Privacy Policy

Version dated July 23, 2026. In case of any discrepancy, the Russian version prevails.

This Policy defines how personal data of users of the GoFish service (the "GoFish" mobile application and the fishonline.kz website) is processed and protected, in accordance with the Law of the Republic of Kazakhstan No. 94-V of May 21, 2013 "On Personal Data and Its Protection".

1. What data we collect

• Account data: username (login), e-mail address, password (stored only as an irreversible hash).
• Profile data (optional): profile photo (avatar).
• Service usage data: fishing session history, catches (fish species, weight, photo), balance transactions, applied promo codes, messages in chats with the operator and support.
• Payment data: processed exclusively by the payment organisation PayLink.kz LLP and the acquiring bank on their side. We do not receive or store full bank card details — we only receive the payment result (amount, status, identifier).
• Technical data: IP address, device model, app and OS version, push notification identifier (FCM token), service logs.
• Cookies and website analytics: the website uses Google Analytics (anonymised visit statistics). Cookies can be disabled in your browser settings.

2. Purposes of processing

• providing the services: account, access to IoT rods, balance and history;
• performing the public offer agreement, accepting payments and refunds;
• communication: service notifications, push notifications about the queue and session events, support replies;
• security, fraud and abuse prevention;
• service quality improvement (anonymised statistics).

3. Legal grounds

Processing is based on: the data subject's consent given upon registration in the App; the necessity to perform the agreement (public offer); requirements of the legislation of the RoK (accounting and tax records of payments).

4. Sharing with third parties

We share data only to the extent necessary to provide the service and only for the purposes listed below:

• with payment organisations — to process payments and refunds: PayLink.kz LLP and the Kaspi Pay service. The amount, the operation identifier and its status are shared. We do not receive or store full bank card details;
• with water body operators (rod operators) — the username and current session data, to support the fishing session and chat;
• with Google LLC (USA) — Firebase Cloud Messaging: the device identifier for push notification delivery; Google Analytics: anonymised website visit statistics; sign-in with a Google account: if you choose this sign-in method, your email address and profile name are shared;
• with Telegram — if you choose to sign in via Telegram: your profile identifier and name;
• with the Yandex email service — the recipient address and message text, to deliver service emails;
• with the SMSC messaging service — the phone number and message text, to deliver confirmation codes;
• with state authorities of the RoK — only upon a lawful request.

Data is not sold and is not shared with third parties for marketing purposes.

5. Storage and protection

The database of users' personal data is located on servers in the territory of the Republic of Kazakhstan (Astana), in accordance with paragraph 2 of Article 12 of the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 «On Personal Data and Their Protection».

Certain data is shared, to a limited extent, with the service providers listed in section 4, some of which are located outside the Republic of Kazakhstan; such sharing is carried out solely for the purposes stated there and only to the extent those purposes require.

We use: encrypted communication channels (TLS), password hashing, access control and action logging. Data is kept for the lifetime of the account and for 3 years after its deletion to the extent necessary for accounting and dispute resolution, after which it is deleted or anonymised.

6. Data subject rights

Under Law No. 94-V of the RoK you have the right to:

• obtain information on the scope and purposes of processing of your data;
• request correction or completion of incomplete/inaccurate data (your profile can be edited in the App);
• withdraw consent and request deletion of your data (account deletion — by request to gofish@fishonline.kz; deletion makes further provision of services impossible);
• appeal against the controller's actions to the authorised body or court.

Requests are processed within 15 calendar days.

7. Changes to this policy

The current version of this Policy is always available on this page. In case of material changes we will notify users through the App.