Donate

Privacy Policy

Next

This Policy applies to personal information processed by Worldwide Cancer Research. The sections below tell you about what personal information we collect, the way we collect, store and use personal information and why, your rights under data protection law, how you can request to see your information, and what to do if you have any concerns about our management of personal information. 

Our use of data for recruitment and for research funding are dealt with in more detail in separate notices. 

Recruitment privacy notice
Research funding privacy notice

Worldwide Cancer Research is a UK registered charity, No SC022918, based at:

Worldwide Cancer Research,
Third Floor South,
121 George Street,
Edinburgh
EH2 4YN

If you have any questions or concerns about how we use personal data, or anything written in this policy, please contact us at the address above or email [email protected] or call us on (0)300 777 7910.

What personal information do we collect?

Personal information is any information that can be used to identify you. We routinely collect, use and store the following types of personal information:

  • your name and contact details (postal address, email address and telephone number) 
  • your date of birth 
  • financial information you provide where you make a payment or as part of research grant award, such as bank details or credit/debit card details, although we don't store credit or debit card details (see Management of financial payments below) 
  • information as to whether you are a UK taxpayer so we can claim gift aid 
  • where you have left us a gift in your Will, any information regarding next of kin with which you may have provided us to administer this 
  • your interactions with Worldwide Cancer Research. This could include your donation history; your responses to our communications; information you’ve shared with us about why you have supported us; events, meetings and fundraising activities you’ve taken part in or shown an interest in 

  • consent for us to contact you on your preferred channels 

 

Special Category Personal Data 

Certain types of personal information are in a special category under data protection law, as they are considered sensitive. Examples of this type of sensitive data are information about health, race, religious beliefs, political views, sexuality, or genetic/biometric information. 

We do not ask you for sensitive personal data unless there is a clear reason for us to do so. However, we may need to ask for information about your health, for example, if you are participating in an event. You may also wish to share information about your health if you decide to speak out about your experience of cancer or otherwise make information public. If you do, we will always treat it sensitively and ask you for explicit consent to use this information in the form of case studies or interviews. 

How do we collect your personal information? 

Information you give us: Most of the personal information we process is given to us directly by you when you enquire, donate, sign-up, or apply to us with your details.  If you call us, we also record and store phone calls for training and monitoring purposes – please refer to our Call Recording Policy.

Information from known third parties and social media: We may receive your personal information from third parties where you have given permission for them to share it with us or where you have directly chosen to provide your information through those services. For example, from fundraising websites such as Just Giving, event partners, and Free Will service providers, or through digital platforms and social media services where you request information from us, sign up to hear from us, register interest in a service or campaign, or download resources such as guides or information booklets. 

This may include information collected through forms or similar tools provided by platforms such as Meta, Google, LinkedIn, or other digital advertising and social media providers. You should check any privacy policy provided to you when you give your data to a third party. 

When you engage with us via social media platforms we may receive personal information about you. For example, if you tag us in an event photograph or interact with our content. The information we receive will depend on the privacy preferences you have set on those types of platforms. 

Information from the use of our website and services: In line with the cookies consent preferences you select on our website, we may use pixels, cookies or similar technologies to understand how our visitors use our website, improve advertising effectiveness, and show relevant adverts to people who have previously interacted with our website or digital content.

More information can be found in our Cookies Policy. This data collected includes:

  • Geographical location, the type of device you’re using, the IP address, and the browser and operating system being used, to improve the services we offer and make them as user friendly as possible by blocking disruptive use and personalising the way our information is presented to you. We utilise performance and security services to help protect our website using Cloudflare and Google reCAPTCHA. They may process IP addresses, device and browser information, and website traffic data to determine whether a user is human or poses a security risk, to protect our website and users from automated abuse. We also use a data validation tool provided through a third party, Data8, to check the validity of addresses, email addresses and phone numbers submitted through our website. 
  • Analytical and behavioural information about your visit to our website to see how you use our website, for example pages you visit and how you navigate the website, i.e. length of visits to certain pages, products and services you viewed and searched for, and referral sources (e.g. how you arrived at our website).  

 

Publicly available information: In some cases we supplement information on our audience with data from publicly available sources such as charity websites and annual reviews, corporate websites, public social media accounts, the electoral register, YouGov, and Companies House in order to create a fuller understanding of individuals or groups of individuals and how best they can support Worldwide Cancer Research. Please see Making our communications relevant to you and Major Donors below for more information.

We also use public information for the purposes of identifying suitable experts to review research grant applications or to join our Scientific Advisory Committee. Please refer to our Research Funding Privacy Notice for more information.

How do we use your personal information? 

We use your personal information for a number of purposes including the following: 

Management of Financial Payments: To process donations made online using your credit or debit card, using specialist payment processors. 

If you provide your card details to donate by phone, only staff who are authorised and trained to process payments will process your card details. We never store your credit or debit card details following the completion of your transaction or on call recordings. All card details and validation codes are securely destroyed once the payment or donation has been processed. 

We ensure that card details are handled securely under Payment Card Industry (PCI) Data Security Standards. 

Allocation of Research Grants: To administrate grant awards for legal, personnel, administrative and management purposes including the payment of grant expenses in accordance with our application handling procedures and our Terms & Conditions of Award. Please refer to our Research Funding Privacy Notice for more information.

Administrative Purposes: To contact you regarding a donation you have made or an event you have registered for. We may use your personal information for the purposes of record keeping of enquiries, feedback, complaints, and fraud prevention. We take reasonable steps to ensure your information is accurate and up to date. Where possible we use publicly available reputable sources to identify deceased records or whether you have changed address. We occasionally use WhatsApp messages to contact supporters and invite event participants into groups to prepare for events. Membership of these groups is entirely optional. 

Management of Volunteers: To record your volunteering activity, training delivery and to update you on our projects, campaigns and activity, as well as ensuring your safety. 

Fundraising and Marketing activities: To raise funds and awareness of our charity. For this, we use a range of channels including phone, email, letters, face-to-face activity, digital, print, broadcast advertising and prize draws. 

We will always respect your choice to not receive marketing communications. We seek your consent to send you marketing by email or text. You can choose to opt out of receiving marketing communications at any time by clicking on the relevant unsubscribe link at the bottom of marketing communications you receive from us or by contacting us. We will send you marketing by post unless you have told us you don’t want to receive this. 

Please note that if you have indicated that you do not wish to be contacted by us for marketing purposes, we will retain your details on a 'do not contact' list to help ensure that we do not contact you accidentally in the future. However, we may still need to communicate with you for administrative purposes like where we are processing a donation or thanking you for your participation in an event.  

Advertising: To help us reach potential new supporters and communicate with our existing ones we use digital advertising tools such as Custom and Lookalike Audiences. 

This may involve using limited personal data we already hold in our supporter database, such as your email address, postcode area, donation or engagement history, with trusted advertising and analytical partners, including Meta (Facebook and Instagram), Google, LinkedIn, TikTok, Microsoft, Reddit, and other digital advertising providers. 

Personal data used for advertising audience matching is shared using appropriate security and privacy safeguards. This may include techniques such as hashing (converting data into a coded format), encrypted transfer methods, or other privacy-protective measures used by advertising platforms. The platform uses this information to match individuals to profiles for audience creations, measurement, suppression, or advertising purposes in accordance with its own privacy policies. 

We use this process for several purposes, including: 

  • Finding new supporters: to create ‘lookalike’ or ‘similar’ audiences of people who share similar interests or characteristics to our current supporters 
  • Excluding existing supporters: so you do not see advertising that may not be relevant to you, for example donor recruitment adverts if you already donate regularly 
  • Reaching existing supporters: to share updates about our work, the impact of donations, or new ways to get involved 
  • Retargeting and re-engagement: to show relevant advertising to people who have previously visited our website, interacted with our adverts, opened emails, or engaged with our content 
  • Advertising measurement and optimisation: to help us understand the effectiveness of our advertising and improve future campaigns 

 

Market Research: To help us deliver our charitable objectives we may conduct research into the needs and behaviours of our audience. We may invite potential participants from our existing network to take part in surveys, focus groups and telephone interviews. We will always seek your consent when collecting any potentially sensitive personal information or when we wish to further use your data for a different purpose. 

Making our communications relevant to you: To understand our audience better we analyse data from our database. We do this to understand more about your interests and preferences so that we can tailor our communications and enhance your experience of supporting us. The process allows us to tell you about the things you are likely to be interested in, to let you know of ways to fundraise that are relevant to you, and to make sure that we only talk to you about ways of giving that are appropriate to you.

We may use external data sources, such as Experian Mosaic, to create supporter groups within our database. This data is based on postcode or broad demographic information and we will, where appropriate, store this information on your record. Using statistics and analysis from trusted third-party companies helps us to improve our fundraising by identifying new audiences, deciding who to send our communications to, and ensuring the communications you receive are relevant to you. Data analysis of our audience also allows us to be more efficient and cost-effective with our resources. 

Major Donors: To enhance the data we hold about individuals and to understand our audience’s potential to give a Major Gift of £5,000 or more to Worldwide Cancer Research, we may use information you have given us and publicly available sources of information. We undertake in-house research and engage other organisations such as Milestone Research or Factary to help us identify people who may have the capacity to give a major gift. This includes getting a better view of your capacity to make a donation using public records such as the electoral roll, land records, ‘rich lists’, Who’s Who publications, Companies House records, and demographic data including estimated income and property value. We may also collect information on your interests in supporting research, for example your career, board memberships, articles about you in newspapers or magazines, date and size of previous donations to other charities, and details of philanthropic activities you engage in. We use this information to identify who we think could give a major gift, and to approach you about how you might accelerate our search for new cures so that one day, no life is cut short by cancer.  

You can opt out of this research profiling activity at any time by contacting us at [email protected] 

Our Legal basis for processing your information 

We are required to have a lawful basis for processing your personal data in the ways that we have outlined in this Policy. 

This means that we will only collect and use your data if: 

  • You have given us consent or 
  • We have formed a contractual relationship or are taking steps to enter a contractual relationship or 
  • We have a legal obligation to process information or 
  • It is necessary to protect the vital interests of an individual or 
  • It is within Worldwide Cancer Research's legitimate interests to do so. 

Consent 

In some instances, we rely on obtaining your specific consent to use your personal information in a certain way, for example, asking for your consent  to send you direct marketing information by email or to use an experience of cancer you have shared with us.  
When you have given your consent for email marketing, we will consider your consent to be valid on an ongoing basis until any time when you choose to withdraw your consent. All marketing emails contain the option to unsubscribe from future emails. 

You have the right to withdraw consent for any future use of your information for this purpose at any time. See Contact Information below for details on how to do this. 

Contractual Relationship 

We have a legal basis to use your personal information where we are entering into, or considering entering into, a contract with you or performing our obligations under that contract. For example, if you apply to work for us or apply for a grant from us to undertake research. 

Legal Obligation 

We may need to collect, process and disclose personal information to comply with a legal obligation. For example, we are legally required to hold donor transaction details for Gift Aid or accounting and tax purposes. In some cases, we may need to share your information with regulators such as the Gambling Commission. 

Vital Interests 

Processing personal information may be necessary to protect life or health, for example in the case of medical emergency suffered by an individual at one of our events, or a safeguarding issue which requires us to share your information with the emergency services. 

Legitimate Interests 

When we are using our legitimate interests to process your personal information we have considered any potential impact on you, including how intrusive you may find it, and determined that balance is in favour of using the information for our charitable objectives. 

We consider our legitimate interests to be running Worldwide Cancer Research as a charitable organisation. For example, to: 

  • administer and record details of our audience and for general enquiries 
  • facilitate the peer review of grant applications 
  • perform analysis and segmentation of our grant application and award information to help inform our Research Strategy, and monitor and improve our effectiveness 
  • conduct research to better understand our audience, including their capacity to give, and to improve the relevance of our marketing and fundraising activities 
  • invite our audience to take part in market research to improve our fundraising activity 
  • use third party sources to update your address when you move 
  • send you postal communications which we think may be of interest to you 
  • better understand how people interact with our website 
  • record calls made to and by our Supporter Care Team for training and monitoring purposes 
  • take and use photos or films of event participants and attendees 
  • promote Worldwide Cancer Research on social media and other online platforms 

Special Category Data 

Please note that when we process special category information about you we require an additional legal basis under data protection law. In the majority of circumstances we will ask you for your explicit consent to process this type of information unless we are required to process the information under another legal basis, for example to comply with a legal obligation or to protect your vital interests. We may also process special category personal data which you yourself have deliberately chosen to make public.

Your Rights

Data protection law gives you specific rights that help you be in control of your personal data and we want to make it easy for you to exercise these rights. Below you will find more information about the rights available to you. You can exercise any of your rights in relation to the data that we hold about you by contacting us. 

Please note that exemptions apply to a number of these rights, and not all rights will be applicable in all circumstances. For more details we recommend you consult the guidance published by the UK’s Information Commissioner’s Office (ICO).

Right to be Informed

You have the right to be told how your personal information will be used. This privacy policy is intended to provide you with a clear and transparent description of how your personal information is used. 

Right of Access

You are entitled to know whether we hold your personal information and if so, receive a copy of your data. For the protection of your information, we may need to verify your identity. 

If you submit a request on behalf of another person, we will need to ensure that this person has authorised you to make this request and receive their data. When we have confirmed your identity we will respond to your request within 1 month. 

Right of Erasure

You may ask us to delete some or all of your personal information from our records. There are certain circumstances in which we may be exempt from fulfilling your request, for example to comply with a legal obligation or if we have an overriding legitimate reason for holding your information. In some cases, we will anonymise or suppress the information, rather than delete it. For example, if you request to be deleted from our database to prevent further communications then we will suppress your details so we will not accidently contact you in the future.

Right of Rectification

If you believe our records are inaccurate or incomplete you have the right to ask for those records concerning your information to be updated.

Right to Restriction

In certain situations you have the right to ask for processing of your personal data to be restricted if there is disagreement about its accuracy or you believe your privacy rights outweigh our legitimate interests to use your information for a particular purpose and you have objected to us doing so.

Right to Object

You have the right to stop the processing of your personal data for direct marketing or profiling purposes, or for other legitimate interests of the charity for which we are unable to demonstrate a compelling reason to continue processing.

Right to Data Portability

If we are processing your personal information based on your consent, or in order to enter into or carry out a contract with you, and the processing is being done by automated means, you may ask us to provide it to you or another service provider in a machine-readable format. 

Rights related to Automated Decision-Making and Profiling

The law requires us to give you specific information about any automated decision-making and profiling where processing of your personal data and the decisions involved in that processing are made by automated means without human involvement. We have no solely automated decision-making systems or processes. Our use of profiling, which does not use automated processing and does not have significant effects for individuals, is described in this policy under ‘Making our communications relevant to you’.  

How do we protect your personal information?

Under data protection law, we have a responsibility to protect any personal information we process about you. The ways we do this include: 

  • Using encryption when collecting or transferring sensitive information, such as credit card details;

  • Having in place technical and organisational measures designed to ensure the ongoing integrity, availability and resilience of processing systems and services; 

  • Limiting physical access to our premises; 

  • Limiting access to the information we collect about you; 

  • Ensuring that we and our contracted business partners have appropriate security safeguards to keep personal information secure 

How long do we keep your personal information?

Legal and operational requirements determine how long we retain your information. For example, we are required to hold some types of information to fulfil our statutory obligations under health and safety or tax law, and other data to meet contractual obligations for our research funding grants. 

We keep your information for no longer than is necessary for the purposes it was collected for. We have a data retention policy that sets out the different periods we retain personal information for in respect of these relevant purposes. 

In general, we will keep records of financial donors for seven years, to meet our requirements for any financial or Gift Aid audit from HMRC. 

Personal information that we no longer need is securely disposed of or anonymised so individuals can no longer be identified.  

Who is your personal data shared with?

We will never sell your information to third parties or share your information with another organisation for its own marketing purposes. In some cases we transfer your information to third-party agents and service providers who are contracted by Worldwide Cancer Research, to fulfil specific business purposes of the charity. 

We work with specialist third party service providers to help us run our organisation more efficiently. This includes providers of: telephone fundraising, marketing services, response handling, lottery processing, print and production, database (CRM) system, wealth research and profiling, payment services, online grant system, grants payment processing and  specialist intellectual property advice. For example, our payment service providers include Stripe and PayPal. 

Other than these third-party service providers who are contracted to us, your information will not be disclosed to outside organisations unless we are required to do so by law, for example if you choose to Gift Aid a donation then we are required to send your name and address details to HMRC in order to make a Gift Aid claim. 

International data transfers and processing

In certain instances, we use service providers who transfer your information to countries outside of the UK. For these international transfers of data, we take steps to make sure that adequate safeguards are in place to protect your personal information and privacy rights. 

  • We will only transfer your personal data to countries that have been found to provide an adequate level of protection for personal data. Countries within the European Economic Area (EEA) are approved as having this adequate level of protection for data. 

  • We may also use specific approved contracts with our service providers that are based in countries outside the EEA. These contracts give your personal data the same protection it has in the EEA. 

 

Please refer to the Research Funding Privacy Notice for further specific information on international transfers during the peer review process for applications. 

Contact Us

You have the right to complain about how we use your personal information. If you have any questions or concerns about how your data is processed, please get in touch so we can help resolve any issues. Please contact us at [email protected] or write to us at: 

Worldwide Cancer Research,
Third Floor South,
121 George Street,
Edinburgh
EH2 4YN

Data protection complaints will be handled in line with our main Complaints Policy. 

You also have the right to complain about how we use your personal information to the Information Commissioner’s Office (ICO), particularly if you are unhappy with our handling of a data protection complaint. You can find details on how to complain on the ICO website.

If you’d like to control the frequency or the nature of fundraising and marketing communications you receive, you can contact on (0)300 777 7910 or by email at [email protected] 

Updates to this Privacy Policy 

Our Policy is a dynamic tool and we update it when there is a change to the ways we process your data to ensure that the information we provide to you is up to date and in accordance with the relevant data protection laws. Any new version of this Policy will be published on our website. It was last updated in June 2026.