Skip to content
Ocean 6

Legal

Privacy

Effective date: 18 July 2026

Effective date: 18 July 2026

OCEAN 6 SDN. BHD. (Registration No. 202601005724 (1667822-A)) (“Ocean6”, “we”, “us”, “our”) operates the Ocean6 website, the Ocean6 Affiliate mobile application, and related services (collectively, the “Service”).

This Privacy Policy explains what personal data we collect, why we use it, when we share it, how long we keep it, and your choices under applicable law, including Malaysia’s Personal Data Protection Act 2010 (PDPA).

Data user / controller: OCEAN 6 SDN. BHD.
Registration No. 202601005724 (1667822-A)
Registered address:
NO. 19 JALAN 7/7C
SECTION 7
BANDAR BARU BANGI
SELANGOR 43650
MALAYSIA

For privacy, access, correction, or deletion requests, contact hey@theocean6.com.

Depending on how you use the Service, we may collect:

  • Account data: name, email address, password hashes, account identifiers, and market.
  • Creator profile data: profile details, creator application information, social-media links or handles you choose to provide, and eligibility information.
  • Website enquiry data: name, email, phone number, company or handle, message content, audience type, and related contact details submitted through our website forms.
  • Service activity: catalog, campaign, showcase, sample-request, and content-submission activity within Ocean6 Affiliate.
  • Submitted content: captions, content links, proof links, and review-related information.
  • Delivery data: shipping recipient name, phone number, and delivery address when you apply for a sample.
  • Support communications: information you send to our support team.
  • Technical and security data: device information, app version, IP address, log data, and security events. Website lead forms may store IP addresses for spam prevention and rate limiting.

We use personal data to:

  • create, authenticate, and secure accounts;
  • provide the creator catalog, campaigns, samples, and showcase features;
  • review creator applications, sample requests, and content submissions;
  • process and respond to website enquiries and support requests;
  • send account, verification, password-reset, and service messages;
  • prevent fraud, abuse, and security incidents;
  • comply with legal obligations; and
  • improve reliability and support.

Under the Personal Data Protection Act 2010 (PDPA), we process personal data with your consent unless the law permits processing without consent. Depending on the activity, processing may also be based on: performance of a contract with you (or steps at your request before entering a contract); compliance with a legal obligation; or a purpose directly related to the reason the data was collected, where the data processed is adequate, relevant, and not excessive for that purpose. We do not rely on any basis that is not permitted by the PDPA for the relevant activity.

PDPA notices must explain whether supply of personal data is obligatory or voluntary and the consequences if you do not provide it. The following applies to the main ways you interact with Ocean6:

  • Mobile account registration and sign-in (required): name, email address, password, acceptance of our Terms and Privacy Policy, and verification codes are required to create and secure an account. If you do not provide this information, you cannot register, sign in, or use authenticated app features.
  • Creator profile and optional app fields (voluntary): display name, phone number, bio, avatar URL, and TikTok username or profile URL are optional unless a specific feature you choose to use requires them. If you omit optional profile fields, you can still use the Service, but some profile or eligibility features may be limited.
  • Sample shipping (required only for fulfilment): recipient name, phone number, and delivery address are required only when you apply for a sample and provide or select a shipping address for approved fulfilment. Without this information, we cannot ship an approved sample to you.
  • Website enquiry forms (mostly required for submission): name, email, and phone are required to submit an enquiry. Message, handle, or company/brand fields are voluntary unless the selected form tab marks them as required. The consent checkbox to be contacted about Ocean6 services is required to submit the form. If you do not provide required enquiry fields or consent, we cannot accept or respond to your enquiry through that form.
  • Support email (voluntary): you choose what personal data to include when you email hey@theocean6.com. We need enough information to identify your account or enquiry to help you.

We collect personal data only from sources that apply to your use of the Service:

  • Directly from you: when you register or sign in to Ocean6 Affiliate; edit your profile; submit team-binding or campaign content; apply for samples; save shipping addresses; request account deletion; email support; or submit website enquiry forms.
  • Generated by our systems: password hashes, account identifiers, authentication/session tokens, security and application logs, and IP addresses used for rate limiting or spam prevention (including on website lead forms).
  • From TikTok when you connect an account: if you authorise TikTok connection, we receive OAuth identifiers (such as open_id), tokens, granted scopes, and binding status. Where enabled, we may sync commerce-related activity linked to your connected account, such as order, commission, sample-status, or showcase/product activity. We do not use TikTok order sync to collect buyer personal data in our systems.
  • Optional website analytics: if analytics tools (for example Google Tag Manager or Google Analytics) are enabled in site settings, those tools may collect usage information through cookies or similar technologies as described in Section 12.

We do not automatically import seller or third-party platform personal contact details (such as seller email or phone records) into Ocean6. TikTok profile display fields in the app are entered by you unless we expressly state otherwise for a live feature.

Ocean6 may offer TikTok connection or showcase-related features where available and authorised. Availability depends on platform approval, account eligibility, and enabled permissions. Ocean6 does not promise live TikTok earnings sync, product sync, sample sync, affiliate-link generation, or any specific TikTok outcome unless we expressly state that a feature is live.

We may share data only as needed with:

  • staff and authorised operators who administer the Service;
  • hosting, email, security, and technology providers acting for Ocean6;
  • delivery or fulfilment partners when a sample requires delivery;
  • sellers, campaign operators, or creators involved in the relevant request or campaign;
  • authorities or other parties where required by law; and
  • another party if Ocean6 undergoes a merger, acquisition, or asset transfer.

We do not sell personal data.

Our providers or systems may process data outside Malaysia. Where this occurs, we take reasonable steps to protect data consistent with applicable law.

We keep data only for as long as reasonably necessary for the purposes in this Policy, including security, dispute resolution, legal compliance, and audit requirements. Website lead submissions are generally kept for up to 24 months. After that period, a daily retention process removes or anonymises enquiry personal data unless a legal or security hold applies. Only non-identifying lead metadata on an explicit allowlist (lead type, submission month, mail-delivery flag, and purge timestamp) may be kept for aggregate reporting.

Production hosting must configure a real server cron job to run WordPress scheduled tasks (for example via system cron calling wp cron event run --due-now or wp-cron.php). Traffic-based WP-Cron alone is not sufficient to guarantee timely lead retention.

You may request account deletion. Some data may be retained where required or permitted by law, or where needed to prevent fraud, resolve disputes, or meet legal obligations.

We use reasonable administrative, technical, and organisational safeguards. No system is completely secure. Keep your password and verification codes confidential, and contact us promptly if you believe your account has been compromised.

Subject to applicable law, including the PDPA, you may request access to, correction of, deletion of, or restriction of processing of your personal data, and withdraw consent where processing depends on consent.

Direct marketing: we do not send promotional direct marketing by email except where you have given consent (for example, by consenting on a website enquiry form to be contacted about Ocean6 services) or as otherwise permitted by law. Account, verification, password-reset, security, and other service messages related to your use of Ocean6 are not direct marketing. To opt out of marketing contact, email hey@theocean6.com from the address we hold for you.

Privacy requests: to exercise access, correction, deletion, or other privacy rights, email hey@theocean6.com from the email address linked to your account or enquiry. We may need to verify your identity before responding. This is the only contact route for privacy requests stated in this Policy.

Our website may use essential cookies needed for basic operation and security. If we enable analytics tools in site settings (for example Google Tag Manager or Google Analytics), those tools may use cookies or similar technologies to collect usage information. We describe such tools here only when they are actually enabled.

The Service is not intended for anyone under 18, or the minimum age required to enter a binding agreement in their location. Do not use the Service if you do not meet this requirement.

We may update this Policy. We will post the updated version here and change the effective date. Material changes may also be notified in the Service or by email.

OCEAN 6 SDN. BHD.
Registration No. 202601005724 (1667822-A)
Registered address:
NO. 19 JALAN 7/7C
SECTION 7
BANDAR BARU BANGI
SELANGOR 43650
MALAYSIA
Email: hey@theocean6.com

Scroll to Top