Introduction
This Privacy Policy (together with the Terms and Conditions and Cookie Policy found on our website and any other documents referred to on it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. This Privacy Policy also sets out your rights to control personal information we hold about you. Please read this Privacy Policy carefully in order to understand our practices regarding your personal data and how we will treat it.
Capernwray Missionary Fellowship of Torchbearers, with registered office: Capernwray Hall, Carnforth, Lancashire, LA6 1AG, registered in England as a charitable organisation with number: 1073139 and as a company limited by guarantee with number: 3573958, including its wholly owned subsidiary Capernwray Parkland Farm Limited, registered in England as a company limited by guarantee with number: 03674234 (together “Capernwray”, “we“, “us” or “our”) are committed to protecting and respecting your privacy and will only process personal data you provide to us in accordance with applicable privacy laws. The rules on processing of personal data are set out in the General Data Protection Regulation (“GDPR”).
For all data matters, contact our Data Protection Representative at privacy@capernwray.org
Definitions
“Data controller” – determines the purposes and means of processing personal data and means Capernwray in this Privacy Policy;
“Data processor” – is responsible for processing personal data on behalf of a data controller;
“Data subject” – a natural person;
“Personal data” – any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier (as explained in Article 6 of GDPR), for example name, passport number, home address or private email address and online identifiers include IP addresses and cookies;
“Processing” – any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
“Special categories personal data” – as set out in the GDPR, the special categories specifically including genetic data, and biometric data where processed to uniquely identify an individual and other examples include racial and ethnic origin, sexual orientation, health data, trade union membership, political opinions, religious or philosophical beliefs;
“Third party” – a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
Section 1 – If you are under 13
We do not and will not knowingly collect information from any unsupervised minor under 13. If you are under the age of 13, you may not use our website unless you have the consent of, and are supervised by, a parent or guardian.
Section 2 – Personal data we collect
We collect different information depending on your relationship with us:
- Enquirers: Your name, contact details, the content of your inquiry, and our communications with you.
- Students (Bible school): Application details, next-of-kin and emergency contacts, attendance, fees and payments, and, where you provide it, dietary and medical information needed for your stay.
- Holiday guests and families: Booking and rooming details, payment information, contact details, and any dietary or medical information needed for your stay. For child guests, we collect parent/guardian contacts and consent.
- Supporters and donors: Your name, contact details, giving history, Gift Aid declarations, and marketing preferences.
- Volunteers and Ministry Assistants (SALT): Application and reference details, right-to-work evidence, training records and, where relevant, health/accessibility information.
- Donor to Capernwray: Your donation and/or pledge details, including Gift Aid status (as required by HMRC).
- Website visitors: Server logs and cookie/analytics data as described in our cookie policy.
Some information is special category data that requires extra protection, in our case, mainly health and dietary information, as well as information that may reveal religious beliefs. We keep this to the minimum necessary and store the details securely, separately from our main CRM.
The vast majority of the information we hold comes directly from the forms you have filled out (such as contact, booking, application, registration, and event forms).
Section 3 – What we use your data for
We only use personal data where the law allows. Depending on the activity, we rely on one or more of the following: your consent; performance of a contract with you; compliance with a legal obligation; protection of someone’s vital interests; a task in the public interest; or our legitimate interests as a charity (balanced against your rights). For special category data, we apply an additional condition, such as explicit consent, the substantial public interest condition for safeguarding, or an employment/health condition.
| What we do | Why | Main lawful basis |
| Respond to inquiries | To answer you and provide the information you ask for | Legitimate interests/consent |
| Provide Bible school places, holidays and accommodation | To deliver the service you booked | Contract/legal obligation |
| Keep you safe during your stay | Dietary, medical and safeguarding needs | Vital interests/legal obligation /substantial public interest |
| Manage fees, payments and Gift Aid | Financial administration and tax | Legal obligation/contract |
| Send you news, appeals and updates | Supporter and alumni engagement | Consent/charitable-purposes soft opt-in (see below) |
| Run and secure our website | Diagnostics and security | Legitimate interests/consent (cookies) |
Section 4 – Is providing your data required?
For some activities, providing certain information is necessary so that we can enter into or carry out a contract with you, or meet a legal obligation, for example, when you apply for a Bible school place, book a holiday, or make a donation with Gift Aid. If you do not provide this information, we may be unable to process your application, booking or payment. Other information is provided voluntarily (for example, optional feedback or your marketing preferences), and there is no obligation to give it.
Section 5 – Automated decision-making
We do not make decisions about you using solely automated means that produce legal or similarly significant effects. We do use profiling in a limited way, for example, grouping audiences and sending automated email journeys to make our communications more relevant. This has no legal or significant effect on you, and you can object to profiling for marketing at any time by using the unsubscribe link or emailing privacy@capernwray.org.
Section 6 – Marketing and the charitable-purposes soft opt-in
We will only send you electronic marketing (email, SMS or social media direct messages) where we are allowed to. We rely on your consent, or as a charity on the “charitable-purposes soft opt-in” that came into force on 5 February 2026. This lets us contact people who have expressed interest in or offered support for our charitable purpose, provided we tell you, when we collect your details, that we will only promote our own charitable aims, and give you a clear, free way to opt out in every message. You can withdraw at any time. Every email has an unsubscribe link, and you can email privacy@capernwray.org. We honour opt-outs promptly and keep a suppression record so you are not contacted again.
Section 7 – Sharing your data
We do not sell your data. We share it only where necessary: with service providers who process data on our behalf under a written contract (for example, our CRM, email platform, and payment processors); when required by law; or to protect people in a safeguarding situation. Any provider acting for us is bound to keep your data confidential and secure and to use it only on our instructions.
Section 8 – Transfer of data abroad
Some of the providers we use to run our services (for example, our email and analytics tools) may store or process data outside the UK. Where that happens, we ensure an appropriate safeguard is in place, such as standard contractual clauses, so your data retains the same level of protection. We will not allow your data to be transferred internationally without one of these protections.
Section 9 – How long we keep your data
We keep personal data only for as long as we genuinely need it for the purpose we collected it, or to meet a legal obligation, and then delete or anonymise it. Our full schedule is set out in the Capernwray Data Retention Log. In summary:
| Information | Typical retention time |
| Student records | Duration of course + 6 years, then an alumni record reviewed every 3 years, to a maximum of 5 years |
| Enquiries | 24 months from last meaningful contact |
| Holiday/guest bookings | 6 years (HMRC accounting requirement) |
| Youth Weeks passport details | Held securely for 30 days after booking, then deleted |
| Medical/dietary information | Deleted shortly after your stay, unless an incident requires longer |
| Safeguarding records | Up to 75 years (held securely, separately) |
| Marketing data | While you remain engaged; reviewed every 12–36 months |
Section 10 – Cookies
Our website uses cookies and similar technologies to help it function, understand how it is used, and power features such as embedded video and live chat. We set strictly necessary cookies without asking; analytics, advertising, and live-chat cookies are set only with your consent, which you can give, refuse, or withdraw at any time using the banner on our site. For the full list of cookies and how to manage them, see our Cookie Policy.
Section 11 – Your rights
Under UK data protection law, you have the right to be informed; to access your data; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to data portability; and rights relating to automated decision-making. Where we rely on consent, you can withdraw it at any time. To exercise any right, contact privacy@capernwray.org. We will usually respond within one month, and will verify your identity first.
Section 12 – How to make a complaint
If you are unhappy with how we have handled your personal data, please contact us first at privacy@capernwray.org so that we can put it right. We will acknowledge your complaint within 30 days and aim to give you a full response within one month. We will tell you the outcome and, if you remain dissatisfied, your right to escalate.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator, at ico.org.uk or on 0303 123 1113.
This policy was last reviewed and updated in September 2026.
