Privacy Policy

1. Purpose of this Privacy Policy

Shark Search Foundation Limited (Shark Search, we, our or us) is an Australian not-for-profit public company limited by guarantee undertaking shark research, scientific monitoring, education, conservation, public engagement and related activities.

We recognise that responsible management of personal information is an important part of scientific integrity, responsible organisational governance and maintaining the trust of researchers, contributors, participants, supporters and members of the public.

This Privacy Policy explains how Shark Search collects, holds, uses, discloses, protects, retains and otherwise manages personal information in connection with its activities.

This may include activities conducted through or in connection with:

• the Shark Search website;
• the Shark Search Atlas and associated shark-identification systems;
• public shark sighting submissions;
• photograph and video submissions;
• scientific research and monitoring;
• research databases;
• research collaborations;
• shark adoption programmes;
• donations and fundraising campaigns;
• education programmes;
• youth programmes;
• schools and university engagement;
• events and workshops;
• public-awareness and conservation activities;
• enquiries and correspondence; and
• other services or activities operated by Shark Search.

This Policy applies to personal information handled by Shark Search Foundation Limited.

It does not automatically apply to a separately owned or operated website, technology, platform, research institution or other third-party service merely because Shark Search links to, integrates with, accesses or uses that service.

2. Privacy law

Shark Search handles personal information in accordance with this Privacy Policy and applicable privacy laws.

Where the Privacy Act 1988 (Cth) and the Australian Privacy Principles apply to Shark Search or to a particular activity undertaken by Shark Search, we will handle personal information in accordance with those applicable requirements.

The application of Australian privacy legislation can depend on matters including an organisation's activities, turnover, contractual relationships and statutory status.

Nothing in this Policy is intended to represent that a particular privacy law applies to Shark Search where that law does not legally apply.

Shark Search nevertheless seeks to apply responsible privacy and information-governance practices across its activities irrespective of whether a particular statutory requirement applies to every activity.

Where another country's privacy or data-protection law applies to a particular Shark Search activity or interaction, Shark Search will take reasonable steps to comply with the requirements legally applicable to that activity.

3. What is personal information?

For the purposes of this Policy, personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Depending on the circumstances, personal information may include:

• a person's name;
• email address;
• telephone number;
• other contact information;
• age;
• country or general location;
• parent or guardian information;
• IP address;
• device or browser information;
• payment and transaction information;
• correspondence with Shark Search;
• programme participation information;
• photographs or video containing an identifiable person;
• information supplied with a shark sighting or research submission; and
• other information reasonably capable of being connected with an identifiable person.

Scientific information about an individual shark is not, merely because it identifies that shark, personal information about a human being.

4. Shark biometric identification

Shark Search may use image-based, machine-assisted or other biometric identification methods to distinguish individual sharks.

These systems analyse sharks, not human beings.

References by Shark Search to shark biometrics, biometric identification, individual identification, image matching, pattern recognition or similar scientific methods concern the identification of individual animals.

Shark Search does not use its shark-identification systems for human facial recognition or human biometric identification.

Personal information may nevertheless become associated with a shark record where, for example, a contributor voluntarily supplies their name, email address, correspondence or other identifying information with a shark submission.

5. Personal information we may collect

5.1 General enquiries and correspondence

If you contact Shark Search, we may collect:

• your name;
• email address;
• telephone number or other contact information you choose to provide;
• organisation or institutional affiliation;
• the contents of your enquiry;
• attachments;
• correspondence history; and
• other information reasonably necessary to respond to your enquiry.

5.2 Public shark sightings and submissions

Where a person submits a shark sighting, photograph, video or related observation, Shark Search may collect:

• photographs;
• video;
• sighting date;
• species information;
• individual shark identification information;
• exact or approximate location;
• GPS coordinates;
• observations or comments;
• image or video metadata;
• file information;
• device or browser information generated by the relevant system;
• IP address where generated by the relevant system;
• optional contributor name;
• optional contributor email address; and
• other information voluntarily included in the submission.

Providing a name and email address with an ordinary public shark submission is optional unless a particular submission process expressly states otherwise.

A shark sighting can therefore form part of Shark Search's scientific record without publicly or internally identifying the contributor by name where those details are not provided.

6. Shark Search Atlas and location information

Location data can be scientifically important for understanding shark occurrence, distribution, movement, recurrence and habitat use.

Where a contributor supplies exact GPS coordinates with a public shark sighting, Shark Search may collect and retain those coordinates as part of the scientific record.

6.1 Public display of locations

Where exact GPS coordinates are submitted for a sighting displayed through the Shark Search Atlas, the exact location is ordinarily displayed publicly for a period of 30 days.

The date of the relevant shark sighting may also be displayed publicly with that Atlas record.

The contributor's name, email address and private contact information are not ordinarily displayed publicly with the sighting.

After the 30-day public display period, the exact coordinates may cease to be displayed publicly but may continue to be retained internally as part of Shark Search's long-term scientific records.

6.2 Restricting or removing location information

Shark Search reserves the right to remove, restrict, delay, generalise, correct or withhold a location where reasonably necessary because of:

• legal requirements;
• scientific integrity;
• conservation considerations;
• data-quality concerns;
• security considerations;
• safety considerations;
• research collaborator obligations;
• contractual obligations; or
• another legitimate organisational reason.

6.3 Atlas information

The Shark Search Atlas is a scientific and informational resource.

It is not a real-time shark-warning service, beach-safety service, emergency-warning system or guarantee of the current presence or absence of a shark.

7. Scientific use of public submissions

Public shark submissions may have continuing scientific value beyond the immediate identification or sighting event.

Subject to applicable law and the Shark Search Website Terms, Shark Search may use submitted shark photographs, videos, sighting information and associated scientific data to:

• identify shark species;
• identify individual sharks;
• compare submissions against existing shark records;
• create new individual shark records;
• maintain resighting histories;
• analyse recurrence and movement;
• validate identification results;
• improve scientific identification methods;
• train shark-identification models;
• test shark-identification models;
• validate shark-identification models;
• conduct scientific analysis;
• create derived scientific information;
• maintain scientific and research databases;
• produce aggregated or de-identified information;
• support conservation activities;
• support education activities;
• communicate scientific findings;
• prepare research outputs;
• support scientific publications; and
• archive scientific records.

Selected public submissions may also be used or displayed in Shark Search's:

• website;
• Shark Search Atlas;
• social media;
• education materials;
• scientific communications;
• public-awareness materials;
• conservation communications; and
• research outputs,

subject to the rights granted by the contributor and any applicable terms governing the submission.

8. Scientific records and personal information are treated separately

A shark photograph, video, individual-identification record, sighting history, location record or derived scientific record can retain long-term scientific value even where Shark Search no longer needs to retain identifying information about the person who originally submitted it.

Shark Search therefore distinguishes between:

1. scientific shark records, submitted media and derived scientific information; and
2. personal information relating to contributors.

A request to delete or de-identify a contributor's personal information does not necessarily require Shark Search to destroy the underlying shark photograph, video, observation, location record or derived scientific information.

Where appropriate, Shark Search may remove or de-identify the contributor's personal details while preserving the underlying scientific record.

9. Long-term scientific retention

Shark Search maintains long-term scientific databases and research records.

Original public shark photographs, videos, sighting records, exact location information and associated scientific information may be retained indefinitely where they continue to have legitimate scientific, research, archival, provenance or conservation value.

This can include retention for purposes such as:

• long-term individual shark identification;
• resighting history;
• scientific verification;
• comparison with future observations;
• movement analysis;
• population analysis;
• research reproducibility;
• scientific provenance;
• model development and validation;
• historical analysis; and
• conservation research.

Where a contributor voluntarily supplies their name or contact information, Shark Search may retain that information with the scientific record where there is a continuing legitimate purpose, including:

• documenting scientific provenance;
• identifying the source of a record;
• contacting the contributor for clarification;
• verifying a sighting;
• resolving data-quality issues;
• managing permissions; or
• seeking additional information relating to the scientific record.

Where identifying details are no longer reasonably required, or where an appropriate deletion or de-identification request is made, Shark Search may remove or de-identify those personal details while preserving the scientific record.

10. Research collaborator data

Shark Search works with researchers, universities, scientists, conservation organisations and other research collaborators.

Research collaborator data is treated differently from an ordinary public shark submission.

Unless a separate written agreement provides otherwise:

• researcher-contributed scientific datasets remain owned by the contributing researcher or lawful data owner;
• collaborator data is not automatically transferred into Shark Search ownership;
• collaborator data is not automatically made public;
• collaborator data may be subject to restricted access;
• collaborator data may be subject to confidentiality requirements;
• collaborator data may be subject to publication restrictions; and
• Shark Search's use of the dataset is governed by the applicable research, collaboration or data agreement.

A separate data agreement may address matters including:

• ownership;
• permitted research uses;
• access rights;
• storage;
• analysis;
• publication;
• attribution;
• confidentiality;
• derived scientific information;
• retention;
• sharing;
• security;
• return or destruction of specified material; and
• termination of the collaboration.

Where collaborator images or research data are stored in Google Drive or another collaborative repository, Shark Search uses restricted access controls intended to limit access to authorised persons.

Nothing in this Privacy Policy transfers ownership of a research collaborator's scientific dataset to Shark Search.

11. Shark adoption information

If you purchase or receive a shark adoption, Shark Search may collect:

• purchaser name;
• purchaser email address;
• billing country;
• adoption order information;
• the adopted shark;
• adoption recipient name;
• gift recipient details where applicable;
• a requested shark name where naming is available;
• correspondence concerning the adoption;
• transaction identifier;
• payment status;
• amount paid; and
• limited payment information supplied by our payment processor.

Children and teenagers may be recipients of gifted shark adoptions.

Shark Search does not currently publish adopter identities as part of the standard adoption programme.

If public adopter recognition is introduced in the future, the adopter's identity will only be publicly displayed where the relevant person has actively agreed to that recognition.

12. Donation information

Where you make a donation, Shark Search may collect:

• your name;
• email address;
• billing country;
• amount donated;
• the relevant donation campaign;
• whether a donation is one-off or recurring;
• transaction identifier;
• payment status;
• limited payment information;
• information relating to transaction-cost contributions;
• correspondence concerning the donation; and
• information required to administer cancellation or refund requests.

If you establish a recurring donation, information reasonably necessary to administer the recurring arrangement may continue to be held while the arrangement remains active and for an appropriate record-keeping period afterwards.

13. Payment information and Stripe

Shark Search uses Stripe to process donations and shark adoption payments.

Shark Search does not receive or store your full credit or debit card number.

Stripe processes the full card and payment information necessary to complete a transaction.

Shark Search may receive limited information from Stripe, including:

• payer name;
• email address;
• billing country;
• transaction ID;
• payment status;
• amount paid; and
• the last four digits of the payment card.

Automatic payment receipts or transaction confirmation communications may be generated following a donation or adoption payment.

Stripe handles information under its own contractual and privacy arrangements in addition to the limited transaction information Shark Search receives to administer the payment.

14. Youth and education programmes

Shark Search conducts education activities that may involve children and teenagers.

We do not apply a blanket rule stating that Shark Search's website or programmes are unavailable to every person under 16.

Instead, additional privacy and consent measures are applied where appropriate to structured youth participation.

14.1 Information collected

For structured youth programmes, Shark Search may collect:

• participant name;
• age;
• country;
• email address;
• contact information where consent permits;
• parent or guardian name;
• parent or guardian contact information;
• parent or guardian consent records;
• programme communications;
• participant photographs; and
• participant video.

Shark Search does not currently collect health, medical, disability, accessibility, emergency-contact or safeguarding information as part of its standard youth programme information.

If this practice changes, Shark Search should review the relevant collection process and this Privacy Policy before such information is routinely collected.

15. Parent and guardian consent

Where participation in a Shark Search youth programme requires parent or guardian consent, Shark Search maintains a consent process addressing the relevant participation and information-handling activities.

This may include consent for:

• programme participation;
• collection of participant information;
• direct communication with the participant;
• photography;
• video recording;
• use of authorised participant content;
• website publication;
• social-media publication;
• education material; and
• programme or organisational communications.

Parents and guardians may be informed that Shark Search personnel may communicate directly with a youth participant by email or other messaging without the parent or guardian being copied into every communication.

Direct communications remain subject to Shark Search's applicable programme procedures and organisational standards.

16. Photographs and video of youth participants

Where the applicable parent or guardian consent permits, photographs or video of youth participants may be used for purposes including:

• Shark Search's website;
• social media;
• educational material;
• programme communications;
• public-awareness activities; and
• promotional communications relating to Shark Search's programmes and activities.

A parent, guardian or participant may request withdrawal of permission for future use.

Where consent is withdrawn, Shark Search will take reasonable steps to:

• stop new use of the relevant material; and
• remove previously published material where reasonably practicable.

It may not always be possible to retrieve material that has already been:

• independently copied;
• downloaded;
• shared by third parties;
• reproduced outside Shark Search's control;
• archived by external systems; or
• technically cached.

Shark Search will nevertheless take reasonable steps in relation to material remaining under its control.

17. Retention of youth programme information

Youth programme application, participant and contact records are generally retained for up to 12 months after the relevant programme ends.

Those records are then deleted where no continuing lawful, administrative, evidentiary or operational reason requires their retention.

Where photographs or videos remain lawfully authorised for continuing use, Shark Search may retain the minimum information reasonably necessary to document:

• the relevant media permission;
• the scope of that permission;
• the consent history;
• any withdrawal of consent; and
• relevant publication history.

This limited evidence of permission may be retained for longer than the ordinary 12-month programme-record period where reasonably necessary to establish that Shark Search had authority to use the relevant material.

18. Website and technical information

When you visit the Shark Search website or use a Shark Search online service, certain technical information may be collected automatically.

This can include:

• IP address;
• browser type;
• device type;
• operating system;
• referring website;
• pages viewed;
• approximate geographic information;
• date and time of access;
• interaction with website features;
• session information;
• cookies; and
• similar technical information.

Shark Search may use this information for:

• operating the website;
• website security;
• troubleshooting;
• understanding website usage;
• improving website structure and performance;
• measuring engagement;
• maintaining service reliability; and
• detecting misuse or technical problems.

19. Analytics and cookies

Shark Search currently uses:

• Google Analytics; and
• Squarespace Analytics.

These services may use cookies, identifiers and similar technologies to help Shark Search understand how visitors use the website.

Analytics information may include:

• page views;
• website navigation;
• general device information;
• browser information;
• approximate geographic information;
• referral sources;
• session information; and
• usage patterns.

Shark Search does not currently use advertising or retargeting technologies such as Meta Pixel, TikTok Pixel or Google Ads conversion tracking.

If Shark Search introduces materially different advertising, behavioural tracking or retargeting technologies, this Privacy Policy and any applicable cookie notice should be reviewed and updated.

Users can generally control cookies through their browser settings. Restricting cookies may affect website functionality or the accuracy of preferences or analytics.

20. How we use personal information

20.1 Research and science

Shark Search may use personal information to:

• administer shark submissions;
• identify shark species;
• identify individual sharks;
• maintain scientific records;
• verify submitted information;
• contact contributors;
• conduct scientific analysis;
• support shark-identification model development;
• support model validation;
• maintain scientific provenance;
• manage research collaborations;
• produce research outputs;
• support scientific communication; and
• support conservation science.

20.2 Education and programmes

We may use personal information to:

• administer youth and education programmes;
• communicate with participants;
• communicate with parents or guardians;
• manage programme consent;
• conduct workshops or events;
• publish authorised programme content; and
• deliver education activities.

20.3 Adoptions and donations

We may use personal information to:

• process shark adoptions;
• administer gift adoptions;
• produce digital adoption materials;
• provide adoption communications;
• provide updates where new verified information about an adopted shark becomes available;
• administer donations;
• administer recurring donations;
• issue receipts;
• process appropriate refunds;
• correct transaction or adoption errors; and
• respond to supporter enquiries.

20.4 Website, security and organisational administration

We may use personal information to:

• respond to enquiries;
• administer the website;
• administer the Shark Search Atlas;
• maintain security;
• prevent or investigate misuse;
• troubleshoot technical issues;
• maintain organisational records;
• manage complaints;
• investigate suspected misconduct;
• exercise or defend legal rights;
• comply with legal obligations; and
• improve Shark Search's systems and services.

21. Shark model development and automated analysis

Shark Search may use submitted shark photographs, videos and scientific information to develop, test, validate or improve shark-identification systems.

This may include machine-assisted or automated analysis for:

• species identification;
• individual shark identification;
• image feature extraction;
• pattern comparison;
• matching against existing shark records;
• candidate identification;
• model testing;
• model validation; and
• development of improved scientific identification methods.

These systems are principally designed to analyse sharks and scientific imagery.

Shark Search does not currently use personal information for automated human biometric identification.

Shark Search also does not currently use personal information to make solely automated decisions that determine or significantly affect a person's legal rights or interests.

22. When we may disclose personal information

Shark Search does not sell, rent or trade personal information.

We may disclose personal information where reasonably necessary for the purposes described in this Policy or where otherwise permitted or required by law.

22.1 Service providers

We may use service providers for functions including:

• website hosting;
• cloud infrastructure;
• email;
• collaborative file storage;
• analytics;
• payment processing;
• technical infrastructure;
• security;
• forms;
• data processing; and
• professional services.

Current providers include, where relevant:

• Squarespace;
• Google;
• Stripe; and
• DigitalOcean.

A service provider may separately collect information under its own privacy policy where it acts independently from Shark Search.

22.2 Researchers and collaborators

Personal information may be disclosed to a researcher or scientific collaborator where:

• necessary for an authorised collaboration;
• permitted by the contributor;
• contemplated by the relevant research or data agreement;
• reasonably connected with the purpose for which the information was collected; or
• otherwise permitted or required by law.

Research collaborator data is not made public merely because Shark Search holds or analyses it.

22.3 Public information associated with scientific activities

Certain information may intentionally become public as part of Shark Search's scientific or public-engagement activities.

This may include:

• selected public shark submissions;
• shark photographs;
• shark identification information;
• sighting dates;
• Atlas records;
• exact GPS locations during the applicable public-display period;
• derived scientific information; and
• authorised educational or programme media.

A contributor's private name, email address and contact details are not ordinarily published with a public shark sighting.

22.4 Legal and regulatory disclosure

Shark Search may disclose information where reasonably necessary to:

• comply with applicable law;
• respond to a court order or compulsory legal process;
• respond to a lawful regulator request;
• respond to a lawful law-enforcement request;
• investigate suspected fraud;
• investigate misuse or unlawful conduct;
• protect Shark Search's legal rights;
• protect the rights or safety of another person; or
• establish, exercise or defend a legal claim.

23. Overseas processing and disclosure

Shark Search is an Australian organisation.

Shark Search's principal shark-identification database, uploaded shark media and associated scientific records are currently hosted through DigitalOcean infrastructure located in Australia.

Some service providers used by Shark Search operate internationally.

Providers such as Google, Squarespace and Stripe may process, transmit or make information accessible outside Australia as part of their global infrastructure and service arrangements.

Overseas processing may include processing in the United States and other jurisdictions in which those providers or their authorised service providers operate.

The countries involved may change as providers alter their infrastructure.

Where Australian privacy law governing cross-border disclosure applies, Shark Search will take the steps required by applicable law.

Where reasonably practicable, Shark Search seeks to use reputable service providers with appropriate privacy, contractual and information-security arrangements.

24. Google Workspace and Google Drive

Shark Search uses Google Workspace for organisational email and related functions.

Google Drive may also be used for restricted research collaboration material, including collaborator images.

Collaborator repositories are access restricted rather than intentionally publicly accessible.

Access is limited according to the requirements of the collaboration and the relevant permissions.

Ownership and permitted use of collaborator data remain governed by the relevant research, collaboration or data agreement.

25. Information security

Shark Search takes reasonable technical and organisational measures designed to protect information against:

• unauthorised access;
• unauthorised disclosure;
• misuse;
• interference;
• unauthorised modification;
• loss; and
• destruction.

Current security measures include, where appropriate:

• restricted user access;
• role or permission-based access controls;
• multi-factor authentication on key administrative systems;
• confidentiality obligations for personnel with access to restricted information;
• restricted research repositories;
• access logging;
• regular backups;
• security monitoring;
• vulnerability scanning or security review; and
• secure online connections.

Access to restricted research data or personal information is limited to persons who require that access for legitimate Shark Search activities.

No internet-based service, electronic storage system or security measure can guarantee absolute security.

26. Data breaches

Shark Search maintains an internal data-breach response process.

If Shark Search becomes aware of suspected:

• unauthorised access;
• unauthorised disclosure;
• loss of information;
• cyber intrusion;
• accidental exposure; or
• another information-security incident,

Shark Search may:

• investigate the incident;
• take reasonable steps to contain it;
• take remedial action;
• assess the information affected;
• assess likely consequences;
• notify affected collaborators where appropriate;
• notify affected individuals where appropriate; and
• notify a regulator or other authority where legally required.

Where a statutory data-breach notification regime applies, Shark Search will comply with applicable notification requirements.

27. Access to personal information

You may contact Shark Search to ask what personal information we hold about you.

Before providing access, Shark Search may take reasonable steps to verify your identity and ensure information is not disclosed to an unauthorised person.

Access may be provided by:

• supplying a copy of relevant information;
• confirming particular information;
• allowing inspection where appropriate; or
• another reasonable method.

Access may be limited or refused where permitted or required by applicable law, including where disclosure would:

• unreasonably affect another person's privacy;
• reveal restricted research information;
• breach confidentiality obligations;
• prejudice an investigation;
• compromise security; or
• conflict with another legal obligation.

Where appropriate, Shark Search will explain the basis of a refusal.

28. Correction of personal information

If you believe personal information held by Shark Search is inaccurate, incomplete, out of date, irrelevant or misleading, you may ask us to correct it.

Shark Search will take reasonable steps to review the request and make an appropriate correction where warranted.

Scientific disagreement with a shark identification, species classification, shark record or research interpretation is not necessarily a correction of personal information.

Scientific records may instead be reviewed under Shark Search's scientific quality-control and research processes.

29. Deletion and de-identification requests

You may contact Shark Search to request deletion or de-identification of personal information associated with you.

Shark Search will consider the request having regard to:

• the type of information;
• the purpose for which it is held;
• applicable privacy law;
• scientific provenance;
• record-keeping requirements;
• contractual obligations;
• research integrity;
• legal requirements; and
• whether personal information can reasonably be separated from the scientific record.

29.1 Public shark submissions

Publicly submitted shark photographs, videos and scientific records are intended to form part of Shark Search's continuing scientific records once submitted.

A contributor's request to remove their personal information therefore does not automatically require Shark Search to destroy the underlying scientific material.

Where appropriate, Shark Search may delete or de-identify:

• the contributor's name;
• email address;
• contact information; and
• other identifying personal information,

while continuing to retain:

• the submitted shark photograph;
• submitted shark video;
• sighting information;
• location information;
• individual shark record;
• species record;
• derived scientific data; and
• other associated scientific information.

The underlying scientific record is therefore not automatically deleted merely because identifying information about its original contributor is removed.

30. Anonymity and optional identification

Where reasonably practicable, Shark Search allows people to interact with us without identifying themselves.

For example, a contributor may submit an ordinary public shark sighting without providing their name or email address where those fields are optional.

Identification or contact information may nevertheless be necessary where Shark Search needs to:

• process an adoption;
• process a donation;
• provide a receipt;
• administer a recurring donation;
• respond personally to an enquiry;
• enrol someone in a youth programme;
• verify parent or guardian consent;
• enter into a research collaboration;
• investigate a complaint;
• verify identity for a privacy request; or
• comply with applicable law.

31. Direct marketing

Shark Search does not currently operate a general bulk marketing or newsletter programme.

Communications relating to an existing adoption, donation, shark submission, research activity, programme participation, enquiry or other existing interaction may be sent where reasonably necessary to administer that interaction.

If Shark Search introduces marketing newsletters or similar direct marketing communications in the future, Shark Search will implement appropriate consent, preference and unsubscribe processes and review this Privacy Policy where necessary.

32. Third-party websites and services

Shark Search's website or services may contain links to external websites, research organisations, social-media platforms, payment providers, mapping systems or other resources.

A link or integration does not necessarily mean Shark Search owns or controls the external service.

Independent third parties may collect and handle information under their own privacy policies and legal terms.

Users should review the privacy information provided by a third party before providing personal information directly to that service.

Nothing in this clause excludes any responsibility Shark Search has under applicable law for a service provider engaged by Shark Search to perform functions on Shark Search's behalf.

33. Separately owned technology

Shark Search may use technology, software, algorithms, models, infrastructure or other systems that are licensed, authorised or otherwise made available to Shark Search but are not owned by Shark Search Foundation Limited.

Ownership of underlying technology and responsibility for personal information handled through Shark Search activities are separate legal matters.

Where Shark Search Foundation Limited collects, receives or controls personal information through a Shark Search-operated activity, this Privacy Policy applies to Shark Search's handling of that personal information even where the underlying technology is owned by another person.

Nothing in this Policy represents that Shark Search owns technology that is lawfully owned by another person.

34. Children and young people outside formal programmes

Children and young people may interact with Shark Search's public education, shark adoption, scientific or engagement activities.

Shark Search takes additional care where it knows that personal information relates to a child or young person.

Depending on the nature of the interaction, Shark Search may:

• minimise the information requested;
• require parent or guardian involvement;
• obtain appropriate consent;
• limit publication;
• limit use of the information;
• limit communications; or
• implement additional privacy or programme safeguards.

If a parent or guardian believes Shark Search holds a child's personal information inappropriately, they may contact Shark Search using the details in this Policy.

35. Privacy enquiries and complaints

If you have a question or concern about Shark Search's handling of personal information, you may contact us.

Our designated internal privacy contact is the:

Please provide sufficient information for Shark Search to understand and investigate the matter.

Shark Search may request further information or reasonable proof of identity where necessary.

We will seek to deal with privacy enquiries and complaints fairly and within a reasonable period.

Where an applicable privacy law gives a person the right to complain to an external regulator, that person may also exercise that right.

In Australia, this may include the Office of the Australian Information Commissioner where that regulator has jurisdiction over the relevant matter.

36. Changes to this Privacy Policy

Shark Search may update this Privacy Policy to reflect:

• changes in applicable law;
• changes in Shark Search's activities;
• new programmes or services;
• new technology;
• changes to service providers;
• changes in information-handling practices;
• changes in organisational structure; or
• improvements to privacy or security procedures.

The current version will be published on Shark Search's website with the date on which it was last updated.

Where a change materially alters the way personal information already collected will be used or disclosed, Shark Search will consider whether additional notice, permission or consent is required.

37. Contact

For privacy enquiries, access requests, correction requests, deletion or de-identification requests, complaints or questions concerning this Privacy Policy, please contact:

38. Interaction with other Shark Search terms and agreements

This Privacy Policy should be read together with, where applicable:

• Shark Search's Website Terms of Use / Terms of Service;
• Shark Search's Shark Adoption Terms;
• research collaboration agreements;
• data-sharing agreements;
• programme-specific consent forms;
• participant permissions;
• submission notices; and
• collection notices presented at particular forms or interfaces.

A research or data agreement may impose additional confidentiality, access, storage, use, disclosure, publication or data-governance requirements in relation to collaborator information.

Nothing in this Privacy Policy transfers ownership of researcher-contributed scientific data to Shark Search.

39. Our privacy and scientific data-governance commitment

Shark Search's scientific work depends upon trust between researchers, contributors, supporters, participants, collaborators and the organisation.

Shark Search therefore seeks to collect information for legitimate organisational purposes, explain how that information is used, protect restricted information appropriately, preserve the integrity of scientific records and provide reasonable mechanisms for individuals to understand and manage personal information held about them.

Scientific data governance and personal privacy are related but distinct responsibilities.

Shark Search seeks to protect both.