Privacy

Prepared by: Company Secretary

Edition Date: August 2026

Review Date: August 2029
 

• View our privacy notice for Young Adults here
• View our privacy notice for Active Together Harrogate here
• View our privacy notice for the Stop Smoking Service

Yorkshire Cancer Research (the Charity) is committed to keeping your information secure and managing it in accordance with our legal responsibilities under privacy and data protection laws where we operate.

This Privacy Policy provides information about how we process your personal information in all contexts, whether or not you provide the information over our website.

By visiting our website, you agree to your personal information being used and disclosed in the manner set out in this Policy.

For the purposes of data protection law, Yorkshire Cancer Research is the controller of personal data which you provide when you interact with us.
 

1. The personal information that we collect

When you use www.yorkshirecancerresearch.org.uk certain limited information (such as your browser type and IP address) will be collected by us automatically.

We will also collect and store certain personal information when you make a donation through yorkshirecancerresearch.org.uk, by telephone, by post or in person (for example, at a community event), signing up to a Direct Debit programme, through an online fundraising platform (for example JustGiving, Virgin Money, etc.) or when donating through an individual’s social media fundraising campaign (for example, via Facebook). To enable us to process donations we will collect basic payment information. If you are eligible for UK Gift Aid, we may also ask you to confirm your UK home address.

You may also provide us with personal information if you complete a form on the Charity’s website, for example if you sign-up to volunteer at a Yorkshire Cancer Research event.

If you make a donation through our text message service (which is administered on our behalf by a third-party service provider), your donation will also be managed in accordance with this Policy. If you wish to claim UK Gift Aid on the donation, or leave a message of support, we will collect information about you as explained in this Policy.

If you apply for a job or volunteer role with the Charity, you will provide us with personal information on your application form and/or in your covering letter and CV. We will generate further personal information in the course of creating interview notes and running recruitment assessments. We may request references about your employment or volunteer history from the referees you provide. For some roles we may also require a basic criminal records check, through the Disclosure and Barring Service (DBS).

For job applicants, we will also provide a link to, or send, a detailed Job Application Privacy Notice providing further detail.

Personal information may also be collected by, and shared by us with, our local voluntary committees (see section 4).

We may also collect personal data from you if you volunteer to help in one of our high street shops.

We may contact you from time to time to ask you if you would be interested in sharing personal experiences you may have had in relation to cancer, or to provide comments on the work that we do. We would explain in further communications with you how that information would be used, and we treat all such information that our supporters share with sensitivity and care.

We will also collect personal information in connection with our funding of charitable research and other activity, in particular from our peer reviewers, Research Advisory Panel members, the administration staff of the universities or other institutions which we fund and/or with whom we work on research and services projects, and those who make an application for charitable, or are given an Award.

Your image may be recorded on CCTV when you visit one of our shops or offices. 

We may also create information about you through our analysis of your interactions with us. This may include supporter segments, profiles, scores and inferred information about your interests, preferences and likely engagement with our campaigns. We may combine information you have given us with appropriate information from publicly available sources, such as Companies House records, public social-media profiles, press reports and postcode-level demographic information.
 

2. How we use personal information

We use the personal information collected for a number of purposes:

• administering donations made (and claiming Gift Aid, if applicable).
• personalising our communications to fit personal preferences which you have told us about.
• providing fundraising related news stories, event information, campaign  updates  and other communications that further our charitable purposes by email or SMS or direct message, where you have consented or where the charitable soft opt-in applies.
• to provide you with newsletters, event information and other fundraising related news stories by post. We will do this on the basis of our legitimate interests, and you may opt out of postal communications at any time.
• in the delivery of our will-writing service.
• analysing our supporter base to improve the relevance and effectiveness of supporter interactions
• contacting you in connection with charitable funding opportunities, to give information about our charitable funding opportunities, any applications for charitable funding submitted to us, any Awards you may hold with us, or where you are involved in a peer review of any such applications.
• considering applications for recruitment, conducting recruitment interviews and assessments, and contacting employment referees.
• to help us prevent fraud or criminal activity associated with online payments.
• improving the service we offer – for example you may be asked to complete one of our online user satisfaction surveys, and
• in the delivery of our charitable research and services activities – for example, we will keep a record of your details if you hold an Award from us to undertake research; or an Award to provide services to patients; or you are an expert in cancer research or cancer services and have peer reviewed an Award proposal for us; or if you are a member of our Research Advisory Panel.

To protect our employees, volunteers, customers, premises, and assets from crime, we operate CCTV systems in our stores and outside our offices which may record images for security. Our CCTV systems do not use facial recognition, nor do they collect biometrics; they are also not connected to other systems containing personal data. We operate these systems on the basis of our legitimate interests.

In accordance with data protection law, we must have a lawful basis for each way in which we use your personal information. In the majority of cases, processing will be justified on the basis that:

You have consented to the processing (for example, where you consent to receive electronic marketing communications from us or to the use of non-essential cookies and similar technologies). You may withdraw your consent at any time, without affecting the lawfulness of processing carried before withdrawal.

The processing is necessary for the performance of a contract with you or in connection with steps preparatory to entering into a contract with you (for example, where you enter into a funding agreement with us in connection with research which the Charity is supporting).

The processing is necessary for us to comply with a relevant legal obligation (for example, the disclosure of certain information to HMRC, or the maintenance of proper records which charities are required to maintain); or

The processing is in our legitimate interests as a charity, provided these are not overridden by your interests, rights and freedoms. Examples of our legitimate interests include: to analyse the composition and demographics of our supporter base better to understand and serve those supporters (for example, with events which we think will appeal to our supporters); to improve the effectiveness of our fundraising and communications; to send you marketing materials and other personalised communications in the post; preventing fraud ; to contact you via electronic means for non-marketing related purposes (e.g. in relation to peer review of Awards we might make); or to work with our peer reviewers and Research Advisory Panel members to evaluate applications for research or services Awards.  Where we rely on legitimate interests for supporter profiling, electronic communications under the charitable purposes soft opt-in or audience matching, we assess whether the processing is necessary and balance our interests against your rights, interests and reasonable expectations.

Profiling, data analysis and targeted advertising

To help us fund vital cancer research and provide a positive experience for our supporters, we use profiling and data analysis techniques to better understand how people engage with Yorkshire Cancer Research and how they may wish to support us.
 

Propensity modelling and supporter profiling

We analyse information you have provided to us, such as donation history, event participation and previous interactions, together with information from publicly available sources, for example Companies House records, public social-media profiles, press reports or postcode-level demographic data.

This helps us to:

• tailor our fundraising communications so they are relevant and proportionate;
• invite supporters to opportunities that match their interests and circumstances; and
• avoid sending communications that are unlikely to be of interest.
   

Our aim is to steward supporters respectfully, reduce unnecessary or intrusive communications, and use charitable funds as effectively as possible.

We may use trusted third-party service providers to help with this analysis. Where they act as our processors, they act only on our instructions and are not permitted to use your personal information for their own purposes.
We do not intentionally use information about your health, cancer diagnosis, genetic information or other special-category personal information to profile you for fundraising or targeted advertising unless you have given explicit consent or another applicable legal condition permits the processing.
 

Targeted digital and social-media advertising

Profiling may also be used to support our supporter acquisition and awareness-raising activity, including targeted digital and social-media advertising.

Where appropriate, and where we have an appropriate lawful basis, we may securely share limited contact details, such as an email address, with digital advertising platforms so that:

• existing supporters can be included in, or excluded from, specific campaigns; and
• similar or 'lookalike' audiences can be created to help us reach new people who are more likely to have an interest in our work.

Before contact details are uploaded, they are converted into a hashed format. Hashing is a security measure that reduces the risk of the original details being read during the matching process, but the hashed information remains personal information where it can be matched to an individual's account.

The advertising platform carries out matching and audience creation under its applicable data protection terms. Depending on the service, the platform may act as our processor or we and the platform may each have responsibilities as controllers. We review the applicable terms before using these services and can provide further information about the platforms we use and our respective responsibilities on request.

We will not upload the details of people who have objected to direct marketing, or use their details to create similar audiences. You can also control how you see adverts on social-media platforms through your own account settings.
This approach helps us avoid broad, untargeted advertising and use charitable funds responsibly.

Automated processing and human oversight

Some profiling uses computer models or algorithms to identify patterns or likelihoods, for example which supporters may be more interested in a particular campaign. These tools are used to support decision-making, not replace it.
We do not make decisions about you that have a legal or similarly significant effect based solely on automated processing. Fundraising and engagement decisions always involve meaningful human review and judgement.

Your rights and choices

You have the right to:

• object at any time to direct marketing, including profiling related to direct marketing;
• access the personal information we hold about you and information about how it is used;
• ask for inaccurate information to be corrected or, in some circumstances, deleted; and
• ask us to restrict certain processing; and
• withdraw your consent where the processing is based on consent.
   

If you object to direct marketing, we will stop using your personal information for that purpose. We may retain limited information on a suppression list so that we continue to respect your wishes.
If you have any questions about how we use profiling, data analysis or targeted advertising, or if you wish to exercise your rights, please contact us using the details at the end of this notice.

3. Communications from us

Where you have given us your consent, we may send electronic marketing communications in various forms (for example, email or SMS), in accordance with the preferences you have expressed. If you are an existing donor or volunteer, we may from time to time send you marketing communications in the post or contact you by telephone. 

Electronic fundraising and charitable communications

In certain circumstances, we may also send electronic fundraising and charitable communications using the charitable purposes soft opt-in. This allows us to contact you without obtaining consent where all of the following conditions are met:

• we obtained your contact details directly from you on or after 1 September 2026;
• you provided those details when expressing an interest in, or offering or providing support for, our charitable purposes;
• the sole purpose of the communication is to further our own charitable purposes;
• we gave you a clear and simple opportunity to opt out when we collected your details; and
• we provide a simple opportunity to opt out in every subsequent communication.

We will not use the charitable purposes soft opt-in for contact details obtained from a third-party fundraising platform, another organisation or a trading subsidiary. We will not apply it retrospectively to contact details collected before 5 February 2026 unless you provide those details to us again in circumstances that meet all of the conditions above.

Where we use the charitable purposes soft opt-in, our data protection lawful basis is legitimate interests. We assess our interest in furthering our charitable purposes against your rights, interests and reasonable expectations, including whether a communication may be inappropriate because someone is in a vulnerable situation.

You can opt out at any time by using the unsubscribe option in the communication or by contacting us using the details below.
You have an absolute right to object at any time to our use of your personal information for direct marketing, including any profiling related to that marketing. If you object, we will stop using your personal information for those purposes. You can unsubscribe from receiving electronic or postal messages by following the “unsubscribe” instructions included in our communication. You can also contact us at any time on supportercare@ycr.org.uk or you can call us during business hours on 01423 501269 to opt-out of any or all forms of marketing communication.

Please note that even where you opt-out of marketing communications, we may still send you non-marketing communications (for example, event information relating to an event you have signed-up to, information about any ongoing donation you are making to the Charity or correspondence relating to a funding application you have made).

The accuracy of personal information is determined by the accuracy of the information you supply to us. If you have an ongoing relationship with the Charity (for example, you are a supporter, volunteer, Award holder or beneficiary of our charitable activity) we encourage you to notify us when there are changes in your personal details (for example of change of postal address or email address), so that we can keep our records up to date. In addition, we will proactively take steps to do this from time to time.

4. Providing information to others, including service providers

We work closely with a number of trusted business and charity partners with whom we need to share personal information to help us operate this website and manage our ongoing relationship with you. These include:

• banks and payment providers – to authorise and complete payment transactions;
• organisations within the payment card industry to help prevent online fraud;
• direct mail providers to print and post newsletters and other printed materials that we may send to you from time to time;
• law enforcement bodies in order to comply with any legal obligation or court order and, where we are otherwise requested to provide information, we provide it but only in accordance with applicable privacy and data protection laws;
• If we discover any criminal activity or alleged criminal activity through our use of CCTV, fraud monitoring and suspicious transaction monitoring, we may share this data with law enforcement bodies for the purposes of preventing or detecting unlawful acts;
• HM Revenue & Customs, but only if we need to authorise claims for Gift Aid or other forms of tax efficient ways of giving;
  organisations who provide the will-writing services accessed through our websites;
• in relation to our charitable funding activities, we may share personal data of applicants who make applications for charitable funding with external reviewers, who may be located outside the United Kingdom, to assess the suitability of any applications or proposals we receive; and
• organisations linked to our charitable activities such as the Association of Medical Research Charities (AMRC) and the National Cancer Research Institute (NCRI).
• profiling and analytics providers that help us understand supporter engagement and improve the relevance of our fundraising; and
• digital advertising and social-media platforms used for audience matching, campaign delivery and measurement. Depending on the service, these organisations may act as processors, independent controllers or joint controllers with us.
   

We may also provide information to third party service providers who process information on our behalf to help run some of our internal business operations including email and mail distribution, tax and financial management service providers, IT services and customer services, or in relation to this website, such as card payment providers. Where we use service providers, we will enter into appropriate contracts to ensure that we are able to exercise control over their access to, and use of, your personal information.

We will only share information with such organisations where (i) we have a legitimate reason to do so, which is related to one of the ways in which we use your information, as set out at section 2 above; or (ii) where a disclosure is required by law or covered by a relevant exemption from disclosure restrictions under data protection law.

We may also transfer personal information to our local voluntary committees, which help to organise fundraising events in local communities on behalf of the Charity.

We may share details of applications for charitable funding with other organisations, under these strict circumstances: 1) with another charity that may contribute funding; 2) with Cancer Alliances and Clinical Research Networks to discuss coordination of cancer research activities regionally and resourcing and support issues for conducting the work; 3) with relevant Research or Service organisations, including the AMRC, where it is either (a) in line with our charitable aims and related activities to do so or (b) we are required to do so (as part of any membership criteria for example).

We may disclose or share your personal information with these organisations where this is necessary to manage our relationship with our supporters, operate our website and services, carry out the activities described in this notice or comply with our legal obligations.

5. International transfers

Some of our service providers and group companies may be located in the UK, other countries in the European Economic Area or elsewhere in the world (for example our card payment provider in the United States). Different privacy laws may apply in these countries.

Where personal information is transferred outside the UK we will take steps to ensure that the information receives the same level of protection as if it remained within the UK, including by entering into data transfer agreements, using EU Commission or ICO approved Standard Contractual Clauses, or by relying on adequacy regulations or certification schemes that have been approved by the ICO. You have a right to be provided with details of the mechanism under which your data is transferred outside of the UK.

6. Keeping information secure

We take appropriate technical and organisational measures to protect your personal information from loss, misuse, unauthorised access, modification or disclosure. We regularly review these measures and require relevant service providers to protect personal information in accordance with applicable laws and their contractual obligations.

7. Keeping your records

If you are a supporter, donor or charitable funding Award holder we will keep certain personal information about you (such as your contact details and, where relevant, bank account details required to take donations) for as long as you remain a supporter, donor, Award holder or beneficiary of our charitable activity. We will also retain some personal information, such as your name, and a record of the fact that you were a supporter. This helps us to resolve any queries and complaints in the future.

The retention periods for some of the records we keep are set by legal requirements or regulatory recommended practice, for example, in the context of tax and accounting requirements that are relevant to your donations or gifts. We maintain a Data Retention Policy, which we apply to records in our care, which contains further detail on the principles explained in this Privacy Policy.

We retain records of successful research and services applications (Awards) for an extended period of time, governed by our Data Retention Policy in order to track and monitor impact of Awards as is expected by best practice in the research sector and, in order to deal with queries which may arise concerning the work we fund. We retain unsuccessful applications for a shorter period of time, as set out in our Data Retention Policy.
We retain supporter profiles, segments, scores and related analysis only for as long as they remain accurate and necessary for the purposes described in this notice. We review and refresh this information at appropriate intervals and delete or anonymise it when it is no longer required.

CCTV footage is deleted after 30 days unless there is an overriding reason to be retained.

Where your information is no longer required, we will ensure it is disposed of in a secure manner and, where required by applicable law, we will notify you when such information has been disposed of.

8. Analytics

We collect, assess, store and analyse information regarding how you use our website and electronic communications, the pages you visit and time spent on each page. This information is used for statistical analysis and helps us to improve the website  and to understand engagement with our communications. This analysis may influence the content and advertising that you see.

Our electronic communications may use technologies such as tracking pixels to record information such as whether a message was opened, the time it was opened and information about the device used. Where these technologies store information on, or access information from, your device, we obtain consent unless an applicable exemption permits their use. You can withdraw consent through the controls we make available.

These tools may be provided by third-party service providers and may include the collection and tracking of certain data and information regarding the characteristics and activities of visitors to our website. We may disclose data, including personal information, to certain such third-party services providers in order to obtain such services.

One of these providers is Google Analytics and more information about the ways in which they collect and process your personal data can be found here:

https://policies.google.com/technologies/partner-sites?hl=en-GB&gl=uk

If you use buttons on our website linked to social media or similar sites (for example “Like” and/or “Share” buttons), content from our website may be sent back to that other website and, depending on your privacy settings, may be privately or publicly visible (for example to friends, followers or generally to anyone who has access to your profile page).

You may request further details on these other tools and third parties from us.

9. Cookies

Our website uses cookies (which includes third party cookies to support social media, personalisation and analytics functionality).
Cookies and similar technologies are small files, identifiers or code placed on or accessed from your . Some of the information they collect, such as cookie identifiers, IP addresses, device information and browsing activity, may identify you directly or indirectly.

We use strictly necessary technologies where required to operate our website.

We use non-essential technologies, including those used for analytics, personalisation and advertising, only where you have given consent. You can change or withdraw your choices using our cookie controls. However, if you choose to block or delete cookies, this may affect the functionality of the website when you use it.

For more information, please refer to our separate cookie policy: https://yorkshirecancerresearch.org.uk/cookie-policy/

10. Personal information rights

Subject to certain conditions and exemptions, you have the right to:

• obtain a copy of your personal information together with information about how and on what basis that personal information is processed.
• rectify inaccurate personal information (including the right to have incomplete personal information completed).
• erase your personal information (in limited circumstances, where it is no longer necessary in relation to the purposes for which it was collected or processed).
• restrict processing of your personal information where:
  • the accuracy of the personal information is contested;
  • the processing is unlawful but you object to the erasure of the personal information; or
  • we no longer require the personal information, but it is still required for the establishment, exercise or defence of a legal claim.
• object to  processing which we have justified on the basis of a legitimate interest.  We will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. This balancing test does not apply to direct marketing;
• object at any time to direct marketing, including profiling related to direct marketing. This right is absolute and, if you object, we will stop using your personal information for those purposes (please see section 3 above);
• withdraw your consent to our processing of your personal information (where that processing is based on your consent);
• not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects, except where the law permits it and appropriate safeguards apply; and
• obtain, or see a copy of the appropriate safeguards under which your personal information is transferred to a third country or international organisation.

In addition to the above, you have the right to lodge a complaint with the supervisory authority. In the UK this is the Information Commissioner.

If you wish to exercise any of these rights or have any question in relation to these rights, please email or write to us using the details below. We may ask for information needed to confirm your identity. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, as permitted by law.. We will endeavour to respond to your requests within all applicable legal timeframes.

In certain circumstances (for example where required or permitted by law) we might not be able to comply with a request (for example, where we consider that the conditions required to exercise the request have not been satisfied, or where a relevant exemption applies), but where appropriate we will notify you of the reasons for this.

11. Complaints Process

If you have a complaint about how we have handled your personal information, you may contact us using the details in section 14 below and we will investigate your complaint.

12. Third Party Websites

If you land on our website from other websites (or move to other sites from our website) you should read their separate privacy policies. We are not responsible for the privacy practices of external websites.

13. Updates

We keep this Policy under regular review and place updates on yorkshirecancerresearch.org.uk from time to time. Please review this Policy periodically for changes.

However, we will always notify you of material changes we make to this Policy and, where required under applicable privacy and data protection legislation, we will appropriately notify or give you the option to consent to changes to the Policy.

If you do not accept our Policy, please stop using our website and/or cease any further interaction with us.

14. Contact

If you have any questions about this Policy or would like to exercise your rights with respect to your personal information, please contact us via supportercare@ycr.org.uk, via telephone on 01423 501269 or write to the Company Secretary, Yorkshire Cancer Research, Hornbeam Square West, Harrogate, HG2 8PA.
 

Requesting the deletion of personal data following participation in an event through Meta

As referenced in section 2, if you have taken part or registered for a charity event using Funraisin (such as We Walk for Yorkshire) and would like your personal information held by the charity to be deleted, please contact us through the methods referenced in section 14.