We take positive steps to make sure you are made aware of the different ways in which you can support our work and are kept up to date about how your support is changing lives.
We may use your personal information for administrative or marketing and fundraising purposes. Here are some of the ways we may hold and process your information:
We will only ask for and use your personal information collected for the purpose stated at the point your information is collected.
We can better achieve our mission by fundraising efficiently. This includes developing a better understanding of our supporters through personal data, and in some instances, we may collect and additional information on factors such as demographics. We do this to help us create a fuller and better picture of our supporters, communicate more effectively and to reach out to individuals who may wish to give additional support.
We may collect information about you in a number of ways, when you:
Occasionally we will collect limited data from public sources if we believe you may share our values, or if your activities relate to our work, for example to invite you to an event or to enquire if we might work with you. We will not hold onto this data any longer than necessary unless you give consent.
We might at some time obtain personal data from third parties about individuals who may share our values. We would use this information to improve the effectiveness of our fundraising, and to ensure we do not send out marketing information which is unlikely to be of relevance. In this scenario we may seek to find out more about these individuals, their interests and motivations through publicly available information. Where we decide not to make contact, we will only keep any personal data that would be relevant to ensure no further contact would be made.
We receive information from the Mail Preference Service, The Telephone Preference Service and The Fundraising Preference Service to ensure that we do not communicate with people who have indicated that they do not wish to hear from us. We may also subscribe to third party services to verify the accuracy of the data we hold.
No personal information is automatically collected by CBM UK as a result of using our websites. We only collect data if you choose to interact with us via the website, for example by making a donation or completing an order form.
The personal information we collect might include your name, gender, address, email address, telephone number, date of birth, organisation name, contact preferences, credit card, bank information or billing information and a record of your donation history, event attendances, volunteering and any other support you provide. When we interact with you, we may also collect notes from our conversations with you, for example recording details of any complaints or comments you make or details if you have asked us to pray for you or others.
If you participate in an event we may take your photograph, or video or interview you. If you participate in a survey, we may record your answers (sometimes anonymised).
If you apply for a role with us, we may collect data for equality monitoring. Further details regarding this are outlined in our recruitment privacy policy.
Rarely, we may collect data for the prevention of crime or dishonesty, to safeguard those with whom we work, or for another reason which is in the public interest, carefully and in accordance with applicable laws.
We only collect sensitive personal information if there is a clear reason to do so and we take care when processing such information. For example, you may wish to tell us you are visually impaired or hard of hearing before attending an event. We use this information to provide appropriate facilities and to uphold our duty of care.
Should you support CBM UK in a substantial way we may collect a small amount of sensitive personal data, such as your religious views, your interests or affiliations. This will only be collected where strictly relevant to assist you in helping to achieve our charitable mission in the way you are most interested. Should you disclose information to us about your health or your family this may be recorded in a limited way to enable us to communicate with you in a considerate and appropriate manner.
All sensitive personal data is stored on a secure database, to which only a limited number of relevant employees have access and regularly reviewed to ensure that it is justified, relevant and not intrusive. All Sensitive Personal Information is deleted when no longer relevant in line with our retention policy, is never shared with third parties, and is available to you at any point should you request to see it.
Whenever we collect or process your personal data, we will only keep it for as long as is necessary for the purpose for which it was collected. For example, if you no longer want to hear from us, we may keep a record of your contact details to enable us to comply with your request.
In certain circumstances, we are required to keep your personal data to comply with our contractual or legal obligations. For example, we will keep a record of your donations subject to Gift Aid for at least seven years to comply with HMRC rules. We may keep your information indefinitely if you donate to us by Direct Debit or pledge a gift in your Will to CBM UK.
At the end of the appropriate retention period, your information will either be deleted or anonymised.
In certain circumstances, we will collect and process your information with your consent. This might include when you tick a box to receive an email about ways you can support us or to receive our newsletter.
Under the General Data Protection Regulations, we may also process your information under ‘legitimate interests’. This means we can legally process your personal information in a reasonable manner in the interests of the charity, but we always ensure your rights are upheld. For example, we may use your personal details to send you further information about our projects that we think might interest you and information of ways to support us in the future because we believe you share our values. We use this basis to communicate with supporters by post, unless they have opted out.
Sometimes we will contact you to reply to a communication that you have made with us or respond to you following your attendance at an event, but this would never become a long-term basis for processing your information.
In limited situations our basis for processing your information will be if we have a contract with you (usually HR and employee data), legal compliance (for example Gift Aid claims) or public interest (for example to prevent crime or dishonesty).
Under the General Data Protection Regulations, you have the right to:
Your request will be processed within one calendar month of it being received unless there are specific reasons why this would not be possible. To help us keep your information secure, we may require you to provide us with proof of identity before any personal information is disclosed. Please note that in some circumstances, these rights are subject to certain legal conditions and limitations.
The accuracy of your information is important to us. We want to communicate with you in ways that you are happy with, with information that is of interest.
We will not contact you for marketing purposes by email or SMS unless you have given us consent to do so.
We may contact you by post and telephone about our work and ways you can support us. We’ll do this on the basis of our legitimate interest. We will not contact you for marketing purposes by post if you have indicated that you do not wish to be contacted.
From time to time, we are required to inform you about certain changes. For example, updates to this Privacy Policy or details about your Direct Debit. These administrative messages will not include any fundraising content and do not require prior consent when sent by email. We need to use your personal data for these purposes so that we can comply with our legal obligations.
You can opt out of hearing from us or change your contact preferences at any time by contacting us by email: info@cbmuk.org.uk or by telephone on 01223 484700. Please be aware it may take a short time for these changes to be effective.
We will never sell or rent your personal information to other organisations and we take all reasonable care to ensure your data is secure at all times.
We work with external organisations that help us to deliver certain services, for example processing donations, posting fundraising appeals, verifying the accuracy of personal data and backing up our database. We will only share the personal information that is necessary for them to deliver the service and we have rigorous contracts in place to protect your information. We do not allow these organisations to use your data for their own purposes. However we may be legally required to disclose your details if required by law.
We do not process the data of children. On rare occasions, where we may use photos of children under 18 to share fundraising activities, such as when they have carried out an event, we will ensure we uphold their rights and we will always collect parental consent or consent from a guardian where necessary. We may also process the data in accordance with the wishes of the child should we decide they have competence and an understanding of their circumstances.
Occasionally we may need to share your personal information with third parties and suppliers outside the European Economic Area (EEA).
The EEA includes all EU Member countries as well as Iceland, Liechtenstein and Norway.
We may transfer personal data that we collect from you to third-party data processors in countries that are outside the EEA such the USA. For example, this might be required when we store data in the Cloud. If we do this, we have procedures in place to ensure your data receives the same protection as if it were being processed inside the EEA and we will treat the information under the guiding principles of this Privacy Notice.
When you make a donation to CBM UK through our website, we may ask you to submit personal information (such as credit/debit card information) so we can process your donation.
All financial transactions made through our website use the highest bank-level security available from Stripe or PayPal. The technology used to process your payments meets PCI (Payment Card Industry) standards.
Your card details are not passed to CBM UK. We only receive your contact details and the value of your transaction, which we enter into a secure database to enable us to provide receipts, record your donation and to fulfil the requirements of our financial auditors or statutory authorities.
You can also donate to CBM UK via a number of third-party websites, including JustGiving.com and MuchLoved.com. CBM UK cannot be held responsible for the content or security of any third-party website. If in doubt, please familiarise yourself with the respective website’s privacy policy.
This privacy and cookies policy refers to www.cbmuk.org.uk and applies solely to this website.
We may collect your social media username and information that you share publicly via social media channels if you interact with us through those channels, to help us respond to your comments, questions and feedback. The data privacy law allows this as part of our legitimate interest in understanding our supporters.
We periodically review this policy. This policy was last updated in May 2025.
We’d love to hear from you if you have any questions, concerns or feedback on CBM UK, our websites or this Privacy Policy. Please contact us by:
CBM UK
1 Munro House
20 Mercers Row
Cambridge
CB5 8HY
You also have the right to make a complaint directly to the Information Commissioner’s Office (ICO) at https://ico.org.uk/global/contact-us/ or by calling the ICO helpline on 0303 123 1113.
