CBN UK Privacy Notice
Effective Date: 28/10/2025
Registered Charity Number: 110 1659
Registered Charity Address: The 700 Club, PO Box 700, Hereford, HR1 9EW
Websites: www.cbn.uk and www.cbneurope.com
1 Introduction
This Privacy Notice applies to all individuals whose personal data we process, including donors, supporters, prayer request submitters, church and school contacts for Superbook Academy, volunteers, and website visitors. It outlines how CBN UK / CBN Europe processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR), and the Data Protection Act 2018.
We are committed to transparency and ensuring you understand how your personal information is collected, used, stored, and shared.
2 Who We Are
CBN UK is a registered charity in England & Wales (The Christian Broadcasting Network UK, registration number 1101659) and operates a trading subsidiary, CBN Resources Ltd (company number 10853789). The name CBN Europe is a ‘working name’ of the CBN UK Charity which represents all CBN’s ministry projects in the UK, Europe and Eurasia. CBN UK is the data controller for the personal data we process. CBN Resources Ltd may act as a data processor on our behalf.
- Data Controller: CBN UK, PO Box 700, Hereford, HR1 9EW, United Kingdom
- Contact Email: dataprotection@cbneurope.com
- Telephone: 0300 561 0700 (UK) or call +44 (0)207 101 7045 (International)
You can contact our data protection officer (DPO) by any of the above if you have any questions regarding the collection and use (processing) of your personal data.
3 What Personal Data We Collect
We collect and process the following categories of personal data:
- Personal Identification Data: Name, title, address, email, phone number.
- Demographic Data: Interests, preferences, and information related to engagement with CBN UK content and services.
- Usage Data: Website visits, IP addresses, analytics, and visitor (online) behaviour patterns.
- Transactional Data: Donation and purchase history, including fulfilment details.
- Communication Data: Correspondence via phone, email, post, or social media.
- Special Category Data: Voluntarily provided information related to religious beliefs or pastoral needs (e.g., prayer requests). Processed with additional safeguards.
We may also collect information via surveys, competitions, and special offers when you choose to participate.
3.1 Data obtained from third parties
In some cases, we may receive your personal data from sources other than you directly, including:
- Churches or schools that register for Superbook Academy on behalf of their organization
- Partner ministries or Christian organizations who refer supporters to us
- Social media platforms (when you interact with our content)
- Publicly available sources (e.g., charity databases, company registers)
When we receive data from third parties, we will inform you within one month (or at the point of first communication if sooner) and provide you with information about the source and our use of your data.
4 How We Collect Personal Data
We collect personal data through:
- Direct Interactions: Forms, calls, donations, event sign-ups, surveys, competitions, prayer support requests, instant messaging.
- Automated Technologies: Cookies, tracking pixels, analytics (e.g., Google Analytics) and usage monitoring.
- Third-Party Sources: Social media, referrals, partner ministries, and publicly available sources, in line with applicable data protection laws.
5 Cookies and Online tracking
Our website uses cookies and similar technologies to improve your experience and understand how you interact with our content.
You can manage your cookie preferences through our cookie banner when you first visit our website, or by adjusting your browser settings. Please note that blocking some cookies may affect website functionality.
For details on cookies used on our website, please see our Cookies Policy https://cbneurope.com/cookie-policy/
6 Legal Basis for Processing
Under UK GDPR, we rely on the following lawful bases:
- Consent: For marketing communications, surveys, prayer requests, or spiritual support.
- Contractual Obligation: To process purchases, donations, and resource fulfilment.
- Legal Obligation: Compliance with financial and charity regulations, including donation record retention.
- Legitimate Interests: Where we rely on legitimate interests as our legal basis, we have conducted a balancing test to ensure our interests do not override your rights and freedoms. Our legitimate interests include
- Improving our services and content based on usage patterns and feedback
- Engaging existing supporters with relevant updates about our ministry activities
- Operating efficiently as a not-for-profit Christian organisation
- Preventing fraud and ensuring security of our systems
- Understanding how our resources are used to better serve churches and individuals.
- You have the right to object to processing based on legitimate interests at any time by contacting us at dataprotection@cbneurope.com
- Special Category Data, including your religious beliefs, is processed under Article 9(2)(d) UK GDPR for legitimate activities of a not-for-profit religious organisation.
6.1 When We Rely on Consent
Where we process your personal data based on your consent (e.g., marketing emails, prayer support), you have the right to withdraw consent at any time. This will not affect the lawfulness of processing before withdrawal.
You can withdraw consent by:
- Clicking ‘unsubscribe’ in any marketing email
- Contacting dataprotection@cbneurope.com
- Calling: 0300 561 0700 (UK) or call +44 (0)207 101 7045 (International)
- Updating your preferences in your online account (if applicable)
We use clear opt-in mechanisms and provide granular choices where possible (e.g., choosing which types of updates you wish to receive).
7 Data Sharing & Third-Party Processors
We work with other organisations, their systems, and services to deliver our mission effectively. We contract with these organisations to help process your data (data Processors) and ensure these Processors are obligated to protect personal data in accordance with data protection laws.
7.1 Key Systems/Processors Used
- Salesforce: CRM and donor management
- Iterable: Email marketing and analytics
- Pantheon / WP Hosting: Website and data hosting
- Google Analytics / Tracking Pixels: Website performance and engagement
- WhatsApp: Prayer communication (subject to WhatsApp’s privacy policy)
- Fathom AI: Internal meeting and insight tools
- Meta (Facebook/Instagram) / Google Ads: Targeted communications• Stripe / PayPal / Findock: Donation and payment processing
- Microsoft 365: Internal documents and communications
- Zoom: Online meetings and webinars
- Zapier: Secure automation of workflows between systems (e.g., Salesforce, Iterable)
- QuickBooks: Financial accounting
- Superbook Academy (SB Academy): Our Sunday school curriculum platform, used to provide churches and schools with Christian resources. We collect contact details for relevant church or school staff. We do not collect children’s personal data directly.
- Waiver Electronic: Electronic waivers and forms Data Recipients:
- Mailing houses (e.g. for direct marketing campaigns)
- Fulfilment centres (e.g. for Superbook merchandise and other resources)
- Social media platforms (for audience engagement)
- Financial auditors and regulators
Where necessary, and where required by law, we will complete a data protection impact assessment (DPIA) to help us understand and reduce or eliminate any risk involved when processing your personal data.
8 Data Transfers Outside the UK & EEA
Some of the third-party services we use may transfer or store your personal data outside the UK and European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place:
8.1 Transfers with Adequate Protection
- United States: We transfer data to US-based processors (including Salesforce, Stripe, PayPal, Google, Meta, and Iterable) who participate in the UK Extension to the EU-US Data Privacy Framework, providing an adequate level of protection as recognised by the UK Government.
8.2 Transfers Using Standard Contractual Clauses (SCCs)
Where adequacy decisions do not apply, we use the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses approved for use in the UK, along with additional safeguards where appropriate.
8.3 Specific Processors with International Transfers:
- Salesforce (USA) – CRM and donor management
- Iterable (USA) – Email marketing
- Stripe/PayPal (USA) – Payment processing
- Google Analytics, Google Ads (USA)
- Website analytics and advertising
- Meta/Facebook (USA) – Social media advertising
- Pantheon (USA) – Website hosting
- Zoom (USA) – Video conferencing
You can request copies of the safeguards we have in place by contacting dataprotection@cbneurope.com..
9 Data Retention & Security
9.1 How long we keep your data
We retain personal data in line with legal and operational requirements:
- Financial/Donor Records: 6 years plus current year
- Legal requirement under UK tax law and Charity Commission guidance
- Gift Aid Declarations: 6 years after the calendar year the donation was made
- HMRC compliance requirements
- Prayer Requests: Up to 12 months (unless you request earlier deletion)
- Operational need to provide ongoing prayer support
- Marketing Communications: Until you withdraw consent or we no longer have a legitimate basis to contact you.
- Legitimate interest in maintaining relationships with supporters
- Survey or Competition Data: Duration of the campaign or up to 12 months
- To fulfil the specific purpose and analyse results
- Website Analytics: Typically, 26 months (Google Analytics default)
- To understand long-term trends in website usage
9.2 Security Measures:
We protect your personal data through
- Role-based access controls (staff only access data needed for their role)
- Encryption of data in transit and at rest
- Regular security training for all staff and volunteers
- Secure password policies and multi-factor authentication
- Regular security audits and updates
- Secure disposal procedures for data no longer needed
10 Your Data Protection Rights
10.1 You have the following rights under UK GDPR:
- Right to Access: Your personal data
- Right to Rectification: Correct inaccuracies
- Right to Erasure: Request deletion
- Right to Restriction: Limit processing
- Right to Data Portability
- Right to Object: Especially to direct marketing
- Right to Withdraw Consent at any time
- Right to Lodge a Complaint with the UK Information Commissioner’s Office (ico.org.uk)
To exercise your rights, contact: dataprotection@cbneurope.com or call +44 (0)1227 453300.
We may require proof of identity and will respond without undue delay, at the latest within one month.
10.2 Our Response Process
- We will acknowledge your request, usually within 72 hours
- We may require proof of identity (e.g., photo ID) to protect your privacy
- We will respond within one month, or inform you if we need longer (up to 3 months for complex requests)
- There is no fee unless your request is manifestly unfounded or excessive
- If we refuse your request, we will explain why and inform you of your right to complain to the Information Commissioner
11 Right to Complain
If you’re unhappy with how we’ve handled your data, you can complain to: Information Commissioner’s Office (ICO) Website: www.ico.org.uk Phone: 0303 123 1113 You can also use the ICO’s online reporting tool at: https://ico.org.uk/make-a-complaint/
We are committed to providing high-quality services. If you have a complaint about how we are processing your personal data, or managing any of your data rights, please.
- Contact us first: Please raise your concern with us directly at the contact details below. We will do our best to resolve the matter promptly.
- Information Commission: If you believe we have not handled your complaint appropriately, you may contact the Information Commission (Formerly the Information Commissioner’s Office)
- Website: www.ico.org.uk
- Phone: 0303 123 1113
- You can also use the ICO’s online reporting tool at: https://ico.org.uk/make-a-complaint/
12 Automated Decision-Making
We do not use personal data for automated decision-making or profiling that has legal or similarly significant effects.
We may use analytics and audience segmentation to tailor communications to supporter interests, but this does not involve automated decisions with legal or similarly significant effects. All significant decisions involving your data are made by real people.
13 Statutory or Contractual Requirement
In some situations, we require certain personal data to fulfill our obligations or provide services.
13.1 Required Data
- To process a donation: Name, contact details, payment information
- To fulfill a resource order: Delivery address
- To provide prayer support: Contact details and prayer request information
- To register for Superbook Academy: Church/school contact details
13.2 Consequences of Not Providing Required Data
- We will be unable to process your donation or purchase
- We cannot deliver resources or materials to you
- We cannot respond to your prayer requests or provide pastoral support
- Churches/schools cannot access Superbook Academy resources
13.3 Voluntary Data
You are not required to provide data for marketing, surveys, or optional services. Declining these will not affect your ability to access our core charitable services..
14 Children’s Personal Data
14.1 Superbook Academy
Our Superbook Academy platform is designed for use by churches and schools to deliver Christian education to children. However: –
- We do not directly collect personal data from individuals under 18
- Churches and schools are responsible for obtaining appropriate consent from parents/guardians for children’s participation
- We collect only organizational contact details (church/school staff)
- Any aggregated data (e.g., number of children participating, age ranges) contains no individually identifiable information.
14.2 Website Visitors
Our website and services are not directed at children under 13. If we become aware that we have inadvertently collected personal data from a child under 13, we will delete it promptly.
15 Changes to This Notice
We regularly review this notice to ensure it reflects our practices and legal obligations.
Significant updates will be communicated directly where appropriate.
The latest version is always available on our website. Last Reviewed: [28/10/2025]
