Privacy Policy

1. About this policy

This policy explains what personal data we collect when you use this website and the Fish Planet London customer portal, who we share it with, and how you can exercise your rights. It sits alongside our Terms & Conditions and the Cookie Policy.

Data handled in our physical stores outside these systems — for example paper records, CCTV, or till transactions that are not linked to a web account — is not described here.

TODO: Confirm whether in-store processing (CCTV, POS customer records, pet sitting paperwork) needs to be covered by this policy or by a separate in-store notice.

2. Who is responsible for your data

Fish Planet London operates aquatic stores in Shoreditch and Finsbury Park, London, and runs this website and the customer portal.

TODO: Supply the data controller details: registered legal entity name, company number, registered office address, and the contact point for data protection enquiries.

TODO: Confirm whether a data protection officer or a UK/EU representative must be appointed and named here, and whether registration with a supervisory authority is required.

3. What this website collects

This marketing site has no accounts and no analytics. There is exactly one place where you can submit personal data:

• Newsletter signup. The form in the footer collects your name and email address. These are sent to our own server, which adds you as a contact in our email provider's audience list. No other field is collected and nothing is stored in our own database by this form.
• Anti-abuse throttling. To stop repeated automated submissions, the newsletter endpoint temporarily counts requests per IP address in memory for one minute. The IP address is not written to a database or a log by this code.

Contacting us by the phone number or email address shown on the site is a direct message to us and is not processed by this website.

TODO: Confirm what happens to newsletter subscribers operationally: who has access to the audience list, how unsubscribe requests are handled, and whether the list is ever exported or used for anything beyond the newsletter.

TODO: Confirm whether the hosting platform keeps server request logs containing IP addresses and user agents, the retention period, and name the hosting provider. This is a platform setting and is not determinable from our source code.

4. What the customer portal collects

The customer portal requires an account. The following is an inventory of the data our code collects there.

Account and sign-in

• Sign-up collects email address, password, first name, last name and username. Sign-in is by email and password only; we do not offer social or single sign-on login.
• When you set a password, we check it against a public breached-password service using a partial, irreversible hash: only the first five characters of the SHA-1 of the password are sent, so the password itself is never disclosed.
• Sign-in and sign-up are protected by a CAPTCHA-style challenge provided by a third party, which receives the challenge token and — as an inherent part of operating it — your IP address.
• To limit brute-force attempts we record rate-limiting counters keyed by an irreversible hash of the IP address or email address, not the values themselves.

Profile

• Optional profile fields: display name, username, bio, location, website link, experience level, main interest, and profile visibility.
• An optional profile picture, stored in our file storage under a path scoped to your account.

Orders and checkout

• Checkout collects email address, phone number, full name and a delivery or billing address(address lines, city, region, postcode, country), plus your fulfilment choice, preferred date and any order notes you write.
• Addresses can be saved to your account for reuse. When you enter a postcode we send it to a postcode lookup service to offer matching addresses.
• We store your order history, including the items, quantities and prices at the time of purchase, and loyalty points earned and spent.

Payments

• Card payments are handled by our payment provider. Card details are entered directly into the provider's own secure fields and are never sent to or stored on our servers.
• We send the payment provider your email address, the amount, and internal reference IDs. We do not send your name, phone number or address to them.
• We store the payment outcome and, for your reference, only the card brand and last four digits.

Aquariums and community features

• Content you create about your tanks — name, location, type, description, photos, setup date, species and water-parameter logs — is stored against your account.
• Social features (posts, comments, likes, follows, saved items) link activity to your account where you use them.

Store systems

• Customer records from our in-store point-of-sale system are synchronised into our database, which can include name, email address and phone numbers. Where a verified email matches, an in-store customer record is linked to the web account.
• When a web order is sent to the store system, only a customer reference, the order number, the items and the amount are transmitted — not your name, email, phone or address.

TODO: Confirm how the in-store customer database was collected and what notice those customers were given, since synchronising it into the web platform is a further processing activity that needs its own basis.

TODO: Confirm whether emails that our authentication system sends (address confirmation, password reset) go through our own email provider or the platform default, so the provider can be named accurately in section 6.

5. Why we process your data

The purposes are visible in the code — fulfilling orders, operating accounts, taking payment, sending order confirmations, sending the newsletter, and protecting the service from abuse. The legal grounding for each is not.

TODO: Legal review required. Set out the lawful basis for each processing purpose (contract, legitimate interests, consent, legal obligation), and record a legitimate-interests assessment where that basis is relied on. Do not publish assumed bases.

TODO: Confirm the marketing consent position: whether newsletter signup alone is sufficient consent, whether a soft opt-in applies to customers, and whether consent records need to be stored (the current signup form does not record one).

6. Providers who process data for us

We use the following third-party services. This list reflects the integrations present in our code:

• Database, authentication and file storage provider — hosts accounts, profiles, orders and uploaded images.
• Payment provider — processes card payments and receives your email address and internal references.
• Email provider — sends order confirmation emails and holds the newsletter audience list. Order confirmation emails contain your name, email address, order details and your collection or delivery address.
• Point-of-sale / retail platform — our store system, synchronised as described in section 4.
• Bot-protection provider — runs the sign-in and sign-up challenge.
• Postcode lookup services — receive the postcode you type at checkout in order to return matching addresses.
• Breached-password service — receives a partial, irreversible hash prefix when a password is set, as described in section 4.
• Image hosting — some marketing images on this site are served from our older website domain, so your browser requests them from there.

Web fonts are served from our own domain at build time, so your browser does not request fonts from a third party while you browse.

TODO: Name each provider explicitly, with a link to its privacy notice, and confirm the hosting provider. Deliberately left unnamed here so the published list matches the contracts actually in place.

TODO: Confirm that a written data processing agreement is in place with each provider, and keep a record of processors.

TODO: Operational issue to resolve before launch: order confirmation emails can be redirected to a single fixed address by an environment override intended for testing. Confirm this override is disabled in production, otherwise customer names and delivery addresses are sent to the wrong recipient.

TODO: Confirm whether we ever disclose data other than to these providers — for example couriers, accountants, or on lawful request — and describe it here.

7. Cookies and local storage

This marketing site sets no cookies. It stores a single flag in your browser's local storage to remember that you closed the store banner, so it is not shown again.

The customer portal sets two first-party cookies: a secure sign-in session cookie, and a cookie remembering which section of the portal you last viewed. Neither is used for advertising or cross-site tracking.

Full details are in our Cookie Policy.

8. Analytics and advertising

We do not use analytics, advertising or tracking services. There is no analytics script, tag manager, advertising pixel or session-recording tool in this website or the customer portal, and our content security policy would block one from loading. We do not sell personal data and we do not share it for cross-context behavioural advertising.

TODO: This statement is accurate as of the audit of the current source code. It must be revisited before any analytics, heat-mapping, advertising or error-reporting tool is introduced, as adding one would likely also require a consent banner.

9. How long we keep data

Account records support a soft-deletion marker, and deleting an account removes the data linked to it. Beyond that, the code does not define retention periods and there is no automated deletion schedule.

TODO: Set and publish a retention schedule for each category: account and profile data, order and payment records (which may carry a statutory accounting retention period), addresses, uploaded images, newsletter subscribers, and security logs.

TODO: Confirm the account closure and data deletion process. The portal currently has no self-service account deletion or data export function, so state the manual route and the response time.

10. International transfers

TODO: Confirm where data is stored and processed. The hosting region of our database and the locations of our providers are configured outside this codebase, so no statement about transfers or safeguards can be made until that is verified.

11. Your rights

You can update most of your profile information and saved addresses yourself in the customer portal, and you can unsubscribe from the newsletter at any time.

TODO: Legal review required. List the applicable data subject rights, how to exercise them, the response deadline, any identity verification step, and the supervisory authority a complaint can be made to. These depend on the applicable jurisdiction and are not assumed here.

12. Children

TODO: Confirm the minimum age for a portal account and whether any age check or parental consent is required. The sign-up form currently does not ask for age.

13. How we protect your data

Measures implemented in our code include: passwords stored and verified only by our authentication provider, new passwords screened against known breaches, rate limiting on sign-in attempts, a bot-protection challenge, sign-in sessions carried in a cookie that scripts cannot read and that expires after 30 days, database access rules that restrict records to their owner, a content security policy, and payment card details never reaching our servers.

No system can be guaranteed secure, but we work to protect data in transit and at rest.

TODO: Confirm the personal data breach notification process and internal escalation contact.

14. Changes to this policy

We may update this policy. The version in force is the one published on this page.

TODO: Confirm how material changes are communicated to account holders and newsletter subscribers.

15. Contact us

Email fishplanetlondon@gmail.com or call +44 2046259881.

TODO: Confirm the dedicated contact route for privacy requests and formal notices, rather than the general store contact details.