1 Introduction & Scope

Aquarium Hobbyist is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy ("Policy") applies to all visitors, users, and others who access or use our services (collectively, "Users" or "you").

This Policy covers information we collect when you use our website, mobile applications, email newsletters, social media pages, forums, community features, and any other products, services, or features we operate (collectively, the "Services").

Scope of Application

This Policy applies to:

• All visitors and users of aquariahobbyist.com
• Registered account holders
• Newsletter subscribers
• Forum and community participants
• Users of our mobile applications
• Individuals who contact us via email, phone, or other channels
• Job applicants and prospective employees
• Business partners and vendors

This Policy does not apply to information collected by third-party websites, services, or applications that may be linked to or from our Site. We are not responsible for the privacy practices of other websites or services.

2 Definitions

For the purposes of this Privacy Policy:

Personal Data

Any information relating to an identified or identifiable natural person ("data subject"), such as name, email address, location data, online identifier, or factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

Processing

Any operation or set of operations performed on personal data, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, alignment, combination, restriction, erasure, or destruction.

Data Controller

The natural or legal person, public authority, agency, or other body that determines the purposes and means of processing personal data. For this Site, Aquarium Hobbyist LLC is the Data Controller.

Data Processor

A natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.

Consent

A freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they, by a statement or clear affirmative action, signify agreement to the processing of personal data relating to them.

Cookies

Small text files stored on your device when you visit a website, used to remember your preferences, understand how you use the site, and provide personalized experiences.

3 Information We Collect

We collect several types of information from and about users of our Services. The categories of information we collect depend on how you interact with our Services.

3.1 Information You Provide Directly

• Account Information: Username, email address, password (stored as salted hash), display name, profile picture, bio, and account preferences.
• Profile Information: Aquarium experience level, types of aquariums you maintain, fish species interests, geographic location (optional), and social media links (optional).
• Communications: Emails, messages, forum posts, comments, support tickets, and any other communications you send through our Services.
• Transaction Information: Purchase history, billing address, payment method details (processed securely through our payment processor - we do not store full credit card numbers), and order details.
• User Content: Photos, videos, articles, reviews, forum posts, aquarium setup descriptions, and any other content you create or upload.
• Survey & Feedback Data: Responses to surveys, polls, feedback forms, and satisfaction questionnaires.
• Job Application Data: Resume, cover letter, education history, work experience, and references (if applicable).

3.2 Information Collected Automatically

• Device Information: Device type, operating system, browser type and version, screen resolution, and device identifiers.
• Network Information: IP address, internet service provider, connection type (WiFi/cellular), and network location.
• Usage Data: Pages visited, time spent on pages, click patterns, scroll depth, search queries, referral URLs, and navigation paths.
• Location Data: General geographic location derived from IP address, and precise location if you grant permission (mobile apps).
• Log Data: Access times, error logs, HTTP headers, and system activity records.
• Performance Data: Page load times, interaction latency, and error occurrence rates.

3.3 Information from Third Parties

• Social Media: Information from social login providers (Google, Facebook, Apple) when you choose to connect your accounts.
• Analytics Providers: Aggregated data from Google Analytics, Hotjar, and similar services.
• Advertising Partners: Information from advertising networks about your interactions with our ads.
• Business Partners: Information shared by partners with whom we offer co-branded services or joint marketing.
• Public Sources: Publicly available information from forums, social media, and public records where legally permissible.

4 How We Use Your Information

We use the information we collect for the following purposes, each supported by a corresponding legal basis under applicable data protection laws:

4.1 Specific Use Cases

• Community Features: To enable forum participation, comments, and user interactions within our aquarium hobby community.
• Content Recommendations: To suggest relevant articles, guides, and products based on your aquarium interests and browsing history.
• Customer Support: To respond to inquiries, resolve issues, and provide technical assistance.
• Contests & Promotions: To administer sweepstakes, contests, and promotional offers (with your consent where required).
• Research & Analysis: To conduct internal research on user behavior, preferences, and trends to improve our Services.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

5 Legal Basis for Processing (GDPR Article 6)

If you are located in the European Economic Area (EEA), we process your personal data based on one or more of the following legal grounds:

• Consent (Article 6(1)(a)): You have given clear consent for processing your personal data for one or more specific purposes.
• Contract (Article 6(1)(b)): Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
• Legal Obligation (Article 6(1)(c)): Processing is necessary for compliance with a legal obligation to which we are subject.
• Vital Interests (Article 6(1)(d)): Processing is necessary to protect the vital interests of you or another natural person.
• Public Interest (Article 6(1)(e)): Processing is necessary for the performance of a task carried out in the public interest.
• Legitimate Interests (Article 6(1)(f)): Processing is necessary for the purposes of legitimate interests pursued by us or a third party, except where such interests are overridden by your interests or fundamental rights.

Where we rely on consent as our legal basis, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

6 Cookies & Tracking Technologies

We use cookies and similar tracking technologies to track activity on our Services and hold certain information. Cookies are files with a small amount of data which may include an anonymous unique identifier.

6.1 Types of Cookies We Use

6.2 Managing Cookies

You can manage your cookie preferences through:

• Our cookie consent banner (available at any time via the cookie icon in the footer)
• Your browser settings (most browsers allow you to refuse or accept cookies)
• Third-party opt-out tools (e.g., Network Advertising Initiative, Digital Advertising Alliance)
• Browser extensions that block tracking (e.g., Privacy Badger, Ghostery)

Please note that disabling certain cookies may affect the functionality of our Services. Essential cookies cannot be disabled as they are necessary for the Site to operate.

7 Data Sharing & Third Parties

We do not sell your personal information. We may share your information in the following circumstances:

7.1 Service Providers

We share data with trusted third-party service providers who assist us in operating our Services, including:

• Hosting Providers: Cloud infrastructure and server hosting (e.g., AWS, Cloudflare)
• Payment Processors: Secure payment handling (e.g., Stripe, PayPal)
• Email Services: Transactional and marketing email delivery (e.g., SendGrid, Mailchimp)
• Analytics Providers: Website analytics and performance monitoring (e.g., Google Analytics)
• Customer Support: Help desk and support ticket management
• Content Delivery Networks: Fast and reliable content delivery

All service providers are bound by data processing agreements that require them to implement appropriate security measures and process data only for specified purposes.

7.2 Other Circumstances for Disclosure

• Legal Requirements: When required by law, court order, or governmental regulation.
• Protection of Rights: To protect the rights, property, or safety of Aquarium Hobbyist, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, or sale of assets (see Section 19).
• With Your Consent: When you have given explicit consent for a specific disclosure.
• Aggregated/Anonymized Data: We may share aggregated or anonymized data that cannot reasonably be used to identify you.

8 International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country.

When we transfer personal data from the EEA to countries not deemed adequate by the European Commission, we implement appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding Corporate Rules where applicable
• EU-US Data Privacy Framework certifications where available
• Supplementary measures to ensure an equivalent level of protection

You may request a copy of the appropriate safeguards we have in place by contacting us at privacy@aquariahobbyist.com.

9 Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements.

After the retention period expires, data is securely deleted or anonymized. In some cases, we may retain anonymized or aggregated data indefinitely for research and analytical purposes.

10 Security Measures

We implement comprehensive technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, destruction, or accidental loss. Our security program includes:

10.1 Technical Measures

• Encryption in Transit: TLS 1.3 for all data transmitted between your browser and our servers
• Encryption at Rest: AES-256 encryption for stored personal data
• Access Controls: Role-based access control (RBAC), multi-factor authentication, and principle of least privilege
• Network Security: Firewalls, intrusion detection/prevention systems, and DDoS protection
• Application Security: Regular vulnerability scanning, secure coding practices, and Web Application Firewall (WAF)
• Backup & Recovery: Automated encrypted backups with tested disaster recovery procedures
• Endpoint Protection: Anti-malware, endpoint detection and response (EDR) for all workstations

10.2 Organizational Measures

• Employee Training: Regular privacy and security awareness training for all staff
• Access Reviews: Quarterly reviews of system access permissions
• Background Checks: Criminal and reference checks for employees with data access
• Confidentiality Agreements: All employees and contractors sign NDAs
• Incident Response Plan: Documented and tested procedures for security incidents
• Vendor Management: Due diligence assessments and ongoing monitoring of service providers
• Data Protection Impact Assessments: Conducted for high-risk processing activities

10.3 Certifications & Compliance

• SOC 2 Type II certified hosting infrastructure
• ISO 27001 aligned information security management
• PCI DSS compliant payment processing
• Regular third-party penetration testing (at least annually)
• Bug bounty program for responsible vulnerability disclosure

11 Your Rights

Depending on your location and applicable laws, you may have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data under certain circumstances.
• Right to Restrict Processing: Request that we limit the processing of your personal data.
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing of your personal data based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Withdraw previously given consent at any time without affecting the lawfulness of prior processing.
• Right Not to be Subject to Automated Decisions: Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
• Right to Lodge a Complaint: File a complaint with a supervisory authority if you believe your rights have been violated.

To exercise any of these rights, please contact our Data Protection Officer at privacy@aquariahobbyist.com . We will respond to verified requests within 30 days (or as required by applicable law).

12 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected, the sources, purposes, and third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out: You may opt out of the "sale" or "sharing" of your personal information. We do not sell personal information.
• Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your privacy rights.
• Right to Limit Use of Sensitive Personal Information: You may limit the use and disclosure of sensitive personal information to what is necessary to provide our Services.

Categories of Personal Information Collected (Past 12 Months)

To submit a verifiable consumer request, contact us at privacy@aquariahobbyist.com or call our toll-free number at 1-800-XXX-XXXX. You may also designate an authorized agent to make requests on your behalf.

13 European Economic Area Rights (GDPR)

If you are located in the EEA, you have the following rights under the General Data Protection Regulation (GDPR):

• Article 15 - Right of Access: Obtain confirmation of processing and a copy of your personal data.
• Article 16 - Right to Rectification: Have inaccurate data corrected without undue delay.
• Article 17 - Right to Erasure: Have your data deleted when it is no longer necessary, consent is withdrawn, or processing is unlawful.
• Article 18 - Right to Restriction: Limit processing in certain circumstances (e.g., while accuracy is contested).
• Article 20 - Right to Portability: Receive your data in a portable format and transmit it to another controller.
• Article 21 - Right to Object: Object to processing based on legitimate interests or for direct marketing (absolute right).
• Article 22 - Automated Decision-Making: Not be subject to solely automated decisions with legal or significant effects.
• Article 77 - Right to Complain: Lodge a complaint with your local supervisory authority.

Our EU Representative (as required by Article 27 GDPR) can be contacted at: eu-representative@aquariahobbyist.com

14 Children's Privacy (COPPA)

Our Services are not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without parental consent, we will take immediate steps to delete that information.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@aquariahobbyist.com .

We comply with the Children's Online Privacy Protection Act (COPPA) and the UK Age Appropriate Design Code. If you have concerns about our practices regarding children's data, you may also file a complaint with the Federal Trade Commission (FTC).

15 Analytics & Advertising

15.1 Analytics Services

We use the following analytics services:

• Google Analytics: Tracks page views, user behavior, and demographics. Data may be transferred to Google LLC in the US. We use IP anonymization and have a Data Processing Agreement in place.
• Hotjar: Provides heatmaps, session recordings (anonymized), and user feedback tools. You can opt out at hotjar.com/opt-out.
• Plausible Analytics: Privacy-focused analytics that does not use cookies or collect personal data.

15.2 Advertising

We may use the following advertising technologies:

• Google AdSense/Ad Manager: Displays relevant advertisements. Uses cookies for ad personalization. You can opt out via Google Ad Settings.
• Amazon Associates: Affiliate program that may use cookies to track referrals.
• Social Media Pixels: Facebook Pixel, Twitter Tag for conversion tracking and audience building (with consent).

15.3 Opting Out of Advertising

• Google Ads Settings: adssettings.google.com
• Network Advertising Initiative: optout.networkadvertising.org
• Digital Advertising Alliance: optout.aboutads.info
• European Interactive Digital Advertising Alliance: youronlinechoices.eu

16 User-Generated Content

When you post content on our forums, comment sections, or community features, please be aware that:

• Content you post publicly may be visible to other users and may be indexed by search engines.
• We may use, display, and distribute your content in connection with our Services.
• By posting content, you grant us a non-exclusive, royalty-free, worldwide license to use, reproduce, modify, and display such content.
• You retain ownership of your content but acknowledge our right to use it as described.
• We may moderate content but are not obligated to monitor or remove user content.
• Personal information included in public posts may be collected and used by other users.

We encourage you to exercise caution when sharing personal information in public areas of our Services.

17 Links to Third-Party Sites

Our Services may contain links to third-party websites, services, or content that are not owned or controlled by Aquarium Hobbyist. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services.

We strongly advise you to read the privacy policy of every website you visit. The inclusion of any link does not imply endorsement, approval, or recommendation by Aquarium Hobbyist.

18 Data Breach Procedures

In the event of a personal data breach, we have established procedures to:

• Detect & Investigate: Our security monitoring systems and incident response team work to quickly identify and assess any potential breach.
• Contain: Immediate steps to contain the breach and prevent further unauthorized access.
• Notify Authorities: Notify the relevant supervisory authority within 72 hours of becoming aware of a breach, as required by GDPR Article 33.
• Notify Affected Individuals: Notify affected users without undue delay when the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34.
• Document: Maintain detailed records of all breaches, including facts, effects, and remedial actions taken.
• Remediate: Implement corrective measures to prevent similar breaches in the future.

Notifications will include a description of the nature of the breach, the categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.

19 Business Transfers & Mergers

If Aquarium Hobbyist is involved in a merger, acquisition, asset sale, bankruptcy, or other business transfer, your personal data may be transferred to the acquiring entity. In such events:

• We will notify you via email and/or a prominent notice on our Site before your data is transferred.
• The acquiring entity must agree to honor the commitments in this Privacy Policy.
• You will retain your rights regarding your personal data under the new entity.
• If the new entity intends to use your data in materially different ways, we will obtain your consent first.

20 Do Not Track Signals

Some browsers incorporate a "Do Not Track" (DNT) feature that signals to websites that you do not wish to be tracked. Because there is no uniform standard for DNT signals and not all browsers support this feature, we currently respond to DNT signals as follows:

• We honor Global Privacy Control (GPC) signals where technically feasible.
• We respect browser-level tracking preferences including Safari's Intelligent Tracking Prevention and Firefox's Enhanced Tracking Protection.
• We honor platform-level opt-outs such as Apple's App Tracking Transparency.
• For DNT signals specifically, we treat them as a preference to limit non-essential tracking and will not use marketing cookies for users who have enabled DNT, where technically identifiable.

21 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• Material Changes: We will provide prominent notice (e.g., email notification, banner on our Site) at least 30 days before changes take effect.
• Minor Changes: We will update the "Last Updated" date at the top of this policy.
• Consent Changes: If changes affect how we use data previously collected with your consent, we will seek your renewed consent.
• Historical Versions: Previous versions of this policy are archived and available upon request.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of our Services after any changes constitutes acceptance of the updated policy.

22 Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

23 Consent & Withdrawal

Where processing is based on your consent:

• Consent is obtained through clear affirmative actions (e.g., checking a box, clicking "I agree").
• Consent requests are clearly distinguishable from other matters and presented in intelligible, accessible language.
• You may withdraw consent at any time through your account settings or by contacting us.
• Withdrawal of consent does not affect the lawfulness of processing before withdrawal.
• We maintain records of when and how consent was obtained.
• Consent is reviewed and refreshed periodically, especially for children's data or sensitive processing.

24 Filing Complaints

If you are unsatisfied with our response to a privacy concern or data request, you have the right to file a complaint with a supervisory authority:

• EEA Residents: Your local Data Protection Authority (DPA). Find yours at edpb.europa.eu
• UK Residents: Information Commissioner's Office (ICO) at ico.org.uk
• US Residents: Federal Trade Commission (FTC) at ftc.gov/complaint
• California Residents: California Attorney General at oag.ca.gov/privacy/report
• Brazil Residents: Autoridade Nacional de Proteção de Dados (ANPD)
• Canada Residents: Office of the Privacy Commissioner of Canada at priv.gc.ca

We encourage you to contact us first so we can attempt to resolve your concern directly. We are committed to addressing all privacy concerns promptly and fairly.

25 Glossary of Terms

GDPR

General Data Protection Regulation (EU) 2016/679 - the primary data protection law in the European Union.

CCPA

California Consumer Privacy Act - a state statute intended to enhance privacy rights and consumer protection for residents of California.

CPRA

California Privacy Rights Act - amendments to CCPA that expanded consumer privacy protections effective January 1, 2023.

COPPA

Children's Online Privacy Protection Act - US federal law protecting the privacy of children under 13 online.

LGPD

Lei Geral de Proteção de Dados - Brazil's comprehensive data protection law, similar in structure to GDPR.

DPIA

Data Protection Impact Assessment - an assessment carried out to identify and minimize data protection risks of a project.

SCCs

Standard Contractual Clauses - standard data protection clauses adopted by the European Commission for international data transfers.

DPO

Data Protection Officer - an independent expert responsible for data protection compliance within an organization.