Privacy Policy
for STURNET

STURNET ("the app") is a mobile application developed for sturgeon bycatch reporting and species identification. Reports are saved locally on your device first and are uploaded to the STURNET research database only when you choose to synchronise them.

This Privacy Policy explains what information is handled by the app, on what legal basis, how reports are stored and synchronised, how long data is kept, and the rights and choices available to you under Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”).

The controller of personal data processed through STURNET is:

The Foundation has assessed that it is not required to designate a Data Protection Officer under Article 37 GDPR. Privacy enquiries are handled through the contact above.

STURNET does not require a user account and does not ask for your name, email address, telephone number, or any other direct personal identifier as part of a bycatch report. When you choose to synchronise a report, the following data is transmitted to and stored on the STURNET server:

• GPS location (optional) — if you select “Capture Location”, the latitude and longitude are added to the report and uploaded when the report is synchronised. A report can be created without GPS coordinates.
• Catch and sighting data — species name, report type, fish count, fish condition, visible-disease information, disease notes, length, weight, and any free-text notes you enter.
• Timestamps — the date and time the event was recorded and the date and time the report was synchronised.
• Technical connection data — when the app communicates with the server, standard server logs record the IP address of the connecting device, the time of the request, and basic technical request data. Server logs are used solely for security and operation of the service and are retained for no longer than 12 months.

A note on identifiability: although reports contain no name or account, a combination of precise GPS coordinates, timestamps, and free-text notes may in some circumstances make a person indirectly identifiable. We therefore treat report data as potentially personal data and apply the GDPR safeguards described in this Policy to all report data. Please avoid entering names, contact details, vessel identifiers, or other personal information in the free-text notes field.

• Location — used only when you choose to record where a bycatch or sighting event occurred, subject to the location permission you grant in your device settings. Coordinates included in a report are uploaded only when you synchronise that report.
• Local storage — new reports are stored in a local database on your device before synchronisation.
• Internet access — used to send completed reports to the STURNET research server when you select the synchronisation function.

Report data is processed for scientific research and sturgeon-conservation purposes, including:

• Mapping bycatch and sighting events across river systems and coastal areas.
• Studying sturgeon distribution, condition, and population-health trends.
• Preparing conservation information for researchers and fisheries authorities.

Legal basis: processing is based on Article 6(1)(f) GDPR — the legitimate interest of the Foundation and its research partners in conducting scientific research and species-conservation work — combined with the safeguards for scientific-research processing under Article 89(1) GDPR (data minimisation; no account or identifier requested; GPS capture optional; photographs never uploaded). Technical connection data (server logs) is processed on the basis of Article 6(1)(f) GDPR for the security and operation of the service.

We do not sell report data, do not use it for advertising, and do not share it with commercial advertisers. No automated decision-making or profiling within the meaning of Article 22 GDPR takes place.

Synchronised report data may be accessed by:

• Researchers and project staff of the PBB Foundation working on the STURNET project;
• Partner research organisations participating in the STURNET project under the Interreg NEXT Black Sea Basin Programme, namely: Protection of Biodiversity in Bulgaria Foundation — lead partner (BG), Aristotle University of Thessaloniki — special account for research funds (EL), Ecological Counseling Center Cahul (MD), Gebze Technical University (TR), Institute of Market & Economic & Ecological Researches of the National Academy of Sciences Ukraine (UKR), National Institute for Research and Development on Marine Geology and Geo-Ecology – GeoEcoMar (RO), bound by project data-sharing arrangements;
• The hosting provider of the STURNET server, SUPERHOSTING.BG, acting as a processor under Article 28 GDPR;
• Competent public authorities, where disclosure is required by law.

Aggregated or fully anonymised conservation results (e.g. distribution maps, statistics) may be shared publicly and with fisheries authorities; such outputs do not contain report-level data allowing identification of any person.

On your device: when you submit a report form, the report is saved to a local database with a pending status. It does not leave your device at this stage.

On the STURNET server: when you open Saved Reports and select Sync Now, pending report data is uploaded to a database hosted on the STURNET server at sturnet.eu, located in the European Union and operated for the project by the PBB Foundation. Reports that you do not synchronise remain on your device and are not sent to the server.

International transfers: report data is stored and processed within the European Union. No transfers to third countries outside the EU/EEA take place. Should this change, transfers would be carried out only under Chapter V GDPR safeguards and this Policy would be updated.

Unsynchronised reports: reports that have not been synchronised exist only on your device. Uninstalling STURNET deletes this local app data.

Synchronised reports: uninstalling the app does not remove reports already uploaded to the STURNET server. Synchronised report data is retained for the duration of the STURNET project and for subsequent long-term conservation research, and is reviewed at least every 5 years to assess whether continued retention in identifiable form remains necessary; where it does not, data is anonymised or erased, in line with Article 5(1)(e) and Article 89(1) GDPR.

Deletion on request: to request the deletion of a synchronised report, contact us at the address in Section 11. Because reports do not contain a user account identifier, please include the approximate report date, species, and GPS location when available so the record can be located. We respond to valid requests without undue delay and in any event within one month, as required by Article 12(3) GDPR.

Subject to the conditions and limitations of the GDPR (including the research derogations under Article 89), you have the right to:

• Access your personal data (Article 15);
• Rectification of inaccurate data (Article 16);
• Erasure (“right to be forgotten”, Article 17);
• Restriction of processing (Article 18);
• Data portability, where applicable (Article 20);
• Object to processing based on legitimate interest, including on grounds relating to your particular situation (Article 21);
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal (Article 7(3)).

Because reports contain no account identifier, we may ask you for the details described in Section 8 in order to locate data relating to you; where we cannot identify the data subject, Article 11 GDPR applies.

Right to lodge a complaint: you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence or place of work. The lead supervisory authority for the PBB Foundation is the Bulgarian Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria; www.cpdp.bg; kzld@cpdp.bg.

STURNET is a professional conservation and research tool and is not directed at children. We do not knowingly process personal data of children under 14 years of age (the age of digital consent applicable in Bulgaria; up to 16 in some EU Member States). If you believe a child has submitted personal data through the app, please contact us and we will delete it.

For questions about this Privacy Policy, or to exercise any of your rights concerning a synchronised report, contact:

We may update this Privacy Policy as the application and project services evolve. Material changes will be shown on this page with a revised effective date. Where a change materially affects how already-collected data is processed, we will take reasonable steps to bring it to users’ attention within the app.