Introduction

Church Mission Society is dependent on the generosity, goodwill and faithfulness of individuals, and churches, to meet our charitable objectives. Building and maintaining truly mutual and fruitful relationships is central to our identity. Because of this we are committed to transparent, ethical and honest communication.

If you are unhappy with our work, whether that is about your data or anything else, please do not hesitate to contact us on supporter.care@churchmissionsociety.org or call us on 01865 787407.

This privacy policy outlines our commitment to you (particularly as a supporter) concerning your personal data.

Church Mission Society (CMS) is registered with the Information Commissioner (ICO), registration number Z6100362. You can read more concerning our registration here, including a list of all data related activities that we have registered with the ICO.

If you use our website or any of our services or provide us with any personal information, we will point you toward this policy, so that you can be fully aware of how information about you might be used and disclosed.

Who we are

“CMS” in this notice means one or more of the following organisations, depending on your relationship with us:

• Church Mission Society is our parent charity. It handles data about supporters, CMS Community members, students, staff, volunteers and mission partners.
• The South American Mission Society (SAMS) handles data about SAMS supporters and SAMS mission activities.
• CMS House Enterprises Ltd is our trading subsidiary. It handles data about conference and venue-hire customers.
• C.M.S. Pension Trust Limited is the trustee of the CMS pension scheme. It handles data about scheme members, their dependants and other beneficiaries.

Because CMS staff administer all of this using shared systems, these organisations are joint controllers of some of your data. In practice, CMS handles requests, security and retention on behalf of the group. You can exercise your rights against any of them, though contacting CMS is recommended in the first instance. Our written joint controller agreement is available on request.

How to contact us about your data

If you have any questions about this notice or how we handle your data, or if you wish to exercise any of your rights, please contact our Data Protection Officer:

Laura Hayes, Data Protection Officer, Church Mission Society, Watlington Road, Oxford OX4 6BZ.
Email: dataprotection@churchmissionsociety.org
Telephone: 01865 787407

What is personal data?

Personal data covers any information that enables us to identify you as an individual. This information could include, name, address, telephone number, email address, credit card details or bank details (submitted when making a donation).

Where do we collect personal data?

We only ever collect information we need to do our work, including data that helps us to improve what we do and how we do it. There are a number of places we collect data from. These are:

Information you give us directly: We gather this information through specific activities, for example when you complete printed forms, telephone us or complete online forms on our website.

Information you give us indirectly: For example, when you give your data to third party websites, such as JustGiving or Give.net.

Information we collect from your use of our websites: This information is collected using cookies, which helps us understand what information people are finding most valuable and make improvements to our websites.

Information from third parties: For example, we may receive information about you from a friend who books you onto an event or makes a donation in your name.

Information from public sources: We may combine information you have provided with information from public sources. This helps us to get a better understanding of who our supporters are, and ensure we engage with you more effectively. This saves time and resources, and helps ensure we are as cost effective as possible.

When we collect your email address, we will tell you if we intend to use it to send you electronic mail marketing about our charitable purposes (under the charitable purpose soft opt-in). We will always give you a clear and easy opportunity to opt out at that point.

We do not ordinarily collect data or seek donations from people under 16 years of age.

Sensitive categories of data

Data protection law recognises that certain categories of personal information are more sensitive than others, such as ethnicity, political opinions or health issues. We do not collect sensitive information unless there is a clear reason for doing so, such as your involvement in an event where knowing this information improves your safety and helps with your engagement. You may disclose sensitive information to a volunteer or member of staff for prayer, and they may make a temporary note as a reminder. 

When we collect this data we will make it very clear why we are doing so and what the legal basis is for doing this. In particular, where we process special category data we rely on a specific condition under Article 9 UK GDPR, typically: (a) your explicit consent (Article 9(2)(a)) for example for dietary or accessibility requirements at events, or for prayer requests you volunteer to us; (b) the not-for-profit body condition (Article 9(2)(d)) for processing of religious or philosophical belief data about our own members and supporters; or (c) the substantial public interest condition under Schedule 1 of the Data Protection Act 2018, for example for safeguarding purposes. We will only use the minimum data necessary, and only for the purposes for which it was collected.

Use of cookies

We use cookies on our website (churchmissionsociety.org) for a variety of reasons:

• To make the website function properly and give you a pleasant user experience
• To collect statistics about how people use our website, so that we can make improvements and report on our investment in digital resources. We also collect Google signals data from people who are signed in to a Google account with Ads Personalisation turned on.
• To help deliver and measure the effectiveness of our online advertising via Google Ads and Meta

Cookies may be set if you access our marketing emails sent via Dotdigital (please see their website for more information) or book for events via Eventbrite (please see their cookie statement)

For more information about cookies and guidance on how to control them, visit the Information Commissioner’s Office (ICO) website.

You may change which cookies you allow us to use at any time, via the Cookie Preferences icon at the bottom left of our website.

How do we use personal data?

We use personal data in a variety of ways, such as sending you subscriptions of our publications, to process event bookings, provide you with information you have requested, record the contact we have had with you, or writing to you as a supporter of Church Mission Society.

All information that we hold concerning you will be held and processed by Church Mission Society in accordance with the provisions of data protection legislation.

We will respect your preferences to be included or not included in email mail-outs and postal mailings. Please do use the options within the emails to unsubscribe or contact us by email at supporter.care@churchmissionsociety.org, by phone on 01865 787407 or by post at the address below.

From 5 February 2026, where permitted by law, we may also send you electronic mail marketing about our charitable purposes using the charitable purpose soft opt-in. When we collect your contact details, we will always give you a clear opportunity to opt out of receiving these emails, and every email we send will include an unsubscribe option.

We will also respect your preference for your photo not to appear in Church Mission Society publications. Please contact us to express this preference.

We will only keep your details for as long as necessary. For details of this please see our data retention policy.

Please be especially assured, we will not transfer your contact details to other charities or to other companies for their marketing purposes.

At Church Mission Society we are concerned to build positive and mutually beneficial relationships with our supporters and members. To do this we often tailor our communications to best meet the interests and motivations of both individuals and churches. To achieve a more tailored approach we may carry out desk and online research which involves reviewing publicly available information such as news articles and business websites to better understand your interests.

You should also note that we may also use publicly available information to ensure we comply with regulations regarding money laundering.

We may also use broader demographic and geographic data to better understand supporters ‘in the round’. All of this work is done to improve the experience supporters have of Church Mission Society.

Direct marketing includes information that encourages you to engage further with our charitable purposes, such as invitations to events, fundraising appeals, mission updates or ways to pray or get involved.

Please note that we do not undertake the practice of wealth screening.

Electronic mail marketing and the charitable purpose soft opt-in

From 5 February 2026, charities are allowed to use a new form of “soft opt-in” for electronic mail marketing about their charitable purposes, under regulation 22(3A) of the Privacy and Electronic Communications Regulations (PECR). This means that, in some situations, CMS may send you marketing emails about our charitable work without your explicit consent, provided we meet all the following requirements:

• We obtained your contact details directly from you when you expressed interest in our charitable purposes or offered to support our work – for example by making a donation, registering for an event, or requesting one of our resources.

• We gave you a clear and easy opportunity to opt out of receiving marketing emails about our charitable purposes at the time you provided your details.

• We include a simple opt-out in every message we send you.

• The content of the emails relates solely to CMS’s charitable purposes, such as mission updates, prayer invitations, appeals, events or ways to support our work.

You can opt out of receiving these marketing emails at any time. Simply use the unsubscribe link in any email, or contact us at supporter.care@churchmissionsociety.org or 01865 787407.

We will continue to separate records of people who receive electronic mail marketing on the basis of:

• their explicit consent,

• the charitable purpose soft opt-in, and

• (where applicable) the commercial soft opt-in for products and services.

If you object to receiving electronic mail marketing, we will add you to our suppression list. We will not send you electronic mail marketing again unless you subsequently choose to give us your consent.

When we share your data, and who we share it with

Except where detailed below we will not, without your consent, supply your contact details or other personal data to any third party outside Church Mission Society except where we are required to do so by law, or where the transfer is within the Church Mission Society group of companies (CMS, C.M.S. Pension Trust Limited, SAMS, CMS House Enterprises Ltd).

There are other situations which mean that we do share your data, such as where it is necessary to do so to undertake our activities. For example, we may:

• transfer your name and address to a mailing house in order to send out mailings to you
• transfer your contact details to our email platform provider (Dotdigital) in order to send out tailored emails to you
• transfer your name, address and the values of gifts that you have given us to HMRC in order to reclaim gift aid on your gifts
• transfer your name and contact details to conference centres if you are a supporter attending a CMS sponsored conference or event
• transfer your application and attainment details, with other academic bodies, if you are a student on one of our courses
• transfer your name and address to profile research organisations in order to get anonymous analysis of our supporters’ collective behaviour and identity – for example, average age or common interests
• transfer your name and address to research organisations so they can conduct personalised surveys or collect independent feedback on our performance, or their own views and opinions
• transfer your name, address and the values of gifts that you have given us to other organisations in the CMS family (specifically CMS-Africa, Asia CMS, CMS Australia, CMS Ireland, New Zealand CMS and SAMS USA), where your gift has been earmarked specifically for the ministry of mission personnel working for one of those entities.

If you are making a donation or payment with a debit or credit card via the Church Mission Society website, or by phone, we use two companies who are experts in their field to do this.

For donations over the website we use Braintree (a service run by PayPal). You can read more about them on the Braintree website and read the PayPal privacy statement.

Similarly we use Worldpay for donations over the phone. You can read more about Worldpay on the Worldpay website. You can also visit the Worldpay privacy centre.

Please do note we really want to encourage members of the Church Mission Society Community to give consent allowing us to supply their contact details to other members of the community. We do this to encourage prayer for one another, fellowship, or arranging times to meet up. You can choose to share your address, phone number and/or email address to do this.

What is our legal basis for processing your data?

Within GDPR there are six legal bases for processing data. We rely on four of these to process your data, below we have highlighted the main activities we undertake that process personal data:

• We use a contractual basis for processing data relating to our online shop, or being a student on one of our courses.

• We rely on legitimate interest for a variety of purposes including sending you our publications, invitations to financially support our work, undertake desk research and thank you for your donation.

• We rely on the charitable purpose soft opt-in under PECR (regulation 22(3A)) to send certain marketing emails about our charitable purposes to people who meet the conditions above. You can opt out at any time.
• We use consent to contact you by email or phone for direct marketing purposes where the law requires consent. Every news, prayer or promotional email you receive (via our managed email platform) provides a clear and simple way to opt out, or unsubscribe, from future emails. These emails will also provide a way for you to amend which emails you receive.
• We use legal obligation as the basis for processing any legally required activities such as Gift Aid returns to HMRC.

It is the area of Legitimate Interest that might be of greatest interest to you. Legitimate Interest is about balancing the interests of CMS (furthering our own charitable objectives; inspiring and informing people about mission and resourcing those in mission) against your interests, rights and freedoms, and having careful and close regard to any reasonable expectations you might have about the use of your data.

Who has access to your information, and how is it kept safe?

We maintain a high level of security in relation to your data. All staff and volunteers of Church Mission Society undertake data protection training. We place a high value on ensuring personal data of any kind is kept securely. Also in accordance with our data protection policy, we report to our Board of Trustees any breach of the data protection policy, for accountability, monitoring and improvement.

If you contact us by phone to make a payment, or donation, by credit or debit card, only those staff authorised to process payments will be able to see your credit card details. Once the transaction is completed we do not store credit or debit card details.

The vast majority of your data is stored within the United Kingdom. Where we transfer data outside the UK – for example, to a cloud-based service provider, or to a placement host or partner mission entity overseas – we ensure appropriate safeguards are in place. We rely on: (a) transfers to countries which the UK Government has determined provide an adequate level of protection (such as countries in the European Economic Area); (b) the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, supplemented where necessary by a transfer risk assessment; or (c) a specific exception under Article 49 UK GDPR (such as your explicit consent at the point of transfer, or necessity for the performance of a contract with you). You can request further information about the specific safeguards used for any transfer by contacting our Data Protection Officer.

However, we will endeavour to ensure that your privacy is protected as outlined in this privacy policy and in accordance with our legal obligations under data protection legislation.

How long do we keep your data for?

We will hold your personal information on our system for as long as it is needed to fulfil the function for which we hold the data, or for as long as is required by law for the relevant activity. For more details of this please refer to our data retention policy.

Contacting us regarding your personal data

Under UK data protection law you have the following rights in respect of your personal data:

Right of access – to obtain confirmation that we are processing your data and a copy of the personal data we hold about you.

Right to rectification – to have inaccurate or incomplete data corrected.

Right to erasure – to ask us to delete your data in certain circumstances.

Right to restrict processing – to ask us to stop processing your data while we resolve an issue.

Right to data portability – to receive certain data in a portable, machine-readable format.

Right to object – including an absolute right to object to direct marketing, and a qualified right to object to other processing we carry out on the basis of legitimate interests.

Right to withdraw consent – where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Rights related to automated decision-making — we do not currently make significant decisions about you using solely automated means.

You also have the right to ask us to opt your photo out of CMS publications.

To exercise any of these rights, please contact our Data Protection Officer using the details in the “How to contact us” section above.

Complaints

If you are unhappy with how we have handled your data, please contact us first so we can try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow SK9 5AF; helpline 0303 123 1113; ico.org.uk.

To contact us to make any changes call us on 01865 787407, email us on supporter.care@churchmissionsociety.org or write to us at the address below.

Church Mission Society,
Watlington Road,
Oxford,
OX4 6BZ

Changes to this policy

From time to time we may update this privacy policy, so you may wish to check it each time you submit personal information to CMS, or when we prompt you on any communications you might receive. The date of the most recent revisions will appear on this page. If you do not agree to these changes please do not continue to use the CMS website or submit personal information. Please also notify us of any changes you want to make to the way we process your data using the contact details above. If material changes are made to the privacy policy we will notify you by placing a prominent notice on the website and through prominent notification on our publications.

This version – August 2026