Privacy Policy

1. Who is responsible and how to contact us

This notice concerns personal data processed through Moana Earth (https://moana.earth). OM Group Limited is the website's controller for GDPR purposes and data user under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486, “PDPO”). The PDPO and, where applicable, the EU General Data Protection Regulation (“GDPR”) govern the processing described here.

Privacy enquiries and requests for access or correction: Privacy Contact, OM Group Limited, at the postal address above or [email protected]. You may also use [email protected]. This is our privacy contact, not an appointed Data Protection Officer.

EU privacy contact and representative

Commercial register: Amtsgericht Hamburg, HRB 194421. Postal correspondence: EU Data Protection Representation for OM Group Limited.

Contact: [email protected]. Please address the message to Ocean Material Solutions GmbH, EU Data Protection Representation.

Ocean Material Solutions GmbH has been designated in writing as OM Group Limited’s EU privacy contact and, for processing to which Article 27 GDPR applies, as its representative in the Union. OM Group Limited remains the controller. Ocean Material Solutions GmbH is not the website operator, controller or Data Protection Officer.

2. Visiting the website: hosting, delivery and security

The site is delivered through Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Processing for delivery, network operation and security can include your IP address, requested address, date and time, HTTP status, browser and device information, referring page where supplied, and technical security or connection events.

These data allow requested pages to reach your device, help detect attacks and diagnose failures, and maintain availability. Where the GDPR applies, the basis is Article 6(1)(f): our legitimate interests in operating a reliable, secure public website and preventing misuse. We consider these interests against visitors' rights and limit processing to what is necessary.

Cloudflare also supplies email-address obfuscation, which can load a script from this website to display contact addresses. Network-error reporting headers can instruct supported browsers to report connection failures to Cloudflare. These features are distinct from advertising tracking.

OM Group Limited uses the Cloudflare services for this project under Cloudflare's applicable online terms and data-processing terms. The current website does not use Cloudflare Web Analytics or Zaraz. Security and network records are retained according to the enabled service, security purpose, account settings and Cloudflare's applicable contractual and legal requirements.

Provider information: Cloudflare Privacy Policy, Data Processing Addendum and subprocessors.

3. Email and telephone enquiries

If you contact us, we process your email address or telephone number, name and organisation where provided, message content, attachments and correspondence metadata to answer your enquiry and organise any requested follow-up. Providing these details is voluntary. Without a reply address and enough information about your request, we may be unable to respond. Please do not send identity documents or sensitive personal information unless specifically needed and requested.

For a contract or pre-contractual steps requested by you personally, the GDPR basis is Article 6(1)(b). For general enquiries, communications with representatives of businesses and relationship management, it is Article 6(1)(f), based on our legitimate interest in handling relevant correspondence. Article 6(1)(c) applies only where a binding EU or Member-State legal obligation requires processing; a Hong Kong obligation is not automatically treated as an Article 6(1)(c) basis.

Email links open your mail application. Clicking alone does not submit a form or subscribe you to a newsletter. Sending an enquiry does not constitute consent to unrelated advertising.

Messages sent to this website’s hello address are forwarded through Cloudflare Email Routing to a Microsoft 365 mailbox. They are currently handled only by OM Group Limited’s authorised Director; no other person routinely reads these website enquiries. Forwarding and mailbox processing involve the sender and recipient addresses, email headers, message content and attachments, for delivery, storage and handling of your enquiry. Cloudflare is the forwarding service; Microsoft 365 is the mailbox service. This routing is not permission to share enquiries with unrelated partners for their own purposes.

Provider information: Cloudflare Email Routing and Microsoft Data Protection Addendum.

The Microsoft 365 subscription is held by OM Group Limited under a Microsoft Online Subscription Agreement and is subject to Microsoft's applicable data-protection terms. The tenant’s administration view identifies Asia Pacific as the current Exchange Online data-at-rest region. This does not establish a specific data centre or exclusive processing in Hong Kong or the EU. Service logs, recovery copies and backups follow Microsoft's applicable service, security, recovery, contractual and legal requirements and are separate from the correspondence-retention rule below.

4. Editorial correspondence and information about other people

Story suggestions, source material and correction requests may include names, professional roles, statements, contact details or other personal information about you or other people. We assess such material for relevance and handle editorial correspondence to evaluate stories, verify facts, respond to corrections and protect sources. Under the GDPR, Article 6(1)(f) may support this activity where the required balance favours the legitimate interest in responsible journalism. Consent is used where genuinely appropriate; submitting material does not grant unrestricted publication permission.

Personal information used in editorial work may originate from the person concerned, correspondents, interviews, public registers, published reports or other public sources. Where Article 14 GDPR applies, the required information must be provided within its applicable time limits, unless a documented lawful exception applies. Journalistic exemptions and source protection depend on the applicable law and are not treated as a blanket exemption from privacy obligations.

Published personal information, sensitive data, allegations and private-life material require a separate assessment of necessity, accuracy, public interest and the rights involved. Published articles and their supporting evidence may be kept as an editorial archive where justified, subject to requests for correction or other applicable rights. This notice does not predetermine the outcome of that assessment.

5. Cookies, browser storage and embedded services

The website does not include advertising pixels, embedded maps or videos, social-media plugins, user accounts, newsletter sign-up or a contact-form backend. Images, styling and fonts are served as website assets rather than fetched from external font services. Cloudflare security features may use strictly necessary cookies when required to provide the requested service; their actual use and lifetime depend on the enabled features.

We offer optional Google Analytics 4 (GA4) to understand which pages are viewed. GA4 is loaded only after you actively select “Accept analytics”. If you select “Necessary only” or make no choice, the Google tag is not loaded and no analytics request is sent by our site. You may change or withdraw your choice at any time using “Privacy settings” in the footer. We save your choice in browser local storage for 180 days so it can be respected on later visits. This storage is used only to remember your privacy choice.

After consent, GA4 receives page-view information such as the page path and title, referring site, time and technical browser/device information. We strip query parameters from the page address and pass only the referring site's origin. GA4 also generates basic session and first-visit events automatically; we have disabled enhanced measurement of scrolls, outbound clicks, downloads, searches, videos and forms. We do not use Google Signals or advertising personalisation. Google Analytics uses first-party _ga cookies to distinguish visitors and sessions; we set their lifetime to at most 180 days from the first consenting visit. Withdrawing consent stops further analytics loading on subsequent pages and removes accessible GA cookies on this domain. Processing for optional analytics is based on your consent under Article 6(1)(a) GDPR, where it applies.

Google Analytics is provided by Google, which may process information outside the EU, including in the United States. Google's applicable data-processing and transfer terms govern this service. See Google's Privacy Policy and Google's Data Processing Terms. Cloudflare Web Analytics and Zaraz are not used. Browser settings can also control cookies, but do not replace our consent control.

6. Recipients and disclosure

Access is limited to authorised persons working for OM Group Limited who need the information for the relevant task, and providers of hosting, network security, optional consent-based analytics, email delivery and storage, and IT support. Professional advisers or competent authorities may receive information where necessary for advice, a legal obligation or a legal claim. A business relationship with OM Group does not by itself authorise unrestricted sharing with partners.

When a provider processes personal data on our behalf, the required contractual protections must govern that processing. We do not treat a website enquiry as permission to sell contact data or provide it to partners for their own direct marketing.

7. International processing and transfers

OM Group Limited is established in Hong Kong. Messages addressed to OM Group may be accessed there by its authorised Director. Cloudflare, Microsoft and, if you consent to analytics, Google operate internationally, including in the United States and other countries. Hong Kong does not have an EU adequacy decision.

Directly providing your own information to a Hong Kong controller and a transfer between organisations are legally distinct situations. A transfer subject to Chapter V GDPR requires an applicable transfer mechanism; merely using this website is not consent to such a transfer.

Email forwarding through Cloudflare, mailbox processing through Microsoft 365 and optional analytics through Google form part of the processing described here. For covered international transfers, the providers' applicable data-processing terms contain transfer mechanisms, including EU Standard Contractual Clauses where applicable. Information about the relevant safeguards or a copy can be requested through the privacy contacts above; legally protected information may be redacted. Provider terms do not promise exclusively EU-based storage or access.

8. How long information is kept

Retention is determined by the purpose, whether an enquiry is still open, any resulting contractual relationship, applicable statutory record-keeping obligations, and a concrete need to establish, exercise or defend legal claims. Data that are no longer needed are deleted or anonymised; duplicate attachments and irrelevant personal data should not be kept simply because they were received.

For enquiries through this website, spam and clearly irrelevant messages are deleted promptly. Completed general enquiries without a resulting business relationship are kept only for necessary follow-up, normally for no more than 24 months after completion, and deleted earlier where no longer needed. Necessary correspondence for ongoing projects, contracts or business relationships is retained for the relevant purpose and applicable statutory periods. Specific legal claims and justified editorial evidence may require longer retention, with the reason documented and reviewed at least annually.

OM Group Limited implements these rules manually, reviews the relevant messages at least annually and organises deletion to meet the applicable deadlines. The rule also covers its own copies and attachments. Provider security logs, recovery copies and backups are retained and overwritten or deleted according to their purpose, the enabled service, security needs, contractual or legal requirements and the provider's recovery cycle. They can therefore remain for a limited period after deletion from the active mailbox.

For optional Google Analytics, the GA4 property is configured to retain user-level and event-level data for two months. This setting does not necessarily remove older aggregated reports. The analytics-consent choice in your browser expires after 180 days; consented analytics cookies have a maximum configured lifetime of 180 days from the first consenting visit.

9. Your rights under the GDPR

Where the GDPR applies, you may request access and a copy, correction, erasure or restriction, subject to the relevant legal conditions. Data portability applies to data you provided where processing is automated and based on consent or contract. You may withdraw consent at any time without affecting earlier lawful processing.

You may object, on grounds relating to your particular situation, to processing based on legitimate interests. You may object to direct marketing at any time, including related profiling.

We respond without undue delay and normally within one month. A permitted extension of up to two further months requires notice within the first month and reasons. Requests are normally free; the GDPR's limited exceptions remain applicable. We may request proportionate information needed to verify identity.

You may complain to a competent supervisory authority, particularly where you habitually reside, work or where an alleged infringement occurred. In Austria this is the Austrian Data Protection Authority. You do not have to contact us before making a complaint.

10. Your rights under Hong Kong's PDPO

You may request confirmation of whether we hold your personal data, access to those data and correction of inaccurate data, subject to the PDPO. Requests can be sent to the Privacy Contact identified above. A data-access request may use the official PCPD request form.

Applicable PDPO access and correction requests are generally handled within 40 calendar days. Where compliance within that time is not possible, the required notice and reasons will be provided. Any PDPO access fee must comply with the law and not be excessive; it does not override the GDPR's free-access rules where those apply.

You may complain to Hong Kong's Privacy Commissioner for Personal Data (PCPD). Direct marketing, if introduced, requires the prescribed information about data and marketing categories, the legally required consent and a free opt-out. We do not infer that consent from an ordinary enquiry.

11. Automated decisions, security and changes

We do not use the website enquiry process to make solely automated decisions producing legal or similarly significant effects, or to profile visitors for advertising. Security systems can automatically filter suspected abusive traffic.

Access controls, appropriate technical protection and arrangements with service providers must protect personal data against unauthorised access, loss and misuse. Email is not guaranteed to be a confidential channel; contact us first if you need to transmit especially sensitive material.

Changes to the actual processing will be reflected in this notice. Material new purposes or consent-requiring services will be addressed before the relevant processing starts.