OCEANiCS

GDPR overview

GDPR implementation is concrete and well documented. The publisher is based in France, invokes Regulation 2016/679 and the French Informatique et Libertés Act, and declares itself data controller. A data protection officer is designated and reachable at privacy@dice-engineering.com, with a postal address in Nantes. Articles 15 to 22 rights are listed individually, with a one-month response commitment and the CNIL named as supervisory authority. Transfers outside the EU rely on the standard contractual clauses of decision 2021/914 and, where applicable, the recipient's EU-US Data Privacy Framework certification. A named subprocessor table gives each provider's role and location, and a retention table gives durations category by category. One caveat: two privacy policies are online at once, an older one embedded in the legal notice and the current one effective 1 January 2026.

Who owns the data?

The terms of use state that content uploaded by the customer, including routes, polars, vessel data and support attachments, remains the customer's property. D-ICE Engineering SAS receives a worldwide, royalty-free licence to host, reproduce and process that content for the sole purpose of operating and improving the services for the customer's own benefit, and that licence ends within a reasonable period after termination, except where law requires retention. Intellectual property in the software, databases, designs, trademarks and documentation belongs to D-ICE Engineering SAS or its licensors. Separately, the privacy policy reserves the right to exploit and commercialise aggregated, anonymised data such as maritime traffic flows and routing statistics, stating that neither an individual nor a vessel can be identified from it.

Reuse rights

Customers keep ownership of what they upload and are not required to seek permission to reuse their own routes, polars and vessel data. What the terms restrict is use of the vendor's own material: reverse engineering, decompiling or extracting source code is prohibited except within the narrow interoperability allowance of Directive 2009/24, and the licence granted over the services is non-exclusive, non-transferable and revocable for the duration of the subscription or use. Google user data obtained through sign-in may not be used for anything other than the D-ICE products themselves. The publisher commits not to sell personal data and not to use Google-derived data for advertising, data brokerage, credit decisions or AI model training, though that last commitment is scoped to Google data only and is not extended to other customer data.

Data retention & training

Hosting summary

The privacy policy publishes a named table of technical providers with their role and location. Amazon Web Services handles hosting and infrastructure in France, specifically Paris. Stripe processes payment and billing in Ireland. Sentry handles diagnostics and error reporting within the EU. Google covers authentication and messaging across the EU and the United States, Webflow serves the corporate website from the United States, and Apple and Google Play handle mobile distribution across the EU and the United States, each of these under standard contractual clauses. Transfers outside the EU rely on the clauses approved by decision 2021/914 and, where applicable, the recipient's EU-US Data Privacy Framework certification, and each provider is stated to be bound by a GDPR-compliant processing agreement. One important limit applies: this table describes the publisher's websites and applications. OCEANiCS is an onboard system whose computations are solved aboard the vessel in real time, and the site does not say where navigation data collected at sea is held.