Skip to content
Draft notice. This DPA has been prepared in good faith but has not yet been reviewed by external counsel. Customers should obtain their own legal review before relying on it.

Data Processing Agreement

Last updated: 1 May 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between MA OCEAN GROUP LTD, a company registered in England and Wales (company number 17120150), 128 City Road, London, EC1V 2NX, United Kingdom (the "Processor") and the customer organisation (the "Controller") using the Holiday Ocean 360 service (the "Service").

1. Roles

The Controller determines the purposes and means of processing personal data uploaded into the Service relating to its workforce. The Processor processes that personal data only on the documented instructions of the Controller, in accordance with this DPA, the Terms, and applicable data protection law (UK GDPR, GDPR, and the Data Protection Act 2018, the "Data Protection Laws").

2. Subject matter, duration, nature & purpose

  • Subject matter: provision of the Holiday Ocean 360 leave-management platform.
  • Duration: for the term of the underlying subscription agreement plus the deletion period defined below.
  • Nature & purpose: hosting, storing, transmitting, indexing, generating notifications and reports, and otherwise providing functionality required to operate the Service.
  • Categories of data subjects: Controller's employees, contractors, managers, HR administrators, and any other workforce members the Controller chooses to add.
  • Categories of personal data: name, work email, job title, department, manager, work location, leave entitlements, leave balances, leave requests (including dates and reason where supplied), attendance and shift data, deduction inputs, audit/event logs, optional comments, and optional uploaded supporting documents (e.g. sickness certificates) where the Controller chooses to enable that functionality.
  • Special category data: may include health-related data (sickness leave, medical certificates) and religion-related data (e.g. religious-holiday calendars) where the Controller chooses to upload it. The Controller is responsible for the lawful basis under Art. 9 UK GDPR.

3. Processor obligations

The Processor will:

  • process personal data only on the Controller's documented instructions, including those reflected in the Terms and platform configuration;
  • ensure all personnel authorised to process personal data are bound by confidentiality;
  • implement appropriate technical and organisational measures (Annex 1);
  • assist the Controller, taking into account the nature of the processing, in fulfilling its obligations to respond to data subject rights requests;
  • assist the Controller with data protection impact assessments and consultations with supervisory authorities;
  • at the Controller's choice, delete or return all personal data within 30 days of termination, except where storage is required by law;
  • make available to the Controller information necessary to demonstrate compliance and allow audits as set out below.

4. Security measures (Annex 1)

  • TLS 1.2+ in transit, AES-256 encryption at rest;
  • Role-based access control with least-privilege defaults;
  • Multi-factor authentication for all staff and admin access;
  • Comprehensive append-only audit logging with tenant scoping;
  • Network isolation, DDoS protection, and Web Application Firewall via Cloudflare;
  • Automated dependency scanning and patch management;
  • Regular backups with tested restore procedures;
  • Documented incident response with 72-hour notification;
  • Background checks for staff with access to production data.

5. Sub-processors

The Controller authorises the Processor to engage the following sub-processors:

  • Amazon Web Services, Inc. — cloud infrastructure (US East — N. Virginia)
  • Railway Corp. — hosting orchestration
  • Cloudflare, Inc. — CDN, DNS, DDoS, WAF
  • Clerk, Inc. — identity and authentication
  • Stripe Payments Europe Ltd / Stripe Inc. — subscription billing
  • Resend Inc. — transactional email delivery

The Processor will give the Controller at least 30 days' prior notice of changes to this list. The Controller may object on reasonable data-protection grounds; if objections cannot be resolved, either party may terminate the affected service component on a pro-rata refund basis.

6. International transfers

The Service hosts personal data on AWS in the United States. Where personal data originates from the UK or EEA:

  • For UK transfers, the parties incorporate the UK International Data Transfer Addendum (issued by the ICO) and the EU SCCs (Module 2: Controller-to-Processor) by reference;
  • For EEA transfers, the parties incorporate the EU Standard Contractual Clauses (Module 2);
  • The Processor implements supplementary technical measures (encryption, key management, minimisation) commensurate with current EDPB guidance.

7. Data subject rights

The Service provides self-service tools for export and deletion. Where the Controller cannot fulfil a data subject request through these tools, it may submit a request to support@maocean360.com and the Processor will respond without undue delay and at no additional cost (where the request volume is reasonable).

8. Personal data breach

The Processor will notify the Controller without undue delay and in any case within 72 hours of becoming aware of a personal data breach affecting Controller Data, providing information sufficient to enable the Controller to comply with its own notification obligations.

9. Audit

On reasonable written notice (not more than once per 12 months, except where required by law or after a security incident), the Controller may audit the Processor's compliance with this DPA. The Processor may satisfy this obligation by providing audit reports, certifications (e.g. SOC 2, ISO 27001 when achieved), or completed security questionnaires. Audits must be conducted under confidentiality and at the Controller's expense, except where they reveal material non-compliance.

10. Liability

Liability under this DPA is subject to the limitations set out in the Terms.

11. Term & termination

This DPA continues for the duration of the underlying subscription. On termination, the Processor will delete or anonymise Controller Data within 30 days, save where retention is legally required.

12. Governing law

This DPA is governed by the laws of England and Wales, without prejudice to mandatory provisions of Data Protection Laws.

13. Acceptance

Acceptance of the Terms of Service constitutes acceptance of this DPA on behalf of the Controller. A separately signed counterpart can be provided on request to support@maocean360.com.