Privacy Policy

Last updated: 28 October 2026

1. Who we are

Quality Ocean 360 ("the Service") is operated by MA Ocean 360 ("we", "us"), a company registered in England and Wales. For anything in this policy, write to contact@maocean360.com.

For the personal data of the people who use the Service in their company's workspace, we are the data controller. For the records and everything your company processes in its workspace, your company is the controller and we act as its processor.

2. What we collect

  • Account data: your name, email address, company, department and role, from Ocean ID and Ocean Console or from your company's administrators.
  • Workspace content: the sites, standards, controls, checks and their readings, photos and files, events and actions, risks, audits and reviews your company keeps in the Service.
  • On the phone: the checks your people record, with the time on the device and on the server, and the photos they take; kept on the phone only until they are sent.
  • The record: who did what to each record, and when. The Service exists to keep this record; your company's administrators see it.
  • Technical data: IP address, browser type and times in server logs, used for security and to fix errors.

We do not run advertising or cross-site tracking. The Service keeps small preferences (such as how a list was left) for your account, and signing in uses cookies from Ocean ID only to keep you signed in.

3. Why we use it, and the lawful bases

  • To provide the Service (performance of a contract): accounts, workspaces, writing, approving, sending and signing contracts, reminders, and the record.
  • To secure and improve it (legitimate interests): protecting accounts, preventing abuse, fixing errors, understanding use as a whole.
  • To meet legal obligations: records we must keep, and answering lawful requests.

We do not sell personal data, and we do not use it for advertising.

4. Who we share it with

Only service providers who process data for us, under contract, to run the Service:

  • Cloudflare: content delivery, DNS and security in front of this website.
  • Railway: application hosting.
  • Neon: database hosting.
  • Resend: email (reminders and notices).
  • Meta (WhatsApp): messages to people your company chooses to reach on WhatsApp, only where your company turns it on.

Beyond providers: the people in your company's workspace see what its roles allow, the people your company invites to see what they are invited to, and we disclose data where the law requires it.

5. International transfers

Some providers process data outside the UK (including in the EEA and the United States). Where they do, we rely on UK adequacy decisions or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum and Standard Contractual Clauses.

6. How long we keep it

  • Account data: for the life of the account, then deleted or anonymised within a reasonable period.
  • Records and their history: as long as your company keeps them, at least as long as its standard asks for evidence to be kept.
  • Server logs: a short rolling window, for security.

7. Security

All traffic is encrypted in transit (HTTPS only), and our hosting providers encrypt data at rest. Each company's data is kept apart from every other company's. Access inside a workspace follows its roles, every check and change is written to a record that can be checked for changes, files are scanned before they are kept, and access on our side is restricted and logged.

8. Your rights

Under UK GDPR you can ask us to:

  • give you a copy of your personal data;
  • correct it, or complete it;
  • delete it, where it does not have to be kept;
  • restrict or object to how we use it;
  • give it to you in a portable format;
  • stop using it, where your consent is the basis.

Write to contact@maocean360.com and we will answer within one month. If your data reached us through a company's workspace, we may pass your request to that company, as its processor. You may also complain to the UK Information Commissioner's Office at ico.org.uk.

9. Children

The Service is a business tool and is not meant for children. We do not knowingly collect data from anyone under 16.

10. Changes

When this policy changes in a way that matters, we update this page and its date, and tell each company's administrators. The English version of this policy is the one that governs.