# Privacy Policy (EU GDPR) | Ocean Archive

URL: https://oceanarchive.net/privacy-policy

Privacy Policy for Ocean Archive, outlining GDPR rights, data processing, and contact for a not-for-profit foundation based in the EU.

---

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Ocean Archive service (the “Service”). The Service is operated by a not-for-profit foundation based in the European Union. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable EU and Member State data protection laws.

### DATA CONTROLLER

For the purposes of the GDPR, the data controller is the not-for-profit foundation operating Ocean Archive. If you have questions about this policy or your rights, please contact us via the Contact page.

### WHAT DATA WE COLLECT

- Account information (e.g., name, username, email)

- Usage data (e.g., pages viewed, features used, device and browser type)

- Content you submit (e.g., media, comments, metadata)

- Technical data (e.g., IP address, cookies, approximate location)

### LAWFUL BASES FOR PROCESSING

- Consent (Article 6(1)(a)) for optional features such as analytics or marketing communications

- Contract (Article 6(1)(b)) to provide and maintain the Service

- Legal obligations (Article 6(1)(c)) where required by law

- Legitimate interests (Article 6(1)(f)) such as ensuring security, preventing abuse, and improving the Service

### HOW WE USE YOUR DATA

- Provide, operate, and improve the Service

- Maintain account authentication and security

- Analyze usage to develop features that support our non-profit mission

- Communicate important updates and respond to enquiries

### DATA SHARING AND TRANSFERS

We do not sell personal data. We may share data with trusted processors who support our operations (e.g., hosting, analytics) under GDPR-compliant data processing agreements. Where data is transferred outside the EEA, we rely on appropriate safeguards such as adequacy decisions and Standard Contractual Clauses.

### DATA RETENTION

We retain personal data only as long as necessary for the purposes described in this policy, unless a longer retention period is required or permitted by law.

### YOUR RIGHTS UNDER GDPR

- Right of access, rectification, and erasure

- Right to restrict or object to processing

- Right to data portability

- Right to withdraw consent at any time (where processing is based on consent)

- Right to lodge a complaint with your local supervisory authority

To exercise your rights, please contact us via the Contact page. We may need to verify your identity before responding to your request.

### SECURITY

We implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

### CHILDREN’S PRIVACY

Our Service is not directed to children under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

### CHANGES TO THIS POLICY

We may update this Privacy Policy periodically. We will indicate the latest update date at the top of this page.

### CONTACT

If you have any questions or concerns about this Privacy Policy or our data practices, please reach out via the Contact page.