Privacy Policy

Who We Are

Ocean Hotspot is operated by Ocean Prime Industries Ltd, registered in England and Wales. We are the data controller for the personal data described in this policy.

Contact: oceanhotspotservices@gmail.com

What We Collect and Why

All Users (Buyers and Vendors)

We collect your name, email address, phone number, and account password when you register. We use this to create and manage your account, communicate with you about orders and the Platform, and verify your identity.

We collect your IP address, browser type, device information, and usage data when you use the Platform. We use this to keep the Platform secure, prevent fraud, improve the Platform, and comply with our legal obligations.

Buyers

We collect your delivery address when you place an order. We share this with the vendor to fulfil your order. We collect your payment details, which are processed by Stripe. We never see or store your full card number.

For orders above £100, we may contact you by phone to verify the order. We collect the outcome of this verification call.

Vendors

We collect business information including your business name, trading name, business type, company registration number, registered address, and tax identification number. We collect this to verify your identity and business (KYC/KYB), comply with anti-money laundering regulations, report seller income to HMRC as required by the UK Digital Platform Reporting Rules, and display your verified status to buyers.

We process your payout information through Stripe Connect. Stripe collects and holds your banking details directly. We do not store your bank account details.

For enhanced verification tiers, we may collect government-issued identification (processed by our verification partner, not stored on our systems), proof of business address, insurance documentation, and trade references.

Legal Bases for Processing

We process your data on the following legal bases:

Contract. Processing necessary to provide the Platform and fulfil our obligations to you (account management, order processing, payouts).

Legal obligation. Processing required by law, including KYC/AML verification, sanctions screening, tax reporting to HMRC under the UK Digital Platform Reporting Rules, and fraud prevention.

Legitimate interests. Processing necessary for our legitimate business interests, including Platform security, fraud detection, analytics to improve the Platform, and marketing communications about Ocean Hotspot (you can opt out at any time).

Who We Share Data With

We share data with other users as necessary for transactions: buyers see vendor business names and showroom information; vendors see buyer names and delivery addresses for orders.

We share data with the following service providers, who process data on our behalf:

Stripe processes payments and vendor payouts. Stripe's privacy policy applies to payment data they collect directly.

Our identity verification provider processes government ID checks for enhanced vendor verification. We do not store identity documents on our systems. We receive only a pass/fail result and a reference number.

Twilio provides phone verification services.

We may also share data with HMRC and other tax authorities as required by the UK Digital Platform Reporting Rules, law enforcement or regulatory bodies if required by law or to prevent fraud, and professional advisors (legal, accounting) under confidentiality obligations.

We do not sell your personal data to third parties. We do not share your data with advertisers.

International Transfers

Your data is primarily stored and processed in the United Kingdom. Where data is transferred outside the UK (for example, to service providers based in the United States), we ensure appropriate safeguards are in place, including the UK International Data Transfer Agreement or equivalent mechanisms.

How Long We Keep Data

We keep your account data for as long as your account is active, plus 12 months after closure to resolve any outstanding matters.

We keep transaction records for 7 years after the transaction, as required for tax and accounting purposes.

We keep KYC and AML verification records for 5 years after your account is closed, as required by the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017.

We keep security logs for 12 months.

Your Rights

Under UK GDPR, you have the right to access the personal data we hold about you, rectify inaccurate data, erase your data (subject to legal retention requirements), restrict processing in certain circumstances, data portability (receive your data in a structured format), object to processing based on legitimate interests, and withdraw consent where processing is based on consent.

To exercise any of these rights, contact oceanhotspotservices@gmail.com. We will respond within one month.

Some data cannot be erased while your account is active or while legal retention periods apply (particularly KYC/AML data and tax reporting data). We will explain any restrictions when you make a request.

Cookies

We use cookies as described in our Cookie Policy. Essential cookies are required for the Platform to function. We do not use advertising cookies.

Security

We protect your data with encryption in transit (TLS 1.3) and at rest (AES-256), multi-factor authentication for admin access, role-based access controls, regular security reviews, and automated monitoring for suspicious activity.

No system is perfectly secure. If we become aware of a data breach that affects your rights, we will notify you and the Information Commissioner's Office as required by law.

Children

The Platform is not intended for anyone under 18. We do not knowingly collect data from children. If we discover we have collected data from someone under 18, we will delete it.

Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email. The date at the top of this policy shows when it was last updated.

Contact and Complaints

For any questions about this policy or your data: oceanhotspotservices@gmail.com

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk