The Website is published, owned, and operated by Over S.A., a corporation (sociedad anónima) organized and existing under the laws of the Republic of Panama (“Company”). Company has prepared this Privacy Policy (this “Policy”) to describe to the user (“User”) the categories of Personal Information (as defined below) Company may collect and generate, the purposes for which Company may use it, and the persons to whom Company may disclose it. This Policy should be read together with Company’s Website Terms of Use (the “Terms”), into which this Policy is incorporated by reference and which describe the Service, the Challenges, and Company’s rights in respect of User Data in more detail. User is encouraged to read the Terms first, as capitalized terms used in this Policy and not defined in it have the meanings given to them in the Terms.
1. ACCEPTANCE OF THE POLICY
Company respects User privacy and is committed to protecting Users’ personal information through our compliance with this Policy. User should take the time to get to know Company’s policies and practices. Please understand that Company reserves the right to change any of Company’s policies and practices at any time, but User can always find the latest version of this Policy here on this page.
Where a change to this Policy materially affects the Personal Information Company collects, the purposes for which Company uses it, the persons to whom Company discloses it, or the rights available to User, Company will notify User by email or by prominent notice on the Website before the change takes effect, and where the change requires User’s consent, Company will obtain that consent. For all other changes, User’s continued use of the Website after Company makes the change is deemed to be acceptance of it, so please check this Policy periodically for updates.
This Policy describes the types of information Company collects from User or that User may provide when User utilizes the Services offered through the Website, and Company’s practices for collecting, generating, using, maintaining, protecting, and disclosing such information.
Please read this Policy carefully to understand Company’s practices regarding User’s information and how Company will treat it. If User does not agree with Company’s policies and practices, then please do not use the Website or any Services offered through the Website. By using the Website, User agrees to the terms of this Policy. Acceptance of this Policy is not, and is not to be treated as, User’s consent to any processing for which this Policy states that separate consent is required.
2. WHO IS RESPONSIBLE FOR USER’S PERSONAL INFORMATION
Company is the controller of User’s Personal Information. Company’s registered address, and the address for all correspondence concerning this Policy, are set out under “Contact Us” below.
3. JURISDICTIONS IN WHICH THE SERVICES ARE OFFERED
The Services are not offered to, and are not intended for, any person who is located in, resident in, a citizen of, or organized under the laws of any jurisdiction in which the Services are not made available, as identified in the Terms. User represents, each time User accesses the Website, that User is not such a person. Because the Services are not offered in those jurisdictions, this Policy does not contain, and Company does not undertake to provide, any notice or disclosure required by the law of a jurisdiction in which the Services are not offered. If Company later offers the Services in any such jurisdiction, Company will amend this Policy before doing so.
4. PERSONAL INFORMATION COMPANY COLLECTS AND GENERATES
As used in this Policy, “Personal Information” means information that identifies or is reasonably capable of identifying an individual, directly or indirectly, and information that is capable of being associated with an identified or reasonably identifiable individual. Personal Information includes information that has been pseudonymized, including information held against an Account identifier rather than a name, where that information can still be attributed to User by the use of additional information. Information that has been irreversibly anonymized, such that User can no longer be identified from it by Company or by any other person by any means reasonably likely to be used, is not Personal Information and is not subject to this Policy.
4.1Personal Information That May Be Collected from User. Depending on how User uses the Services, Company may collect and store Personal Information in the following categories, which are illustrative and not exhaustive:
(a)Profile and account information, such as name, email address, username and password, and, where applicable, date of birth or age, residential address, country of residence, nationality, and digital asset wallet address (collectively, “Profile Information”);
(b)Verification information, such as identity or address documents, and information generated in the course of identity, age, residence, eligibility, sanctions, or anti-money-laundering checks carried out by Company or by a verification provider engaged by Company (collectively, “Verification Information”);
(c)Payment and payout information, such as payment method and transaction references, tax documentation where required as a condition of payment, and the account, address, or other mechanism to which Company makes payouts;
(d)Information User provides to Company through correspondence, including Account opening, customer support, messages, text boxes, or the like;
(e)Any content or information User posts, uploads, submits, or otherwise makes available through the Website or the Services, together with User’s chosen username. Anyone who can see such content can read, collect, and use any Personal Information that accompanies it;
(f)Online identifier information, such as internet protocol address, log information, domain names, and similar identifying names or addresses (collectively, “Online Identifiers”);
(g)Device and network information, such as hardware, software, operating system, browser, device name, and language preferences (collectively, “Device Information”);
(h)Usage data, such as system activity, interactions with the Website, and clickstream information (collectively, “Usage Data”); and
(i)Location information, including approximate location derived from any of the foregoing (“Location Data”).
4.2Personal Information Company Generates About User. In addition to Personal Information User provides, Company generates, records, and stores Personal Information about User in the course of User’s use of the Services. This may include, for each prediction, decision, or other input User submits, the values User assigns and the corresponding market or reference values and resolved outcomes; scores, measures, statistical results, objectives, drawdown measurements, rankings, classifications, designations, and other performance and track-record data derived from them; any persistent or lifetime score Company maintains, including after a Challenge has ended; records of the use of any Automated Tool on or through User’s Account; and records of Company’s administration of, and User’s compliance with, the Terms and the applicable Challenge Rules.
Records of the kind described above relate to User and are Personal Information for so long as Company is able to attribute them to User, whether directly or by reference to an Account identifier or other information in Company’s possession. Company does not treat such records as anonymous merely because they are expressed as numbers or held against an identifier.
4.3Personal Information Company Collects from Third Parties. Company may collect and verify Personal Information about User from third parties, including Verification Information and the results of any screening from Company’s verification provider, payment and payout information from Company’s payment and payout providers, and any additional information necessary to comply with a legal obligation to which Company is subject.
4.4Whether Provision of Personal Information Is Required. Provision of Profile Information, Verification Information, and payment and payout information is a requirement of entering into and performing the Terms. If User does not provide it, Company will not be able to open an Account for User, verify User’s eligibility, permit User to participate in a Challenge, or make any payout to User. Provision of any Personal Information for which this Policy states that Company relies on User’s consent is optional, and User’s refusal to provide it, or withdrawal of consent, will not affect User’s access to the Services or the terms on which the Services are offered to User.
4.5Accuracy of Personal Information. Company takes reasonable and practicable steps to ensure that User’s Personal Information held by Company is accurate with regard to the purposes for which it is to be used, and User may correct inaccurate Personal Information as described under “Information for Persons Subject to EU and UK Data Protection Law” below.
5. INTENDED FOR USERS 18+
Company does not knowingly collect data from or market to anyone under 18 years of age. Company does not knowingly solicit data from or market to anyone under 18 years of age. By using the Services, User represents that User is at least 18 years old. If Company learns that Personal Information from a User less than 18 years of age has been collected, Company will deactivate the Account, to the extent that is possible, and take reasonable measures to promptly delete such data from Company’s records. If User becomes aware of any data Company may have collected from anyone under age 18, please contact Company at the address set out under “Contact Us” below.
6. HOW COMPANY USES USER’S PERSONAL INFORMATION
Company collects and generates Personal Information about User in order to provide User with the Services, to protect User and Company from risks related to improper use and fraud, and to maintain and improve the Website. Company may use User’s Personal Information for the following purposes:
6.1Provide User with the Services. To open and administer User’s Account and to provide User with the Services pursuant to the Terms.
6.2Verify Eligibility and Identity. To confirm User’s identity, age, residence, and nationality, to carry out sanctions, anti-money-laundering, and other eligibility screening, and to determine whether User is eligible to use the Services and to receive any payout under the Terms and the applicable Challenge Rules.
6.3Enforce Territorial and Access Restrictions. To determine the territory from which the Services are accessed and to apply geographic blocking, internet protocol address screening, device or network fingerprinting, account screening, and other technical or procedural measures to prevent access to the Services from any jurisdiction in which they are not offered, or by any person who is not eligible to use them, including access attempted through a virtual private network or other anonymisation tool.
6.4Evaluate and Score User’s Performance. To evaluate User’s performance, to calculate User’s scores, rankings, and other performance measures, to determine whether User has satisfied the Objective Evaluation Threshold and the other conditions of a Challenge, and to maintain any persistent score. This evaluation is carried out by automated means, by applying the applicable Challenge Rules to the records described above, and it may determine whether User becomes eligible to be considered for a payout. Where the GDPR or the UK GDPR applies, Company carries out that evaluation because it is necessary for entering into and performing User’s contract with Company: it is the service User has contracted for and cannot be provided without it. User may contact Company at the address set out under “Contact Us” below to obtain human intervention in respect of a determination, to express User’s point of view, and to contest the determination.
6.5Process Payments and Payouts. To collect any Fee payable by User, to make payouts to User, and to keep records of those transactions, including for accounting, tax, and record-keeping purposes.
6.6Comply with Legal and Regulatory Requirements. To comply with applicable laws and regulations and to respond to lawful requests from competent authorities.
6.7Detect and Prevent Fraud and Abuse, and Protect the Security and Integrity of the Website. To detect and prevent fraud, the operation of multiple or duplicate Accounts, collusion between Users, and any other manipulation or abuse of a Challenge or of the Services, and to maintain the security of User’s Account and of the Website.
6.8Provide User with Customer Support. To respond to User when User contacts Company’s support team with questions about or issues with User’s Account.
6.9Maintain, Analyse, Develop, and Improve the Services and Company’s Other Products. To host, store, reproduce, adapt, combine, analyse, evaluate, classify, tag, label, index, aggregate, pseudonymise, and anonymise User Data and to create derived and derivative works from it; to operate, secure, evaluate, maintain, develop, test, improve, and expand the Services and any other product or service of Company or any of its Affiliates; to develop, test, and improve Company’s scoring and evaluation methodology; for research, statistical, analytical, benchmarking, indexing, and reporting purposes, and for the creation, operation, publication, and improvement of datasets, statistics, indices, benchmarks, evaluations, scores, and insights; and for the training, development, testing, and evaluation of models, systems, and Automated Tools. Company may carry out these activities itself or through an Affiliate or a service provider engaged by Company.
6.10Market Company’s Products. To contact User with information about the Website and the Services. Where User’s consent is required, Company will do so only with User’s consent, which User may withdraw at any time.
Company will not use User’s Personal Information for a materially different purpose without first amending this Policy, notifying User in accordance with “Acceptance of the Policy” above, and, where the new purpose requires it, obtaining User’s consent.
7. HOW COMPANY SHARES USER’S PERSONAL INFORMATION
Company shares User’s Personal Information only as described in this Section, or as otherwise described in this Policy or the Terms. Company does not disclose User’s Personal Information to any third party for that third party’s own direct marketing purposes.
7.1Third-Party Service Providers. Company may share User’s Personal Information with third-party service providers that provide services to Company, including identity verification and screening, payment and payout processing, customer support, hosting and network infrastructure, data storage, security and fraud detection, and data analytics. Company shares User’s Personal Information with these service providers only so that they can provide Company with their services, and Company prohibits its service providers from using or disclosing User’s Personal Information for any other purpose. Where the GDPR or the UK GDPR applies, each such provider processes User’s Personal Information as a processor on Company’s documented instructions under a written contract meeting the requirements of Article 28.
7.2Affiliates. Company may share User’s Personal Information with its Affiliates, and with the subcontractors and agents of Company and of its Affiliates, where they exercise a right or perform an obligation of Company under the Terms or otherwise carry out any of the purposes described in this Policy. Company remains responsible to User for their acts and omissions in connection with the Services.
7.3Other Users and Public Display. Company may display, publish, and otherwise make available any username, handle, or other identifier User selects, together with any score, rank, result, statistic, performance record, classification, designation, or status generated in connection with User’s use of the Services, on the Website, on any leaderboard, ranking, index, benchmark, or comparison Company or any Affiliate operates, and in research, promotional, and other materials, and may continue to do so after a Challenge has ended and after an Account is closed. User may ask Company to stop displaying User’s identifier in connection with any public display by contacting Company at the address set out under “Contact Us” below, and Company will give effect to any right User has under applicable law; Company may nevertheless continue to use the underlying information as described in this Policy and to display the relevant score, rank, or designation on an anonymized or pseudonymized basis.
7.4Third-Party Sites and Applications. Where User accesses a third-party website or application through the Website, information User provides to it may be received and processed by its operator under that operator’s own terms and privacy policy.
7.5Law Enforcement and Regulators. Company may be compelled to share User’s Personal Information with law enforcement, government officials, and regulators.
7.6Corporate Transactions. Company may disclose Personal Information in the event of a proposed or consummated merger, acquisition, reorganization, asset sale, or similar corporate transaction, or in the event of a bankruptcy or dissolution.
7.7Professional Advisors. Company may share User’s Personal Information with Company’s professional advisors, including legal, accounting, or other consulting services, for the purposes of audits or to comply with Company’s legal obligations.
7.8Consent. Company may share User’s Personal Information with User’s consent.
8. CONSENT WHERE REQUIRED
Where applicable law requires User’s consent to any collection, use, or disclosure described in this Policy, that consent is given by User’s acceptance of the Terms and of this Policy and, where Company presents a separate consent mechanism for a particular activity, by User’s use of that mechanism. Company will present a separate and specific consent mechanism where applicable law requires consent to be obtained separately, and in that case User’s acceptance of the Terms or of this Policy alone is not that consent.
User may withdraw any consent at any time by contacting Company at the address set out under “Contact Us” below. Withdrawal takes effect prospectively only. It does not affect the lawfulness of any processing carried out on the basis of that consent before it was withdrawn, and it does not extend to information that has been irreversibly anonymized or aggregated so that User can no longer be identified from it, or to any model, index, benchmark, dataset, score, or other output already created from it.
9. RETENTION OF PERSONAL INFORMATION
Company retains User’s Personal Information only for as long as is necessary for the purposes for which it was collected or generated, and thereafter for such further period as is necessary to comply with Company’s legal obligations, to resolve disputes, and to enforce Company’s agreements. In determining the appropriate retention period, Company considers the nature, amount, and sensitivity of the Personal Information; the purposes for which it is processed and whether those purposes can be achieved by other means; the potential risk of harm from unauthorized use or disclosure; whether the Personal Information relates to an open Account or to a Challenge that remains capable of assessment or payment; and any accounting, tax, anti-money-laundering, limitation, or other legal or regulatory retention requirement that applies. Personal Information relating to User’s performance, including any persistent score, may be retained after a Challenge has ended and after an Account is closed for the purposes described in this Policy. When the applicable retention period expires, Company will delete the Personal Information or irreversibly anonymize it.
10. COOKIES
When User accesses the Website, Company may make use of the standard practice of placing tiny data files called cookies, flash cookies, pixel tags, or other tracking tools (herein, “Cookies”) on User’s Device. Company may use Cookies to help Company recognize User as a customer, collect information about User’s use of the Website to better customize the Website and content for User, and collect information about User’s Device to: (i) ensure that User’s Account security has not been compromised by detecting irregular, suspicious, or potentially fraudulent Account activities; and (ii) assess and improve the Website.
Company sets Cookies that are strictly necessary for the operation of the Website without User’s consent. Where User’s consent is required, Company sets all other Cookies only with that consent, and User may withdraw that consent or change User’s preferences at any time. Where Company publishes a separate cookie notice, it forms part of this Policy.
User can also learn more about Cookies by visiting http://www.allaboutcookies.org, which includes additional useful information on Cookies and how to block Cookies on different types of browsers and mobile devices. Please note that if User rejects Cookies, User may not be able to use certain aspects of the Website.
11. DIRECT MARKETING
Subject to applicable laws and regulations, and where User’s consent is required, only with User’s consent, Company may from time to time send direct marketing materials promoting services, products, facilities, or activities to User using information collected from or about User. User may withdraw that consent, or opt out of such communications, at any time and without charge, by following the directions provided in any marketing communication or by contacting Company at the address below. It is Company’s policy not to provide User’s Personal Information to third parties for those third parties’ direct marketing purposes.
12. INFORMATION SECURITY
No security is foolproof, and the Internet is an insecure medium. Company cannot guarantee absolute security, but Company works hard to protect Company and User from unauthorized access to or unauthorized alteration, disclosure, or destruction of Personal Information Company collects and stores. Measures Company takes may include encryption of Website communications; periodic review of Company’s Personal Information collection, storage, and processing practices; and restricted access to User’s Personal Information on a need-to-know basis for Company’s employees, contractors, and agents, who are subject to strict contractual confidentiality obligations and may be disciplined or terminated if they fail to meet these obligations.
13. INFORMATION FOR PERSONS SUBJECT TO EU AND UK DATA PROTECTION LAW
This Section applies to User if User is located in the European Union, the European Economic Area (“EEA”), the United Kingdom, or the Channel Islands, or is otherwise subject to the General Data Protection Regulation (EU) 2016/679 (the “GDPR”) or to the GDPR as it forms part of the law of the United Kingdom (the “UK GDPR”). For the purposes of this Section, “personal data” has the meaning given in the GDPR.
13.1Legal Bases for Processing. Company processes personal data on one or more of the following legal bases, according to the purpose for which it is processed: because the processing is necessary for the performance of Company’s contract with User or in order to take steps at User’s request before entering into it (Article 6(1)(b)), which applies to the provision of the Services, the evaluation and scoring of User’s performance, the processing of payments and payouts, and the provision of customer support; because the processing is necessary for compliance with a legal obligation to which Company is subject (Article 6(1)(c)), which applies to identity, sanctions, and anti-money-laundering verification where required of Company by law, to accounting, tax, and record-keeping obligations, and to responding to lawful requests from competent authorities; because the processing is necessary for the purposes of the legitimate interests pursued by Company or a third party (Article 6(1)(f)), which applies to the enforcement of territorial and access restrictions, the detection and prevention of fraud and abuse, the security and integrity of the Website, and the maintenance, analysis, development, and improvement of the Services, and in respect of which User may object at any time as set out below; and, where Company relies on User’s consent (Article 6(1)(a)), that consent is sought separately and specifically for the processing concerned and may be withdrawn by User at any time without affecting the lawfulness of processing carried out before withdrawal.
13.2Rights of Data Subjects. Subject to the exceptions provided by applicable law, User has the following rights in respect of User’s personal data:
(a)Access. User may request confirmation of whether Company processes personal data concerning User and, if so, a copy of that personal data and the information set out in Article 15.
(b)Rectification. User may request that Company correct inaccurate personal data concerning User and complete incomplete personal data.
(c)Erasure. User may request that Company erase personal data concerning User in the circumstances set out in Article 17.
(d)Restriction of Processing. User may request that Company restrict the processing of personal data concerning User in the circumstances set out in Article 18.
(e)Objection. User may object at any time, on grounds relating to User’s particular situation, to processing that Company carries out on the basis of its legitimate interests, and Company will cease that processing unless Company demonstrates compelling legitimate grounds that override User’s interests, rights, and freedoms, or that the processing is necessary for the establishment, exercise, or defence of legal claims. Where personal data are processed for direct marketing purposes, User may object at any time and Company will cease that processing without exception.
(f)Data Portability. User may request to receive the personal data User has provided to Company, in respect of processing carried out by automated means on the basis of consent or of a contract, in a structured, commonly used, and machine-readable format, and to transmit that personal data to another controller.
(g)Withdrawal of Consent. Where Company processes personal data on the basis of User’s consent, User may withdraw that consent at any time, without affecting the lawfulness of processing carried out on the basis of that consent before its withdrawal.
(h)Automated Decision-Making. User has the rights described under “Evaluate and Score User’s Performance” above.
13.3How to Exercise These Rights. To submit a request to exercise these rights, please contact Company using the methods described at the end of this Policy. When handling such a request, Company checks the identity of the requesting party to ensure that he or she is the person legally entitled to make the request. Company will respond without undue delay and in any event within one month of receipt of the request, which period may be extended by two further months where necessary taking into account the complexity and number of the requests, in which case Company will inform User of the extension and of the reasons for it within one month. Company responds to such requests free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, Company may charge a reasonable fee reflecting the administrative costs of responding, or may refuse to act on the request.
13.4Right to Lodge a Complaint. Without prejudice to any other remedy, User has the right to lodge a complaint with a supervisory authority, in particular in the Member State of User’s habitual residence, place of work, or place of the alleged infringement. Users in the United Kingdom may lodge a complaint with the Information Commissioner’s Office.
14. COLLECTION AND TRANSFER OF DATA OUTSIDE THE EEA AND THE UNITED KINGDOM
Company is established in the Republic of Panama, and Company’s hosting, verification, payment, and other service providers may be located in other jurisdictions. Personal Information collected from User will therefore be transferred to, stored in, and processed in countries other than the country in which User is located, including countries that may not provide the same level of protection for personal information as User’s own.
Where applicable law requires a particular basis or safeguard for such a transfer, Company implements a transfer mechanism that satisfies that requirement, which may include standard contractual clauses or other appropriate safeguards recognized under that law. User may request further information about the safeguards applicable to a transfer of User’s Personal Information by contacting Company at the address set out below.
15. CONTACT US
If User has questions or concerns regarding this Policy or Company’s use of User’s Personal Information, please feel free to email Company at compliance@over.computer; or write to Company at:
Over S.A.
Attn: Compliance
Blvd. Costa del Este, P.H. Financial Park Tower, 17th Fl
Panama City, Panama 080808
Republic of Panama