Legal

Privacy Policy

How the Fishing Around platform handles your data

Privacy Policy

Fish Around Platform

Version: 1.1
Effective Date: 15 October 2026
Document Owner: Fishing Around the UK CIC
Status: Active

Fishing Around the UK CIC
The Melting Pot
15 Calton Road
Edinburgh
EH8 8DL
United Kingdom

Fishing Around the UK CIC (“we”, “us”, “our”) is committed to protecting personal data and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.

Fish Around is the public name of the platform. Fishing Around the UK CIC is the legal entity responsible for the platform’s data governance.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we retain it, and the rights available to individuals.

Data Controller

Fishing Around the UK CIC is the Data Controller for personal data processed through the Fish Around platform.

As Data Controller, Fishing Around the UK CIC determines the purposes and means of processing personal data through the platform.

Contact: admin@fisharound.uk

Platform Operation

The platform is operated on behalf of Fishing Around the UK CIC by Fishing Around Ltd.

Fishing Around Ltd provides technical, operational, payment processing and support services and acts as a Data Processor where it processes personal data on behalf of Fishing Around the UK CIC.

We may also appoint developers, technology partners, contractors and other service providers to support the operation, development, maintenance and security of the platform.

Where these organisations act as Data Processors, they process personal data under appropriate contractual arrangements.

Certain organisations, including payment providers and participating fisheries, may act as independent Data Controllers for particular processing activities, as explained in this policy.

Information We Collect

We collect and process personal data where necessary to operate the platform, provide fishing permits, support fisheries, manage transactions and fulfil our legal and operational responsibilities.

Personal Information

We may collect:

  • name
  • email address
  • telephone number
  • postal address
  • date of birth or age-related information
  • profile photograph
  • account identifiers
  • authentication and login information
  • account settings and preferences

Booking and Payment Information

We may collect:

  • permit purchases and booking details
  • fishery, beat, location and fishing dates
  • permit type and permit holder information
  • booking history
  • payment amounts and transaction references
  • payment status
  • refund and account credit records
  • rescheduling records
  • gift voucher information
  • payment disputes and chargeback records
  • relevant information about additional or junior anglers

Conservation and Fishery Information

We may collect:

  • catch returns
  • species caught
  • fishing effort and participation records
  • catch return notes and reviews
  • fishery usage information
  • conservation monitoring information

Compliance and Enforcement Information

We may collect:

  • permit verification and scan records
  • incident reports and descriptions
  • bailiff or authorised officer notes
  • fishery bans and restrictions
  • records of suspected unauthorised fishing or misuse
  • relevant investigation, appeal and compliance records

Support and Communications

We may collect:

  • support tickets and messages
  • booking change requests
  • support attachments
  • transactional email records
  • newsletter subscriptions and preferences
  • consent and unsubscribe records

Technical Information

We may collect:

  • IP addresses
  • device and browser information
  • session and authentication records
  • security and sign-in logs
  • platform activity records
  • cookie preferences
  • analytics information where consent has been given
  • records of data downloads, exports, access and account deletion actions

How We Collect Information

We collect information:

  • directly from users when they register, book permits, submit catch returns, contact support or update their profiles
  • from a purchaser when they provide information about another angler or junior permit holder
  • from participating fisheries and authorised personnel where information is needed for permit verification, fisheries management or compliance
  • from payment providers and technical services when transactions or platform operations take place
  • automatically through essential technical processes and, where consent has been given, analytics technologies

How We Use Your Information

We use personal data to:

  • create and manage user accounts
  • provide access to the platform
  • process and administer fishing permit bookings
  • issue permits and booking confirmations
  • manage payments, refunds, account credit and rescheduling
  • allow fisheries to manage access and verify permits
  • support compliance with fishery rules and legal requirements
  • investigate incidents, suspected misuse and unauthorised fishing
  • administer catch returns and conservation reporting
  • respond to support requests
  • send necessary service communications
  • manage security, fraud prevention and payment disputes
  • provide account data downloads and process deletion requests
  • manage retention and anonymisation
  • maintain financial, operational and audit records
  • improve the platform and user experience
  • send optional marketing communications where appropriately authorised

We may use aggregated or anonymised information for conservation, research, fisheries reporting, platform development and related purposes.

Legal Basis for Processing

We process personal data using one or more lawful bases under UK GDPR, depending on the activity.

Contract

Where processing is necessary to provide services requested by a user or fulfil our contractual commitments, including:

  • account creation and management
  • permit bookings
  • booking confirmations
  • booking changes
  • refunds and account credit
  • customer support connected with the service

Legitimate Interests

Where processing is necessary for legitimate interests, subject to appropriate consideration of individuals’ rights and freedoms, including:

  • operating and securing the platform
  • managing fisheries and permit verification
  • preventing fraud and misuse
  • investigating incidents and disputes
  • supporting lawful fisheries management and enforcement
  • maintaining appropriate operational records
  • improving platform functionality
  • processing information about permit holders supplied by another person where necessary and proportionate

Legal Obligations

Where information must be processed or retained to comply with applicable legal, tax, accounting, regulatory or other statutory obligations.

Consent

We rely on consent where required for:

  • optional email marketing
  • non-essential analytics cookies and technologies
  • session recordings used for analytics
  • other optional processing activities where consent is requested

Consent can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

User Accounts and Profile Requirements

Users must be aged 18 or over to create a Fish Around account.

Users may be asked to confirm that they are 18 or over when requesting access to their account.

Users may be required to provide profile information for:

  • issuing permits
  • validating bookings
  • identity verification where applicable
  • fisheries management and compliance
  • customer support
  • maintaining booking and account records

We collect only the information reasonably necessary for these purposes.

Children and Junior Permits

An adult may purchase a fishing permit for a child.

Junior permits must be purchased by a parent, guardian or responsible adult.

We only collect information about junior anglers where necessary to issue, administer or verify their permits.

For anglers under 16, a named permit holder is not required by default. Where a fishery has a specific lawful or verification requirement, additional information may be requested.

For anglers aged 16 or over, the permit is issued in the angler’s name.

We do not require a separate postal address for a child. The booking is managed through the adult purchaser’s account and contact details.

A junior angler photograph is not required by default. A photograph may be requested where necessary and proportionate for permit verification, fishery management or enforcement.

We take additional care when processing children’s personal data and seek to minimise the information collected.

Buying a Permit for Someone Else

Users may purchase permits for:

  • themselves
  • junior anglers
  • other individuals

Where a permit is purchased for someone else, we may collect the permit holder’s name, address and other information necessary to issue and verify the permit.

This information may appear:

  • on the permit
  • on the permit PDF
  • in relevant booking records
  • in verification tools available to the fishery or authorised bailiffs

The person making the purchase remains responsible for the booking and associated payment.

Purchasers should ensure that they have appropriate authority to provide another person’s information and that the individual is made aware of how it will be used.

Where a permit is purchased for another person, the purchaser’s own photograph and date of birth are not used as the identification details of the named permit holder.

Payments

Payments are processed securely through third-party payment services, including Stripe.

Fishing Around Ltd administers the platform’s payment processing arrangements and acts as payment collection agent for participating fisheries.

Payment providers may process information necessary for:

  • payment authorisation
  • fraud prevention
  • settlement
  • fishery payouts
  • refunds
  • account credit administration
  • chargebacks and disputes

Fish Around does not store full payment card details. Card information is handled through the payment provider’s secure payment systems.

Payment providers may act as independent Data Controllers for certain activities, such as their own fraud prevention, regulatory compliance and verification obligations.

Communications and Marketing

We send service communications necessary to operate the platform, including:

  • permit and booking confirmations
  • account security and sign-in messages
  • booking changes and cancellations
  • refund and account credit notices
  • retention and account anonymisation warnings
  • support communications
  • important service and compliance notices

We may use Resend or equivalent services to deliver these communications.

Optional newsletters and promotional emails may be sent using Brevo or another appropriate email service provider.

Marketing subscriptions are optional, and users may unsubscribe at any time.

We maintain appropriate records of marketing consent and unsubscribe preferences.

Sharing Information

We may share relevant personal data with:

  • participating fisheries
  • fishery managers and authorised representatives
  • bailiffs and authorised enforcement personnel
  • fishery boards and regulatory bodies
  • payment processors
  • technical and infrastructure providers
  • email and support service providers
  • appointed developers and contractors
  • other recipients where legally necessary

Personal data is shared only where there is an appropriate purpose and lawful basis.

We do not sell personal data.

Data Sharing with Fisheries

Participating fisheries may receive or access personal data where necessary for:

  • booking fulfilment
  • permit verification
  • fishery access management
  • customer support
  • compliance and enforcement
  • catch return administration
  • conservation and fisheries management

This may include:

  • angler or permit holder name
  • relevant contact details
  • permit details
  • booking dates
  • permit status
  • profile photograph where enabled and necessary
  • catch return information
  • relevant compliance or incident information

Fisheries as Independent Data Controllers

Participating fisheries act as independent Data Controllers for personal data they receive or separately control for their own purposes.

They are responsible for complying with applicable data protection law in relation to their own use and retention of that information.

If a user requests deletion or access through Fish Around, we will handle personal data for which Fishing Around the UK CIC is responsible.

Personal data independently retained by a fishery may be subject to that fishery’s own obligations.

Users may need to contact the relevant fishery directly in relation to records it separately holds.

Data Sharing for Fisheries Management and Enforcement

We may share relevant data with fisheries, fishery boards, authorised bailiffs, enforcement bodies and regulators for legitimate and lawful purposes, including:

  • permit verification
  • identification of permit holders
  • prevention and investigation of unauthorised fishing
  • enforcement of fishery rules and regulations
  • incident investigation
  • protection of fisheries and conservation interests
  • compliance with applicable laws

Access is restricted to authorised personnel with an appropriate operational need.

Access to enforcement and personal data may be logged and monitored.

Where Your Data Is Processed

We use service providers based in the United Kingdom, European Union and other countries.

These may include:

  • Xano for database, backend services and file storage
  • Railway and related infrastructure providers for website and document services
  • Stripe for payment processing
  • Resend for transactional email
  • Brevo for newsletters
  • PostHog and Google Analytics for consent-based analytics
  • Mapbox and other mapping providers for fishery maps
  • services used for QR code generation, document production and video content where applicable

Some service providers, or their subcontractors, may process data outside the United Kingdom, including in the United States.

We take steps to ensure that restricted international transfers comply with UK GDPR.

Depending on the destination and provider, transfers may be covered by:

  • UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where applicable
  • the UK International Data Transfer Agreement
  • the UK Addendum to approved contractual clauses
  • another lawful international transfer mechanism

The transfer mechanism applicable to a particular provider depends on that provider’s arrangements and the circumstances of the transfer.

Individuals may request further information about international transfers and relevant safeguards by contacting admin@fisharound.uk.

Cookies and Platform Analytics

We use cookies and similar technologies to operate the platform and, with consent where required, understand how it is used.

Essential Cookies and Storage

Strictly necessary cookies and browser storage may be used for:

  • authentication and keeping users signed in
  • maintaining account sessions
  • remembering cookie preferences
  • maintaining the booking basket
  • payment processing
  • essential fraud prevention and security
  • core platform functionality

These technologies support essential services and do not require consent where an applicable legal exemption applies.

They may be managed through browser settings, although blocking them could prevent parts of the platform from working correctly.

Analytics Cookies

With your consent, we use or may enable:

  • PostHog, for product analytics, usage analysis, masked session recordings and technical error monitoring
  • Google Analytics (GA4), for website traffic analysis, visitor behaviour, referral information and understanding platform performance

Non-essential analytics technologies are used only where the visitor has accepted the relevant analytics consent.

Users can refuse or withdraw consent through the cookie preferences controls, including the link in the website footer.

Withdrawing consent stops further consent-dependent tracking and clears associated analytics cookies where technically applicable.

Information Collected Through Analytics

Depending on the provider and features enabled, analytics may collect:

  • pages visited
  • navigation and clicks
  • device and browser information
  • approximate geographic location
  • referral information
  • usage patterns
  • technical errors
  • purchase events, including amount, currency, fishery and permit type

Full payment card details are not collected by analytics.

Signed-In Analytics

Where a user is signed in and has accepted analytics cookies, PostHog analytics may be associated with their platform account identifier, name, email address and role.

This supports distinguishing genuine platform use from internal testing and investigating usability issues.

Because this information can identify a user, signed-in analytics records are not treated as anonymous.

Session Recordings

Where the user has consented, PostHog may record masked session replays to help identify usability problems and technical issues.

Session replays record page interactions while masking typed information and on-screen text according to the platform’s configured privacy controls.

Card payment information is entered through the payment provider’s secure payment interface and is not included in session recordings.

Where a session recording is linked to a signed-in account, the recording is identifiable to that account even though page content and form inputs are masked.

Analytics Retention

Analytics information is retained only for as long as necessary for the purposes for which it was collected, subject to the configured retention settings of the relevant analytics services.

We review those settings and take reasonable steps to minimise or remove analytics information when it is no longer required.

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected.

Different types of information have different retention periods.

At the end of the relevant retention period, the platform’s scheduled retention process anonymises records by removing or replacing personal identifiers.

Anonymised records may retain information needed for accounting, reporting, audit, conservation and statistical purposes, provided individuals are no longer identifiable.

Some records may need to remain identifiable for longer where there is an appropriate lawful reason, including an unresolved legal obligation, dispute or enforcement matter.

Retention Periods

Account information and associated records, including permits, bookings, payments, refunds, account credit, catch returns and support records, are normally retained for 6 years from the last meaningful activity on the account.

Permit verification and bailiff scan records are retained for 2 years from the date of the scan. Records of bans that have been lifted are retained for 2 years from the date the ban was lifted. Bans that remain in force are reviewed 2 years after they started. Incident reports are retained for 6 years after the incident is closed.

Records relating to access to personal data, including data downloads, exports and account erasure actions, are retained for 6 years.

Sign-in attempts, session records, routine security logs and associated IP addresses are normally retained for 90 days. Relevant information may be retained longer where necessary for an active security investigation, fraud matter, dispute or legal obligation.

Emails relating to permits, bookings, payments, refunds, account credit or disputes follow the retention period of the associated transaction. Other email records, including sign-in links and general notifications, are retained for 12 months.

General platform activity logs that are not subject to another retention category are retained for 12 months. Unfinished checkout records are cleared after 24 hours.

Newsletter consent records are retained while a user remains subscribed. Following an unsubscribe, relevant consent and suppression records are normally retained for 6 years, or longer where necessary to ensure the unsubscribe request continues to be honoured.

Where a record reaches the end of its applicable retention period, personal identifiers are removed or anonymised in accordance with our retention policy. Information may be retained for longer where necessary and lawful for accounting, legal, security, fraud prevention, enforcement or dispute resolution purposes.

What Counts as Last Activity

For the standard account retention period, meaningful activity may include:

  • account creation
  • purchasing a permit
  • changing a booking
  • refund or account credit activity
  • submitting a catch return
  • interacting with support
  • downloading account data
  • updating account settings
  • other relevant signed-in account activity

Newsletter sign-up before an account is created does not start the angler account retention period.

Account Retention Warnings

Where an account is approaching scheduled anonymisation, we send warning emails:

  • 90 days before
  • 30 days before
  • 1 day before

These warnings relate to whole-account anonymisation.

Individual background records, such as technical logs or permit scans, may reach their retention dates separately without individual notifications.

Retention Holds

An account may be temporarily held back from scheduled anonymisation where there is an active reason to preserve relevant information.

Examples include:

  • current or future permits
  • orders or refunds in progress
  • unspent account credit
  • outstanding payments
  • unresolved support tickets or booking changes
  • bans in force or under appeal
  • active incidents or investigations
  • documented fraud, security, legal or compliance holds

A support hold must be authorised and recorded with an appropriate reason and review date.

Once the relevant issue is resolved, normal retention rules resume.

Account Credit Retention

Account credit expires 12 months after it is issued.

We send a reminder 30 days before expiry.

Unspent account credit may prevent an account from being automatically anonymised until it has been used, expired or otherwise appropriately resolved.

Account credit records may remain in anonymised financial records where necessary.

Enforcement Records and Bans

Permit scan logs are normally retained for 2 years from the date of the scan.

Records of bans that have been lifted are normally retained for 2 years after the ban is lifted.

A ban that remains in force is reviewed 2 years after its start date.

Platform support may lift or extend a ban following review, with a recorded decision, reason and new review date.

Where no decision has been recorded by the 2-year review date, the platform is configured to release the ban at that review point, including where a fishery originally set a later end date.

Incident reports are normally retained for 6 years from closure.

For retention purposes, incidents marked resolved or archived are treated as closed. Open, under-review and escalated incidents are not treated as closed.

Keep My Data

Users may choose to retain their personal fishing history beyond the standard 6-year account retention period.

This option may include:

  • historic bookings
  • permits
  • catch returns
  • related fishing history

This preference is optional.

It does not extend the normal retention periods for:

  • security logs
  • authentication records
  • data-access audit records
  • enforcement records
  • incidents
  • internal technical logs

Users may switch the preference off at any time.

When switched off, normal retention rules apply to the original records and dates. Information already beyond its normal retention period may be anonymised at the next scheduled retention run.

Fisheries and Bailiffs After Six Years

Where an angler chooses to retain fishing history beyond 6 years, this does not automatically extend the visibility of their personal details to fisheries or bailiffs.

After the normal retention period, fisheries and bailiffs will ordinarily no longer see identifying information such as:

  • name
  • email address
  • postal address
  • profile photograph

Access may continue where there is a current lawful and operational requirement, such as:

  • a current or future permit
  • active enforcement
  • an unresolved dispute
  • a documented legal or compliance hold

Authorised platform administrators may access retained information where necessary and permitted for legitimate platform administration, support, audit or compliance purposes.

Staff Accounts

Staff account information is retained while the person holds an authorised staff role and for any additional period required for legitimate operational, security or legal purposes.

When the staff role ends, the relevant standard account retention rules apply.

Downloading Your Data

Users can obtain a copy of their personal data through the platform’s Privacy and Your Data area, where the self-service facility is enabled.

The self-service download may include:

  • profile information
  • permits
  • bookings
  • orders and transactions
  • catch returns
  • relevant account activity
  • support messages
  • permit verification records
  • ban information
  • newsletter information

Protection of Other People’s Information

Self-service downloads are designed to minimise disclosure of information relating to other people.

They ordinarily exclude:

  • bailiff free-text notes
  • internal enforcement notes
  • internal administration notes
  • other people’s names and addresses entered during bookings
  • identifiable information about additional group members
  • other third-party personal data requiring review

Requesting Fuller Information

Users may request fuller personal data from:

admin@fisharound.uk

We will review such requests in accordance with applicable data protection law.

Additional information may be provided where appropriate, taking account of the rights and freedoms of other individuals and any applicable exemptions.

The self-service download does not limit an individual’s statutory right of access.

Authorised Administrative Exports

Authorised platform administrators may have access to standard/minimised or fuller data exports where necessary for legitimate purposes.

These may include:

  • responding to data rights requests
  • investigating disputes
  • preventing fraud
  • supporting legitimate enforcement
  • meeting legal obligations
  • managing platform operations

Full exports may contain personal data about other individuals and must be accessed only by appropriately authorised users.

The platform records relevant export activity, which may include:

  • who performed the export
  • date and time
  • record or account concerned
  • type of export
  • stated reason for the export

Any information subsequently disclosed to a requester is subject to an appropriate review.

Deleting Your Account

Users may request account deletion through the Privacy and Your Data area where the self-service facility is enabled, or by contacting us.

Automated account deletion uses an email confirmation process.

When Account Deletion May Need Review

Self-service deletion may be delayed where the account has:

  • a current or future permit
  • unspent account credit
  • a refund or payment in progress
  • an open support ticket or booking change
  • a ban in force or under appeal
  • an ongoing incident or investigation
  • a documented legal, security, fraud or compliance hold

These safeguards prevent unintended cancellation of valid permits, loss of outstanding credit or interference with live operational and enforcement matters.

Where an automated deletion cannot proceed, users may contact support for a review.

Such restrictions do not prevent an individual from exercising their statutory right to request erasure. Each request will be assessed under applicable data protection law.

What Happens When an Account Is Deleted

Where deletion is appropriate, the platform removes or anonymises unnecessary personal identifiers, including:

  • name
  • email address
  • telephone number
  • postal address
  • date of birth
  • profile photograph
  • personal information on permits purchased for other people
  • additional group member information
  • catch return notes and reviews
  • support messages and ticket details
  • booking change contact details
  • gift voucher recipient details and personal messages
  • unnecessary personal identifiers in email records

Newsletter subscriptions are ended, and the relevant contact is removed or suppressed from marketing systems as appropriate.

Records We May Retain

Certain records may remain where necessary for accounting, audit, legal obligations, fraud prevention, dispute management or enforcement.

Where possible, these are anonymised so that they no longer identify the individual.

Records may include:

  • transaction amounts and dates
  • permit and booking references
  • financial adjustments
  • anonymised catch returns
  • historic permit verification records
  • anonymised incident records
  • relevant audit information

Where identifiable information must be retained for a specific lawful reason, access is limited and the retention is reviewed as appropriate.

Rejoining After Deletion

Once an account has been deleted, users may ordinarily create a new account using the same email address.

Where necessary and lawful, separate enforcement or security restrictions may continue to apply.

Data Security

We use appropriate technical and organisational safeguards to protect personal data.

These may include:

  • secure infrastructure
  • role-based access controls
  • authentication and access restrictions
  • monitoring and audit logging
  • appropriate encryption
  • security reviews and maintenance
  • contractual controls with service providers
  • controls for sensitive administration and enforcement tools

No online system can be guaranteed to be entirely free from risk, but we take reasonable measures to protect personal data.

Your Rights

Under UK data protection law, individuals may have the right to:

  • access personal data held about them
  • request correction of inaccurate information
  • request erasure where applicable
  • restrict certain processing
  • object to processing based on legitimate interests
  • withdraw consent where processing relies on consent
  • request data portability where applicable
  • complain to the Information Commissioner’s Office

Rights are subject to the conditions and exceptions provided by law.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests. We will consider your objection and stop the relevant processing unless we have compelling legitimate grounds to continue or another applicable legal basis.

You may object to direct marketing at any time.

Exercising Your Rights

You may submit a request through the platform or contact:

admin@fisharound.uk

We may request information necessary to confirm your identity or authority to act for another person.

We will respond without undue delay and normally within one calendar month, subject to applicable extensions and legal requirements.

There is normally no charge for exercising your data protection rights, although the law permits fees in limited circumstances.

Complaints

If you are unhappy with how we handle your personal data, please contact us so that we can investigate your concerns.

You also have the right to complain to the Information Commissioner’s Office (ICO), the United Kingdom’s independent data protection regulator.

Website: https://ico.org.uk

Changes to This Policy

We may update this Privacy Policy to reflect changes in:

  • platform functionality
  • data processing activities
  • services and suppliers
  • legal and regulatory requirements
  • retention arrangements
  • operational and security practices

Material changes may be communicated to users where appropriate.

The latest version will be published on the Fish Around platform with its effective date.

Contact

For questions about privacy, data protection, account deletion or requests to access personal information, contact:

Fishing Around the UK CIC
The Melting Pot
15 Calton Road
Edinburgh
EH8 8DL
United Kingdom

Email: admin@fisharound.uk