Trending now
Your cart is empty
Continue ShoppingPrivacy Policy
PRIVACY POLICY
This Privacy Notice provides you with information about how The Ocean Bottle Ltd and Ocean Bottle Inc, collectively referred to as Ocean Bottle (‘we’, ‘our’, ‘us’), collect, process and take care of your personal information when you use our Services, such as:
- When you use our website or app(s)
- When you engage with us, including any sales, marketing or events
Ocean Bottle is a B Corp certified reusables brand. With the sale of each Ocean Bottle, 11.4kg of plastic is collected globally, by working with plastic collection partners in coastal areas where plastic pollution is worst.
We are registered in England and Wales under company number 11235061 and have our registered office at 3rd Floor, 39 Tabernacle Street, London, England, EC2A 4AA. We are a limited company.
We are also registered as an information protection fee payer with the Information Commissioner’s Office. Our registration reference number is ZB557179.
If you have any questions about this notice or how we collect, use, store, share or otherwise process your personal information, please reach out to us at gdpr@oceanbottle.co.
This privacy notice covers the processing of personal information where Ocean Bottle acts as the controller. We act as the controller when Ocean Bottle exercises overall control of the personal information processed - in other words, when we decide how personal information is collected, stored and used.
Our website may contain links to third-party websites, plug-ins, and applications. We are not responsible for the content of such third-party content or their privacy statement. If you provide any information to the third party, then you should check the third-party website to find the applicable privacy policy.
We may collect the following categories of personal information from you:
- Contact data: Such as your name, email address, phone number, mailing address and shipping address
- Payment information: Such as billing address, the last four digits of your card, payment method and transaction result
- Professional data: Such as your job title, company, job history, LinkedIn profile
- Account data: Such as your login credentials, username, order, purchase history, contact preferences, avatar or selfie, bottle name, country and information about your product usage
- Customer support data: Any information relating to your request, such as messages, inquiries, feedback or any other information you provide
- Profile data: Including your choices for receiving marketing communications, your age, gender and interests.
- Collection data: Such as your name, hydration data and details of your collection with our Collection Partners
- Any other personal data you may choose to provide us.
Sometimes you can choose whether to provide your personal data. However, in some circumstances, this information is mandatory to provide to enter into a contract with us (for example if you purchase products from us, we need your personal data to fulfil your order and enter into a business relationship with you). Where personal data is required to enter into a contract with us, failure to provide such information may mean we are unable to enter a contract with you or perform our obligations under that contract. For example, Shopify requires certain personal data to be provided in order to process an order. Information may also be required by law, namely for tax reasons (such as filing VAT reports). We shall make it clear to you at the point of collection what personal data is optional.
We may also collect and store the following personal data automatically (for example, when you access our website):
- Technical data: such as internet protocol (IP) address, your login data, browser type and version, device ID and characteristics, language preferences, cookies, time zone setting, operating system and platform and other technology on the devices you use to access our website and any communications we may send to you.
- Log and usage data: such as information about your visit to our website, including IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, pages you viewed or searches you made, page response times, download errors, length of visit, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.
- Audience data: Including personal information we collect when you engage with us, for example on our social media pages.
If you provide us with personal data about any other individual, you must have the appropriate authority to do so.
How we process your personal information may depend on how you interact with us. Before processing your personal information, we ensure we have an appropriate lawful basis and have told you about how your personal information will be processed.
The below table describes the purposes we may process your personal information and our lawful basis for doing so.
| How we may use your information | Our lawful basis for processing your information |
|---|---|
| To provide you with our online shop (we may process your technical data). | Our legitimate interest to operate and maintain the security and operation of our Services |
| To provide and respond to online enquiry forms (we may process your contact, account and professional data). | Our legitimate interest to manage our business relationship with you, and respond to sales, supplier, partner and press queries |
| To monitor network activity for security and fraud detection purposes (we may process your technical data). | Our legitimate interest to operate and maintain a secure, e-commerce store |
| To carry out performance tracking and analytics (we may process your account and technical data). | Consent |
| How we may use your information | Our lawful basis for processing your information |
|---|---|
| To process your order and deliver Services to you, either through our online shop or our self-service portal (we may process your account, contact, payment and professional data). |
Contract Our legitimate interest to fulfil and manage our business relationship with you. |
| To create an account with us when you are a business customer (we may process your contact, account and professional data). | Our legitimate interest to fulfil and manage our business relationship with you. |
| To provide customer support, maintain a record of your account and respond to any queries or complaints (we may process your contact, account, customer support and professional data, as well as any other personal data you provide us). | Our legitimate interest to manage and keep a record of our relationship with you, including the provision of customer support |
| To provide shipping and service updates (we may process your contact, account and professional data). |
Contract Our legitimate interest to fulfil and manage our business relationship with you. |
| To process payments and issue refunds (we may process your contact and payment data). |
Contract Our legitimate interest to fulfil and manage our business relationship with you. |
| How we may use your information | Our lawful basis for processing your information |
|---|---|
| To enable logon and access to our Ocean Bottle app (we may process data such as your username, email address, unique identifiers, country, bottle name, and other device data). | Our legitimate interest to enable you to securely login and access our Ocean Bottle app, operate and maintain the security of our platform, and provide you with access to your account and our services. |
| To create an avatar (we may process images of you if you choose to upload these to our Ocean Bottle app). | Our legitimate interest to provide you with a personalised app experience. |
| So that we can match purchases and bottle refills with impact (we may process data such as your impact ID, order ID, member ID, and activity on our Ocean Bottle app). | Our legitimate interest and the legitimate interest of users to measure the impact of plastic water bottles saved. |
| To integrate health apps with your Ocean Bottle app (we may collect data such as unique identifiers and hydration data). | If you download our app, you will be prompted to link your health app with your consent. |
| How we may use your information | Our lawful basis for processing your information |
|---|---|
| To send you marketing and promotional communications (we may process data, such as your contact data, marketing preferences, and customer profile). If we are contacting you in a business capacity, we may also use information about your professional capacity, such as your job title at the place you work. |
If you are a business, we rely on our legitimate interest to promote and grow our business. If you are an individual and an existing customer, we rely on our legitimate interest to show you Services, products and offers that may interest you. If you are an individual that is not an existing customer, we will only ever send you direct marketing material with your consent. |
| To deliver personalised and relevant advertising content targeted to you (we may process profile data, log and usage data, and audience data). | Our legitimate interests to develop and display personalised and relevant advertising content for our users and improve user experience Your consent (for data processed by non-essential cookies, pixels and other tracking technologies) |
| How we may use your information | Our lawful basis for processing your information |
|---|---|
| To manage our business relationship with you (we may process data, such as your contact and professional data). | Our legitimate interests to fulfil and manage our business relationship with you. |
| How we may use your information | Our lawful basis for processing your information |
|---|---|
| So that we verify plastic collection, calculate impact and maintain a chain of traceability (we may process data, such as your first and last name from our Collection Partners and record this information alongside a unique identifier, called your Ocean Bottle Collector ID). | Our legitimate interests to verify and keep accurate records of plastic collection and maintain a chain of traceability. |
| To demonstrate impact traceability for purchases and refills (we may share your Ocean Bottle Collector ID, country and details about your collection, such as date of collection and collection centre, with our customers). | Our legitimate interests to verify and keep accurate records of plastic collection and maintain a chain of traceability. |
| How we may use your information | Our lawful basis for processing your information |
|---|---|
| To monitor network activity for security and fraud detection purposes (we may process your technical data) | Our legitimate interests to operate and maintain a secure Service, including our website(s) and app(s) |
| For analytics, reporting and service improvement purposes (we may process technical and usage data) | Our legitimate interests to understand our customer base and improve our Service, including our website(s) and app(s) |
| To analyse usage trends and optimise marketing effectiveness (we may process contact, account, profile, technical, log, usage and audience data) | Our legitimate interests to better understand our customer base and improve our Service, including our website(s) and app(s) |
| To carry out surveys and market research (we may process your contact, account and profile data, as well as any other personal data you provide us). | Our legitimate interests to better understand our customers, grow our business and improve our products |
| To use AI to transcribe meetings and help draft responses to requests for quotes and frequently asked questions | Our legitimate interests to improve efficiencies, accurately capture customer requirements, reduce administrative workload, enable faster response times and improved service delivery |
We may also process your personal data when necessary:
- for the legitimate interests of our business and third parties to maintain the security and operation of our Services
- for the legitimate interests of our business and third parties to establish, exercise and defend against legal claims
- to fulfil our legal obligations (for example, as part of our tax filings with HMRC)
- to save or protect an individual’s vital interest
Like most companies, we sometimes need to share your personal information with third parties to help provide our service to you or to comply with our legal obligations.
These third parties may include:
- Third party service providers, such as:
- businesses that process data on our behalf, including payment providers, data storage providers, data analytics services and sales tools
- Fulfilment and logistics providers to help deliver our products and services to you
- Third party professionals and advisors, such as tax consultants, HR and data protection advisors, and lawyers
- Ad networks, cookie providers, affiliate marketing programs and retargeting platforms
- Law enforcement, regulators and other government agencies
- Other companies within our corporate group or in the event of a business transfer, such as a merger or acquisition
- Our customers if you are a collector (please see the table above for more information)
We only ever share your personal information with third party processors where we are satisfied there is an appropriate contract, called a data processing agreement, in place.
We may share aggregated, anonymised information about our customers and online audience with brand partners and other similar third parties. Once anonymised, you can no longer be identified by this data.
Where we need to store your personal information outside of the United Kingdom, we make sure your personal information remains subject to the same robust protections as it would be in the United Kingdom. For example, we either ensure the country we are transferring the personal information to has been recognised as having adequate privacy regulations or that there are appropriate safeguards in place (as per Article 46, 47 or 49 of the UK GDPR). For a copy of the safeguards relied on to transfer your personal information outside of the United Kingdom, please get in touch with us.
We only ever keep your personal information for as long as we have a legitimate business reason to retain it. When we no longer have a business reason to keep your information, we securely delete it.
It is really important to us to keep your personal information safe and secure. We have implemented appropriate technical and organisational measures to help safeguard your personal information and help prevent unauthorised access to your personal information. For more information on how we keep your personal information secure, please get in touch with us.
We do not currently use AI or profiling in a way that has legal or similarly significant effects. However, as described above, we sometimes use AI when we have a legitimate business interest to increase productivity and reduce manual tasks across the business or we have your consent.
- We currently use an AI notetaker to transcribe and create meeting summaries.
- We also use AI as part of our Google Workspace flow to assist with drafting quotes. This may mean that personal data sent to us via email (such as your name, email address and information in your email signature, as well as the body of your email) is processed by AI. We have safeguards in place to ensure that LLMs do not train on your personal information.
- We may use cookies and similar tracking technologies to track performance, build audience awareness, provide targeted advertising (including to find new potential customers who share similar profiles to our existing customers or followers) and collect information about your browsing behavior over time. This data may be used to build a profile of your interests to personalise your experience, deliver relevant content and improve our services.
You may have certain rights protected by law over how your personal information is processed (subject to certain exceptions):
- Right to access: You have the right to ask us if we process your personal information and for copies of your personal information
- Right to be informed: You have the right to be informed about how we process your personal information
- Right to rectification: You have the right to ask us to correct personal information you think it inaccurate
- Right to erasure: You have the right to ask us to delete your personal information in certain circumstances
- Right to restrict processing: You have the right to ask us to restrict the processing of your personal information in certain circumstances
- Right to information portability: You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances
- Right to object to processing: You have the right to object to the processing of your personal information in certain circumstances
- Right to withdraw consent: You have the right to withdraw your consent at any time.
To exercise any of your rights in respect to the personal information we process, please get in touch with us and we will respond to you as soon as we can (usually, within one calendar month).
Please note that you have an absolute right to object to any direct marketing you receive from us. You can also withdraw your consent to receive direct marketing at any time.
If you are located outside the United Kingdom or European Union, you may have additional privacy rights under your local laws. The following sections explain how we address specific requirements in certain jurisdictions.
To exercise these rights, please contact us at the details set out in this Privacy Notice.
United States (State Privacy Rights – CCPA/CPRA, VCDPA, CPA, CTDPA, DPDPA, UCPA, PPPL, SHIELD)
This section of the Privacy Policy sets out fair processing information for data subjects in the United States.
| Category | Examples | Collected |
|---|---|---|
| Identifiers | Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name | YES |
| Personal information such as defined in the California Customer Records statute | Name, contact information, education, employment, employment history, and financial information | YES |
| Protected classification characteristics under state or federal law | Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data | NOT ROUTINELY COLLECTED |
| Commercial information | Transaction information, purchase history, financial details, and payment information | YES |
| Biometric information | Fingerprints and voiceprints | NO |
| Internet or other similar network activity | Browsing history, search history, online behaviour, interest data, and interactions with our and other websites, applications, systems, and advertisements | YES |
| Geolocation data | Device location | YES (country/region level only) |
| Audio, electronic, sensory or similar information | Images and audio, video or call recordings created in connection with our business activities | YES |
| Professional or employment-related information | Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us | YES |
| Education information | Student records and directory information | NO |
| Inferences drawn from collected personal information | Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics | YES |
| Sensitive personal information | NO |
We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:
- Receiving help through our customer support channels;
- Participation in customer surveys or contests; and
- Facilitation in the delivery of our Services and to respond to your inquiries.
If you are a resident of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, New York, Oregon, Tennessee, Texas, Utah, or Virginia, you may have the following rights under state privacy laws:
- The right to know what personal information we collect, use, disclose, and sell or share.
- The right to request deletion of your personal information.
- The right to correct inaccurate personal information.
- The right to request a portable copy of your information.
- The right to opt-out of the sale or sharing of your personal information.
- The right to request that we limit our use of sensitive personal information (where applicable).
- The right not to be discriminated against for exercising these rights.
- The right to opt out of certain automated decision-making.
- The right to appeal a denied decision.
- The right to act through an authorised agent.
To exercise these rights, or to opt-out of the sale/sharing of your information, please contact us at the details set out in this Privacy Notice.
California residents may also use the “Do Not Sell or Share My Personal Information” link (where applicable).
We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.
We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including to help manage and display advertisements, to tailor advertisements to your interests, or to send abandoned shopping cart reminders (depending on your communication preferences). The third parties and service providers use their technology to provide advertising about products and services tailored to your interests which may appear either on our Services or on other websites.
To the extent these online tracking technologies are deemed to be a 'sale'/'sharing' (which includes targeted advertising, as defined under the applicable laws) under applicable US state laws, you can opt out of these online tracking technologies by contacting us at ahoy@oceanbottle.co.
Some of the technologies we use - such as cookies, pixels, and analytics tools - may collect information about your activity on our website and across other sites. Under certain US privacy laws, this may be considered a “sale” of information. However, subject to this, we have not sold any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding twelve (12) months:
- Category A. Identifiers
- Category B. Personal information as defined in the California Customer Records law
- Category D. Commercial information
- Category F. Internet or other electronic network activity information
- Category G. Geolocation data
Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at ahoy@oceanbottle.co. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.
Canada (PIPEDA)
If you are located in Canada, you have the right to request access to and correction of the personal information we hold about you, and to withdraw your consent to our processing of your personal information at any time.
Other Countries
If you are located outside the UK, EU, or the countries listed above, you may still have rights under your local data protection laws. These may include the right to access, correct, delete, or withdraw consent for the processing of your personal data. To exercise these rights, please contact us at the details set out in this Privacy Notice.
Please get in touch with us if you have any complaints or queries about how your personal information is processed.
You have the right to raise a complaint with the supervisory authority in the jurisdiction you live, work or where the infringement took place. In the UK, this is the Information Commissioner’s Office. If you need support, you can get in touch with the ICO here.
If you do have a query or a complaint, we would really appreciate the opportunity to respond to your concern in the first instance so please get in touch with us.
We may update this privacy notice from time to time. The updated version will be indicated by an updated 'Revised' date at the top of this privacy notice. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.
Last update: August 2026