Privacy Policy
Last updated: July 2026
Overview
Fishelper ("we", "us", "our") is the data controller for the personal data processed via this website. This policy explains, in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and applicable national implementing law, what personal data we collect, the legal bases on which we rely, how long we retain it, and the rights available to you. By using this website or placing an order, you acknowledge that you have read and understood this policy. Where processing is necessary for the performance of a contract with you (Art. 6(1)(b) GDPR), refusal to provide the requested data will make it impossible for us to accept or fulfil your order.
What we collect and why
When you place an order we collect your full name, email address, shipping and billing address, telephone number, the products ordered, order value, IP address, and the transaction reference returned by our payment processor. Payment card details are entered directly into our PCI-DSS certified payment processor's environment and are never transmitted to, stored on, or accessible by Fishelper servers. When you browse the website we collect standard technical data (IP address, browser user-agent, device type, referring URL, timestamps, pages viewed) via cookies and equivalent technologies for the purposes of security, fraud prevention, aggregated analytics and legitimate-interest performance monitoring (Art. 6(1)(f) GDPR). Strictly necessary cookies are set without consent as permitted under the ePrivacy Directive; analytics and marketing cookies, where used, are set only after you provide affirmative consent via the cookie banner and may be withdrawn at any time.
How we use it, retention and sharing
Personal data is processed only for the purposes for which it was collected: order fulfilment and customer care (Art. 6(1)(b)), compliance with our accounting, tax and consumer-law obligations (Art. 6(1)(c)), fraud prevention and network security (Art. 6(1)(f)), and, where you have opted in, direct marketing (Art. 6(1)(a)). Order and invoicing records are retained for the statutory period required by EU tax law (currently up to 10 years); other data is deleted or irreversibly anonymised once the purpose for which it was collected has been fulfilled. We share data only with vetted processors acting on our documented instructions under Art. 28 GDPR: our payment processor (payment processing), our logistics carriers and warehouse partners (order dispatch), our email service provider (transactional and, where consented, marketing email), and our hosting and analytics providers. Where a processor is located outside the European Economic Area, transfers are governed by the European Commission's Standard Contractual Clauses (2021/914) together with supplementary safeguards where required. We never sell personal data, and we do not carry out automated decision-making producing legal or similarly significant effects.
Your rights
Under GDPR you have the right to: access the personal data we hold about you (Art. 15); request rectification of inaccurate data (Art. 16); request erasure where the legal grounds set out in Art. 17 apply; request restriction of processing (Art. 18); data portability for data you have provided to us (Art. 20); object to processing based on legitimate interests, including profiling, at any time (Art. 21); and withdraw any consent you have given (Art. 7(3)) without affecting the lawfulness of processing carried out before withdrawal. To exercise any of these rights, please submit your request via the postal address associated with the trading entity that appears on your invoice. We will respond within one month of receipt in accordance with Art. 12(3) GDPR; where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act. You also have the right to lodge a complaint with the data protection supervisory authority of the EU Member State in which you reside, work, or where the alleged infringement took place (Art. 77).