oceanone — SWIFT17 GmbH Effective date: 23/10/2026
1. Purpose
This Data Protection Policy describes how SWIFT17 GmbH (“oceanone”, “we”) collects, uses, stores, and protects personal information when providing wholesale digital marketing and related Services to Resellers (agencies and businesses).
It is designed to align with:
- EU GDPR and German BDSG / TDDDG;
- UK GDPR where UK persons are concerned;
- South African POPIA principles where relevant;
- UAE PDPL principles where relevant;
- applicable US state privacy expectations for B2B website visitors.
Governing contracts with Resellers are under German law.
2. Roles
| Situation | Our role |
|---|---|
| Your account, billing, Portal usage, our website | Controller |
| End Client personal data you instruct us to process to deliver a project | Processor (Art. 28 GDPR) under our DPA |
| Joint decisions on purposes (rare) | Only if expressly agreed in writing (Art. 26) |
We do not use End Client data for our own marketing. We do not contact End Clients or reveal that oceanone performed the work, unless you instruct us in writing.
3. Information we process
3.1 Reseller / account data (controller)
Name, email, phone, company details, VAT ID, payment metadata, IP/device logs, support communications, project metadata.
3.2 Project / End Client data (typically processor)
Only what you provide or connect for delivery, for example: brand guidelines, content, ad/social/analytics account access, End Client contact details in briefs, website credentials, creative assets.
We store what is needed to perform the work in our encrypted systems. When a project is closed, data remains archived until you request removal, subject to statutory retention (e.g. invoices).
4. How we use information
- Create and manage your account;
- Deliver ordered Services under your brand;
- Communicate about projects (with you, not End Clients);
- Process payments (Stripe — card / IBAN; EUR, ZAR, USD, GBP);
- Secure systems, prevent fraud, comply with law;
- Improve Services using aggregated or anonymised insights where possible.
5. Data protection practices
We maintain technical and organisational measures appropriate to risk, including:
- encryption in transit and at rest where applicable;
- role-based access and need-to-know;
- multi-factor authentication where offered;
- password management and least-privilege access;
- network protections (firewall / DDoS where provided by host);
- backups;
- vulnerability management and monitoring / logging;
- staff confidentiality obligations;
- vendor / sub-processor due diligence and Art. 28 contracts.
Hosting for a given project follows what you request where reasonably feasible; Portal infrastructure is operated with EU-capable providers where practicable.
6. Sharing and disclosure
We may share data with sub-processors needed to operate Services (hosting, email, project tools, AI tooling under contract, Stripe). We disclose to authorities only when legally required.
We do not sell personal data. We do not disclose your client list or End Client identities for our marketing.
7. Retention and deletion
- Active projects: retained as needed for delivery;
- Closed projects: archived in encrypted storage; removable on your request except where law requires retention;
- Contract / tax records: retained per German commercial and tax law.
Deletion / return procedures for processor data are set out in the DPA.
8. Breaches
If a personal-data breach affecting your data occurs, we will notify you without undue delay as required by Art. 33/34 GDPR and the DPA, and cooperate on required notices to authorities or data subjects.
9. Your and data subjects’ rights
Resellers and data subjects may exercise applicable rights via dpo@oceanone.io. Where we are processor, we will assist you in answering End Client requests as required by the DPA.
Complaints may be lodged with HBDI (Hesse) or another competent authority (ICO, Information Regulator ZA, etc.).
10. Contact
SWIFT17 GmbH Zimmersmühlenweg 71, 61440 Oberursel, Germany hello@oceanone.io · dpo@oceanone.io