Data Protection Policy

Effective Date:

01/01/2025

Last Updated:

06/19/2025

Entity Covered:

Overscale Consulting, LLC (referred to as “we,” “us,” or “Overscale Consulting”)

Jurisdiction:

State of Minnesota, United States

1. Types of Data Collected

Overscale Consulting collects the following categories of data via website form capture tools (e.g., lead forms, contact forms, intake forms, opt-in forms):

a. Personal Data

Full name

Email address

Phone number

Company name

Business address

Job title

b. Sensitive Data (only when explicitly needed and with clear consent)

Financial details (e.g., billing addresses)Business performance metrics (e.g., revenue ranges)Any disclosed proprietary business information voluntarily submitted by the user

c. Demographic Data

Location (city, state, ZIP)

Business type/industry

Size of company or staff count

We do

not

knowingly collect data from individuals under the age of 18.

2. Data Collection & Storage Methodology

a. Collection Methods

Data is collected through SSL-encrypted web forms hosted on our platform or verified third-party platforms (e.g., GoHighLevel).Collection is strictly purpose-limited: only information necessary to fulfill our service offering or marketing follow-up is requested.

b. Storage Strategy

Data is stored on secure cloud infrastructure using AWS or GCP (SOC 2, ISO 27001 compliant environments).Data is segmented by purpose (marketing, onboarding, service delivery) and access-controlled accordingly. All data is encrypted at rest (AES-256) and in transit (TLS 1.2+).

3. Safeguards Against Unauthorized Access

a. Physical Security

Restricted access to admin consoles and data processing environments. Internal access is granted only to verified personnel via MFA-secured portals.

b. Access Controls

Role-Based Access Control (RBAC) policies define user data access based on job role necessity. Login attempts are monitored and throttled to prevent brute-force access.

c. Encryption Protocols

HTTPS enforced across all data capture points. All form submissions are transmitted via TLS with HSTS headers enabled.

d. Backup & Redundancy

Nightly backups with 30-day retention stored in a separate encrypted environment. Disaster recovery plans in place to ensure platform uptime and data continuity.

4. Incident Response Plan

Overscale Consulting maintains a detailed and documented

Incident Response Plan (IRP)

including:

Identification Detection through intrusion detection systems, system logs, and employee reporting. Containment Immediate isolation of affected systems to prevent further spread. Eradication Removal of malicious code, unauthorized users, or compromised credentials. Recovery Restoration of data from secure backups and validation of system integrity. Post-Incident Review Root cause analysis, affected user notification (within 72 hours per applicable law), and security improvement roadmap.

All breaches are logged and reported in accordance with the

Minnesota Government Data Practices Act

and

Federal Trade Commission (FTC) guidelines

.

5. User Data Rights Procedures

In alignment with Minnesota and federal laws (including the

FTC Act

,

CCPA if applicable

, and best practices from the

GDPR

), Overscale Consulting supports the following user rights:

Access Request: Users may request a copy of their data via email at [[email protected]].Correction Request: Users may submit changes or corrections to inaccurate data. Deletion Request: “Right to be Forgotten” requests are honored within 30 days upon verification. Portability Request: We provide a portable, machine-readable format upon verified request.

All data requests require identity verification and are processed free of charge within statutory timeframes.

6. Consent & Withdrawal Process

a. Consent Acquisition

Clear opt-in checkboxes are used on all data forms with explicit descriptions of purpose (e.g., newsletters, booking services).Consent is never bundled with unrelated services.

b. Withdrawal Process

Users can withdraw consent at any time by clicking “unsubscribe” on emails or emailing [[email protected]].Withdrawal does not affect the legality of prior processing based on consent.

7. Cross-Border Data Transfers

If data is transmitted outside the U.S. (e.g., for processing or storage on global cloud infrastructure):

We ensure compliance with the U.S.–EU Data Privacy Framework or standard contractual clauses (SCCs).All third-party vendors handling personal data must be contractually bound to equivalent privacy obligations.

Your Responsibility as a User

You agree not to submit any data unless you are authorized to do so and understand your responsibilities under this policy. Misuse of data collection forms is a breach of our terms of service.

Contact Us

For privacy-related inquiries or to exercise your rights:

📧

[email protected]

📬 Overscale Consulting LLC, Minnesota, USA