Privacy Policy

Updated: September 30, 2026

1. WHO IS RESPONSIBLE?

The controller for this website is:

OM Group Limited
6/F, Cheung Hing Industrial Building
12P Smithfield Road, Kennedy Town, Hong Kong
Website: www.oceanmaterial.com
Privacy enquiries and requests: support@oceanmaterial.com

This policy applies to oceanmaterial.com. KOMA KARANTH FOUNDATION LIMITED and other external websites provide their own privacy information.

EU DATA PROTECTION REPRESENTATIVE

Ocean Material Solutions GmbH
Graumannsweg 61, 22087 Hamburg, Germany
Commercial register: Amtsgericht Hamburg, HRB 194421
Email: support@oceanmaterial.com

Ocean Material Solutions GmbH is OM Group Limited’s appointed EU data protection representative under Article 27 GDPR for oceanmaterial.com where that provision applies. Individuals and supervisory authorities may contact the representative about the processing covered by the mandate. OM Group Limited remains the controller.

2. DATA WE PROCESS AND WHY

Website delivery and security

When you access the website, technical data needed to deliver and secure it may be processed. This can include your IP address, date and time, requested address, referrer, browser and device information, response status and security signals.

Where the GDPR applies, this processing is based on our legitimate interests in providing a reliable and secure business website and preventing abuse (Article 6(1)(f) GDPR). Comparable purposes apply under Hong Kong’s Personal Data (Privacy) Ordinance (PDPO).

Contact and sample requests

The contact and sample forms collect the fields shown in the relevant form. Depending on the form, these may include your name, company, role, email address, country, inquiry category, requested material, product page, message and optional project details. The forms do not request payment-card, passport or identity-document data. Please do not include sensitive personal information unless it is necessary and we have asked you to provide it.

We use this information to answer your inquiry, assess a requested sample or project, take steps requested before a possible contract and keep necessary business correspondence. Where the GDPR applies, the legal bases are Article 6(1)(b) GDPR for pre-contractual steps and Article 6(1)(f) GDPR for general business communication, follow-up and the establishment, exercise or defence of legal claims.

Direct email

If you email us, we process your address, message, attachments and related delivery information to deal with the communication. The applicable purposes and legal bases are the same as for contact and sample requests.

If you actively subscribe, we use your email address to send Ocean Material updates. Where the GDPR applies, the legal basis is your consent (Article 6(1)(a) GDPR). You may withdraw consent at any time with effect for the future by using an unsubscribe option in a message or contacting support@oceanmaterial.com. Withdrawal does not affect processing already carried out lawfully.

Newsletter registration is separate from inquiries, sample requests and donations. We do not add donors or business contacts automatically.

3. SERVICE PROVIDERS AND RECIPIENTS

We use the following providers to operate the reviewed website:

Cloudflare: Cloudflare Pages and Functions deliver and protect the website and process technical request and security data. If Cloudflare Turnstile is enabled, it processes browser and device signals to distinguish people from automated traffic. Cloudflare privacy information and Turnstile privacy information.
Resend (Plus Five Five, Inc.): Form submissions are transmitted through Resend’s email-delivery service to the Ocean Material recipient mailbox configured for the form. This includes the form content and sender email address. Resend privacy information and data processing addendum.
Email and IT providers: The configured recipient mailbox and supporting IT providers process communications so that authorised personnel can respond and administer them.
YouTube: The reviewed video sections use a local preview image. A connection to YouTube’s privacy-enhanced domain is made only after you choose to play a YouTube video. YouTube/Google then processes technical usage data under its own terms. Google privacy information.

We may also disclose relevant data to professional advisers, contractual partners involved in your request or authorities where necessary for the stated purpose, the handling of legal claims or compliance with law. We do not sell personal data.

4. STORAGE AND DELETION

Spam and obviously irrelevant messages are deleted promptly. Completed general website inquiries that do not lead to a continuing business relationship are normally kept for no more than 24 months after the inquiry is closed and are deleted earlier when no longer needed.

Information required for a continuing project, contract, accounting, tax, compliance obligation or legal claim is kept for the applicable purpose and period. Newsletter data is kept until you withdraw consent or the newsletter service ends; a minimal record may be retained where necessary to document the withdrawal or prevent further mailings.

Cloudflare, Resend and other infrastructure providers may keep security logs, delivery records, backups and recovery copies under their documented technical retention cycles. These copies are restricted to the relevant operational, security and legal purposes and are deleted or overwritten according to those cycles.

5. COOKIES AND GOOGLE ANALYTICS

We use Google Analytics 4, provided in the EEA by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand use of this website. Analytics is optional and starts only after you select “Accept analytics” in the cookie banner. Selecting “Reject analytics” allows you to use the website without Google Analytics.

With your consent, Google processes page views, interactions, approximate location, browser/device information and cookie identifiers. Google receives technical connection data, including your IP address; GA4 does not log or store individual IP addresses. The legal basis, where the GDPR applies, is consent under Article 6(1)(a), together with applicable consent rules for device storage/access.

The first-party cookies _ga and _ga_* distinguish visitors and sessions. This website configures their lifetime to 180 days without refreshing expiry on each visit. Advertising personalisation and Google Signals are disabled in this integration. Analytics is not loaded before consent, including for cookieless measurement.

Your choice is saved in local storage as om-cookie-consent-v1 for up to 180 days. This preference storage is necessary to remember and respect your selection. You can change or withdraw consent at any time through “Cookie settings” in the footer. Withdrawal stops this integration’s further collection and removes its accessible first-party Analytics cookies; it does not retroactively delete data already sent to Google. Contact us about deletion requests.

Further information: Google privacy information, Google Analytics data safeguards. Google’s processing may involve the United States and other countries; its transfer safeguards describe the applicable mechanisms. Analytics event-data retention is controlled separately in the Analytics account.

If configured, Cloudflare Turnstile is used only to protect forms against abuse. Cloudflare describes the associated signals and strictly necessary technologies in its Turnstile privacy information. YouTube content is loaded only after you press the play button, as described above.

If we introduce further optional services, we will update this information and request any additional consent required.

6. INTERNATIONAL PROCESSING

OM Group Limited is located in Hong Kong. Cloudflare and Resend are global or US-based providers and may process data outside your country, including in the United States and the European Economic Area. Where the GDPR requires transfer safeguards, the providers state that they use recognised mechanisms such as the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. Their current information is linked in section 3.

7. THE CIRCULAR ROADSHOW AND NGO DONATIONS

Ocean Material develops The Circular Roadshow concept and learning content. KOMA KARANTH FOUNDATION LIMITED organises local delivery. A direct external NGO donation route is being prepared; Ocean Material does not currently operate a donation checkout on this website.

The intended recipient is KOMA KARANTH FOUNDATION LIMITED, incorporated in Hong Kong, company number 3216673. Under the planned arrangement, the NGO and its payment provider will handle donor and payment information for their respective purposes. Review the privacy and payment information at the donation destination before providing personal data.

The planned route does not automatically transfer donor details to Ocean Material or enrol donors in our newsletter. If you contact Ocean Material separately, we process the information you send under this policy. Send payment and receipt enquiries directly to the NGO at maitreyi@komakaranthfoundation.org, and do not send card details to Ocean Material.

Earlier donations remain subject to the recipient and processing arrangements used at the time. For a historic donation enquiry, use the details on the original receipt.

8. EXTERNAL LINKS

When you follow an external link, review the privacy information provided by the destination website.

9. YOUR RIGHTS

Subject to the applicable law and relevant conditions, you may request access to and correction of your personal data. Where the GDPR applies, you may also request erasure, restriction or portability, object to processing based on legitimate interests or withdraw consent with effect for the future.

Send requests to support@oceanmaterial.com. We may need information to verify your identity and locate the relevant records. You may complain to the Hong Kong Privacy Commissioner for Personal Data or, where applicable, the data protection authority in the EU/EEA country of your habitual residence, workplace or the alleged infringement.

10. SECURITY AND CHANGES

We use proportionate technical and organisational measures designed to protect personal data. No transmission or storage method is completely secure.

We may update this policy when the website, providers or legal requirements change. The current version and update date will be published on this page.