Privacy Policy

OceanX Ltd ("we", "our", or "us") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (oceanx-ltd.com) and use our products, including NEXA, our AI-powered maritime compliance platform.

Please read this policy carefully. If you disagree with its terms, please discontinue use of our services.

We collect information you provide directly to us, including:

Account Information: Name, email address, phone number, company name, and role when you register for an account or request a demo.

Organisation Details: Company registration number (RC number), NIMASA licence number, vessel details, and other maritime-specific data you enter into our platforms.

Usage Data: Pages visited, features used, time spent, and interaction logs within our platforms.

Device & Technical Data: IP address, browser type, operating system, and device identifiers collected automatically when you access our services.

Communications: Any messages, support requests, or feedback you send us.

We use the information we collect to:

• •Provide, operate, and maintain our services and platforms
• •Process your registration and manage your account
• •Send administrative communications such as confirmations, invoices, and security alerts
• •Send compliance and certificate expiry notifications relevant to your vessels
• •Improve, personalise, and expand our services
• •Understand and analyse how you use our services
• •Develop new products, services, and features
• •Communicate with you about promotions, updates, and maritime industry news (you may opt out at any time)
• •Prevent fraud and ensure the security of our platforms
• •Comply with applicable Nigerian and international law

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following limited circumstances:

Service Providers: We engage trusted third-party companies to perform services on our behalf (e.g. cloud hosting, email delivery, payment processing). These providers are contractually bound to handle data only as instructed by us.

Regulatory Compliance: We may disclose information if required by Nigerian law, court order, or government authority, including NIMASA, NPA, or other maritime regulatory bodies.

Business Transfers: If OceanX Ltd undergoes a merger, acquisition, or asset sale, your information may be transferred as part of that transaction.

With Your Consent: We will share your information with third parties when you have given us explicit permission to do so.

Your data is stored on secure cloud servers provided by Supabase (hosted on AWS infrastructure). We implement industry-standard security measures including:

• •Encryption in transit (TLS/HTTPS) and at rest (AES-256)
• •Role-based access controls so only authorised personnel can access your data
• •Regular security assessments and vulnerability testing
• •Audit logs for all data access events

While we take reasonable precautions, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your data.

We retain your personal information for as long as your account is active or as needed to provide you services. If you close your account, we will delete or anonymise your personal data within 90 days, unless we are required to retain it longer by law (for example, for tax or regulatory compliance purposes).

Certificate records and compliance history may be retained for up to 7 years to comply with maritime regulatory requirements.

Depending on your location, you may have the following rights regarding your personal data:

• •Access: Request a copy of the personal data we hold about you
• •Correction: Request that we correct inaccurate or incomplete data
• •Deletion: Request that we delete your personal data (subject to legal retention obligations)
• •Portability: Request your data in a machine-readable format
• •Objection: Object to our processing of your data for marketing purposes
• •Withdrawal of Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at legal@oceanx-ltd.com. We will respond within 30 days.

We use cookies and similar tracking technologies to improve your experience on our website. Cookies we use include:

• •Essential cookies: Required for the website and platform to function correctly
• •Analytics cookies: Help us understand how visitors interact with our website (e.g. page views, session duration)
• •Preference cookies: Remember your settings such as language and theme

You can control cookies through your browser settings. Disabling essential cookies may impair the functionality of our services.

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately at legal@oceanx-ltd.com and we will take steps to delete that information.

Our website and platforms may contain links to third-party websites including regulatory body portals (NIMASA, NPA) and industry resources. We are not responsible for the privacy practices of those websites and encourage you to read their privacy policies.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the updated policy on our website with a revised "Last Updated" date. We encourage you to review this policy periodically.

This policy gives you certain rights in respect of the personal data OceanX Ltd holds. At any point while OceanX Ltd is in possession of or processing your personal data, you have the following rights:

• •Right to Access: You have the right to request access to a copy of the information that we hold about you in a commonly structured format.
• •Right to Lodge Complaints: You have the right to lodge a complaint with the Nigeria Data Protection Commission if you have reason to believe that your rights have been violated.
• •Right to Rectification: You have the right to correct data that we hold about you that is inaccurate or incomplete.
• •Right to Erasure: You have the right to request that the data we hold about you be erased from our records where there is no compelling legal or regulatory requirement for its continued processing.
• •Right to Restrict Processing: Where certain conditions apply, you have a right to restrict processing or withdraw your consent at any time.
• •Right to Data Portability: You have the right to request that the data we hold about you be transferred to another organisation.
• •Right to Object: You have the right to object to automated processing, including profiling of your data.

In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data, OceanX Ltd shall, within 72 hours of having knowledge of such breach, report the details of the breach to the Nigeria Data Protection Commission.

Furthermore, where we determine that such a breach is detrimental to your rights and freedoms in relation to your Personal Data, we will, as soon as reasonably practicable, take steps to inform you of the breach incident, the risk to your rights and freedoms resulting therefrom, and any course of action to remedy said breach.

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us:

OceanX Ltd Email: legal@oceanx-ltd.com Address: Lagos, Nigeria

If you believe that your Personal Data has not been handled correctly, or you are unhappy with our response to any requests you have made regarding the use of your Personal Data, you have the right to complain to the Nigeria Data Protection Commission:

Nigeria Data Protection Commission Tel: +234 (0) 916 061 5551 Email: info@ndpc.gov.ng Website: https://ndpc.gov.ng

Where you remain dissatisfied, you reserve the right to explore other appropriate legal remedies as guaranteed under Nigerian law.

We take all privacy enquiries seriously and will respond within 30 business days.