Privacy Policy

Last updated: 28 October 2026

1. Who we are

Contract Ocean 360 ("the Service") is operated by MA Ocean 360 ("we", "us"), a company registered in England and Wales. For anything in this policy, write to contact@maocean360.com.

For the personal data of the people who use the Service in their company's workspace, we are the data controller. For the contracts and everything your company processes in its workspace, your company is the controller and we act as its processor.

2. What we collect

  • Account data: your name, email address, company, department and role, from Ocean ID and Ocean Console or from your company's administrators.
  • Workspace content: the contracts, templates, clauses, fields, comments, files, approvals, negotiation rounds, renewals and obligations your company keeps in the Service.
  • People outside your company: when your company sends a contract, shares it or asks for changes, the names, email addresses and, where your company uses WhatsApp, phone numbers of the people it sends to; their signatures and answers; and when they opened their link and signed.
  • The record: who did what to each contract, and when. The Service exists to keep this record; your company's administrators see it.
  • Technical data: IP address, browser type and times in server logs, used for security and to fix errors.

We do not run advertising or cross-site tracking. The Service keeps small preferences (such as how a list was left) for your account, and signing in uses cookies from Ocean ID only to keep you signed in.

3. Why we use it, and the lawful bases

  • To provide the Service (performance of a contract): accounts, workspaces, writing, approving, sending and signing contracts, reminders, and the record.
  • To secure and improve it (legitimate interests): protecting accounts, preventing abuse, fixing errors, understanding use as a whole.
  • To meet legal obligations: records we must keep, and answering lawful requests.

We do not sell personal data, and we do not use it for advertising.

4. Who we share it with

Only service providers who process data for us, under contract, to run the Service:

  • Cloudflare: content delivery, DNS and security in front of this website.
  • Railway: application hosting.
  • Neon: database hosting.
  • Resend: email (signing links, codes, reminders, notices).
  • Meta (WhatsApp): messages to people your company chooses to reach on WhatsApp, only where your company turns it on.

Beyond providers: the people in your company's workspace see what its roles allow, the people your company sends a contract to see that contract, and we disclose data where the law requires it.

5. International transfers

Some providers process data outside the UK (including in the EEA and the United States). Where they do, we rely on UK adequacy decisions or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum and Standard Contractual Clauses.

6. How long we keep it

  • Account data: for the life of the account, then deleted or anonymised within a reasonable period.
  • Contracts and their record: as long as your company keeps them. Your company sets how long each type of contract is kept, and can remove a contract once its time has passed; its record stays.
  • Signing codes and links: wiped once their message is done or their time has passed.
  • Server logs: a short rolling window, for security.

7. Security

All traffic is encrypted in transit (HTTPS only), and our hosting providers encrypt data at rest. Each company's data is kept apart from every other company's. Access inside a workspace follows its roles, every step on a contract is written to a record that can be checked for changes, files are scanned before they are kept, and access on our side is restricted and logged.

8. Your rights

Under UK GDPR you can ask us to:

  • give you a copy of your personal data;
  • correct it, or complete it;
  • delete it, where it does not have to be kept;
  • restrict or object to how we use it;
  • give it to you in a portable format;
  • stop using it, where your consent is the basis.

Write to contact@maocean360.com and we will answer within one month. If your data reached us through a company's workspace, we may pass your request to that company, as its processor. You may also complain to the UK Information Commissioner's Office at ico.org.uk.

9. Children

The Service is a business tool and is not meant for children. We do not knowingly collect data from anyone under 16.

10. Changes

When this policy changes in a way that matters, we update this page and its date, and tell each company's administrators. The English version of this policy is the one that governs.