Personal Data Protection Notice

This translation is provided for information only. The binding text is the Turkish version.

This Data Protection Notice has been prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK) (the “Law”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to inform natural persons who use the Piscatorium website and mobile app about the purposes for which their personal data is processed, the legal grounds, the collection methods, to whom it may be transferred and their rights under the Law.

1. Data controller

Muharrem Umut Derebek (Piscatorium)
info@piscatorium.com

You can send your applications concerning your personal data to this address. The application procedure is explained in detail in section 12.

2. Who and what does this notice cover?

Piscatorium is a website and a mobile app; this notice covers both. No account is needed just to read the site. When you open an account, log a catch, use the community features or move to Pro membership, the data processed grows. The sections below show separately which data comes into play when.

The service is intended to provide information about weather and sea conditions, fishing grounds, fish species and recreational fishing regulations. Personal data is processed only to the extent of this purpose and in accordance with the general principles in Article 4 of the Law — lawfulness and fairness, accuracy and being up to date, processing for specified, explicit and legitimate purposes, being relevant, limited and proportionate to the purposes for which it is processed, and retention only for as long as necessary.

3. Categories of personal data processed

Data category	Data processed in this category	When
Identity	Your name; the profile address derived from your name	When you open an account
Contact	Your email address	When you open an account or join the waiting list
Transaction security	Password hash, IP address, browser information, requested address, session and security cookies, device notification token, and the account ID from the provider if you used social sign-in	Whenever you use the site
Location	The exact coordinates of the catch log and the approximate coordinates derived from them; in the mobile app, your current location only while the app is open	When you log a catch and when you show your location on the map
Visual records	Your profile photo, your catch photos	When you upload them
User content	The date, time, species, length and weight, technique, tackle and your notes of the catch log; your comments, likes, and follow and block relationships	When you log a catch and when you use the community features
Customer transaction	Pro subscription status, start and end date, store subscription ID	When you move to Pro membership
Requests and feedback	The message you send via the feedback form and the topic you select, app version and device platform	When you send us feedback
Device and usage	In the mobile app: usage events, performance data such as launch time and freezes, crash logs, notification delivery metrics, app-specific device identifiers and the approximate location derived from the IP address	When you use the mobile app
Marketing	On the website, analytics cookies and identifiers; in the mobile app, the ads shown to you and your ad interactions (no advertising identifier is used)	On the website while analytics is on; in the mobile app during free use
Legal transaction	The version of the text you accepted and the time of acceptance; content reports you submitted or that were submitted about you, and moderation records	When you give consent and during complaint processes

No special categories of personal data are processed. Special categories of data within the meaning of Article 6 of the Law, such as health, biometrics, religion, political opinion, sex life and the like, are never requested or processed in any way. We ask you not to include such data in the texts and images you upload.

4. Purposes of processing

• Carrying out membership and authentication processes, i.e. contract processes
• Providing the fishing log, map and community features
• Carrying out information security processes and ensuring the security of the data controller’s operations
• Detecting abuse, fake entries and automated access
• Content moderation and following up on requests and complaints
• Carrying out communication activities
• Carrying out Pro subscription processes and after-sales support
• Responding to feedback and support requests
• Showing ads in free use and measuring the ads
• Fixing errors in the mobile app and measuring and improving its performance and usage
• Analytics activities on the website (only with your explicit consent)
• Sending the announcement to the waiting list (only with your explicit consent)
• Conducting activities in compliance with legislation, following up on legal matters and carrying out storage and archiving activities
• Providing information to authorized persons, institutions and organizations

5. Collection method

Your personal data is collected entirely electronically, by automated means or by non-automated means provided that they form part of a data recording system:

• Forms you fill in directly: sign-up, sign-in, catch log, comment, report, feedback, waiting list
• Permissions you grant in the mobile app: location, photos, notifications
• Records created automatically while you use the site and the app: cookies, server access logs
• Records created automatically by the measurement, crash reporting, notification and advertising software built into the mobile app
• Information from the relevant provider if you choose the social sign-in route
• Subscription information from the app store

6. Legal grounds

Data / processing	Legal ground under the Law
Name, email, password hash, profile address; fishing log and community records	Establishment or performance of a contract (Art. 5(2)(c))
Pro subscription data	Establishment or performance of a contract (Art. 5(2)(c))
The version of the text accepted and the time of acceptance; records kept as required by legislation	Fulfilment of the data controller’s legal obligation (Art. 5(2)(ç))
Server access logs, session and security cookies, abuse detection	Legitimate interest of the data controller (Art. 5(2)(f))
Crash, performance and usage measurement in the mobile app; ad display and ad measurement; feedback records	Legitimate interest of the data controller (Art. 5(2)(f))
Moderation and complaint records, records used in disputes	Establishment, exercise or protection of a right (Art. 5(2)(e))
Responding to requests from competent authorities	Being expressly provided for by law (Art. 5(2)(a))
Catch location, photos, analytics cookies on the website, waiting list registration, social sign-in, notification token	Explicit consent (Art. 5(1))

Where processing is based on explicit consent, you can withdraw your consent at any time. Withdrawal does not make processing carried out up to that point unlawful. You can turn off the relevant permissions within the app or in your device settings.

7. Transfer

Your personal data is not sold and is not transferred to third parties for marketing purposes. Transfers are made only in order to provide the service and fulfil legal obligations, and only to the recipient groups listed below.

7.1 Domestic transfer

• Suppliers from which hosting and infrastructure services are obtained
• Persons from whom legal and financial consultancy services are obtained
• On request, competent public institutions and organizations, judicial authorities and law enforcement units

7.2 Transfer abroad (Law, Art. 9)

The service providers below are used in order to provide the service, and personal data is transferred abroad in this context. No special categories of personal data are transferred abroad.

Recipient	Data transferred	Purpose
Content delivery network and security provider (Cloudflare)	IP address, browser information, requested address	Delivery of the site, speed and attack protection
Email delivery provider (Mailgun — European Union region)	Email address and message content	Password reset, notification and announcement emails
App measurement, crash reporting and notification provider (Google Firebase Analytics, Crashlytics and Cloud Messaging)	Usage events, performance and crash logs, notification delivery metrics, app-specific device identifiers, approximate location derived from the IP address. Your account ID, name and email address are not sent.	Debugging, performance and usage measurement, delivering notifications and improving the app
Ad network (Google AdMob)	IP address and the approximate location derived from it, general device information, an app-specific device identifier and a publisher ID valid only in our own apps, the ads shown and ad interactions, the ads’ performance and crash logs (no advertising identifier is used on iPhone and iPad)	Showing non-personalized ads in free use, ad measurement, frequency capping and fraud prevention
Subscription infrastructure (RevenueCat)	User ID, subscription status	Verifying the subscription and matching it to the account
App stores (Apple App Store, Google Play)	Subscription and payment information	Taking payment and running the subscription. Your card details never reach us.
Web payment provider (Paddle.com, as merchant of record)	Email address, country, order and payment information	Taking payment, invoicing, tax and refunds when Pro is bought on the website. Your card details never reach us.
AI provider (Anthropic, PBC — Claude API, USA)	Forecast and condition data of the chosen spot, species and regulation details, the question typed to the assistant and the earlier messages of the same conversation; with Pro, a summary of your catches at that spot (date, species, count, conditions that day). Name, email address, account ID and the exact catch location are not sent.	Generating the AI narration and assistant answers on the website; the data is not used to train models
Social sign-in providers (Google, Meta, Apple)	Name, email address, account ID	Opening an account and signing in, if you choose this route
Analytics providers (Google Analytics, Microsoft Clarity, Ahrefs)	Cookies and identifiers, IP address, page usage and session recording	Only while analytics is on; measuring site usage
Map base layer and map layer providers (Esri, OpenStreetMap Foundation, EMODnet, NASA GIBS)	IP address and the requested map tile	Drawing the map image

The third-party services actually active on the site at that moment can be seen in the list below, which is generated from the configuration:

Weather and sea data

Our own server fetches this data and we serve it from our own address. Your browser never talks to the data provider; none of your information is sent outside. The fonts are also hosted on our own server; no font request goes out.

Map imagery

The satellite and street imagery on the map is made up of image tiles your browser downloads itself, as on every web map. We send no personal information to the provider in this request — only your device’s IP address and which tile was requested are visible, as with every request on the internet. Your name, your email or any other information of yours is not included in these requests.

Advertising

Ads are shown to free users in the mobile app. The ads are not personalized: no interest profile is sent to the ad network. We do not ask for tracking permission on iPhone and iPad, so the device’s advertising identifier is not used. The ad network sees your IP address and the approximate location it derives from it, general device information, an app-specific device identifier and a publisher ID that is valid only in our own apps. It also collects the ads shown to you, your interactions with ads, and the ads’ performance and crash logs. These are used to show the ad, to prevent the same ad from appearing over and over, for ad measurement and for fraud prevention. No ads are shown with Pro membership.

8. Retention periods

• Account data, catch logs, photos and community content: until you delete your account
• Catch photo files: removed from disk within thirty days at the latest after the account is deleted
• Waiting list records: until the announcement is sent; deleted immediately on request
• Session data: dropped after 120 minutes of inactivity
• Session persistence (“remember me”) cookie: at most 400 days
• Server access logs: for the hosting infrastructure’s own cycle
• Consent records (the version of the text accepted and the time of acceptance): for the applicable limitation periods
• Administrator accounts: until the account is closed

When the period expires, personal data is deleted, destroyed or anonymized.

9. What happens when you delete your account?

You can delete your account from the account screen in the mobile app or, without the app, by signing in at piscatorium.com and using the Account page; if you cannot sign in, write to the address on the contact page from the email address registered in your account. The action cannot be undone. After the deletion request:

• Your account and your content (your catch logs, your rod setups) are closed to access and do not appear on any surface.
• Your profile photo is deleted from disk immediately.
• Your catch photos are removed from disk within thirty days at the latest.
• Your likes, follow relationships, notifications, comments and device notification token are permanently deleted.
• Moderation records such as the feedback and location reports you sent are not deleted; the record itself remains, but its link to you is severed.

10. Data security

Pursuant to Article 12 of the Law, technical and administrative measures are taken to ensure an appropriate level of security in order to prevent unlawful processing of personal data and unlawful access to data and to ensure the preservation of data. Some of the measures actually applied:

• Passwords are never kept in the clear anywhere; only their irreversible hash is stored.
• Site and app traffic is carried over an encrypted connection (HTTPS).
• All uploaded photos are re-encoded on the server and their embedded metadata — including GPS coordinates, device model and serial number — is dropped.
• Access to the data is limited to a small number of people who need it for their duties.
• Backups are made and the security of the backups is ensured.

If a data breach occurs despite the measures taken, the data subjects and the Personal Data Protection Board are notified pursuant to paragraph 5 of Article 12 of the Law.

11. Children’s data

The service is not directed at persons under 18. To open an account and share content, you must be at least 18 years old or have the consent of your parent or guardian. When we learn that data belonging to a person under 18 is being processed, the relevant record is deleted.

12. Your rights (Art. 11) and applications

Pursuant to Article 11 of the Law, by applying to the data controller you have the right to:

• Learn whether your personal data is being processed,
• Request information about it if it has been processed,
• Learn the purpose of the processing and whether the data is used in accordance with its purpose,
• Know the third parties in Türkiye or abroad to whom it is transferred,
• Request its correction if it has been processed incompletely or inaccurately, and request that the action taken in this regard be notified to the third parties to whom it has been transferred,
• Request its erasure or destruction if the reasons requiring its processing no longer exist, and request that the action taken in this regard be notified to the third parties to whom it has been transferred,
• Object to a result to your detriment arising from its analysis exclusively through automated systems,
• Request compensation for the damage if you suffer damage due to its unlawful processing

These are your rights.

Pursuant to Article 5 of the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can submit your requests in writing, via a registered electronic mail (KEP) address, a secure electronic signature, a mobile signature, or by using the email address you previously notified to us and that is registered in our system. So that your identity can be verified, you must send your application from the email address registered in your account.

Your application must include the following:

• Name, surname and, if the application is in writing, signature,
• For citizens of the Republic of Türkiye, the Turkish identity number (T.C. kimlik numarası); for foreigners, nationality, passport number or, if any, identity number,
• Residential or business address for service of notices,
• If any, email address, telephone and fax number for notifications,
• Subject of the request.

Any information and documents relating to the matter should be attached to the application. Your application is concluded as soon as possible depending on the nature of the request and within thirty days at the latest. If the action does not require an additional cost, no fee is charged; if it does require a cost, the tariff in Article 7 of the said Communiqué applies.

If your application is rejected, if you find the response insufficient or if no response is given in time, you can file a complaint with the Personal Data Protection Board within thirty days from the date you learn of the response and in any case within sixty days from the date of application.

13. Changes

This Data Protection Notice may be updated in line with changes to legislation or to the service. The current text is always published at this address; in the case of significant changes, additional notice may be given within the app.

Last updated: 08 October 2026