Privacy Policy

Jump to

1. Who are we?

Sussex Wildlife Trust (SWT) is a conservation charity for everyone who cares about nature in Sussex. We focus on protecting the wonderfully rich natural life that is found across our towns, countryside and coast, increasing people’s awareness and understanding of the natural world, and deepening people’s relationship with it. Founded in 1961 we are the largest local organisation dedicated to protecting the wildlife and natural environment across Sussex.

Supported by some 38,000 members and over 1,000 volunteers we look after more than 30 nature reserves across Sussex covering over 5,000 acres of land. We create opportunities for people of all ages to learn about nature and connect with it. Over 10,000 children visit our environmental education centres each year, and 5,000 people attend our wildlife events and courses.

You can find out more about our role and our projects here

https://sussexwildlifetrust.org.uk/what-we-do

2. Our commitment to your privacy

This privacy policy explains how and why we collect your personal data, how we use it, with whom we share it and how we keep it secure. You can also find information about your rights and how to exercise them. We will process your personal data in compliance with

the UK General Data Protection Regulation (UK GDPR)
the Data Protection Act 2018
the Privacy and Electronic Communications Regulations 2003 (as amended) (PECR)
the Data (Use and Access) Act 2025 (DUAA) which introduces updates to areas such as automated decision-making, legitimate interests, children’s data and subject access rights.

We are committed to:

Transparency: Clearly explaining how your data is used.
Accountability: Ensuring robust governance and data protection practices.
Security: Implementing appropriate technical and organisational measures.
Respecting your rights: Including your right to access, correct, delete, or object to the use of your data.

We may make changes to this policy, so we recommend you check this page occasionally to make sure you are aware of any changes.

Any references to Sussex Wildlife Trust, SWT, or to ‘we’ or ‘us’ refer to:

Sussex Wildlife Trust. We are a registered charity in England and Wales, and our registered charity number is 207005.

3. What information do we collect?

Your personal data is defined as any information that can directly or indirectly identify you.

a) We collect some or all the following information, depending upon the purposes outlined in section 4:

Personal and Contact Information

Full name, date of birth, gender
Postal address, telephone number, email address
Social media identity

Financial and Transactional Data

Bank or credit card details (for payments)
Membership subscriptions, donations, pledges
Purchases from our online shop
Taxpayer status (for Gift Aid claims)

Engagement and Correspondence

Records of correspondence
Volunteering services provided
Events attended, campaigns or activities participated in
Wildlife interests and interactions on social media

Visual Data

Photographs taken during events (with permission)
Supplied photographs/videos credited with your name
CCTV images from Sussex Wildlife Trust locations

Legacies

Legacy information (next of kin or executors)

Digital and Website Usage

IP address, device type, location data
Usernames and passwords
Cookie and tracking data (in line with PECR and DUAA updates on storage/access technologies)

Spatial Data on Land and Wildlife

Biological wildlife records (recorder name, date and location of observation)
Land or garden information (for Landowner advice services or have a surveyed Local Wildlife Site on your land)
Local Wildlife Site ownership records

Children’s Data

Where applicable, we apply enhanced safeguards for children’s data, in line with DUAA and the Age Appropriate Design Code.

b) Special category data

We do not routinely collect or store special category data (eg. health, ethnicity, religious beliefs, or political affiliation) about supporters, members, biological recorders or landowners. However, in certain circumstances we may need to do so. . When this happens, we will:

Be transparent about why we are collecting it;
Collect it directly from you;
Obtain your explicit consent, unless another lawful basis applies (e.g. legal obligation or vital interests);
Apply additional safeguards, including minimisation, access controls, and retention limits.

Examples of situations in which we may collect special category data include:

Volunteering: We may collect health information, ethnicity, criminal records checks, references, and emergency contact details.
Accidents or incidents: Health-related data may be collected for legal, safeguarding, or insurance purposes.
Events: Dietary requirements or accessibility needs may be collected to ensure your wellbeing and inclusion.

Under DUAA 2025, the Secretary of State may designate new types of special category data in future (e.g. biometric or neurodata), in which case so we will update our practices accordingly.

c) Children and young people

We are committed to protecting children’s data and will comply with the DUAA 2025 provisions, which reinforces the need for specific safeguards for children.

We do not knowingly collect, store or process your personal details if you are under 13 years of age; unless we have the express permission from your parent or guardian to do so.

We will process your personal data only for specific reasons. For example, if we have the permission of your parent or guardian, and you are a Wildlife Watch member, we will record your date of birth at the point of joining. We will also process your personal data to send you a paper copy of the junior magazine if you are a member of our programmes.

d) Recruitment and employment

To meet our contractual, legal , and operational obligations and responsibilities, we process personal data, including special category data, from job applicants and employees. Such data can include, but isn’t limited to, information relating to health (eg for occupational health or reasonable adjustments), ethnicity (eg for equality monitoring), and criminal convictions. In certain circumstances, we may process personal data or special category data, without explicit consent as we are relying on other lawful bases more appropriate for the processing activities we are carrying out (e.g., legal obligation or contract).

e) Trustees

If you apply to be a trustee of SWT, we will need to collect additional information about you, in line with Charity Commission guidance, to enable us to make a decision about your suitability as a trustee (e.g., information provided in the declaration of eligibility about your age, that you are not disqualified in the administration of a charity, that you are not an undischarged bankrupt etc.). This data is processed under our legal obligations and for the purpose of governance and Companie House compliance.

4. How we collect your information and how your information is used

a) Sussex Wildlife Trust and its partnership projects use the information you provide to us for the following purposes:

To administer your Sussex Wildlife Trust membership;
To provide you with the data, services, products or information you asked for (purchases, magazines etc.);
To administer your donations or support your fundraising, including processing Gift Aid and process payments including Direct Debits
To ask for your opinion about our work;
To communicate with you about hiring our event or meeting spaces;
To keep in touch with you as a volunteer;
To respond to any enquiries or complaints you make to us;
To process your application for a job or volunteering position, including Trustee applications;
To understand how we can improve our services or information by conducting analysis or market research;
To record your intention to remember us with a gift in your Will, and to communicate with you appropriately;
To send you information about our work that we feel will be of interest to you such as events (and update you about these if you have booked your attendance), fundraising appeals, campaigning opportunities, and volunteering.
To manage your employment contract or your job application.
To comply with contractual, statutory and management obligations relating to our governance;
To communicate with our existing supporters via social media and advertise our services or services of our third parties. We also use the information you provide to us for research marketing purposes, namely to find other contacts sharing the same interests with you
To enable attribution and verification of biological records;
To contact biological recorders about their observations, for data management and verification purposes;
If specifically requested by you, to enable other members of the Sussex biological recording community to contact you about biological recording activities or events;
To communicate with landowners and land managers in relation to the Local Wildlife Site survey, review and selection process and site management;
To communicate with landowners and land managers in relation to our landowner advice services;
If you own or manage a Local Wildlife Site, to request permission to access the land for survey purposes, and to notify you of survey results and designations decisions;
If you own or manage a property adjacent to a Sussex Wildlife Trust reserve, to contact you in relation to activities or works affecting the local area.

b) Sussex Wildlife Trust may also collect your information from third parties in the following cases:

when you donate through third parties (such as Just Giving)
when you register for events through third parties such as Zoom or Eventbrite and provide your consent for your personal information to be shared with us.
if your membership has been purchased as a gift your personal details will have been provided by the gift purchaser.
from time to time, we may collaborate with third parties so that we receive the contact details of people who might be interested in hearing from us in the future. Before we receive this information, we always make sure that the data subjects had actively expressed an interest in receiving information from third parties.
to ensure that the personal data we hold for you is up to date (Directory Enquiries for telephone numbers, or Royal Mail’s National Change of Address database).
we may collect information about certain supporters from public sources including public databases (such as Companies House) news and other media, search engines and social media.
to obtain information on ownership of registered land (including from the HM Land Registry portal).
we may make use of profiling methods from external sources of geodemographic and consumption data such as CACI Acorn and MOSAIC to help us identify the demographic profile of our supporters, in order to provide more personalised communications. Examples of such information include newspaper readership, leisure interests and indicators of financial status such as house value. These will be based on postcodes rather than being specific to any individual.
when we use social media platform services for targeted advertising and research marketing purposes. For example, the Custom audience service of Facebook. As regards targeted advertising, and based on existing supporters’ information, we can find individuals/users of Facebook who might be interested in SWT’s programmes or events and ask them to join or donate to Sussex Wildlife Trust. At the same time, we may use information of existing members (emails and names), to exclude them from advertising campaigns and appeals.
We also use Facebook’s tool, Facebook pixel to retarget supporters who have previously engaged with us through our website. For more information about the way Facebook processes your personal information Read Facebook’s privacy policy.

c) Sussex Wildlife Trust may also collect your information through our websites.

On the websites we maintain (sussexwildlifetrust.org.uk, ryeharbourdiscoverycentre.co.uk, sxbrc.org.uk, lws-sussex.org.uk, wildcoastsussex.org.uk and geodiversitysussex.org.uk) we gather information through cookies which might include which pages you visit most often and which of our areas of work are of most interest to you.

For more information on our Cookies Policy, please click here

https://sussexwildlifetrust.org.uk/cookies

https://sxbrc.org.uk/about/privacy.php

5. Lawful basis for using your information

We will only collect, store and use your personal data when we have a clear justification for doing so. For the data processing activities described in this policy, the lawful bases we rely on include the following :

Consent

Consent is used when we ask you for permission to use your information in a certain way, and you agree to this. For example, in order to send you communications about our events, programmes and fundraising requests. You have the right to withdraw your consent at any time.

Legal Obligation

To comply with legal or regulatory obligations we may need to share your information with bodies such as the Charity Commission, Fundraising Regulator or Information Commissioner.

Performance of the contract

We use your information on a contractual basis when you purchase something from us, such as membership, a service or an event we may organise such as our wildlife walks and our educational courses.

Vital Interests

We may need to use your information where it is necessary for us to protect life or health. For example, in the event of an emergency on one of our reserves, or a safeguarding issue requiring us to share your information with emergency services.

Legitimate Interests

Legitimate interests means that we can process your personal information if we have a genuine and legitimate reason, and we are not harming any of your rights and interests. For example, holding your personal data to respond to an enquiry or to send you a thank-you letter. In order to determine this, we undertake a ‘balancing test’ to evaluate the impact of processing data in this way.

Recognised Legitimate Interests (New under DUAA 2025)

The DUAA introduces a new lawful basis for certain pre-approved purposes, known as recognised legitimate interests. These do not require a balancing test and include:

Safeguarding vulnerable individuals
Responding to emergencies
Preventing or detecting crime
Protecting public or national security
Disclosures for tasks in the public interest

Where applicable, we will rely on this basis and document our justification accordingly.

6. When and how and we communicate with you

We are committed to communicating with you in a way that is respectful, transparent, and compliant with data protection law, including the Privacy and Electronic Communications Regulations (PECR) and the Data (Use and Access) Act 2025.

Post

We may rely on your consent or our legitimate interest to send you fundraising or marketing communications by post. If you prefer not to hear from us this way, please get in contact and let us know by any of the contact details listed in section 10.

Phone/Email/Text

If you have provided us with your contact details (eg telephone number or email address) we may contact you to provide information about our services or respond to your enquiries. We will only send you fundraising and marketing communications if you have explicitly provided your consent or if you meet the criteria for the “soft opt-in” (e.g. you previously purchased or expressed interest in similar services). We will make sure you wish to receive such communications by occasionally reaffirming your consent with us.

You may opt-out from these communications at any time by clicking the unsubscribe link at the end of our marketing emails. Alternatively, you can get in touch via any of the contact details listed in section 11 of this policy.

7. Who your information is shared with

We will never sell or trade your personal data.

We may share your personal data with trusted third parties (processors) who help us deliver services. When we work with other organisations in this way, we always set up a written contract with them to protect your data, as set out in UK GDPR and DUAA . We may also share your personal data with third parties who do not act on our behalf (HMRC services for example).

More specifically, we may share your personal data with third parties to assist us:

process your payments. If you use a credit or debit card to donate, buy a membership or purchase something from us we will pass your credit card details securely to our payment provider
send your membership magazine
send Marketing communications. For example, this might be a communication or software provider who may send e-mail communications (for example Mailchimp) and confirmation and reminders for events you have booked through these platforms
administer Gift Aid. If you have made a Gift Aid declaration, we will disclose the information you have provided to HMRC in order to reclaim Gift Aid on your donation(s).
collect and store basic personal data for Biodiversity Record Centre Data Requests
with IT and Digital Services
document our events and activities through photographs
process donations
social media platforms for the purposes identified in section 4(b)

8. International data transfers and security

All the personal data we process is processed by our staff in the UK. However, for the purposes of IT hosting, maintenance or other services, your information may be transferred outside of the UK.

Under the Data (Use and Access) Act 2025, international transfers must meet the revised “data protection test”, which requires that the destination country’s protections are not materially lower than those in the UK (replacing the previous “essentially equivalent” standard). [technology...fields.com]

We ensure that any international transfers are lawful by:

Relying on UK adequacy regulations where applicable;
Using appropriate safeguards, such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses;
Conducting transfer risk assessments where required.

For example, we use Mailchimp to manage newsletter subscriptions. Mailchimp stores data in the USA. We have a Data Processing Agreement and a UK Addendum in place to ensure compliance with UK data protection laws.

We have implemented robust technical and organisational security policies and procedures to protect personal data (including sensitive personal data) from loss, misuse, alteration, or destruction. Electronic data and databases are stored on secure computer systems, and we control who has access to information (using both physical and electronic means). Our staff receive data protection training, and we have data protection procedures which personnel are required to follow when handling personal data.

9. Data retention policy

We will only use and store information for as long as it is required for the purposes it was collected or to meet legal, regulatory or contractual obligations.

Our retention policy is based on:

Business need
Statutory requirements
Best practice guidance (e.g. that of the National Archives and the Information Commissioner’s Office ( ICO)

We:

Review data holdings regularly
Delete or anonymise data that is no longer required
Assign clear responsibilities for retention and disposal
Document retention periods and disposal actions

Where appropriate, we apply pseudonymisation or anonymisation techniques to reduce risk while retaining data for research or analysis.

10. Your rights

We respect your right to control your data. Under the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025, your rights include:

The right to be informed

You have the right to be informed as to how we use your data, under what lawful basis we carry out any processing.

The right of access

You have a right to request access to a copy of some or all your personal information we hold about you, along with the information on what personal information we use, why we use it, who we share it with, how long we keep it for and whenever it has been used for automated decision making. You can make a request for access free of charge and proof of identity is required. If you wish to obtain a record of the personal data we hold about you, through a Subject Access Request (SAR), we will respond within one month.

Under DUAA 2025, organisations are expected to take reasonable and proportionate steps when responding to SARs, and may pause the response timeframe in limited cases (e.g. identity verification or scope clarification)

The right to rectification

If any of your information is out of date or if you are unsure of this, please contact us through any of the contact details listed in this section and we will update it.

The right to erasure

You can request that we delete your personal data, where:

It is no longer needed for the purpose it was collected
You withdraw consent (where consent was the lawful basis)
You object to processing and there are no overriding legitimate grounds

We will assess each request in line with legal obligations and exemptions.

The right to restrict processing

You have the right to restrict the processing of some or all your personal information if there is a disagreement about its accuracy, or we are not lawfully allowed to use it.

The right to data portability

You or a third party can ask to obtain your personal data from us for your own purposes in a structured, commonly used, electronic form so it can be easily transferred.

The right to object

You can object to processing where we are using your personal information such as where it is based on legitimate interest or for direct marketing and fundraising communications. We will stop processing unless we can demonstrate compelling legitimate grounds.

Rights in relation to automated decision making and profiling

Automated decision making takes place when an electronic system uses personal information to make a decision without human intervention. You have the right to question the outcome of automated decisions that may create legal effects or create a similar significant impact on you. We respect your right not to be subject to a decision that is based on automated processing.

Under DUAA 2025, organisations may use a wider range of lawful bases for automated decision-making, but must implement appropriate safeguards, including transparency and the ability to contest decisions.

New Right to Complain (DUAA 2025)

You now have a statutory right to complain directly to us if you believe your data rights have been infringed. We must:

Acknowledge your complaint within 30 days
Investigate it without undue delay
Inform you of the outcome

Only after our response can you escalate the matter to the ICO.

For more information on your individual rights, please see the ICO’s website.

11. Contacting us

To amend your communication preferences or update your contact details,

please contact:

Membership Department

Sussex Wildlife Trust, First Floor, The Keep, Woollard Way, Brighton BN1 9BP

Telephone: 01273 497532

Email: [email protected]

Our office hours are Monday – Friday, 9am – 5pm.

To ask questions about this Privacy Policy, or exercise your data protection rights, please contact:

Director of Finance & Operations

Sussex Wildlife Trust, First Floor, The Keep, Woollard Way, Brighton BN1 9BP

Telephone: 01273 497532

Email: [email protected]

Our office hours are Monday – Friday, 9am – 5pm.

To make a complaint

We take complaints seriously and we treat them as an opportunity to develop our approach. We are always very grateful to hear from people who are willing to take the time to help us improve.

For information on how to make a complaint, please see Complaints Procedure | Sussex Wildlife Trust

If you have any complaints in relation to the processing of your personal data, you can lodge a complaint with the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Telephone: 0303 123 1113
Email: [email protected]

Online: https://ico.org.uk/make-a-complaint/

12. Changes to this Privacy Policy

We update this policy periodically to ensure it accurately reflects our use of personal data.

This Privacy Policy was last updated on 11^th November 2025