Privacy notice

Go Fishing (gofishingtours.co.uk) is run by an individual. There is no company behind it yet. The person who runs the site decides how and why personal data on it is used, and is the data controller under the UK GDPR. In this notice, "we" and "us" mean that person.

You can contact us about your data through the contact form.

• Account details: your name, email address and password. We only store the password as a one-way hash, so we cannot read it. You can also add a phone number and a profile photo.
• Google sign-in: if you sign in with Google, Google sends us your name, email address, profile picture and Google account ID.
• Bookings and waiting lists: the trips you book or join the waiting list for, the number of seats, any notes you add and the booking status. On a waiting list you can also give a phone number for text alerts, although we do not send texts yet.
• Reviews: your star rating and review text.
• Skipper accounts: business name, home port, company number, descriptions, boat details, photos and any documents you upload.
• Contact form messages: your name, email address, subject and message.
• Usage data: if you accept analytics cookies, Google Analytics records how you use the site, such as the pages you visit, your device and browser type, and your approximate location.

• To run your account, take bookings and waiting-list entries, and send the emails that go with them, such as email verification, password resets and booking or waiting-list updates. Our lawful basis is that this is needed to provide the service you signed up for under our terms of service.
• To answer messages you send through the contact form. Lawful basis: legitimate interests.
• To keep the site secure and stop misuse, for example by limiting repeated login attempts. Lawful basis: legitimate interests.
• To let us know when someone registers. When you create an account or start a skipper account, we email ourselves your name and email address. Lawful basis: legitimate interests in running the site.
• To understand how the site is used, through Google Analytics. Lawful basis: your consent, which you can withdraw at any time with the Cookie settings link at the bottom of every page.

We do not sell your personal data.

• Everyone: reviews are public and show your name, rating, review text and date. Skipper profiles, boats and trips are public too.
• Skippers: when you book a trip, the skipper running it can see your name, email address and booking details.
• Our service providers, who process data on our behalf:
  • Vercel, which hosts the website
  • Fly.io, which hosts our server and database in London
  • Resend, which sends our emails
  • Google, for Google Analytics if you accept analytics cookies, Google sign-in if you use it, and the Gmail inbox that receives contact form messages and registration alerts
• Authorities: we will share data if the law requires us to.

Payments are switched off while the site is a demo, so we do not collect any card details.

Vercel, Resend and Google may process data outside the UK, including in the United States. These transfers rely on safeguards recognised under UK law, such as the UK-US data bridge or the UK International Data Transfer Agreement.

These cookies are essential and are always set:

• Login cookies keep you signed in. One lasts 15 minutes and is renewed by a second that lasts 30 days. Signing in with Google also sets two cookies that last 10 minutes. The site cannot log you in without these.
• gf_cookie_consent remembers whether you accepted or rejected analytics cookies, for 6 months.

These cookies are only set if you accept them in the cookie banner:

• Google Analytics cookies (_ga and _ga_*) measure how visitors use the site and last up to 2 years.

You can change your choice at any time with the Cookie settings link at the bottom of every page. If you withdraw consent, we delete the Google Analytics cookies from your browser. You can also block or delete cookies in your browser settings, but blocking login cookies stops you signing in.

• Account details, bookings, waiting-list entries and reviews: until you close your account or ask us to delete them.
• Contact form messages: as long as we need them to deal with your enquiry. If you make a data protection request, we keep a short record of the request and how we answered it.
• Google Analytics data: up to 14 months.

Because this is a demonstration site, we sometimes reset it. A reset permanently deletes all accounts, bookings, reviews and messages.

Under the UK GDPR you have the right to:

• get a copy of the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• restrict or object to how we use your data
• receive your data in a format you can take elsewhere
• withdraw your consent to analytics cookies at any time

To use any of these rights, send a request through the contact form, using the email address on your account if you can. We will reply within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

If Go Fishing launches as a real booking service, this notice will change, including who the data controller is. The date at the top shows when it last changed.