CBM UK is committed to protecting your privacy in every way. We promise to respect your concerns about privacy and value the relationship that we have with you.
This policy includes the following information:
- Who we are
- Our mission and vision
- Why and when we use your information
- How we collect your information
- What type of information we collect
- How long we keep your information for
- Our legal basis for processing your information
- Your rights
- You can change your preferences at any time
- Protecting your Information
- Children and their data
- Protecting your data outside the EEA
- Online transactions
- Social Media
- Review of this Policy
- Contact Us
CBM is an international Christian disability and development organisation, transforming the lives of disabled people in the world's poorest communities.
CBM UK is a registered with the Charity Commission of England and Wales– as charity number 1058162 (England & Wales) and with the office of the Scottish Charity Regulator as charity number SC041101. The registered address is Oakington Business Park, Oakington, Cambridge CB24 3DQ, UK.
Our mission is to transform the lives of disabled people in the world’s poorest communities. Driven by Christian values, we work with disabled people to break down barriers by delivering practical support, improving policy and practice and inspiring the people of the UK to act.
Our vision is an inclusive world in which all people with disabilities enjoy their human rights and achieve their full potential.
Our supporters help us transform the lives of women, men and children with disabilities and communities at risk by donating money, volunteering and fundraising to support our work in the world’s poorest places. We take positive steps to make sure our supporters are aware of the different ways in which they can help and are kept up to date about how their support is changing lives.
We can better achieve our mission by fundraising efficiently. This includes developing a better understanding of our supporters through their personal data.
We may use your personal information for administrative or marketing & fundraising purposes. Here are some of the ways we may hold and process your information:
- To process a donation that you have made and confirm receipt of donations (unless you have asked us not to)
- To claim Gift Aid on your donations, comply with other legal or contractual obligations and keep your data up to date
- When we seek your views or comments on our work
- To send you communications, which you may have requested, and or information about our work that may be of interest to you. These may include information about campaigns, projects, events and other fundraising activities.
- To keep a record of donations, support given and ensure we do not send unwanted information
- To understand how and why you engage with our work and communicate with you appropriately
- In relation to your correspondence with us or any content you provide
- To support volunteers in your designated role or administer that role
- To keep you safe, for example if you participate in an event
- To contact individuals where working with us may be relevant to their job.
- To use images taken at our events and case studies for publicity purposes, unless you have informed us you do not wish us to do so
We will only ask for and use your personal information collected for the purpose stated at the point your information is collected.
In some instances, we may make use of additional factors such as demographic information. We do this to help us create a fuller and better picture of our supporters, communicate more effectively and to reach out to individuals who may wish to give additional support.
We may collect information about you in a number of ways, for example when you:
- Make a donation
- Sign up to receive updates by post or email
- Visit our website
- Take part in surveys
- Volunteer for us
- Apply for a job
- Attend a meeting or one of our events
- Fundraise on our behalf
- Contact us through email, phone, online, post, SMS or social media
- Contribute via independent third-party fundraising sites who pass your data to us with your consent.
- Are otherwise introduced to us through a third party.
Occasionally we will collect limited data from public sources if we believe you may share our values, or if your activities relate to our work, for example to invite you to an event or to enquire if we might work with you. We will not hold onto this data any longer than necessary unless you give consent.
We might at some time obtain personal data from third parties about individuals who may share our values. We would use this information to improve the effectiveness of our fundraising, and to ensure we do not send out marketing information which is unlikely to be of relevance. In this scenario we may seek to find out more about these individuals, their interests and motivations through publicly available information. CBM UK will not retain publicly available data relating to individuals without their consent, which will be sought at the earliest practical opportunity. Where we decide not to make contact, we will delete all personal data obtained.
We receive information from the The Mail Preference Service, The Telephone Preference Service and The Fundraising Preference Service to ensure that we do not communicate with people who have indicated that they do not wish to hear from us. We may also subscribe to third party services to verify the accuracy of the data we hold.
No personal information is automatically collected by CBM UK as a result of using our websites. We only collect data if you choose to interact with us via the website, for example by making a donation or completing an order form.
The personal information we collect might include your name, gender, address, email address, telephone number, date of birth, organisation name, contact preferences, credit card, bank information or billing information and a record of your donation history, event attendances, volunteering and any other support you provide. When we interact with you we may also collect notes from our conversations with you, for example recording details of any complaints or comments you make or details if you have asked us to pray for you or others.
Rarely, we may collect data for the prevention of crime or dishonesty, to safeguard those with whom we work, or for another reason which is in the public interest, carefully and in accordance with applicable laws.
Sensitive Personal Information:
We only collect sensitive personal information if there is a clear reason to do so and we take extra care when processing such information. For example, you may wish to tell us you are visually impaired or hard of hearing before attending an event. We use this information to provide appropriate facilities and to uphold our duty of care.
Should you support CBM UK in a substantial way we may collect a small amount of sensitive personal data, such as your religious views, your interests or affiliations. This will only be collected where strictly relevant to assist you in helping to achieve our charitable mission in the way you are most interested. Should you disclose information to us about your health or your family this may be recorded in a limited way to enable us to communicate with you in a considerate and appropriate manner. All sensitive personal data is stored on a secure database, to which only a limited number of relevant employees have access and regularly reviewed to ensure that it is justified, relevant and not intrusive. It is deleted when no longer relevant, is never shared with third parties, and is available to you at any point should you wish to see it.
Whenever we collect or process your personal data, we will only keep it for as long as is necessary for the purpose for which it was collected. For example, if you no longer want to hear from us, we may keep a record of your contact details to enable us to comply with your request.
In certain circumstances, we are required to keep your personal data to comply with our contractual or legal obligations. For example, we will keep a record of your donations subject to gift aid for at least seven years to comply with HMRC rules. We may keep your information indefinitely if you donate to us by Direct Debit or pledge a gift in your Will to CBM UK.
At the end of the appropriate retention period, your information will either be deleted or anonymised.
In certain circumstances, we will collect and process your information with your consent. This might include when you tick a box to receive an email about ways you can support us or to receive our newsletter.
Under the General Data Protection Regulations we may also process your information under ‘legitimate interests’. This means we can legally process your personal information in a reasonable manner in the interests of the charity, but we always ensure your rights are upheld. For example, we may use your personal details to send you further information about our projects that we think might interest you and information of ways to support us in the future because we believe you share our values. We use this basis to communicate with supporters by post, unless they have opted out.
Sometimes we will contact you to reply to a communication that you have made with us or respond to you following your attendance at an event, but this would never become a long-term basis for processing your information.
In limited situations our basis for processing your information will be if we have a contract with you (usually HR and employee data), legal compliance (for example Gift Aid claims) or public interest (for example to prevent crime or dishonesty).
Under the General Data Protection Regulations, you have the right to:
- know how and why we collect your information (Right to be informed)
- request any information we hold about you (Right of access)
- update or correct any inaccurate information we have about you (Right to rectification)
- ask us to erase any personal information we have about you (Right to be ‘forgotten’)
- ask us to stop processing your information (Right to restrict processing)
- obtain and reuse personal information for your own purposes (Right to data portability)
- object to us processing your information for fundraising purposes (Right to object)
- for your information to be excluded from any automated decision making and profiling (rights related to automated decision making)
Your request will be processed within one calendar month of it being received unless there are specific reasons why this would not be possible. To help us keep your information secure, we may require you to provide us with proof of identity before any personal information is disclosed. Please note that in some circumstances, these rights are subject to certain legal conditions and limitations.
The accuracy of your information is important to us. We want to communicate with you in ways that you are happy with, with information that is of interest.
We will not contact you for marketing purposes by email unless you have given us consent to do so.
We may send you relevant and personalised communications by post about our work and ways you can support us. We’ll do this on the basis of our legitimate interest. We will not contact you for marketing purposes by post if you have indicated that you do not wish to be contacted.
You can opt out of hearing from us or change your contact preferences at any time by contacting us by email: firstname.lastname@example.org or by telephone on 01223 484700. Please be aware it may take a short time for these changes to be effective.
We will never sell or rent your personal information to other organisations and we take all reasonable care to ensure your data is secure at all times.
We work with external organisations that help us to deliver certain services, for example processing donations or posting fundraising appeals. We will only share the personal information that is necessary for them to deliver the service and we have rigorous contracts in place to protect your information. We do not allow these organisations to use your data for their own purposes. However we may be legally required to disclose your details if required by law.
We may also process the data of children. When we do we will ensure we uphold their rights and ensure we collect parental consent or consent from a guardian where necessary. We may also process the data in accordance with the wishes of the child should we decide they have competence and an understanding of their circumstances.
Occasionally we may need to share your personal information with third parties and suppliers outside the European Economic Area (EEA).
The EEA includes all EU Member countries as well as Iceland, Liechtenstein and Norway.
We may transfer personal data that we collect from you to third-party data processors in countries that are outside the EEA such the USA. For example, this might be required when we store data in the Cloud. If we do this, we have procedures in place to ensure your data receives the same protection as if it were being processed inside the EEA and we will treat the information under the guiding principles of this Privacy Notice
When you make a donation to CBM UK through our website, we may ask you to submit personal information (such as credit/debit card information) so we can process your donation.
All financial transactions made through our website use the highest bank-level security available from Worldpay or PayPal. The technology used to process your payments meets PCI (Payment Card Industry) standards.
Your card details are not passed to CBM UK. We only receive your contact details and the value of your transaction, which we enter into a secure database to enable us to provide receipts, record your donation and to fulfil the requirements of our financial auditors or statutory authorities.
We may collect your social media username and information that you share publicly via social media channels if you interact with us through those channels, to help us respond to your comments, questions and feedback. The data privacy law allows this as part of our legitimate interest in understanding our supporters.
- Sending an email to our Supporter Care Team.
- Telephoning us on 01223 484700 between 9am - 5pm, Monday to Friday.
- Writing to us at the following address:
Oakington Business Park
Our Data Protection Officer is Jennifer Ramos.
You also have the right to make a complaint direct to the Information Commissioner’s Office (ICO) at https://ico.org.uk/global/contact-us/ or by calling the ICO helpline on 0303 123 1113