Privacy Policy
Last updated: 2026-04-11
This is the English version of our privacy policy. The original Swedish text is available at /integritetspolicy and takes precedence in case of any discrepancy.
1. Who is responsible for your data?
gofish.nu ("GoFish", "we", "us") is operated by IT-Entreprenörerna AB (org. reg. 556840-1086), with registered office in Sundsvall. We follow a shared responsibility model that is industry standard for fishing licence platforms:
- Account data (login, profile, favourites, fishing diary) — GoFish is the data controller
- Purchase data (who bought which fishing licence from which FVO) — the FVO is the data controller, GoFish is the data processor handling the data on the FVO's behalf
This split reflects that the FVO (fishing rights association) issuing the licence is the legal seller. GoFish is the intermediary providing the platform and payment flow. See our terms of purchase for more on the intermediary role.
Contact us:
IT-Entreprenörerna AB
Kyrkogatan 24, 85232 Sundsvall
Email: gdpr@gofish.nu
2. What data do we collect?
When purchasing a fishing licence
The data collected depends on what the FVO requires. The minimum is:
- First and last name — to identify the licence holder
- Email address — for receipt and digital licence
The FVO may also choose to collect:
- Phone number
- Date of birth or personal identity number — for age-based pricing or ID verification
- Address, postal code, city
We never collect more than what the FVO has chosen to ask for.
When creating an account
- Email address and password (handled by Firebase Authentication)
When paying
- Payment details are handled by Stripe and are never stored by us
Automatically
- We use no tracking cookies or third-party analytics
In the mobile app (Fisketillsyn / fishing supervision)
- Login email (via Firebase Authentication)
- GPS location — only when explicitly attached to a supervision report (optional)
- Photos — only when explicitly attached to a supervision report (optional)
- Crash logs — to help us diagnose and fix app crashes
3. Why do we process your data?
| Purpose | Legal basis |
|---|---|
| Fulfil purchase of fishing licence | Contract |
| Send receipt and digital licence by email | Contract |
| Enable fishing supervision to verify licences | Legitimate interest |
| Bookkeeping of transactions | Legal obligation (Swedish Bookkeeping Act) |
| Manage your account | Contract |
4. Who can see your data?
Fishing supervision during inspection
When fishing supervision personnel verify your licence (via QR code), they can see your name and whether the licence is valid. They cannot see your email, phone, address or other contact information.
The FVO (fishing rights association)
The FVO selling the licence is the data controller for the purchase and therefore has access to the data they chose to collect at the time of purchase — typically name, email, phone and possibly address. The FVO uses the data to fulfil the purchase, record the sale, and handle inspections, complaints and any member discounts.
The FVO may not use the data for marketing or other purposes without separate consent from you. Between GoFish and each FVO, there is a Data Processing Agreement (DPA) regulating how the data may be processed.
Sub-processors (third-party suppliers)
GoFish uses the following sub-processors to deliver the service. All have their own data processing agreements with us and comply with GDPR requirements. Transfers outside the EU are made under Standard Contractual Clauses (SCC) or the Data Privacy Framework (DPF).
| Supplier | Service | What they do | Location | Basis |
|---|---|---|---|---|
| Supabase | Database (PostgreSQL) | Stores all application data — users, fishing licences, purchases, FVOs, catch reports and bookings. Automatic backup. | EU (Frankfurt) | Within EU |
| Firebase (Google) | Authentication | Handles login, passwords and sessions. Passwords are hashed by Google — we never see them. | EU / US | SCC + DPF |
| Stripe | Payments | Receives card payments and forwards funds directly to the FVO via Stripe Connect. Card details never pass through our servers. | EU / US | SCC + DPF |
| Resend | Email delivery | Sends transactional emails — receipts, verification links, invitations. Sees the recipient's email and the message content. | US | SCC |
| Vercel | Hosting / CDN | Runs the web application itself. Temporary traffic logs (IP, user agent) for security and troubleshooting. | EU / US | SCC + DPF |
5. How long do we keep your data?
| Data | Retention period |
|---|---|
| Account data | Until you delete your account |
| Buyer personal data (name, email etc.) | Anonymised on deletion, transaction kept for 7 years (Swedish Bookkeeping Act) |
| Transaction history (amount, date, licence type) | 7 years (Swedish Bookkeeping Act) |
| Catch reports | Anonymised on account deletion |
6. Security and incidents
We take appropriate technical and organisational measures to protect your data: all traffic is encrypted with HTTPS/TLS, passwords are handled by Firebase Authentication and never stored in plain text, payment details are handled by Stripe and never pass through our servers, and access to the data is role-based.
If a personal data breach occurs that may affect you, we notify the responsible data controller (GoFish and/or the FVO) without undue delay, at the latest within 24 hours of discovery. Affected individuals are informed in accordance with Article 34 GDPR.
7. Your rights
Under GDPR, you have the right to:
- Access — request a copy of the data we hold about you
- Rectify — correct inaccurate data
- Erase — request deletion of your data (personal data is anonymised, transaction history is kept under the Bookkeeping Act)
- Restrict — restrict processing of your data
- Portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interest
Contact gdpr@gofish.nu to exercise your rights. We respond within 30 days.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) — imy.se.
8. Consent at purchase
When buying a fishing licence, you accept that we process your personal data in accordance with this policy. The processing is necessary to fulfil the purchase and deliver your digital licence.
9. Changes to this policy
We may update this policy. For material changes we will notify you by email if you have an account. The latest version is always available on this page.