Who are we? 

CBN UK Privacy Notice – Updated Draft (April 2025)

1. Introduction

This Privacy Notice applies to all individuals whose personal data we process, including

donors, supporters, prayer request submitters, church and school contacts for Superbook

Academy, volunteers, and website visitors. It outlines how CBN UK processes personal data

in accordance with the UK General Data Protection Regulation (UK GDPR), including

Articles 13 and 14, and the Data Protection Act 2018.

We are committed to transparency and ensuring you understand how your personal

information is collected, used, stored, and shared.

2. Who We Are

CBN UK is a registered charity in England & Wales (The Christian Broadcasting Network

UK, registration number 1101659) and operates a trading subsidiary, CBN Resources Ltd

(company number 10853789). CBN UK is the data controller for the personal data we

process. CBN Resources Ltd may act as a data processor on our behalf.

Data Controller: CBN UK, PO Box 700, Hereford, HR1 9EW, United Kingdom

Contact Email: dataprotection@cbneurope.com

Telephone: +44 (0)1227 453300

3. What Personal Data We Collect

We collect and process the following types of personal data:

• Personal Identification Data: Name, title, address, email, phone number.

• Demographic Data: Interests, preferences, and information related to engagement

with CBN UK content and services.

• Usage Data: Website visits, IP addresses, cookies, analytics, and visitor behaviour

patterns.

• Transactional Data: Donation and purchase history, including fulfilment details.

• Communication Data: Correspondence via phone, email, post, or social media.

• Special Category Data: Voluntarily provided information related to religious beliefs

or pastoral needs (e.g., prayer requests). Processed with additional safeguards.

We may also collect information via surveys, competitions, and special offers when you

choose to participate.

If personal data is not collected directly from the data subject, we will specify the source in

line with Article 14 UK GDPR.4. How We Collect Personal Data

We collect personal data through:

• Direct Interactions: Forms, calls, donations, event sign-ups, surveys, competitions,

prayer support requests, instant messaging.

• Automated Technologies: Cookies, tracking pixels, analytics (e.g., Google

Analytics) and usage monitoring.

• Third-Party Sources: Social media, referrals, partner ministries, and publicly

available sources, in line with applicable data protection laws.

For details on cookies used on our website, please see our Cookies Policy.

5. Legal Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

• Consent: For marketing communications, surveys, prayer requests, or spiritual

support.

• Contractual Obligation: To process purchases, donations, and resource fulfilment.

• Legal Obligation: Compliance with financial and charity regulations, including

donation record retention.

• Legitimate Interest: Improving services, engaging supporters, and operating

efficiently as a not-for-profit organisation.

Special Category Data is processed under Article 9(2)(d) UK GDPR for legitimate activities

of a not-for-profit religious organisation.

6. Data Sharing & Third-Party Processors

We work with third-party systems and services to deliver our mission effectively. All

processors are contractually obligated to protect personal data in accordance with data

protection laws.

Key Systems Used:

• Salesforce: CRM and donor management

• Iterable: Email marketing and analytics

• Pantheon / WP Hosting: Website and data hosting

• Google Analytics / Tracking Pixels: Website performance and engagement

• WhatsApp: Prayer communication (subject to WhatsApp’s privacy policy)

• Fathom AI: Internal meeting and insight tools

• Meta (Facebook/Instagram) / Google Ads: Targeted communications• Stripe / PayPal / Findock: Donation and payment processing

• Microsoft 365: Internal documents and communications

• Zoom: Online meetings and webinars

• Zapier: Secure automation of workflows between systems (e.g., Salesforce, Iterable)

• QuickBooks: Financial accounting

• Superbook Academy (SB Academy): Our Sunday school curriculum platform, used

to provide churches and schools with Christian resources. We collect contact details

for relevant church or school staff. We do not collect children’s personal data directly.

• Waiver Electronic: Electronic waivers and forms

Data Recipients:

• Mailing houses (e.g. for direct marketing campaigns)

• Fulfilment centres (e.g. for Superbook merchandise and other resources)

• Social media platforms (for audience engagement)

• Financial auditors and regulators

All sharing is governed by DPIAs and secure contracts.

7. Data Transfers Outside the UK & EEA

When data is transferred outside the UK or EEA, we use:

• Standard Contractual Clauses (SCCs), or

• Rely on adequacy decisions

to ensure equivalent levels of protection.

8. Data Retention & Security

We retain personal data in line with legal and operational requirements:

• Financial/Donor Records: 6 years plus current year (as per legal obligations)

• Prayer Requests: Up to 12 months

• Marketing Data: Until consent is withdrawn or data is no longer needed

• Survey or Competition Data: Duration of the campaign or project

Security measures include access controls, encryption, and regular staff training.

9. Your Data Protection Rights

You have the following rights under UK GDPR:• Right to Access: Your personal data

• Right to Rectification: Correct inaccuracies

• Right to Erasure: Request deletion

• Right to Restriction: Limit processing

• Right to Data Portability

• Right to Object: Especially to direct marketing

• Right to Withdraw Consent at any time

• Right to Lodge a Complaint with the UK Information Commissioner’s Office

(www.ico.org.uk)

To exercise your rights, contact: dataprotection@cbneurope.com or call +44 (0)1227 453300.

We may require proof of identity and will respond within one month.

10. Automated Decision-Making

We do not use personal data for automated decision-making or profiling that has legal or

similarly significant effects.

11. Statutory or Contractual Requirement

In some cases, providing personal data is necessary (e.g. to process a donation or resource

purchase). Where required, we will inform you of the implications of not providing it.

12. Children’s Data

While our Superbook Academy is intended for use in church and school settings, we do not

directly collect personal data from children. If any limited data (e.g., age groups or group

sizes) is provided for operational purposes, it is handled with appropriate care and access

restrictions.

13. Changes to This Notice

We regularly review this notice to ensure it reflects our practices and legal obligations.

Significant updates will be communicated directly where appropriate. The latest version is

always available on our website.

Last Reviewed: April 2025