PRIVACY POLICY
www.cymfed.org.uk
- Introduction
The Catholic Youth Ministry Federation (“CYMFed”, “we”, “us”, or “our) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect personal information when you interact with us, including through our website at www.cymfed.org.uk
This policy applies to personal data provided by adults, including clergy, staff, volunteers, and group leaders, who engage with CYMFed services such as event bookings, memberships, communications, and newsletters.
CYMFed does not directly collect or process personal data relating to children through its website or booking systems. Where events involve children or young people, personal data relating to them is collected and processed by local group leaders, dioceses, parishes, schools, or other responsible adults, not by CYMFed.
- Who We Are
CYMFed is the Data Controller for the personal data described in this policy.
Organisation Name: CYMFed – Catholic Youth Ministry Federation
Address: 39 Eccleston Sq, London, SW1V 1BX
Email: admin@cymfed.org.uk
- The Personal Data We Collect
We many collect and process the following types of personal data:
- Name and title
- Email address
- Telephone number
- Postal Address
- Organisation, parish, diocese, school, or group name
- Booking and payment-related information (note: payment card details are processed securely by third-party payment providers and are not stored by CYMFed)
- Communication preferences
- Records of correspondence with us
- Website usage data (such as IP addresses, browser type, and pages visited)
- How We Use Your Personal Data
We use personal data for the following purposes:
- To administer event bookings, conferences, and gatherings
- To manage memberships or registrations
- To communication with group leaders, clergy, staff and volunteers
- To send service-related communications (e.g. booking confirmations, event updates)
- To send newsletters or other communications where you have opted in
- To improve our website and services
- To meet legal, regulatory, and safeguarding obligations
We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that another purpose is compatible with the original one.
- Lawful Basis for Processing
Under UK data protection law, we rely on the following lawful bases to process personal data:
- Consent: where you have given clear consent for us to process your data (e.g. subscribing to a newsletter)
- Contact: where processing is necessary to fulfil a booking, registration, or agreement with you
- Legal obligation: where we are required to process data to comply with the law
- Legitimate interests: where processing is necessary for our legitimate organisational purposes and does not override your rights and freedoms (e.g. basic administration and communication)
- Children’s Data
CYMFed does not knowingly collect or process personal data relating to children through its website or booking systems.
For events that involved children or young people, personal data relating to them is collected and processed by responsible adults (such as group leaders, parishes, dioceses or school). Those individuals and organisations are responsible for ensuring that appropriate consent and safeguards are in place.
If you believe that a child’s personal data has been provided to us in error, please contact us and we will take appropriate steps to remove it.
- How We Share Personal Data
We do not sell or rent personal data to third parties.
We may share personal data with trusted third-party service providers who act on our behalf, such as:
- Website hosting providers
- Email and newsletter platforms
- Event booking and ticketing systems
- Payment processing providers
These providers are only permitted to process personal data in accordance with our instructions and are required to keep it secure.
We may also disclose personal data where required by law or where necessary to protect the rights, property, or safety of CYMFed or others.
- International Data Transfers
Some of our service providers may store or process data outside of the UK. Where this occurs, we ensure appropriate safeguards are in place, such as adequacy regulations or standard contractual clauses, to protect your personal data.
- Data Retention
We will only keep personal data for as long as necessary for the purposes for which it was collected, including legal, accounting, and reporting requirements.
Typical retention periods include:
- Event and booking records: retained for up to 7 years for financial and legal purposes
- Membership and contact records: retained while the relationship remains active and reviewed periodically
- Marketing communications: retained until you withdraw consent or unsubscribe
- Website usage data: retained for a limited period for analytical purposes
- Data Security
We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorized access, disclosure, or alteration.
Access to personal data is limited to those who need it for legitimate purposes, and all data is stored securely.
- Your Rights
Under data protection law, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate or incomplete data
- Request erasure of your personal data in certain circumstances
- Request restriction of processing in certain circumstances
- Object to processing based on legitimate interests
- Withdraw consent at any time where processing is based on consent
- Request data portability where applicable
To exercise any of these rights, please contact us using the details in Section 2.
- Cookies and Website Analytics
Our website uses cookies and similar technologies to ensure it functions properly and to help us understand how visitors use the site.
You can control or disable cookies through your browser settings. Further information about the cookies we use is provided in our Cookie Notice.
- Complaints
If you have concerns about how we handle your personal data, please contact us in the first instance so we can seek to resolve the issue.
You also have the right to make a complaint to the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk
Telephone: 0303 123 1113
- Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in law or our practices. The most recent version will always be publish on our website.
Last updated: January 2026