Privacy Policy

1. About this policy

This policy explains what personal data we collect when you use this website and the online store, who we share it with, and how you can exercise your rights. It sits alongside our Terms & Conditions and the Cookie Policy.

Data handled in our physical stores outside these systems — for example paper records, CCTV, or till transactions that are not linked to a web account — is not described here.

2. Who is responsible for your data

Fish Planet London is responsible for the personal data described in this policy. We trade from 6 Scawfell St, London E2 8NG, United Kingdom and 2 Wells Terrace, London N4 3JU, United Kingdom, and we run this website and the online store. Privacy questions go to contact@fishplanetlondon.co.uk.

3. What this website collects

This marketing site has no accounts and no analytics. There is exactly one place where you can submit personal data:

• Newsletter signup. The form in the footer collects your name and email address. These are sent to our own server, which adds you as a contact in our email provider's audience list. No other field is collected and nothing is stored in our own database by this form.
• Anti-abuse throttling. To stop repeated automated submissions, the newsletter endpoint temporarily counts requests per IP address in memory for one minute. The IP address is not written to a database or a log by this code.

Contacting us by the phone number or email address shown on the site is a direct message to us and is not processed by this website.

We use the newsletter list only to send that newsletter. You can unsubscribe at any time from the link in those emails, or by contacting us.

4. What the online store collects

The online store uses an account. We collect the following.

Account and sign-in

• Sign-up collects email address, password, first name, last name and username. Sign-in is by email and password only; we do not offer social or single sign-on login.
• When you set a password, we check it against a public list of passwords known to have been leaked elsewhere. Your password is not sent. Only a partial, irreversible fingerprint is used for the check, and it cannot be turned back into the password.
• Sign-in and sign-up are protected by a CAPTCHA-style challenge provided by a third party, which receives the challenge token and — as an inherent part of operating it — your IP address.
• To limit brute-force attempts we record rate-limiting counters keyed by an irreversible hash of the IP address or email address, not the values themselves.

Profile

• Optional profile fields: display name, username, bio, location, website link, experience level, main interest, and profile visibility.
• An optional profile picture, stored in our file storage under a path scoped to your account.

Orders and checkout

• Checkout collects email address, phone number, full name and a delivery or billing address(address lines, city, region, postcode, country), plus your fulfilment choice, preferred date and any order notes you write.
• Addresses can be saved to your account for reuse.
• We store your order history, including the items, quantities and prices at the time of purchase, and loyalty points earned and spent.

Payments

• Card payments are handled by our payment provider. Card details are entered directly into the provider's own secure fields and are never sent to or stored on our servers.
• We send the payment provider your email address, the amount, and internal reference IDs. We do not send your name, phone number or address to them.
• We store the payment outcome and, for your reference, only the card brand and last four digits.

Aquariums and community features

• Content you create about your tanks — name, location, type, description, photos, setup date, species and water-parameter logs — is stored against your account.
• Social features (posts, comments, likes, follows, saved items) link activity to your account where you use them.

Store systems

• Customer records from our in-store point-of-sale system are synchronised into our database, which can include name, email address and phone numbers. Where a verified email matches, an in-store customer record is linked to the web account.
• When a web order is sent to the store system, only a customer reference, the order number, the items and the amount are transmitted — not your name, email, phone or address.

5. Why we process your data

We use personal data to fulfil orders, operate accounts, take payment, send order confirmations, send the newsletter when you sign up, and protect the service from abuse.

6. Providers who process data for us

We use the following third-party services:

• Database, authentication and file storage provider — hosts accounts, profiles, orders and uploaded images.
• Payment provider — processes card payments and receives your email address and internal references.
• Email provider — sends order confirmation emails and holds the newsletter audience list. Order confirmation emails contain your name, email address, order details and your collection or delivery address.
• Point-of-sale / retail platform — our store system, synchronised as described in section 4.
• Bot-protection provider — runs the sign-in and sign-up challenge.
• Breached-password service — used when a password is set, as described in section 4. Your password is not sent to it.

Web fonts are served from our own domain at build time, so your browser does not request fonts from a third party while you browse.

7. Cookies and local storage

This marketing site sets no cookies. It stores a single flag in your browser's local storage to remember that you closed the store banner, so it is not shown again.

The online store sets two first-party cookies: a secure sign-in session cookie, and a cookie remembering which section of the store you last viewed. Neither is used for advertising or cross-site tracking.

Full details are in our Cookie Policy.

8. Analytics and advertising

We do not use analytics, advertising or tracking services. There is no analytics script, tag manager, advertising pixel or session-recording tool in this website or the online store. We do not sell personal data and we do not share it for cross-context behavioural advertising.

9. How long we keep data

We keep account and profile information while your account is open. If you ask us to delete the account, we delete the data linked to it, apart from records we must keep to complete orders, take payment, or meet accounting and legal duties.

Newsletter details are kept until you unsubscribe or ask us to remove them. To close an account or request a copy of your data, email contact@fishplanetlondon.co.uk.

10. International transfers

The providers listed in this policy may process personal data in the United Kingdom or in other countries where they operate. They do so only to provide the service we use them for.

11. Your rights

You can update most of your profile information and saved addresses yourself in the online store, and you can unsubscribe from the newsletter at any time.

You can also ask us for a copy of your personal data, to correct it, to delete it, to limit how we use it, or to object to certain uses. You can withdraw consent for the newsletter at any time. We aim to respond within one month. If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk.

12. Children

This website and the online store are not aimed at children, and we do not knowingly collect their personal data. If you believe a child has given us their details, contact us and we will delete them.

13. How we protect your data

Measures implemented in our code include: passwords stored and verified only by our authentication provider, new passwords screened against known breaches, rate limiting on sign-in attempts, a bot-protection challenge, sign-in sessions carried in a cookie that scripts cannot read and that expires after 30 days, database access rules that restrict records to their owner, a content security policy, and payment card details never reaching our servers.

No system can be guaranteed secure, but we work to protect data in transit and at rest.

14. Changes to this policy

We may update this policy. The version and date at the top of this page show which version is in force.

15. Contact us

Email contact@fishplanetlondon.co.uk or call +44 2046259881. Privacy requests use the same email address.