Privacy policy
THE OVERLAY KING PRIVACY PRACTICES ADDENDUM
Effective Date: July 1, 2020
This Privacy Practices Addendum supplements The Overlay King’s published Privacy Policy.
The published Privacy Policy describes the primary privacy practices associated with this Shopify-hosted store. This Addendum explains additional practices specific to The Overlay King’s digital products, custom projects, Setup Lab services, marketing communications, project files, customer-support requests, and business operations.
The Privacy Policy and this Addendum should be read together.
Nothing in this Addendum limits privacy rights or protections that cannot legally be waived.
1. SCOPE
This Addendum applies to personal information collected or processed through:
• The Overlay King website and online store.
• Purchases of digital products.
• Custom-service inquiries and projects.
• Setup Lab appointments and services.
• Customer-support communications.
• Newsletter and marketing subscriptions.
• Contact forms and project-intake forms.
• Connected applications and service providers used to operate the business.
This Addendum does not control information that Shopify, Shop, Shop Pay, payment processors, social-media platforms, or other independent services collect and process for their own purposes under their own privacy terms.
2. INFORMATION THE OVERLAY KING MAY COLLECT
Depending on how an individual uses the website or services, The Overlay King may collect the following categories of information.
Contact and identity information may include:
• Name.
• Email address.
• Telephone number.
• Customer-account information.
• Business or creator name.
• Social-media or channel name.
Order and transaction information may include:
• Products or services purchased.
• Order number.
• Purchase date.
• Payment status.
• Billing details provided through checkout.
• Delivery status.
• Refund or dispute information.
• Transaction history.
Complete payment-card numbers and card-security codes are intended to be processed through Shopify and authorized payment providers rather than stored directly by The Overlay King.
Custom-project and service information may include:
• Brand references.
• Logos, graphics, photographs, and project files.
• Visual preferences.
• Brand colors and typography.
• Channel, portfolio, cloud-storage, or social-media links.
• Approved project scopes.
• Proofs and approval records.
• Revision requests and feedback.
• Delivery records.
• Appointment information.
• Software and platform information.
• Technical requirements.
• Communications relating to a project or service.
Technical and storefront information may include:
• Internet Protocol address.
• Browser type.
• Device type.
• Operating system.
• Referring page.
• Website activity.
• Store interactions.
• Cookie identifiers.
• Pixel and analytics information.
• Approximate location inferred from technical information.
Marketing information may include:
• Subscription status.
• Consent records.
• Communication preferences.
• Email engagement.
• Unsubscribe activity.
• Marketing interactions.
Support information may include:
• Questions and requests.
• Product and order information.
• Screenshots.
• Error messages.
• Software details.
• Troubleshooting information.
• Customer-service history.
• Communications relating to a reported issue.
3. HOW INFORMATION MAY BE USED
The Overlay King may use personal information to:
• Operate the website and online store.
• Process orders and transactions.
• Deliver digital products and related instructions.
• Review custom-service inquiries.
• Prepare project scopes and quotes.
• Design and complete approved custom projects.
• Schedule and provide Setup Lab services.
• Respond to product, order, project, and technical-support requests.
• Verify customer identity where reasonably necessary.
• Send order, delivery, appointment, project, security, and support communications.
• Maintain customer and project records.
• Prevent fraud, misuse, and unauthorized transactions.
• Secure and improve the website and business systems.
• Analyze store performance and customer interactions.
• Maintain accounting, tax, contract, and business records.
• Resolve disputes and enforce agreements.
• Comply with applicable legal obligations.
• Send marketing communications when valid consent has been provided.
The Overlay King intends to collect and use only information reasonably necessary for the applicable transaction, service, support request, security purpose, business record, marketing consent, or legal obligation.
4. SHOPIFY AND OTHER SERVICE PROVIDERS
The Overlay King’s online store is hosted by Shopify.
Shopify processes customer and visitor information to provide hosting, checkout, payment, fraud-prevention, storefront, analytics, personalization, and other services associated with the Shopify platform.
The Overlay King may also provide necessary information to categories of service providers such as:
• Payment processors.
• Fraud-prevention providers.
• Digital-download and file-delivery services.
• Email and transactional-message providers.
• Newsletter and marketing platforms.
• Scheduling services.
• Video-meeting and communication platforms.
• Cloud-storage providers.
• Project-management platforms.
• Analytics and advertising providers.
• Cookie and consent-management services.
• Website and technical-support providers.
• Accountants, attorneys, insurers, and professional advisors.
• Government agencies or legal authorities when lawfully required.
Service providers should receive only the information reasonably necessary to perform their assigned functions.
Service providers control their own infrastructure, systems, security practices, processing locations, and retention procedures.
5. COOKIES, ANALYTICS, AND SIMILAR TECHNOLOGIES
The website may use cookies, pixels, local storage, analytics tools, and similar technologies to:
• Operate required storefront functions.
• Maintain security.
• Support checkout.
• Remember customer preferences.
• Measure website activity.
• Analyze store performance.
• Improve products and services.
• Support marketing and advertising.
• Provide personalized experiences where permitted.
Necessary technologies may be used to provide core website, security, account, cart, checkout, and transaction functions.
Non-essential technologies are managed according to the available consent controls and regional settings.
Customers may use the available cookie controls to accept, reject, or manage non-essential data collection where those controls are provided.
6. DATA SHARING, TARGETED ADVERTISING, AND OPT-OUT RIGHTS
The Overlay King does not directly sell personal information in exchange for money.
However, certain uses of Shopify services, analytics tools, advertising services, pixels, cookies, or connected applications may be considered “selling,” “sharing,” targeted advertising, or another regulated use under some privacy laws.
Customers may use the store’s available data-sharing opt-out page to exercise applicable rights concerning qualifying data sale, sharing, or targeted advertising.
Where supported and legally applicable, qualifying Global Privacy Control signals may also be recognized.
Opting out of qualifying advertising or data-sharing uses does not prevent information from being processed for necessary transactions, security, fraud prevention, legal compliance, or other permitted purposes.
7. EMAIL AND SMS MARKETING
The Overlay King sends promotional emails only to individuals who have affirmatively subscribed or otherwise provided valid marketing consent.
The following actions do not automatically enroll an individual in promotional marketing:
• Completing a purchase.
• Submitting a support request.
• Requesting a quote.
• Submitting a custom-project inquiry.
• Booking a Setup Lab appointment.
• Providing a telephone number for order or service purposes.
Double opt-in may be used to confirm email-marketing subscriptions.
Marketing checkboxes should not be preselected by default.
Phone numbers provided through an order, appointment, or contact form are not used for promotional SMS marketing unless the individual provides separate express consent.
Marketing recipients may unsubscribe using the link included in a marketing email or another available opt-out method.
Withdrawing marketing consent does not prevent necessary transactional communications, including:
• Order confirmations.
• Digital-delivery messages.
• Project updates.
• Appointment information.
• Security messages.
• Support responses.
• Policy or service notices.
8. CUSTOM-PROJECT FILES AND COMMUNICATIONS
Customers may provide logos, images, brand materials, channel links, references, recordings, written content, and other files for custom projects.
The Overlay King may use those materials to:
• Review the request.
• Develop project concepts.
• Create approved deliverables.
• Communicate about the project.
• Process revisions.
• Document approvals.
• Deliver the completed work.
• Resolve project or delivery issues.
• Maintain reasonable business and project records.
Customers should provide only materials that they are authorized to use and share.
Customers should not provide unnecessary sensitive information through project files or communications.
9. SETUP LAB SESSIONS AND RECORDINGS
Setup Lab sessions are not recorded by default.
A Setup Lab session may be recorded only after the client provides express consent.
When a recording is approved:
• The purpose of the recording should be explained.
• Access should be limited to authorized individuals.
• The recording should be used only for the disclosed project, support, documentation, or training purpose.
• The client may ask reasonable questions about how the recording will be used.
Unless another period is disclosed and agreed to in writing, an approved Setup Lab recording will generally be deleted within 30 days.
The Overlay King does not guarantee that every service provider or communication platform is capable of immediate permanent deletion from all restricted backup systems.
10. DATA RETENTION
The Overlay King retains personal information only as long as reasonably necessary for the purpose for which it was collected or for another permitted business or legal purpose.
Order and transaction records may be retained as reasonably necessary for:
• Accounting.
• Tax obligations.
• Fraud prevention.
• Transaction records.
• Refunds and disputes.
• Contract enforcement.
• Security.
• Legal compliance.
General inquiries that do not result in an order, appointment, or project may be retained for up to 24 months after the last interaction.
Custom-project records may be retained as reasonably necessary to document:
• The approved scope.
• Payments.
• Creative direction.
• Client instructions.
• Proofs and approvals.
• Revisions.
• Delivery.
• Support.
• Disputes.
• Contract performance.
Customer-provided reference files and working project files may be retained for up to 12 months after final delivery or project closure.
The Overlay King does not guarantee indefinite storage, replacement, or future availability of project files.
Customers are responsible for securely downloading, backing up, and retaining their delivered files.
Approved Setup Lab recordings will generally be deleted within 30 days unless another period is agreed to in writing.
Marketing information may be retained until:
• The individual unsubscribes.
• Consent is withdrawn.
• The information is no longer reasonably needed.
• Continued retention is otherwise required or permitted by law.
When information is no longer reasonably required, The Overlay King may delete, anonymize, aggregate, or securely dispose of it.
Information may remain temporarily in restricted backups or systems maintained by Shopify and other service providers according to their own retention and deletion procedures.
11. PRIVACY RIGHTS AND REQUESTS
Depending on the individual’s location and applicable law, privacy rights may include the right to:
• Request access to personal information.
• Request correction of inaccurate information.
• Request deletion of eligible information.
• Request a portable copy of eligible information.
• Withdraw marketing consent.
• Opt out of qualifying data sale or sharing.
• Opt out of qualifying targeted advertising.
• Appeal certain privacy decisions where applicable.
• Submit a request through an authorized representative.
• Receive equal service without unlawful discrimination for exercising a privacy right.
These rights are subject to applicable definitions, exceptions, verification standards, and legal limitations.
12. VERIFYING A PRIVACY REQUEST
Before releasing, correcting, or deleting personal information, The Overlay King may request reasonable information to:
• Confirm the requester’s identity.
• Match the requester to relevant customer or transaction records.
• Confirm the authority of an authorized representative.
• Protect information from unauthorized access, alteration, or deletion.
Verification information will be limited to what is reasonably necessary for the request.
Customers should not submit:
• Passwords.
• Full payment-card numbers.
• Card-security codes.
• Recovery codes.
• Backup codes.
• Private keys.
• Complete account credentials.
• Other highly sensitive authentication information.
13. PRIVACY-REQUEST RESPONSE TIMES
Receipt of an applicable privacy request will generally be confirmed within 10 business days.
A substantive response will generally be provided within 45 calendar days.
When reasonably necessary and legally permitted, the response period may be extended once for up to an additional 45 calendar days.
When an extension is used, notice will be provided explaining that additional time is required.
These response periods apply where required by applicable law or when adopted as The Overlay King’s operational standard for the request.
A request may be denied or limited when an exception permits or requires information to be retained, including when reasonably necessary to:
• Complete a transaction.
• Deliver a requested product.
• Perform an approved project or service.
• Maintain tax or accounting records.
• Prevent fraud.
• Protect security.
• Resolve disputes.
• Exercise or defend legal claims.
• Enforce an agreement.
• Comply with another legal obligation.
When appropriate, the customer will be informed of the reason a request cannot be completed in full.
14. CHILDREN AND MINORS
The Overlay King’s website, products, and services are not directed to children under 13 years of age.
The Overlay King does not knowingly collect personal information online from children under 13 without legally required parental consent.
Individuals who are under the legal age of majority in their location should use the website only with the involvement and permission of a parent or legal guardian.
Purchases, custom-project approvals, payment commitments, and Setup Lab bookings for a minor must be completed or authorized by a parent or legal guardian who accepts responsibility for the transaction and applicable agreements.
If The Overlay King learns that personal information was collected from a child under 13 without appropriate authorization, reasonable steps will be taken to delete or otherwise address the information as required by law.
A parent or legal guardian who believes a child submitted personal information may submit a privacy request through the Contact page.
15. INFORMATION SECURITY
The Overlay King uses reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized:
• Access.
• Use.
• Alteration.
• Disclosure.
• Loss.
• Destruction.
Security practices may include:
• Multifactor authentication for authorized business accounts.
• Strong account-access controls.
• Limiting access according to business responsibilities.
• Reviewing installed applications and permissions.
• Removing access when no longer needed.
• Maintaining supported software and devices.
• Using approved storage and communication systems.
• Retaining only reasonably necessary information.
• Securely disposing of information that is no longer required.
Payment transactions are processed through Shopify and authorized payment providers. The Overlay King does not intend to directly receive or store complete payment-card numbers or card-security codes.
Customers should not send passwords, recovery codes, payment credentials, private keys, backup codes, or sensitive login information through contact forms, email, project messages, or support communications.
No internet transmission, electronic-storage system, website, or digital communication method can be guaranteed to be completely secure.
16. SECURITY INCIDENTS
When a suspected privacy or security incident occurs, The Overlay King may:
• Secure affected accounts, devices, files, and systems.
• Preserve relevant records.
• Investigate what occurred.
• Work with Shopify and affected service providers.
• Consult technical professionals, insurers, legal counsel, or law enforcement.
• Identify information and individuals potentially affected.
• Correct vulnerabilities.
• Reduce continuing risk.
• Provide legally required notices.
• Document the incident and response.
When notification is required by applicable law, affected individuals and appropriate authorities will be notified according to the legally required content, method, and timing.
17. INTERNATIONAL DATA TRANSFERS
The Overlay King is based in the United States and uses Shopify and other service providers that may operate in multiple countries.
Personal information may therefore be transferred to, stored in, or processed in a jurisdiction other than the customer’s state, province, or country of residence.
Privacy and data-protection laws may differ between jurisdictions.
When required, The Overlay King and its service providers may rely on legally recognized contractual protections, data-processing agreements, adequacy decisions, or other lawful transfer mechanisms.
Service providers control their own infrastructure and processing locations.
Customers should review the published Privacy Policy and Shopify’s Consumer Privacy Policy for additional information about Shopify’s processing and international data practices.
18. THIRD-PARTY WEBSITES AND SERVICES
The website may contain links to external websites, social-media platforms, cloud-storage services, scheduling tools, video platforms, or other independent services.
The Overlay King does not control the privacy, security, accessibility, or content practices of independent third parties.
Customers should review the privacy policies and account settings of third-party services before submitting information or using those services.
19. POLICY UPDATES
The Overlay King may update this Addendum to reflect changes to:
• Products.
• Services.
• Website functionality.
• Technology.
• Service providers.
• Privacy settings.
• Business practices.
• Legal obligations.
The effective date will be updated when this Addendum changes.
Minor or administrative changes may be communicated by publishing the revised Addendum online.
When a change materially affects how personal information is collected, used, disclosed, or shared, additional notice may be provided when appropriate or legally required.
Continued use of the website does not waive privacy rights that cannot legally be waived.
20. PRIVACY QUESTIONS AND REQUESTS
Customers may submit privacy questions or applicable privacy requests through The Overlay King’s Contact page.
Select:
Inquiry Type:
Privacy Request
The request should identify the closest applicable category:
• Access my information.
• Correct my information.
• Delete eligible information.
• Request a portable copy.
• Withdraw marketing consent.
• Question about privacy practices.
• Authorized representative request.
• Other privacy request.
Requests concerning qualifying data sale, sharing, or targeted advertising may also be submitted through the store’s data-sharing opt-out page.
Certain requests concerning information independently controlled by Shopify, Shop, or Shop Pay may be submitted through Shopify’s Privacy Portal.
The Overlay King may request reasonable information to verify the requester’s identity or an authorized representative’s authority.
Do not submit passwords, complete payment-card information, security codes, recovery codes, private keys, or other sensitive credentials with a privacy request.