinates;
date and time of a recorded position;
accuracy;
altitude;
speed;
heading;
device identifiers;
tracking session identifiers;
event and zone associations.

The availability and precision of this information depends on the device, operating system permissions and configuration of the relevant event.

Communications data

When organizations use Overmap's communication features, the Service may process:

email addresses;
names;
communication preferences;
subscription and unsubscribe status;
message delivery information;
campaign membership;
communication history.

Technical data

We may process technical information such as:

IP address;
browser and device information;
operating system;
timestamps;
application logs;
security events;
request metadata.

Billing data

Where paid services are used, we may process information related to subscriptions, billing status, invoices and transactions.

Payment card information may be processed directly by our payment provider rather than stored by Overmap.

3. Why we process personal data

We process personal data for purposes including:

creating and managing user accounts;
authenticating users;
managing organizations and permissions;
providing event management features;
enabling event location and mapping functionality where applicable;
providing communication tools;
providing customer support;
processing subscriptions and payments;
maintaining and improving the Service;
monitoring reliability and performance;
preventing fraud and abuse;
protecting the security of Overmap and its users;
complying with legal obligations.

4. Legal bases

Depending on the circumstances, personal data may be processed on one or more of the following legal bases:

Performance of a contract

Processing may be necessary to create your account, provide the Service and perform our contractual obligations.

Legitimate interests

We may process certain data where necessary for legitimate interests such as securing the Service, preventing abuse, improving reliability and administering our relationship with customers.

Consent

Consent may be relied upon where required by law, particularly for specific optional processing activities.

Legal obligations

Certain information may be processed or retained where necessary to comply with legal, accounting, tax or regulatory obligations.

5. Location data

Overmap may provide features allowing an event organizer to collect and use the location of participants or devices during an event.

Location information is only processed where the relevant location functionality is enabled and the device permits access to location data.

Depending on the event and the requested service, location data may be used to:

display the location of a participant or device;
determine whether a participant entered a defined zone;
provide event navigation or location-based functionality;
display activity within an event;
provide event statistics or analytics;
allow an organizer to provide features requested by participants.

Location data is not sold by Overmap.

Overmap does not permit organizations to use the Service for unlawful surveillance of individuals.

Additional information may be displayed before location tracking is activated for a particular event.

6. Role of event organizers

Organizations using Overmap determine many aspects of how data relating to their events is collected and used.

For these processing activities, the relevant organization may act as the data controller and Overmap may act as a data processor on its behalf.

This may apply, for example, where an organization imports contact lists, sends communications, manages event participants or uses location information through Overmap.

In such cases, requests concerning the organization's use of your personal data should normally be addressed to that organization. Overmap will assist organizations in responding to valid requests where required.

7. How long we keep personal data

Personal data is retained only for as long as necessary for the purpose for which it was collected, subject to applicable legal obligations.

Retention periods may depend on the type of data, the applicable subscription plan and the configuration of an organization or event.

In particular:

account information may be retained for the duration of the account and for a limited period following its closure;
organization and event information may be retained while the relevant customer account remains active;
location history is subject to a dedicated retention period determined according to the purpose of the relevant event and applicable configuration;
technical and security logs are retained for a limited period appropriate to security, debugging and fraud-prevention needs;
billing and accounting records may be retained for the duration required by applicable law;
data may be retained for longer where required for the establishment, exercise or defense of legal claims.

Where possible, data that no longer needs to identify an individual may be deleted or irreversibly anonymized.

8. Who can access personal data

Personal data may be accessible to authorized persons within Overmap where necessary to operate, secure and support the Service.

Depending on the Service being used, information may also be accessible to:

authorized members of the organization managing the relevant event;
service providers involved in hosting, storage, infrastructure, email delivery, maps, authentication, analytics or payment processing;
professional advisers where necessary;
public authorities where disclosure is required by applicable law.

Service providers are given access only to information reasonably necessary to provide their services and are subject to appropriate contractual obligations where required.

9. International transfers

We seek to use service providers and infrastructure located within the European Economic Area where reasonably possible.

If personal data is transferred outside the European Economic Area, we implement appropriate safeguards where required by applicable data protection law.

These safeguards may include an adequacy decision adopted by the European Commission or appropriate contractual safeguards such as Standard Contractual Clauses.

10. Data security

We implement technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or unauthorized access.

These measures may include:

access controls and permission management;
encrypted network communications;
authentication mechanisms;
infrastructure and application monitoring;
rate limiting and abuse prevention;
security logging;
backup and recovery procedures;
restricted administrative access.

No information system can guarantee absolute security. We continuously review our security measures as the Service evolves.

11. Cookies and local storage

Overmap may use cookies or similar storage mechanisms that are technically necessary to provide functionality such as authentication, security, session management and user preferences.

Where non-essential cookies or similar technologies are used, they will be subject to the consent requirements applicable to them.

12. Your rights

Subject to applicable data protection law, you may have the right to:

access your personal data;
correct inaccurate personal data;
request deletion of your personal data;
restrict certain processing;
object to certain processing;
receive certain data in a portable format;
withdraw your consent where processing is based on consent;
lodge a complaint with a competent data protection authority.

In France, the competent supervisory authority is the Commission Nationale de l'Informatique et des Libertés (CNIL).

You may exercise your rights by contacting:

privacy@overmap.fr

We may need to verify your identity before responding to certain requests.

13. Automated decision-making

Overmap does not currently use personal data to make decisions producing legal effects or similarly significant effects on individuals solely through automated processing.

If this changes, this Privacy Policy will be updated and affected persons will receive the information required by applicable law.

14. Children's data

The Overmap administration platform is intended for professional users and is not intended for use by children.

Events using Overmap may have participants who are minors. Where this occurs, the event organizer is responsible for ensuring that any processing involving those participants complies with applicable requirements.

15. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to the Service, our processing activities or applicable law.

The date displayed at the top of this page indicates when the policy was last updated.

Where appropriate, we will provide additional notice of material changes.

16. Contact

For questions concerning privacy or the processing of personal data, contact:

privacy@overmap.fr