Protect the Wild – Privacy Policy
Effective Date: 22 May 2025
Last Updated: 16 October 2026
Protect the Wild takes its responsibility to protect and respect your privacy seriously. We are committed to handling personal information transparently, securely and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
This privacy policy explains what personal data we collect, how we use it, where it is stored, how long we retain it and your rights.
1. Who We Are
Protect the Wild is a not-for-profit organisation campaigning to protect British wildlife.
Registered address:
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ
Data protection contact:
Rob Pownall
Email: contact@protectthewild.org.uk
Protect the Wild is responsible for determining how and why personal data collected directly through our website and campaigning activities is processed.
2. How We Collect Your Data
We may collect personal information when you:
Sign one of our petitions or complete a campaign form.
Subscribe to our newsletters or mailing lists.
Make a donation through our website or a third-party donation platform.
Purchase products through our online shop.
Subscribe to our Substack publications.
Apply for employment or volunteering opportunities.
Contact us by email, phone, social media or through our website.
We do not operate a central customer relationship management (CRM) database.
Personal information submitted through our website is stored temporarily and, where you have consented to receive communications, relevant details are exported to Substack, which we use to manage our email subscribers and send campaign updates.
3. Types of Data We Collect
Depending on how you interact with us, we may collect:
First and last name.
Email address.
Postal address.
Telephone number.
Petition signatures and campaign actions.
Newsletter subscription preferences and marketing consent.
Donation and purchase information.
Payment-related information processed through third-party providers.
Information submitted through contact forms.
Employment or volunteering application details.
We do not intentionally collect special category personal data, such as health information or ethnicity, unless there is a specific lawful reason to do so.
4. How We Use Your Data
We use personal data to:
Record petition signatures and campaign participation.
Send campaign updates, newsletters and appeals where you have opted in.
Process donations and purchases.
Communicate about orders, donations or enquiries.
Administer recruitment and volunteering.
Meet legal, financial and accounting obligations.
Maintain the security and functionality of our website and services.
Our legal bases for processing personal data depend on the activity involved and may include:
Consent: For sending marketing emails, newsletters and campaign appeals.
Contractual necessity: For processing purchases and fulfilling orders.
Legal obligation: For maintaining records required by law.
Legitimate interests: For administering our organisation, responding to enquiries and operating our campaigning activities, where permitted by law.
You can withdraw your consent to marketing communications at any time.
5. Petitions, Campaign Forms and Website Data
When you sign a petition or complete a campaign form on our website, the information you provide is initially stored within our website’s database.
This may include your name, email address, date of submission, petition or campaign details, and whether you have opted in to receive further communications.
We use this information to record campaign participation, administer petitions and, where appropriate, communicate with the relevant decision-makers.
Our policy is to delete personal data collected through website petitions and signup forms from our website database within 30 days.
Where you have explicitly opted in to receive email communications, your relevant contact information and subscription preferences may be exported to Substack before deletion from our website.
We do not automatically add petition signatories to our mailing lists unless they have separately opted in.
Deleting this information from our website does not automatically remove an active subscription from Substack. Subscriber information is managed separately under the arrangements described below.
6. Email Communications and Substack
Substack is our primary platform for managing email subscribers and sending newsletters, campaign updates and fundraising appeals.
We no longer use Mailchimp.
There are two main ways people join our mailing lists:
Through our website
When you complete a petition or signup form and explicitly consent to receiving communications, your contact details may be exported from our website to the appropriate Protect the Wild Substack mailing list.
The original website submission data is then deleted in accordance with our 30-day retention policy.
Directly through Substack
When you subscribe directly to one of our Substack publications, your subscriber information is collected and managed through Substack.
We use subscriber information to send updates relevant to the mailing list you have joined.
You can unsubscribe at any time using the link included in our emails or by contacting contact@protectthewild.org.uk.
Subscriber data held on Substack is retained while your subscription remains active, subject to applicable data protection requirements. You may also request deletion of your personal information.
Substack processes personal information under its own applicable privacy terms.
Substack Privacy Policy:
https://substack.com/privacy
7. Donations and Payment Platforms
We use third-party providers to process donations and supporter payments.
Donorbox
Donorbox is our main donation platform. When you donate, we may receive your name, contact information, donation amount and transaction details.
This information is used to administer donations, provide receipts and maintain appropriate financial records.
PayPal
Where PayPal is used for donations or purchases, relevant transaction information may be shared with us for processing, record-keeping and customer support.
Patreon
Where individuals support us through Patreon, we may access information necessary to administer their support, including their name, email address and membership details.
We do not automatically add supporters from these platforms to our marketing mailing lists unless they have provided the necessary consent.
Financial and transaction records may be retained for up to seven years, or longer where required by law.
8. Online Shop – Shopify
Our online shop operates through Shopify.
When you make a purchase, information such as your name, email address, delivery address and order details is processed to fulfil your order.
We use this information for:
Order processing and delivery.
Transactional communications.
Customer service.
Refunds and returns.
Financial record-keeping.
We do not automatically add customers to our marketing mailing lists without the necessary consent.
Shopify and relevant payment providers may retain transaction information in accordance with their privacy policies and applicable legal requirements.
9. How Long We Keep Your Data
We aim to retain personal data only for as long as necessary.
Our general retention arrangements are:
| Type of data | Retention period |
|---|---|
| Website petition signatures and campaign form submissions | Deleted from our website database within 30 days |
| Website mailing-list signup submissions | Deleted from our website database within 30 days, following any relevant export to Substack |
| Substack subscriber information | Retained while the subscription remains active, subject to applicable deletion requests and legal requirements |
| Donation and financial transaction records | Up to 7 years, or longer where legally required |
| Shopify order information | Retained as necessary for fulfilment, accounting and legal obligations |
| Job applications and CVs | Normally deleted after 3 months, unless a longer period has been agreed or is legally justified |
| General correspondence | Retained only for as long as reasonably necessary for the purpose of the correspondence |
Our 30-day deletion policy applies to the temporary personal data collected and stored through our website’s petition and signup systems.
It does not override legal obligations to retain financial records or automatically delete information held by third-party services such as Substack, Donorbox and Shopify.
Limited records of marketing consent or withdrawal may also be retained where necessary to demonstrate compliance with data protection law or prevent further unwanted communications.
10. Third-Party Services
We do not sell, rent or trade personal information to third parties.
We use external service providers where necessary to operate our activities, including:
Substack: Email subscriptions and campaign communications.
Donorbox: Donation processing.
PayPal: Payments and transactions.
Patreon: Supporter memberships.
Shopify: Online shop and order processing.
Website and hosting providers: Secure operation of our website and temporary storage of form submissions.
These providers process relevant information in connection with the services they provide. Depending on the service, they may act as data processors or independent data controllers.
We expect our service providers to maintain appropriate data protection and security measures.
11. International Data Transfers
Some of the third-party platforms we use, including Substack and payment processing services, may process or store personal data outside the United Kingdom.
Where personal data is transferred internationally, we take appropriate steps to ensure that applicable UK data protection requirements are met, including the use of recognised safeguards where required.
12. Your Data Protection Rights
Under UK data protection law, you may have the right to:
Request access to personal information we hold about you.
Ask us to correct inaccurate information.
Request deletion of your personal information.
Restrict or object to certain uses of your information.
Withdraw consent for marketing communications.
Request a copy of certain personal data in a portable format.
Raise concerns with the Information Commissioner’s Office (ICO).
To exercise your rights, contact:
We will normally respond to valid data protection requests within one calendar month, subject to any applicable legal extensions.
You can also contact the Information Commissioner’s Office:
13. Data Storage and Security
We take reasonable technical and organisational measures to protect personal information.
These include:
Restricting access to personal data to authorised individuals.
Using secure website infrastructure and reputable service providers.
Using appropriate account security measures, including two-factor authentication where available.
Limiting unnecessary storage and duplication of personal information.
Regularly deleting temporary personal data from our website in accordance with our 30-day policy.
Handling personal information in accordance with applicable data protection requirements.
While we take data security seriously, no online system can guarantee absolute security.
14. Data Breaches
In the event of a personal data breach, we will investigate the incident and take appropriate steps to minimise any risks.
Where required by law, we will notify the Information Commissioner’s Office and affected individuals within the applicable statutory timeframes.
15. Changes to This Privacy Policy
We may update this privacy policy to reflect changes in our activities, technology, service providers or legal obligations.
The latest version will be published on our website with an updated revision date.
16. Contact Us
If you have any questions about this privacy policy, how we handle your personal information, or wish to exercise your data protection rights, please contact:
Protect the Wild
71–75 Shelton Street
Covent Garden
London, WC2H 9JQ
Email: contact@protectthewild.org.uk