At CAFOD, we are committed to protecting personal information and we take our responsibilities regarding the security of supporter and volunteer information very seriously.
This privacy notice explains what personal data we collect about you, how and why we use it, who we disclose it to and how we protect it.
Who is responsible for your data?
Personal data we collect about you
How and why we use your personal data
Legal basis for processing your personal data
Children and vulnerable people
How long do we keep personal data?
Requesting access to your personal data
Security of your personal data
CAFOD is the official aid agency of the Catholic Church in England and Wales. Inspired by Gospel values and as part of the Catholic community of England and Wales, we come together in partnership with others, locally and globally:
To reach those in greatest need, save lives and relieve suffering.
To support and enable people, communities and our local partners to be artisans of their own destiny.
To challenge and transform the structures and behaviours that drive poverty, vulnerability, inequality, injustice and exclusion and harm the natural world.
To educate, enable and inspire the Catholic community of England and Wales to act in solidarity for the common good.
Our Privacy Notice applies to the personal data that CAFOD collects and uses.
References in this Privacy Notice to “CAFOD,” “we,” “us” or “our” mean the CATHOLIC AGENCY FOR OVERSEAS DEVELOPMENT, a charity registered in England and Wales (number 1160384) and a company limited by guarantee no 09387398. Our registered office is Romero House, 55 Westminster Bridge Road, London, SE1 7JB.
We are the “data controller” for the purposes of the Data Protection Act 2018.
We are registered with the Information Commissioner’s Office, registration number ZA106788.
CAFOD has a designated Data Protection Officer who can be contacted via dataprotection@cafod.org.uk.
When using the term “personal data” in our Privacy Notice, we mean information that relates to you and allows us to identify you, either directly or in combination with other information that we may hold.
We collect some personal data from you, for example, when you donate to us, use our website, use our services or contact us.
We may collect and process the following categories of information about you:
For example, your name, postal address, telephone number and date of birth (where relevant).
We collect this when you contact us or donate by post, telephone or on our website.
We and our authorised third-party payment processors collect your banking information (name, sort code and account number) or credit card details (name, number, CVV code or date of expiration).
We collect this when you make a donation online or by phone, set up a regular gift (e.g., direct debit or standing order) with us or send us a cheque in the post. We only retain your financial information for the purposes of collecting a direct debit but not when it is processed by an accredited third-party payment processor. All credit/debit card financial information processed by CAFOD is redacted.
We may collect information about you whenever you interact with us by email, post or phone. For example, when you contact CAFOD regarding our activities, send or receive information, register for an event or to receive news updates, make a donation or register for gift aid.
We collect contact details and other information indirectly from third parties such as:
Fundraise Up, our online donations provider, capture and share information with us about the CAFOD webpage, email, QR code, Meta (Facebook, Instagram), Google or other social advertising you clicked from to arrive at our donation page. We use this data to measure and improve the effectiveness of our marketing efforts. Find out more about CAFOD's use of Fundraise Up
Our lottery and raffle provider, Woods Group Ltd, captures the last CAFOD email, advertisement, social media post or page on the CAFOD website you clicked before arriving at our lottery and raffle website, and is appended to your supporter record when you join the lottery and raffle.
Event organisers (eg marathon organisers) or fundraising sites like JustGiving and Much Loved, where you have agreed to support CAFOD.
Our online tribute fund platform, Much Loved, captures information regarding tribute funds set up in memory of loved ones including photos as well as donations made to those tribute funds and any accompanying messages.
When you have provided permission for a company or other organisation to share your data with third parties, including charities (when you’ve mentioned CAFOD). This could be when you buy a product or service, or register for an online competition.
When you have agreed to support CAFOD using bank account-to-account payment transfers and have given specific permission for us to receive your data.
We collect non-personalised information about how our websites are used, such as your searches for information, non-personal data such as Internet Protocol (IP) addresses, details of webpages visited and files downloaded. Website usage information is collected using cookies.
Please see the section on cookies below. This information is collected when you use our websites.
We collect your posts and messages when you interact directly with CAFOD on social media.
This information is collected when you use platforms such as Meta’s Facebook, X (formerly known as Twitter), Instagram or LinkedIn.
We collect personal data as part of our staff or volunteer recruitment processes.
This information is collected when you apply for a job or for volunteering opportunities with CAFOD.
We collect personal data necessary for legacy administration.
This information is collected when a supporter has died, leaving a legacy to CAFOD, and you are the executor, or you have an interest in the estate.
We collect and use personal data that you provide to us, as CAFOD supporters, to contact you and inform you about CAFOD’s activities. We recognise that many of our supporters (but not all) hold religious beliefs and, as this is defined as a special category of personal data, we put in place procedures to ensure that additional security and access restrictions are applied to all the personal data CAFOD holds, in accordance with UK GDPR data processing principles and the Data Protection Act 2018.
CAFOD does not share your data with any other charity, public body or commercial organisation for their marketing purposes.
We may disclose your personal information to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligations, or in order to enforce or apply any agreements; or to protect the rights, property, or safety of the organisation, or others. This includes exchanging information with other companies and organisations for the purposes of safeguarding or other statutory regulations we have to comply with.
We will share your personal information with those organisations with whom we have reciprocal agreements for providing services for fulfilment, joint campaigns or other actions in line with our charitable purposes.
We may share your email address, in a way that cannot be used for any other purpose, with social media companies like Meta (Facebook, WhatsApp, Instagram), X (formerly known as Twitter) or LinkedIn, in order to exclude you from CAFOD appeals being advertised on that platform. Social media companies do not use or retain this information for any other purpose. More details follow under Profiling and Research.
We may also share customer and transaction data with advertising platforms such as Google, Microsoft and TikTok, via secure Shopify integrations, to measure the effectiveness of our campaigns, attribute sales activity and improve the targeting of our ads. These platforms may process data outside the UK/EEA. We ensure appropriate safeguards are in place for these international transfers, including reliance on Standard Contractual Clauses or Data Privacy Framework registration where applicable.
We use your personal data for the following purposes:
To manage your donations, requests or calls to action
When you interact with us, we use your information to perform our services in relation to your donation, to deal with your queries and requests and to process responses to our campaigns or advocacy work.
To fundraise and promote CAFOD’s work, in both financial and non-financial ways
We know how fundamental our supporters and donors are to the work we do. In order to develop and foster your ongoing support, we want to keep in touch with you through feedback and further opportunities and invitations to support our work in both financial and non-financial ways. Under our lawful basis of legitimate interest, CAFOD will contact you by postal mailings and, occasionally, an introductory telephone marketing call. However, we will always seek your consent to make further marketing calls.
When you take a supporter action with us, such as making a donation, we will either ask for your explicit consent to send you marketing emails or SMS texts, or we will offer you the option to opt out of these future communications while you are taking your chosen action. You will always be given the opportunity to unsubscribe in each promotional email or SMS communications that we subsequently send you.
Where you engage with CAFOD through digital ads (eg Google Shopping, Bing or TikTok Shop) we may use Shopify-integrated tools that allow us to track conversions and ad performance by sharing limited transactional data with the relevant platform. This helps us optimise advertising spend and improve supporter experience, particularly by limiting repeat ad targeting or enabling checkout from within a partner platform.
To communicate with you and manage our relationship with you
Occasionally, we may need to contact you by mail, email and/or telephone for administrative or operational reasons – for example, to send you confirmation of your donation or your World Gifts orders. Please be aware that these communications are not made for marketing purposes and as such, you will continue to receive them even if you opt out of receiving marketing communications from us.
We will also use your personal data if we contact you after you have sent us a request, filled in a web form through our website or contacted us on social media.
Your views and opinions are very important to us, so we may send you a survey to seek your feedback.
We will use the communications you exchange with us and the feedback you may provide to manage our relationship with you as a supporter of CAFOD and to improve our services and communications.
To inform you about our news and ways you may be able to help CAFOD
We may send you marketing communications by post. We may send you marketing communications by email, if you have indicated that you are happy to receive these – for example, when you have donated or completed a campaign action and you have either opted in to receive such communications or not opted out of receiving them.
You can choose to opt out of receiving email marketing communications at any time by clicking on the relevant unsubscribe link at the bottom of any marketing related email you may receive from us.
If you do not want to receive marketing communications from us, you can also tell us by contacting our Supporter Care team on 0303 303 3030 or cafod@cafod.org.uk.
To manage our volunteers
We need to keep some personal information in order to recruit and manage people who volunteer for CAFOD.
To maintain and improve our own accounts, records and organisational processes, to fulfil our administrative purposes and protect our charitable interests
The purposes for which we will use your information includes accounting, billing and audit, credit or other payment card verification, fraud screening, safety, security and legal purposes, statistical and marketing analysis, legacy administration, systems testing, maintenance and development.
Our processing also includes the use of CCTV systems at our premises for the detection and prevention of crime.
The Data Protection Act 2018 requires organisations to consider the legal basis on which they process personal data.
CAFOD will process personal data under the following lawful basis:
Agreement - Where it is necessary for us to fulfil a contract with you: for example, when you make a World Gifts purchase.
Legitimate interests - When it is in our legitimate interests to do so as part of our efforts to build long-term relationships with our supporters. In such instances, we will send you communications and marketing material via post and make initial telephone contact, unless you have told us you do not wish to receive these communications.
Consent - With your consent, we will send you emails or SMS or make marketing telephone calls.
We maintain a range of communication preferences and options, so you can choose both the type of material (whether that is fundraising activities, our campaigns work or prayer resources), and the most convenient channel(s) for you to receive information from us (eg email, post or SMS).
We use automated profiling and targeting tools and systems to help us understand our supporters needs better and ensure our communications (eg our emails) and services (eg our website) are relevant, personalised and interesting to you. This also helps us to keep our costs down.
If you would rather your personal data was not used for automated profiling, you can contact our Supporter Care team on 0303 303 3030 or via email at cafod@cafod.org.uk.
We use a service provider (Fundraise Up) on our website to process online donations. Fundraise Up uses machine learning to make suggestions that are appropriate and relevant to you, such as the donation amount, how often you are asked to donate, and whether to give you an option to cover the transaction costs. This is based on analysis of publicly available data related to your location, browser type and device, plus your website activity and previous donations made through the Fundraise Up platform. This information is only ever used anonymously and in ways that cannot identify any individual.
We use email analytical systems to monitor how you interact with the emails we send you (for example when you click on a link). This allows us to understand better your interests and preferences and tailor our communication programme to suit them.
In doing this, we obtain information such as but not limited to:
Time of receipt;
Time of opening;
Device used to open;
Location it was opened in;
Which parts of the email you interacted with.
To opt out of our email analytics tracking you can update your email service and web browser settings. Please refer to our how to guide
If your email provider is not listed or you need support to apply any desired changes, please contact supportercare@cafod.org.uk for further guidance.
If the solutions suggested above are not suitable, you can always unsubscribe from CAFOD email communications. There are links in all CAFOD marketing emails to allow you to easily unsubscribe.
As a fundraising organisation, we undertake in-house research and from time to time engage specialist agencies to gather information about you from publicly available sources, for example, Companies House, the Electoral Register, company websites, ‘rich lists,’ social networks such as LinkedIn, political and property registers and news archives. We may also carry out wealth screening to fast track the research using our trusted third-party partners. You will always have the right to opt out of this processing. We may also carry out research using information in the public domain to identify individuals who may have an affinity to our cause but with whom we are not already in touch. This research helps us to understand more about you as an individual so we can focus conversations we have with you about fundraising and volunteering in the most effective way and ensure that we provide you with an experience as a donor or potential donor which is appropriate for you.
If you would rather your personal data was not used for the purposes of wealth screening, you can contact our Supporter Care team on 0303 303 3030 or via email at cafod@cafod.org.uk.
We occasionally conduct surveys with our supporters, customers, staff and volunteers to get feedback on their experience with us. We use this feedback to improve the experiences we offer and ensure we know what you find relevant and interesting.
If you choose to take part in research, we will tell you when you start what data we will collect, why and how we will use it. All the research we conduct is optional and you can choose not to take part. For some of our research we may ask you to provide sensitive personal data (for example, ethnicity). You do not have to provide this data and we also provide a ‘prefer not to say’ option. We only use it at an aggregate rather than individual level (for example, for reporting on equal opportunities).
We may share some of your personal data (for example, contact information) with a research agency so that they can carry out research on our behalf.
If you do not wish to receive an invitation to take part in our surveys or market research you can contact our Supporter Care team on 0303 303 3030 or via email at cafod@cafod.org.uk.
If you have agreed to receive communications from us, we may securely share your email address with social media platforms such as Meta (Facebook, Instagram, Threads). This helps us tailor our advertising and ensure it’s relevant to you.
For example, we may:
Exclude you from seeing CAFOD fundraising appeals if you’ve already donated or taken part.
Show you campaigns or events that may be of interest based on your previous engagement with us.
Use tools provided by these platforms to help reach people with similar interests to you who may want to support CAFOD’s work.
Your data is encrypted, used only for this purpose, and deleted immediately after processing. We never receive any personal information about your social media activity from the platforms, and your data is never used for unrelated advertising.
We rely on the lawful basis of legitimate interest for this activity and ensure appropriate safeguards are in place.
You can opt out of this type of data use at any time by contacting our Supporter Care team on 0303 303 3030 or emailing us at cafod@cafod.org.uk.
We also use publicly available sources to carry out due diligence on donors in line with our Fundraising Policy Gift Acceptance and to meet money laundering regulations.
We are committed to working in a transparent, ethical, responsible and honest way. To reflect this commitment, we are registered with the Fundraising Regulator and are committed to the Regulator’s Code of Practice.
We are committed to protecting the privacy of the young people who engage with us through our website, at events and at schools. If you are under 16 and would like to get involved with our work, please note we will request consent from a parent or guardian before we take your information.
Some of our young people’s events, such as our young leadership programme request specific information about the age of participants and we may require explicit parental consent for this. We will only ever collect or process any personal information for a child under 13 with explicit parental consent. When we collect information about a child or young person aged under 16, we will make clear the reasons for collecting this information, as well as how the information will be used.
We are committed to protecting vulnerable supporters. We provide training for our staff who come into regular contact with supporters to be aware of, and to identify signs of, people in potentially vulnerable circumstances. We work in accordance with our Fundraising Policy at all times. We may record relevant personal information so that we can respond appropriately in future – for example, by ensuring no further marketing or fundraising requests are sent.
We will keep your personal data only for as long as we consider it necessary to carry out each processing activity.
We maintain data retention criteria to help implement this. This takes account of our legal and accounting obligations, balancing this with what would be considered reasonable.
We are required to keep details of financial transactions, including donations, for seven years to meet accountancy and HMRC requirements. We will anonymise or delete personal data if, after a period of seven years, we have not had any contact or communication from you (this will be measured over a rolling seven-year period) – subject to special circumstances concerning legacies.
Many supporters tell us that they have kindly included a gift to CAFOD in their will, or that they intend to do so. We retain their personal information indefinitely so that we can keep in touch during their lifetime and provide a caring and efficient legacy administration service.
CAFOD actively supports the principle of “fair and transparent” processing of your personal information. We support your rights in relation to your personal information under the Data Protection Act 2018, including the:
right to be informed (chiefly via this policy)
right of access
right to rectification
right to erasure
right to restrict processing
right to data portability
right to object
rights related to automated decision-making including profiling.
If you wish to exercise any of these rights, please contact the Data Protection Officer in writing at CAFOD, Romero House, 55 Westminster Bridge Road, London, SE1 7JB or via email at dataprotection@cafod.org.uk.
You have a right to request access to the personal data that we hold about you.
If you would like to request a copy of your personal data or have any questions in relation to your personal data, please contact us at dataprotection@cafod.org.uk.
In accordance with the Data Protection Act 2018, we are committed to taking appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. When you provide your personal data through our websites, this information is transmitted across the internet securely using high-grade encryption.
CAFOD takes particular care with online giving. CAFOD uses providers offering secure payment processing, which specialise in the secure capture and processing of online transactions. The online donation form is secure, and your information is encrypted and stored on a secure database. CAFOD does not retain any card payment information.
The data that we collect from you will be processed at servers based in the UK. It may also be processed by specialist organisations operating in the European Economic Area (EU/EEA), or other countries i.e., the USA, that CAFOD has instructed. If your data needs to be transferred outside of the EU/EEA, or to a country that has not been granted a finding of adequacy by the UK , we will transfer your data using ‘appropriate safeguards’ ie Binding Corporate Rules (BCR) or Standard Contract Clauses (SCC) (also known as Model Contract Clauses) etc, or we will seek your consent, on a case-by -case basis, and where appropriate to do so.
Specifically, we share data with platforms such as Google LLC, Microsoft Corporation and TikTok, each of which may process your information in the US or other jurisdictions. These transfers are safeguarded through mechanisms such as the EU–US and UK–US Data Privacy Framework or Standard Contractual Clauses included in their platform terms of service.
In order to improve our services, to provide you with more relevant content and to analyse how visitors use our websites, we may use technologies, such as cookies or other tracking software. Please be aware that in most cases we will not be able to identify you from the information we collect using these technologies, as this is based on your Internet Protocol (IP) address only.
The CAFOD website uses Google Analytics, a web analytics service provided by Google. Google Analytics uses cookies, which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about aggregated use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States.
Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf.
Google will not associate your IP address with any other data held by Google.
Opt out of Google Analytics tracking in your browser
Control website tracking permissions in your browser and on your device
Crazy Egg
We use a testing tool called Crazy Egg to help us understand how supporters navigate our website, so we can continue to improve the experience. Crazy Egg may collect anonymised data, such as your IP address and how you interact with our site. No personally identifiable information is collected.
To find out more about how Crazy Egg handles your data, please see the Crazy Egg privacy policy. If you'd prefer to opt out of Crazy Egg cookies and have your data removed, you can do so at any time by following the instructions at crazyegg.com/opt-out.
Cookies for checkout and donations
CAFOD World Gifts and our Online Donation process via our supplier Fundraise Up also use cookies to store your purchase or donation amount preferences as you move to checkout and make payments.
Opting out of cookies
You may refuse the use of cookies by selecting the appropriate settings on your browser.
However, please note that if you do this, you may not be able to use the full functionality of our website or our online donation process. Without cookies enabled, you may be unable to purchase a World Gift, or make a donation.
We will make changes to this Privacy Notice from time to time, as and when required, and we will publish any new version of this Privacy Notice on this page.
If you have any complaints about our use of personal data, please send an email with the details of your complaint to dataprotection@cafod.org.uk.
You also have the right to lodge a complaint with the UK data protection regulator, the Information Commissioner's Office (“ICO”). For further information on your rights and how to complain to the ICO, please refer to the ICO website.
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113 (local rate)
CAFOD will occasionally provide you with the opportunity to opt-in to receiving certain types of communication. If you are already receiving such communication, you do not need to opt-in again as your existing preference will persist until you provide explicit instruction that you want to opt-out.
You can change your preferences on what you receive from CAFOD at any time, including fundraising and marketing materials or how we contact you.
Telephone
Call our Supporter Care team on 0303 303 3030.
Email us at cafod@cafod.org.uk.
Post
Write to us at:
Supporter Care
CAFOD Romero House
55 Westminster Bridge Road
London
SE1 7JB
We welcome any questions, comments and requests regarding this Privacy Notice and these should be addressed to dataprotection@cafod.org.uk or:
Data Protection Officer
CAFOD Romero House
55 Westminster Bridge Road
London
SE1 7JB
