Privacy Policy

Wild Fish Conservation

We take the privacy and security of your personal data seriously.  By ‘personal data’, we mean information which relates to you as an individual and tells us something about you.  This privacy notice explains what personal data we collect about you, how and why we process (collect, store, use and share) your personal data, your rights in relation to your personal data and how to contact us or make a complaint.   

1. Who we are

1.1 This privacy notice is provided by Wild Fish Conservation, a UK registered charity.

1.2 References to ‘we’, ‘us’ or ‘our’ in this privacy notice are references to Wild Fish Conservation.

2. Data protection basics

2.1 This privacy notice applies to our processing of personal data relating to individuals located in the UK and elsewhere.

2.2 When we process the personal data of these individuals, we are regulated under UK (and sometimes EU) data protection laws and we are responsible as ‘controller’ of that personal data for any processing undertaken by us, our staff or other organisations that process your personal data on our instructions for the purposes of those laws.

2.3 The personal data we collect, and the use we make of it, varies depending on our relationship with you. For that reason, this privacy notice distinguishes between our members, donors, SmartRivers and Riverfly Census volunteers, subscribers and supporters, enquirers, customers, suppliers, job applicants and others.  Please be sure to read the sections of the privacy notice which relate to you.

2.4 Under data protection law, we can only use your personal data if we have a permitted legal basis for doing so, for example:

• • Where you have given consent
  • For the performance of our contract with you or to take steps at your request before entering into a contract
  • To comply with our legal and regulatory obligations
  • For our legitimate interests or those of a third party.

A legitimate interest is when we have a good reason to use your personal data, so long as this is not overridden by your own rights. 

We explain in section 4 below our legal bases for using your personal data.

3. Personal data we collect about you

The information we collect about you depends on who you are and will generally be provided by you, your employer, your SmartRivers or Riverfly Census coordinator or others who think you might be interested in our work or events.  If you are a job applicant, we may also collect your personal data from employment agencies, previous employers, educational establishments, other referees and publicly available sources such as LinkedIn or social media.  If we contact you for marketing purposes, we may have obtained your personal data from publicly available sources.

The information we collect may include:

For members

• Name and contact details including email address, telephone number, home address and employer/company name
• Date of birth
• Membership type, number and duration
• Information about family members
• Tax status
• Contact preferences for communications from us
• Membership fee payment information
• Information related to your third party liability insurance cover

For donors

• Name and contact details including email address, telephone number, home address and employer/company name
• Donation details
• Tax status
• Contact preferences for communications from us
• Payment information
• Information you provide about a gift to us in your will

For SmartRivers and Riverfly Census volunteers

• Name and, if we are in direct contact with you, your contact information including email address and telephone number
• Training provided by us to you
• Details of your sampling activities provided by you
• Contact preferences for communications from us

For subscribers and supporters

• Name and email address
• Contact preferences for communications from us
• Your pledge to support us

For enquirers

• Name, email address and telephone number
• Your enquiry and our response

For customers

• Name, email address, telephone number and postal address
• Information about your order
• Payment information

For our suppliers

• Name and contact details including email address, telephone number, address, employer/company name and your role
• Billing, transaction and payment information
• Information to enable us to check and verify your identity
• Information to enable us to undertake credit or other financial checks on you
• Your supplier history

For job applicants

• Your qualifications, employment history and other information contained in your curriculum vitae
• References
• Other personal data provided by you

For website users

• Information about how you use our website (from Cookies)

For others

• Name, email address and other information supplied by you if you send us an incident report
• Name, contact details and information about you if you participate in our auction by donating, bidding or winning
• Name, contact details, questions from and information about you if you are invited to and/or attend our events (online or in person)
• Names, email address and password if you access our SmartRivers database or Riverfly Census spreadsheet
• Biographical and financial information if you are a potential donor
• Your information if it is relevant to the administration of an estate of a person who left a gift to us in their will

4. How and why we use your personal data

The table below explains what we use your personal data for and our legal basis for doing so:

What we use your personal data for	Our legal basis
To contact and communicate with you  To administer payments of membership fees and donations To process your orders for products and related payments To provide members with third party liability insurance cover To order, pay for and receive products and services from you or your employer To administer our membership scheme including by sending you journals, renewals, reminders, branch communications and notice of the annual members meeting	For the performance of our contract with you or to take steps at your or our request before entering into a contract For our legitimate interests or those of a third party
To provide information requested by law enforcement or regulatory bodies	To comply with our legal and regulatory obligations
For operational reasons, such as management of our business, physical and information security and maintenance of internal records	For our legitimate interests or those of a third party To comply with our legal and regulatory obligations
To reclaim tax on fees and donations (gift aid) To help us manage our right to receive legacies To administer our SmartRivers scheme including by training you and receiving sample information from you To record your support To respond to your enquiries To operate our website efficiently To record incidents reported to us To administer our events, auctions and other fundraising and marketing activities To assess your suitability for a job and to contact you in relation to that job To target our communications with you to meet your interests and to identify ways in which you might choose to support us. To administer our legacies	For our legitimate interests or those of a third party
To keep you up-to-date with newsletters and press releases To send you campaign updates and pledge assets To give you access to our local water resources spreadsheet and our SmartRivers database	With your consent

5. Who we share your personal data with

We routinely share your personal data with:

• Our advisers and service providers including Cloud-based storage providers, our spreadsheet and database hosts, IT support providers, telecoms providers, accountants, lawyers, insurers, our bank, payment service providers, marketing agencies, delivery services (mail, membership cards and newsletters) or website hosts
• Where appropriate with employment agencies, previous employers, educational establishments and referees
• Law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations

6. Whether information has to be provided by you, and if so why

If you are a member, donor, SmartRivers volunteer, subscriber, supporter, enquirer or other, you do not have to provide us with your personal data but it may prevent us from continuing our relationship with you, or aspects of it, if you fail to do so. 

If you are a supplier, we need your personal data to contract with you/your employer for the supply of products or services and to facilitate payments between us.   We cannot contract with you without that information.

If you are applying for a job with us, we need your personal data to consider your job application.  Without it we cannot consider hiring you.

7. How long we keep your personal data for

We keep your personal data for no longer than necessary for the purposes for which it was collected. 

Generally, this will be for seven years after the end of our relationship with you unless we are required by law to adopt a longer retention period, or we need the information for longer to respond to any questions, complaints or claims made by you or on your behalf.

If you are a job applicant:

• We will keep your personal data for a maximum of two years from the date when you first contact us in relation to a job
• If you are accepted for a job, your personal data will be kept in accordance with our Privacy Notice for Staff.

If we process your personal data to send you marketing communications, we will keep it for as long as you are happy to hear from us.  If you object to receiving marketing communications from us, we will stop contacting you.

We keep information relating to legacies for as long as necessary to protect our legal rights.

When it is no longer necessary to retain your personal data, we will anonymise or securely delete it.

8. Transferring your personal data outside the UK

8.1 We do not generally transfer your personal data outside the UK but some of our service providers are based or store the personal data we send them overseas.  

8.2 To comply with UK data protection law, we will only make these overseas transfers:

• • • Where the UK government has decided the recipient country ensures an adequate level of protection for personal data
    • Where the recipient individual or organisation has entered into a contract containing terms approved by the EU/UK in which they agree to protect your privacy rights, or
    • With your explicit consent.

9. Your rights

You have the following rights, which you can exercise free of charge.

Access	The right to be provided with a copy of your personal data
Rectification	The right to require us to correct any mistakes in your personal data
To be forgotten	The right to require us to delete your personal data – in certain situations
Restriction of processing	The right to require us to restrict processing of your personal data – in certain circumstances, for example if you contest the accuracy of the data
Data portability	The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party – in certain situations
To object	The right to object: –        at any time to your personal data being processed for direct marketing purposes –        in certain other situations to our continued processing of your personal data, for example processing carried out for the purpose of our legitimate interest.
Not to be subject to automated individual decision making	The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.

For further information on each of those rights, including the circumstances in which they apply, please contact us or see the website of the UK Information Commissioner’s Office: https://ico.org.uk/.

If you would like to exercise any of those rights, please

• email us – for our contact information, see How to contact us below
• let us have enough information to identify you
• tell us know what right you want to exercise and the information to which your request relates.

10. Keeping your personal data secure

We have robust security measures in place to protect your personal data from being accidentally lost or used or accessed unlawfully. These include suitable physical, electronic and managerial procedures to protect and secure the information we collect. Our staff are all also subject to a duty of confidentiality.

11. How to complain

We hope that we can resolve any query or concern you may raise about our use of your information, see How to contact us below.

The UK GDPR gives you the right to lodge a complaint with the Information Commissioner who may be contacted at https://ico.org.uk/concerns or by telephone on 0303 123 1113.  If you live or work in the EU or EEA, you can also complain to your local supervisory authority.

12. Changes to this privacy notice

We may change this privacy notice from time to time so please check it periodically. 

13. Microsoft Clarity Website Tracking

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

14. How to contact us

If you have any questions about this privacy notice or the information we hold about you, or if you would like to exercise a right under data protection law or to make a complaint please contact us at info@wildfish.org.