Skip to content
Ocean 6

Legal

Privacy

Effective date: 20 October 2026

Effective date: 20 October 2026

OCEAN 6 SDN. BHD. (Registration No. 202601005724 (1667822-A)) (“Ocean6”, “we”, “us”, “our”) operates the Ocean6 website, the Ocean6 Affiliate mobile application, and related services (collectively, the “Service”).

This Privacy Policy explains what personal data we collect, why we use it, when we share it, how long we keep it, and your choices under applicable law, including Malaysia’s Personal Data Protection Act 2010 (PDPA).

Data user / controller: OCEAN 6 SDN. BHD.
Registration No. 202601005724 (1667822-A)
Registered address:
NO. 19 JALAN 7/7C
SECTION 7
BANDAR BARU BANGI
SELANGOR 43650
MALAYSIA

For privacy, access, correction, or deletion requests, contact hey@theocean6.com.

Depending on how you use the Service, we may collect:

  • Account data: name, email address, password hashes, account identifiers, and market.
  • Creator profile and media data: profile details, creator application information, and avatar, social-media identity or other profile/media URLs returned through an authorised connected feature. Submitted video links and associated cover or source URLs may identify your photos or videos; this does not give Ocean6 access to your device photo library.
  • Website enquiry data: name, email, phone number, company or handle, message content, audience type, and related contact details submitted through our website forms.
  • Service activity and preferences: catalog, campaign, showcase, sample-request, and content-submission activity within Ocean6 Affiliate. When signed in, your selected favourite category is saved with your account and market so the category shortcut can be restored. This user-selected preference is not a claim of behavioural recommendations or cross-app tracking.
  • Submitted content: captions, content links, proof links, and review-related information.
  • Delivery data: shipping recipient name, phone number, and delivery address when you apply for a sample.
  • Support and concern reports: information you send to support. An in-app Spark concern report stores your account identifier, the submission reference, a selected reason (abusive content, unwanted sharing, or other concern), timestamps and its review/resolution status. Reports do not copy the video or Spark code into the report record.
  • Technical and security data: device information, app version, IP address, log data, and security events. Website lead forms may store IP addresses for spam prevention and rate limiting.

We use personal data to:

  • create, authenticate, and secure accounts;
  • provide the creator catalog, campaigns, samples, and showcase features;
  • review creator applications, sample requests, and content submissions;
  • process and respond to website enquiries and support requests;
  • send account, verification, password-reset, and service messages;
  • prevent fraud, abuse, and security incidents;
  • comply with legal obligations; and
  • improve reliability and support.

Under the Personal Data Protection Act 2010 (PDPA), we process personal data with your consent unless the law permits processing without consent. Depending on the activity, processing may also be based on: performance of a contract with you (or steps at your request before entering a contract); compliance with a legal obligation; or a purpose directly related to the reason the data was collected, where the data processed is adequate, relevant, and not excessive for that purpose. We do not rely on any basis that is not permitted by the PDPA for the relevant activity.

PDPA notices must explain whether supply of personal data is obligatory or voluntary and the consequences if you do not provide it. The following applies to the main ways you interact with Ocean6:

  • Mobile account registration and sign-in (required): name, email address, password, acceptance of our Terms and Privacy Policy, and verification codes are required to create and secure an account. If you do not provide this information, you cannot register, sign in, or use authenticated app features.
  • Optional profile fields (voluntary): you may provide editable fields such as display name, phone number and bio. TikTok identity and avatar fields are returned through the authorised connected profile feature; the Account profile form does not let you upload an avatar or manually replace those protected TikTok fields. Omitting optional editable fields does not prevent basic use, although a feature you choose may require additional information.
  • Sample shipping (required only for fulfilment): recipient name, phone number, and delivery address are required only when you apply for a sample and provide or select a shipping address for approved fulfilment. Without this information, we cannot ship an approved sample to you.
  • Website enquiry forms (mostly required for submission): name, email, and phone are required to submit an enquiry. Message, handle, or company/brand fields are voluntary unless the selected form tab marks them as required. The consent checkbox to be contacted about Ocean6 services is required to submit the form. If you do not provide required enquiry fields or consent, we cannot accept or respond to your enquiry through that form.
  • Support email (voluntary): you choose what personal data to include when you email hey@theocean6.com. We need enough information to identify your account or enquiry to help you.

We collect personal data only from sources that apply to your use of the Service:

  • Directly from you: when you register or sign in to Ocean6 Affiliate; edit your profile; submit team-binding or campaign content; apply for samples; save shipping addresses; request account deletion; email support; or submit website enquiry forms.
  • Generated by our systems: password hashes, account identifiers, authentication/session tokens, security and application logs, and IP addresses used for rate limiting or spam prevention (including on website lead forms).
  • From TikTok when you connect an account: if you authorise TikTok connection, we receive OAuth identifiers (such as open_id), tokens, granted scopes, and binding status. Where enabled, we may sync commerce-related activity linked to your connected account, such as order, commission, sample-status, or showcase/product activity. We do not use TikTok order sync to collect buyer personal data in our systems.
  • Optional website analytics: if analytics tools (for example Google Tag Manager or Google Analytics) are enabled in site settings, those tools may collect usage information through cookies or similar technologies as described in Section 12.

We do not automatically import seller or third-party platform personal contact details (such as seller email or phone records) into Ocean6. Editable profile information such as display name, phone number and bio comes from you. Protected TikTok identity and avatar display information comes from the authorised connected profile feature when returned by the provider, not a manual avatar upload.

TikTok Shop authorizations: Ocean6 account registration and login use Ocean6 email and password. Optional TikTok Shop connections are separate. Where enabled and consented, our backend stores encrypted Shop access and refresh credentials for the approved creator, seller or partner permissions, refreshes them, and may synchronize authorized business data in scheduled server jobs while the mobile app is closed. A Shop connection is not a Spark Ads authorization code. Disconnect in Account removes Ocean6’s saved creator credentials and disables its creator data access; manage the provider’s authorization separately in TikTok Shop. We do not claim that a local disconnect revokes provider-side authorization.

Private Spark contributions: when you submit a TikTok video URL and Spark Ads code, Ocean6 saves them for authorized Ocean6 staff and, where ownership and consent are verified, the relevant seller. Separately opting in to Team leadership sharing permits the current Team Leader and Supreme Leader for the disclosed Team/Group to view the video/code and manually hand it to the confirmed seller. There is no public Spark feed in Ocean6. The code is creator-provided; Ocean6 does not verify ownership, code validity, expiry, ad delivery or advertising results. Withdrawal prevents further Ocean6 delivery but cannot retract copies already shared or revoke advertising authorization. Manage that authorization in TikTok and with the advertiser.

Screening and concern reports: Spark contributions await Ocean6 admin screening before authorised seller or opted-in leadership delivery. Screening does not verify ownership, code validity or advertising results. Use “Report a concern” on a supported submission screen, or email hey@theocean6.com with the submission reference without sending the Spark code. A report on an approved contribution holds further Ocean6 delivery for admin review. Authorised admins can review and resolve reports, reject contributions or remove their private video/code material. Authorised staff can suspend abusive accounts. There is no public Spark feed, peer messaging or creator-to-creator blocking feature; account suspension is a staff action.

Ocean6 may offer TikTok connection or showcase-related features where available and authorised. Availability depends on platform approval, account eligibility, and enabled permissions. Ocean6 does not promise live TikTok earnings sync, product sync, sample sync, affiliate-link generation, or any specific TikTok outcome unless we expressly state that a feature is live.

We may share data only as needed with:

  • staff and authorised operators who administer the Service, including admins handling concern reports and content removal under their access permissions;
  • hosting, email, security, and technology providers acting for Ocean6;
  • delivery or fulfilment partners when a sample requires delivery;
  • sellers, campaign operators, or creators involved in the relevant request or campaign;
  • authorities or other parties where required by law; and
  • another party if Ocean6 undergoes a merger, acquisition, or asset transfer.

We do not sell personal data.

Our providers or systems may process data outside Malaysia. Where this occurs, we take reasonable steps to protect data consistent with applicable law.

We keep data only for as long as reasonably necessary for the purposes in this Policy, including security, dispute resolution, legal compliance, and audit requirements. Website lead submissions are generally kept for up to 24 months. After that period, a daily retention process removes or anonymises enquiry personal data unless a legal or security hold applies. Only non-identifying lead metadata on an explicit allowlist (lead type, submission month, mail-delivery flag, and purge timestamp) may be kept for aggregate reporting.

Production hosting must configure a real server cron job to run WordPress scheduled tasks (for example via system cron calling wp cron event run --due-now or wp-cron.php). Traffic-based WP-Cron alone is not sufficient to guarantee timely lead retention.

Request account deletion in the app under Account. The existing grace period is at least seven days; eligibility for processing is not a guarantee of completion on a particular date. Once processed, Ocean6 removes private Spark contributions and saved creator OAuth credentials and temporary authorization state, and removes or anonymises profile/contact, address and selected operational data. Seller and partner organizations’ separate authorizations are not deleted by a creator’s request. Copies already shared outside Ocean6 and TikTok-hosted content are outside this cleanup.

Financial transactions, commission entitlements, settlements, published-link history and minimal legal-acceptance/audit evidence may remain linked to a pseudonymous internal account identifier for reconciliation, security, consent evidence and dispute handling. Pseudonymous records are not necessarily anonymous. They are not retained for continued creator access or advertising use. No fixed statutory retention period is asserted here; access, necessity and applicable obligations require review. Admin removal clears the private video/code fields but may retain the submission reference, report reason/status and minimal staff-action evidence for moderation and dispute handling. Reports are deleted when their parent Spark submission is deleted; processing a creator account deletion deletes that creator’s private Spark submissions and their linked reports. Other retained operational or report evidence can remain linked to a pseudonymous internal identifier where still necessary; account anonymisation is not the same as deleting every related record. No fixed report-retention deadline or response-time guarantee is made. Contact us for deletion, access, correction, retention or consent questions.

We use reasonable administrative, technical, and organisational safeguards. No system is completely secure. Keep your password and verification codes confidential, and contact us promptly if you believe your account has been compromised.

Subject to applicable law, including the PDPA, you may request access to, correction of, deletion of, or restriction of processing of your personal data, and withdraw consent where processing depends on consent.

Direct marketing: we do not send promotional direct marketing by email except where you have given consent (for example, by consenting on a website enquiry form to be contacted about Ocean6 services) or as otherwise permitted by law. Account, verification, password-reset, security, and other service messages related to your use of Ocean6 are not direct marketing. To opt out of marketing contact, email hey@theocean6.com from the address we hold for you.

Privacy requests: to exercise access, correction, deletion, or other privacy rights, email hey@theocean6.com from the email address linked to your account or enquiry. We may need to verify your identity before responding. This is the only contact route for privacy requests stated in this Policy.

Our website may use essential cookies needed for basic operation and security. If we enable analytics tools in site settings (for example Google Tag Manager or Google Analytics), those tools may use cookies or similar technologies to collect usage information. We describe such tools here only when they are actually enabled.

The Service is not intended for anyone under 18, or the minimum age required to enter a binding agreement in their location. Do not use the Service if you do not meet this requirement.

We may update this Policy. We will post the updated version here and change the effective date. Material changes may also be notified in the Service or by email.

OCEAN 6 SDN. BHD.
Registration No. 202601005724 (1667822-A)
Registered address:
NO. 19 JALAN 7/7C
SECTION 7
BANDAR BARU BANGI
SELANGOR 43650
MALAYSIA
Email: hey@theocean6.com

Scroll to Top