oceanone — SWIFT17 GmbH Effective date: 23/10/2026 Languages: English (primary). German version available separately.
1. Who we are
This Privacy Policy explains how SWIFT17 GmbH (“we”, “us”, “oceanone”) processes personal data when you visit our websites, create an account, or use our white-label digital marketing services.
| Controller | SWIFT17 GmbH |
|---|---|
| Register | HRB 16660, Amtsgericht Bad Homburg vor der Höhe |
| Address | Zimmersmühlenweg 71, 61440 Oberursel, Germany |
| Managing Director | Armand de Beer |
| VAT ID | DE369492000 |
| Contact | hello@oceanone.io |
| Data Protection Officer | dpo@oceanone.io |
We operate internationally (including the United States, DACH, United Kingdom, UAE, and South Africa). Where local laws apply in addition to the GDPR (e.g. UK GDPR, POPIA, UAE PDPL, US state privacy laws), we honour applicable rights as described below.
2. Scope
This Policy covers:
- visitors to oceanone websites and marketing pages;
- Resellers / agencies who create accounts and order services;
- contact persons at business customers;
- newsletter or enquiry submitters.
It does not replace the End Client privacy notices that you (as Reseller) must publish for your own customers. When we process End Client data solely to deliver your ordered work, we generally act as your processor under Art. 28 GDPR (see our Data Processing Agreement and Data Protection Policy).
3. What data we collect
Depending on how you interact with us, we may process:
| Category | Examples | Source |
|---|---|---|
| Identity & contact | Name, email, phone, company, job title, address, VAT ID | You |
| Account | Login credentials, preferences, roles, activity in the Portal | You / automated |
| Project / client work | Briefs, brand assets, access credentials, End Client details you upload | You (Reseller) |
| Payment | Payment status, last4 / IBAN metadata via Stripe (we do not store full card numbers) | You / Stripe |
| Technical | IP address, device/browser data, logs, approximate location | Automated |
| Communication | Support tickets, emails, call notes | You / us |
| Marketing | Newsletter opt-in, campaign engagement | You / us |
We do not intentionally collect special-category data (Art. 9 GDPR). Please do not upload such data unless we have agreed a specific lawful basis in writing.
4. Why we process data (purposes & legal bases)
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide website, account, and contracted Services | Art. 6(1)(b) contract |
| Payment, invoicing, accounting | Art. 6(1)(b), Art. 6(1)(c) |
| Customer support and service communications | Art. 6(1)(b), Art. 6(1)(f) |
| Security, fraud prevention, abuse detection | Art. 6(1)(f) |
| Improve Services and Portal (aggregated / limited analytics) | Art. 6(1)(f) or consent where required |
| Marketing emails / newsletter | Art. 6(1)(a) consent and/or § 7 UWG where applicable |
| Legal claims and compliance | Art. 6(1)(c), Art. 6(1)(f) |
| Processing End Client data on your instructions | Art. 28 GDPR + DPA (processor) |
Legitimate interests (Art. 6(1)(f)) include securing our systems, B2B relationship management, and improving white-label delivery. You may object under Art. 21 GDPR (see Section 10).
5. Cookies and similar technologies
We use technically necessary cookies to run the site and account area. Analytics or marketing cookies are used only with consent where required (e.g. TDDDG in Germany / ePrivacy). Details are in our Cookie Policy and cookie settings.
6. Who we share data with
We share personal data only as needed with:
- Payment: Stripe (card / IBAN; EUR, ZAR, USD, GBP);
- Hosting & infrastructure: providers you request for a project and/or our chosen EU-capable hosts for the Portal;
- Operations tools: email, support, project management, and (where used) AI tooling under contract;
- Professional advisers (legal, tax, accounting) under confidentiality;
- Authorities where required by law.
We do not sell personal data. We do not disclose your identity as our customer to End Clients, and we do not contact your End Clients, except with your written instruction (white-label model).
7. International transfers
If data is transferred outside the EEA / UK, we use appropriate safeguards (EU Standard Contractual Clauses, adequacy decisions such as the EU–US Data Privacy Framework where applicable, or other lawful mechanisms). Stripe and some tool vendors may process data in the US under such safeguards.
8. Retention
| Data | Typical retention |
|---|---|
| Account & contract data | Duration of relationship + statutory periods (e.g. German commercial/tax retention up to 10 years where applicable) |
| Project / access data | While needed for active work; archived after close; deleted on Reseller request subject to law |
| Support correspondence | Up to 3 years after last interaction, unless longer needed for claims |
| Marketing consent records | Until withdrawal + proof period |
| Server logs | Short period unless needed for security investigations |
9. Security
We apply appropriate technical and organisational measures, including encryption in transit and at rest where applicable, access control (including 2FA where offered), least-privilege access, backups, monitoring, and vendor due diligence. No method of transmission or storage is 100% secure.
10. Your rights
Subject to applicable law (GDPR / UK GDPR / POPIA / UAE PDPL / US state law), you may have the right to:
- access, rectification, erasure;
- restriction and portability;
- object to processing based on legitimate interests or to direct marketing;
- withdraw consent at any time (without affecting prior lawful processing);
- lodge a complaint with a supervisory authority.
Lead supervisory authority (Germany): Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI) — https://datenschutz.hessen.de
UK: Information Commissioner’s Office (ICO) South Africa: Information Regulator UAE: relevant PDPL supervisory body California / other US states: rights as provided under applicable state law (e.g. access, delete, correct, opt-out of sale/sharing — we do not sell personal information).
To exercise rights: dpo@oceanone.io or hello@oceanone.io.
11. Children
Our Services are directed at businesses. We do not knowingly collect data from children under 16 (or higher age required locally).
12. Automated decisions / AI
We may use AI-assisted tools to help produce marketing content or analyse performance on your instructions. We do not make solely automated decisions that produce legal or similarly significant effects about you without human involvement (Art. 22 GDPR). Where AI features are used in Services, additional transparency may appear in the product or order description (AI Act Art. 50 where applicable).
13. Changes
We may update this Policy. The “Effective date” will change; material changes will be notified via the Portal or email where appropriate.
14. Contact
SWIFT17 GmbH — oceanone Zimmersmühlenweg 71, 61440 Oberursel, Germany hello@oceanone.io · dpo@oceanone.io