Privacy Policy

01 Who We Are

OceanCloud LLC ("OceanCloud", "we", "us", "our") is a company registered in the United States with its principal office in the United States.

We are a Microsoft Solutions Partner providing SharePoint and Microsoft 365 consultancy services. OceanCloud is the data controller for personal data collected through this website and in the course of our consulting engagements.

02 Data We Collect

Information you provide directly

• Name, email address, phone number, and company name submitted via our contact form
• Project details, requirements, or messages you send us
• Information shared during discovery calls or consultations
• Billing and payment information during commercial engagements

Information collected automatically

• IP address, browser type, operating system, and referring URLs
• Pages visited, time on site, and clickstream data via analytics
• Cookie identifiers, advertising identifiers, and similar technologies where analytics or advertising services are enabled — see our Cookie Policy for full details

Information from third parties

• LinkedIn profile data when you connect with us professionally
• Referral information from partner organisations

03 How We Use Your Data

We use the personal data we collect for the following purposes:

• Responding to enquiries and booking discovery calls
• Delivering contracted consultancy services and projects
• Sending relevant updates about our services (where you have opted in)
• Improving our website and understanding user behaviour through analytics
• Displaying, measuring, and improving advertisements if Google AdSense or similar advertising services are enabled
• Meeting our legal and regulatory obligations
• Fraud prevention and security monitoring

We will never sell, rent, or trade your personal data to third parties for marketing purposes.

04 Legal Basis for Processing

Under UK GDPR, we process your data on the following lawful bases:

• Contract — to perform a contract or take steps at your request before entering one
• Legitimate Interests — to respond to enquiries, improve our services, and operate our business securely
• Consent — for marketing communications, analytics cookies, advertising cookies, and other non-essential cookies where consent is required (you may withdraw at any time)
• Legal Obligation — where processing is required to comply with applicable law

05 Sharing Your Data

We may share your personal data with carefully selected third parties, including:

• Microsoft Corporation — for Microsoft 365 tools used in service delivery (covered by the Microsoft Data Processing Agreement)
• Analytics providers — Google Analytics 4 (only activated after you accept cookies — see our Cookie Policy)
• Advertising providers — Google AdSense and related Google advertising services, if enabled, to display ads, measure ad performance, prevent fraud, and comply with advertising policies
• AI service providers — Groq, used to power our OceanBot chatbot with the Llama 3.3 model. Chat queries are transmitted to Groq's API to generate a response and are not linked by OceanCloud to your personal identity unless you choose to include personal information in the chat
• Form delivery — EmailJS Ltd, used to transmit contact form submissions to our team. No data is stored by EmailJS beyond delivery
• CRM and email tools — used to manage client communications, each bound by data processing agreements
• Legal and regulatory bodies — where required by applicable law or court order

All third-party processors are vetted and required to maintain appropriate data protection standards.

06 Data Retention

• Enquiry and contact form data: 2 years from last contact, unless a contract is formed
• Client project data: 7 years following project completion (for legal and financial compliance)
• Analytics data: 13 months rolling window
• Advertising and consent records: retained according to Google platform settings, browser cookie duration, and legal compliance requirements
• Marketing opt-in records: Indefinitely until consent is withdrawn

When retention periods expire, data is securely deleted or anonymised.

07 Your Rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — ask us to limit how we process your data
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests or for direct marketing
• Withdraw consent — at any time where processing is based on consent

To exercise any right, email us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

08 Security Measures

We take data security seriously. Our measures include:

• TLS encryption for all data in transit
• AES-256 encryption for data at rest
• Access controls and multi-factor authentication across all internal systems
• Regular security assessments and penetration testing
• Staff training on data protection obligations
• ISO 27001-aligned information security policies

09 International Transfers

Your personal data is primarily stored and processed within the UK and the European Economic Area (EEA). Where data is transferred outside these regions (for example to Microsoft datacentres), it is protected by:

• UK International Data Transfer Agreements (IDTAs)
• Standard Contractual Clauses (SCCs) approved by the ICO
• Microsoft's EU Data Boundary commitments

10 Contact & Data Protection Officer

For any data protection queries, requests, or complaints:

• Email: [email protected]
• Post: Data Protection Officer, OceanCloud LLC, United States

We are registered with the Information Commissioner's Office (ICO). Our ICO registration number will be published here once confirmed.

11 Children's Privacy

Our website and consulting services are directed at business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 16. If you believe we have inadvertently collected data from a minor, please contact us at [email protected] and we will delete it promptly.

12 Automated Decision-Making

OceanCloud does not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you. Our AI-powered chatbot is used solely to answer general enquiries about our services and does not make decisions that affect your rights or access to services.

13 Advertising & Google AdSense

OceanCloud may use Google AdSense or similar advertising services to display ads on selected pages of this website. Google and its partners may use cookies, web beacons, device identifiers, IP addresses, browser information, and similar technologies to serve ads, limit ad repetition, measure ad performance, detect invalid activity, and provide reporting.

Depending on your location and consent choices, ads may be personalised or non-personalised. Personalised ads use information such as previous visits to this and other websites to make advertising more relevant. Non-personalised ads use contextual information such as page content, approximate location, browser type, and time of day.

You can learn how Google uses data from partner sites at How Google uses information from sites or apps that use our services. You can manage Google ad personalisation at Google Ads Settings.

We do not currently place ads on pages that are primarily legal notices, search utilities, contact workflows, or curated Microsoft news/archive pages unless those pages are later updated with sufficient original commentary and reviewed for policy compliance.

14 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Continued use of our website or services after any changes constitutes your acknowledgement of the updated policy. For significant changes affecting how we use your data, we will take reasonable steps to notify affected individuals directly.