Privacy Policy
YOUR PERSONAL DATA
Your data is your data. The Shark Trust is committed to keeping your data secure and being transparent about how we use it.
If you have any concerns about your data, you can contact us at any time at privacy@sharktrust.org
UPDATES AND CHANGES TO THIS POLICY
This privacy policy is reviewed on a regular basis and may change from time to time. Please visit this section of the website occasionally to keep updated with our privacy policy and any changes that may occur.
Beacon CRM Security Breach July 2026
Unfortunately, we have been informed that Beacon, the platform we use to manage supporter communications, experienced a security breach on 27th July 2026. As a result, some supporter contact information, including email addresses and phone numbers, may have been accessed by unauthorised individuals.
Importantly, no payment card details, bank account information, or financial data have been compromised.
We will put any updates we receive here. This is what Beacon have told us so far:
“Currently, our investigation has confirmed that copies of database backups were made and likely downloaded by the unauthorised third-party. We have evidence that shows a spike in activity during the incident timeline symptomatic of data leaving our systems. It is highly unlikely we will be able to ascertain any more granular detail regarding exactly what data this was and to whom it relates so out of an abundance of caution, you may want to assume that all data that you store in Beacon, including attachment files, has been downloaded. ”
WHAT WE NEED
The Shark Trust acts as the ‘Controller’ of the personal data you provide to us – that means we decide how and why it's used. We only collect the basic personal data that we need to fulfil your needs – no more than is necessary.
In some cases we’ll use a ‘Processor’ to help us collect your data and process your request. We work closely with trusted processors to ensure they share our commitment to your security.
If you’ve paid us for something, the data we hold is restricted to contact details (name, address, phone and email) along with details of your donation/purchase/subscription. Where there’s a financial transaction, we’re obliged to hold your information on record for 6 years.
If you’ve only consented to join our mailing list we’ll hold your name and email only. You can unsubscribe from the list at any time by clicking on the link at the bottom of any email that we send. Alternatively, you can ask us to remove your details.
WHY, WHO AND HOW LONG?
It depends on what you’ve asked us to do:
If you’ve… | We need your data to… | Your data is processed by… | And shared with… | We’ll keep it until… |
Joined as a member | Fulfil the contract and send your Shark Focus magazines | Beacon CRM (UK) and/or Enthuse (UK), Go Cardless (Direct Debit), Stripe (Card Payments) & Shark Trust | St Austell Printing Company who send out your magazines HMRC (Gift Aid) MailChimp | 6 years after your membership lapses |
Bought from our shop | Fulfil the contract and deliver your goods | Shopify (US), Shark Trust & Paypal | Courier and postage companies | 6 years after the transaction (for UK tax records) |
Donated to us through the website or Charity Checkout | Process your donation | Beacon CRM (UK) and/or Enthuse (UK), Go Cardless (Direct Debit), Stripe (Card Payments) & Shark Trust | HMRC (Gift Aid) | 6 years after the transaction (for UK gift aid tax records) |
Signed up as a fundraiser | Send you vital information and register your event | Beacon CRM or Enthuse & Shark Trust | Race and event organisers | The end of the year in which the event is held |
Recorded a shark sighting or an eggcase find (UK) | Contact you for verification and manage your recorder account | Cookie Technology & Shark Trust | Anonymised recording data is made available through our data sharing platform Mailchimp | Indefinitely unless you ask us to remove it |
Recorded an Eggcase find in Netherlands | Contact you for verification and manage your recorder account | Cookie Technology & Shark Trust | Dutch Elasmobrach Society (National Partners) | Indefinitely unless you ask us to remove it |
Signed up to our mailing list | Email you with updates and marketing information | MailChimp (USA) | No-one | Indefinitely until you withdraw consent (unsubscribe) |
Your data may also be available to our website provider to enable us and them to deliver their service to us, carry out analysis and research on demographics, interests, wealth screening and behaviour of our users and supporters to help us gain a better understanding of them to enable us to improve our services. This may include connecting data we receive from you on the website to data available from other sources in the public domain, such as Companies House, Press Articles, Google Analytics and Linkedin.
Where we have identified that you may have the capacity to support the Shark Trust at a higher level. We may review other information that is available publicly (e.g., Companies House, The Electoral Register, or the Land Registry) Looking at information about corporate directorships, shareholdings, employment and earnings, philanthropic interests and networks, charitable giving history, and relevant media coverage. This will enable us to engage with you in a more personalized way.
Your personally identifiable data will only be used where it's necessary for the analysis required, and where your interests for privacy are not deemed to outweigh their legitimate interests in developing new services for us. In the case of this activity the following will apply:
Your data will be made available to our website provider
The data that may be available to them include any of the data we collect as described in this privacy policy.
Our website provider will not transfer your data to any other third party, or transfer your data outside of the EEA.
They will store your data for a maximum of 7 years.
This processing does not affect your rights as detailed in this privacy policy
WHERE WE KEEP YOUR DATA
We keep a copy of your personal data on secure software (Beacon CRM) managed from our office in the UK. The system is held on a server in the UK. We have a Data Protection policy in place to oversee the effective and secure processing of your personal data. Any third party that has access to your data has a processing contract with us which binds them to manage your data securely and only under our instruction. Where these third-parties are outside the EU, we take steps to ensure they meet the standards of the GDPR (The EU’s General Data Protection Regulation).
WHAT ARE YOUR RIGHTS?
If at any point you believe the information we process is incorrect you may request to see this and have it corrected or deleted – please send an email with the heading “Subject Access Request” to privacy@sharktrust.org
If you wish to raise a complaint on how we’ve handled your personal data, you can contact us and we’ll investigate the matter.
If you’re not satisfied with our response or believe we’re processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).
Because of our size and the nature of the data held, we haven’t appointed a Data Protection Officer. The person responsible for Data Protection is Paul Cox who can be contacted at privacy@sharktrust.org or 01752 672020.
The Shark Trust
4 Creykes Court
The Millfields
Plymouth
PL1 3JB, UK
