Skip to content
Draft notice. This privacy policy has been prepared in good faith but has not yet been reviewed by external counsel. We recommend obtaining your own legal advice before relying on it for compliance.

Privacy Policy

Last updated: 1 May 2026

1. Who we are

This policy is issued by MA OCEAN GROUP LTD, a company registered in England and Wales (company number 17120150) with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom ("we", "us", "our"). We operate the Holiday Ocean 360 service (the "Service").

For privacy queries you can contact us at support@maocean360.com.

2. Our role

We act in two capacities depending on the data:

  • Data controller — for marketing-website visitors, prospect enquiries, billing contacts, and customer-account administrators. This policy explains how we handle that data.
  • Data processor — for personal data your organisation uploads about its workforce (employees, managers, HR admins). In that case your organisation is the data controller and our handling is governed by our Data Processing Agreement.

3. Information we collect (where we are the controller)

We collect:

  • Account & identity data — name, email, employer, job title, password hash via Clerk;
  • Billing data — billing contact, VAT number, plan, last 4 digits of payment card via Stripe (we do not store card numbers);
  • Communications data — messages you send via the contact form, support tickets, email replies;
  • Technical data — IP address, browser, device, pages visited, approximate location, security and audit logs;
  • Usage data — how you interact with features, performance metrics, error reports.

4. How we use it

We use the information to:

  • Provide, secure, support, and improve the Service;
  • Authenticate users, prevent fraud and abuse, and maintain audit trails;
  • Process payments and manage subscriptions;
  • Send transactional emails (notifications, invitations, billing, security alerts);
  • Respond to enquiries and support requests;
  • Comply with our legal, tax, and accounting obligations;
  • With your consent, send product updates and marketing emails (you can unsubscribe at any time).

5. Lawful bases (UK GDPR / GDPR)

  • Contract — to deliver the Service to you and your organisation;
  • Legitimate interests — to operate, secure, and improve the Service, prevent abuse, and run our business;
  • Legal obligation — to comply with tax, accounting, and law-enforcement requirements;
  • Consent — for non-essential cookies and marketing emails (withdrawable at any time).

6. Where your data is stored

The Service is currently hosted on AWS infrastructure in the United States (US East — N. Virginia). Where personal data is transferred from the UK or EEA to the US, we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, supplemented with the technical and organisational measures described in our DPA. We plan to introduce regional hosting based on customer location in future.

7. Sub-processors we use

  • Amazon Web Services (AWS) — primary infrastructure (US East);
  • Railway — application hosting orchestrator;
  • Cloudflare — CDN, DNS, DDoS protection;
  • Clerk — authentication and identity;
  • Stripe — payment processing;
  • Resend — transactional email delivery.

Each sub-processor is bound by a data protection agreement and provides equivalent safeguards. A current sub-processor list is maintained in the DPA.

8. Sharing

We do not sell personal data. We share data with:

  • Sub-processors listed above, strictly for the purpose of running the Service;
  • Your own organisation — managers, HR admins, and configured approvers can see workforce data as part of normal Service operation;
  • Professional advisers (legal, accounting, audit) under confidentiality;
  • Public authorities, courts, or regulators where legally required.

9. Data security

We use TLS in transit, encryption at rest, role-based access controls, multi-factor authentication for staff, comprehensive audit logging, and least-privilege access. We perform regular dependency scanning and apply security patches promptly.

10. Retention

We retain account data for as long as the customer relationship is active. On termination, Customer Data is deleted or anonymised within 30 days, except where retention is legally required (e.g. tax records for up to 7 years). Audit logs may be retained longer where required for security or legal reasons.

11. Your rights

Subject to UK GDPR you have the right to:

  • Access the personal data we hold about you;
  • Have inaccurate data corrected;
  • Have your data deleted (where applicable);
  • Restrict or object to processing;
  • Receive your data in a portable format;
  • Withdraw consent where processing is based on consent;
  • Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

If you are an employee of one of our customers and you wish to exercise your rights in respect of workforce data, please contact your employer first — they are the data controller of that information. We will support them on reasonable request.

12. Cookies

See our Cookie Policy for details of the cookies and similar technologies we use, and how to manage your preferences.

13. Children

The Service is not intended for use by individuals under 16. We do not knowingly collect data from children.

14. Changes

We may update this policy from time to time. Material changes will be notified by email or in-app where you have an account. Continued use after the effective date indicates acceptance.

15. Contact

For privacy enquiries: support@maocean360.com or write to: MA OCEAN GROUP LTD, 128 City Road, London, EC1V 2NX, United Kingdom.