GDPR Statement

📅 Effective Date: 1 January 2025

Our Data Controller Details

Indian Occean Limited is the data controller for all personal data collected through our website, services, and communications. Our contact details for data protection matters are:

• Email: info@occeanindian.com
• Phone: +44-7827-094186
• Address: London, United Kingdom

The Six Principles of UK GDPR — How We Apply Them

1. Lawfulness, Fairness, and Transparency

We only process personal data where we have a valid legal basis under UK GDPR (contract performance, legitimate interests, legal obligation, or consent). We are transparent about how we use data through this statement and our Privacy Policy.

2. Purpose Limitation

We collect personal data for specified, explicit, and legitimate purposes. We do not use personal data for purposes incompatible with those for which it was collected. For example, data collected to fulfil a booking is not used for marketing without separate consent.

3. Data Minimisation

We only collect the personal data that is necessary for the specific service or purpose. We do not collect excessive information and regularly review what we hold to ensure we only retain what is needed.

4. Accuracy

We take reasonable steps to ensure that personal data we hold is accurate and, where necessary, kept up to date. We encourage clients to inform us of any changes to their personal information.

5. Storage Limitation

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our detailed retention schedule is available in our Privacy Policy.

6. Integrity and Confidentiality (Security)

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage. This includes secure password practices, encrypted email communications where possible, and restricted access to personal data within our organisation.

Your Rights Under UK GDPR

As a data subject, you have the following rights, which we are committed to honouring:

• Right of access (Subject Access Request): You can request a copy of all personal data we hold about you. We will respond within one calendar month.
• Right to rectification: If data we hold about you is inaccurate or incomplete, you can ask us to correct it.
• Right to erasure ("right to be forgotten"): In certain circumstances, you can ask us to delete your personal data.
• Right to restrict processing: You can ask us to temporarily stop processing your data in certain circumstances.
• Right to data portability: Where processing is based on consent or contract and carried out by automated means, you can request your data in a structured, commonly used, machine-readable format.
• Right to object: Where processing is based on legitimate interests, you can object and we will assess whether our interests override your rights.
• Rights related to automated decision-making: Indian Occean Limited does not use automated decision-making or profiling.

How to Exercise Your Rights

To exercise any of the above rights, please contact us at info@occeanindian.com with the subject line "Data Subject Request". We may need to verify your identity before fulfilling your request. We will respond within one calendar month. This service is free of charge in most circumstances.

How to Complain

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection:

• Website: ico.org.uk
• Helpline: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns directly before you approach the ICO, and encourage you to contact us first.

Data Breach Procedures

In the event of a personal data breach, Indian Occean Limited will assess the risk to individuals and, where required by UK GDPR, notify the ICO within 72 hours. We will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Third-Party Processors

Where we use third-party companies to process personal data on our behalf (such as payment processors and email providers), we ensure they are bound by appropriate data processing agreements and comply with UK GDPR requirements.

Review of This Statement

This GDPR Statement is reviewed at least annually and updated as necessary to reflect changes in our data processing activities or applicable legislation.