← Home

Privacy Policy

Last updated: 29 May 2026

1. Who we are

This website is operated by Overlay Technology OÜ, a private limited company registered in Estonia (registry code available on request). We provide fractional CTO services to non-technical founders across Europe.

For the purposes of EU General Data Protection Regulation (GDPR) 2016/679, Overlay Technology OÜ is the data controller of the personal data described in this policy.

Contact us at: [email protected]

2. Data we collect and why

2.1 Contact and enquiry data

When you reach out to us via email or any contact form, we collect your name, email address, company name, and the content of your message. We use this data solely to respond to your enquiry and, where you have consented or there is a legitimate interest, to follow up on a potential engagement.

Legal basis: legitimate interests (Art. 6(1)(f) GDPR) and, where applicable, pre-contractual steps (Art. 6(1)(b) GDPR).

2.2 Website analytics

We use Google Analytics 4 (operated by Google Ireland Limited) to understand how visitors use our website. This service may collect your IP address (anonymised), browser type, referring URL, pages visited, and session duration using cookies and similar technologies.

Legal basis: legitimate interests (Art. 6(1)(f) GDPR). You may opt out by installing the Google Analytics Opt-out Browser Add-on.

2.3 LinkedIn data

Our website links to our LinkedIn Company Page (linkedin.com/company/overlay-technology). If you interact with that page — including following, liking, commenting, or sending us a message via LinkedIn — LinkedIn Ireland Unlimited Company processes your data as a joint controller with us under LinkedIn's own Privacy Policy.

We may receive aggregated, anonymised page analytics (e.g. follower demographics, post impressions) from LinkedIn. We do not receive, store, or process individually identifiable LinkedIn profile data unless you have explicitly sent us a direct message or connection request on LinkedIn, in which case the data you share is used only to respond to your communication.

We do not use LinkedIn's API to scrape, harvest, or systematically collect profile data. We do not use LinkedIn data for automated decision-making or profiling.

Legal basis: legitimate interests (Art. 6(1)(f) GDPR) for page analytics; pre-contractual steps (Art. 6(1)(b) GDPR) for direct communications.

3. Cookies

We use the following categories of cookies:

  • Strictly necessary: required for the website to function. No consent required.
  • Analytics: Google Analytics cookies (e.g. _ga, _gid) that help us measure traffic and usage patterns. These are set only after you have been informed of their use.

You can manage or delete cookies at any time through your browser settings.

4. Data sharing and third parties

We do not sell or rent your personal data. We share data only in the following limited circumstances:

  • Service providers: Google (Analytics), email hosting providers, and other tools necessary to operate our business — all bound by data processing agreements.
  • LinkedIn: as described in section 2.3 above.
  • Legal obligation: where required by applicable law, court order, or regulatory authority.

All third-party processors are selected to ensure adequate data protection standards, including Standard Contractual Clauses where data is transferred outside the EEA.

5. Data retention

We retain personal data only as long as necessary for the purpose for which it was collected:

  • Enquiry and communication data: up to 3 years from last contact, unless an engagement leads to a contract (in which case statutory retention periods apply).
  • Analytics data: retained according to Google Analytics default retention settings (14 months for user-level data).
  • LinkedIn communications: for as long as the communication thread is relevant to a potential or active engagement.

6. Your rights under GDPR

If you are located in the European Economic Area (EEA) or the UK, you have the following rights:

  • Access: request a copy of the personal data we hold about you.
  • Rectification: ask us to correct inaccurate or incomplete data.
  • Erasure: ask us to delete your data ("right to be forgotten") where there is no overriding legal basis for retention.
  • Restriction: ask us to pause processing of your data in certain circumstances.
  • Portability: receive your data in a structured, machine-readable format.
  • Objection: object to processing based on legitimate interests, including for direct marketing.
  • Withdrawal of consent: where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority. In Estonia, this is the Data Protection Inspectorate (AKI).

7. External links

Our website contains links to third-party sites including LinkedIn. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies directly.

8. Changes to this policy

We may update this policy from time to time. Material changes will be noted on this page with a revised "Last updated" date. Continued use of our website after changes constitutes acceptance of the updated policy.

9. Contact

For any privacy-related questions or to exercise your rights, please contact:
Overlay Technology OÜ
[email protected]