LJWB
Privacy Policy
Privacy Notice
Applicable to all LJWB & subsidiary services
Last reviewed: May 2026
1. Introduction
This is Leeds Jewish Welfare Board’s Privacy Notice. As a subsidiary of LJWB, this policy and any reference therein also applies to the Leeds Kosher Kitchen CIC.
As part of the services we offer, we are required to process personal data. We are committed to being transparent about why we need your personal data and what we do with it. This Privacy Notice explains how we hold and process your personal information. It also explains your rights when it comes to your data.
We are what is known as a data controller. This means we have control over how your details are used and what we do with this information.
Contact details
Leeds Jewish Welfare Board (LJWB)
Marjorie & Arnold Ziff Community Centre
311 Stonegate Road
Leeds
LS17 6AZ
Contact channels
Email: hello@ljwb.co.uk
Telephone: 0113 268 4211
Website: www.ljwb.co.uk
2. About the information we collect
By law, we need to have a lawful basis for processing your personal data. Under UK General Data Protection Regulation (UK GDPR), the lawful bases we can rely on for processing this information are:
- Your consent
- We have a contractual obligation
- We have a legal obligation
- We have a vital interest
- We need it to perform a public task
- We have a legitimate interest
Special category data is personal data that needs more protection because it is sensitive. The UK GDPR defines special category data as:
- personal data revealing racial or ethnic origin
- personal data revealing religious or philosophical beliefs
- personal data revealing political opinions
- personal data revealing trade union membership
- data concerning health
- data concerning a person’s sex life or sexual orientation
- genetic data
- biometric data (where used for identification purposes)
Additional legal conditions are in place for processing special category data.
Most of the personal information we process is provided to us directly by you for one of the following reasons:
Service users, residents, clients and customers
| What type of data do we have? | Why do we have this data? | Where do we process your data? |
|---|---|---|
| Basic details and contact information e.g. name, address, date of birth, next of kin. Financial details e.g. details of how you pay us for care or your funding arrangements. Images e.g. photos, videos. Special category data: Information about your religion, race and ethnicity, or sexual orientation. | To provide high-quality and appropriate care, support, and services. To assist in assessment of eligible funding. To ensure the safety and reduce the vulnerability of you, your family or other members of the community. To manage and administer activities and events. To comply with regulatory and legal obligations, such as reporting to Care Quality Commission and the local authority. To investigate and respond to any complaints. To support marketing or fundraising activities. | This is collected from or shared with:
We do this face to face, or via phone, email, post, website, video conferencing, or application forms. We will only permit the use of pre-authorised, fully encrypted, secure and approved apps for communication. |
We process your data because:
- We have a legal obligation to process your data, generally under the Health and Social Care Act 2012 or Mental Capacity Act 2005.
- We process special category data because it is necessary for us to provide and manage our services; we are required to provide data to our regulator; and it is necessary for us due to social protection law (e.g. safeguarding).
- We have a legitimate interest in marketing our services and showcasing our community centre.
- We may also process your data with consent. If we need to ask for your permission, we will explain clearly what we need the data for and how you can withdraw consent at any time. We will offer you a clear choice and ask that you confirm to us that you consent.
Relatives or friends
| What type of data do we have? | Why do we have this data? | Where do we process your data? |
|---|---|---|
| Basic details and contact information e.g. name, address. | To provide high-quality and appropriate care, support, and services. | This is collected from or shared with:
We do this face to face, or via phone, email, post, website, video conferencing, or application forms. We will only permit the use of pre-authorised, fully encrypted, secure and approved apps for communication. |
We process your data because:
- We have a legitimate business interest in holding next of kin and lasting power of attorney information about the individuals who use our service and keeping emergency contact details for our staff and volunteers.
- We may also process your data with consent. If we need to ask for your permission, we will explain clearly what we need the data for and how you can withdraw consent at any time. We will offer you a clear choice and ask that you confirm to us that you consent.
Supporters, funders and donors
| What type of data do we have? | Why do we have this data? | Where do we process your data? |
|---|---|---|
| Basic details and contact information e.g. name, address, email, phone number. Financial information e.g. bank account details; whether you are a UK taxpayer. Historic donations including donations to the charity shop. | To administer donations and grants. To enable us to claim gift aid on your donation or take regular payments with your consent e.g. direct debit. To inform you of our work and invite you to activities or events. In limited circumstances, to inform you of work of our partners. To ask for your support. Recording pledges of future support. | This is collected from or shared with:
We do this face to face, or via phone, email, post, website, video conferencing, or donation forms. We will only permit the use of pre-authorised, fully encrypted, secure and approved apps for communication. |
We process your data because:
- We have a legitimate business interest in holding contact and financial details to process donations and claim gift aid.
- We may also process your data with consent. If we need to ask for your permission, we will explain clearly what we need the data for and how you can withdraw consent at any time. We will offer you a clear choice and ask that you confirm to us that you consent. You may opt out of receiving any marketing communication at any time by sending an email to GDPR@ljwb.co.uk or contacting us at the details above.
Staff and volunteers
| What type of data do we have? | Why do we have this data? | Where do we process your data? |
|---|---|---|
| Basic details and contact information e.g. name, address, date of birth, sex, National Insurance number, right to work documentation, emergency contact details. Employment or volunteering history e.g. hours of work, holidays. Confidential references. Financial details e.g. bank, insurance, pension, tax details. Qualifications or training records. Images e.g. ID photo, CCTV. Evidence of a Disclosure and Barring Service (DBS) check. Special category data: Information about your religion, race and ethnicity, trade union membership or sexual orientation, with your permission. | To provide a safe and professional service. To process applications for employment or volunteering. To support you in your work. To pay you. To provide you with updates on our work and further opportunities. For statistical purposes such as equal opportunities monitoring. | This is collected from or shared with:
We do this face to face, or via phone, email, post, website, video conferencing, or application forms. We will only permit the use of pre-authorised, fully encrypted, secure and approved apps for communication. |
We process your data because:
- We have a legal obligation under UK employment law.
- We have a legitimate interest e.g. where relevant we provide data about your training in order to claim training funding repayments.
- We are required to provide data to our regulator, the Care Quality Commission (CQC), as part of our public interest obligations and local authority funders and safeguarding boards.
- We process special category data because it is necessary for us to process requests for sick pay or maternity pay, or to make reasonable adjustments in the workplace.
- If we request your criminal records data, it is because we have a legal obligation to do this due to the type of work you do. This is set out in the Data Protection Act 2018 and the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975. We do not keep a record of your criminal records information (if any). We do record that we have checked this.
- We may also process your data with consent. If we need to ask for your permission, we will explain clearly what we need the data for and how you can withdraw consent at any time. We will offer you a clear choice and ask that you confirm to us that you consent.
Suppliers and contractors
| What type of data do we have? | Why do we have this data? | Where do we process your data? |
|---|---|---|
| Basic details and contact information e.g. contact name, business name, address. Financial details e.g. payment information, insurance, going concern information. Qualifications, certifications you may hold, and memberships e.g. CHAS. Contract details. | To contact you to talk about our business needs. To pay you for any goods and services received. To enable specialist work to be undertaken and evidence ability to do so. | This is collected from or shared with:
We will only permit the use of pre-authorised, fully encrypted, secure and approved apps for communication. |
We process your data because:
- We have a legal or contractual obligation to pay you for goods or services received.
- We have a legitimate business interest to talk to you about your goods or services and your experience in providing these.
If we wish to use your personal data for a new purpose which is different from the original purpose for which you gave your data to us, we will provide you with an additional privacy notice to explain the new use prior to commencing the processing.
If you are aged 16 or under
For children under the age of 16, consent from parents or legal guardian is needed before personal data is processed. Children aged 16 or under must get permission from parents or legal guardian before any personal data is shared on the LJWB website.
Our website and cookies
In order to provide you with the best experience while using our website, we process some data about you. We use cookies to provide you with a better browsing experience and keep track of visitor browsing patterns. We do not use cookies to identify you as an individual.
The cookie setting on our website is set to “allow cookies”. When you first access our website and periodically thereafter, you will be asked for consent to our use of cookies.
If you do not wish to allow the use of cookies, you can disable them through your browser settings. Please note that if you disable cookies, our website may not function properly.
CCTV and images
CCTV data is processed in accordance with the Surveillance Camera Code of Practice and in line with our CCTV Policy.
View the Surveillance Camera Code of Practice
We occasionally capture images of our services for marketing and fundraising purposes, such as sharing videos of our events on social media or photographs in the local press. Further details of when images are being captured is available at our community centre reception or by speaking to the service manager.
National data opt-out
At this time, we do not share any data for planning or research purposes for which the national data opt-out would apply. We review all of the confidential client information we process on an annual basis to see if this is used for research and planning purposes. If it is, then individuals can decide to stop their information being shared for this purpose.
Find out more about the national data opt-out
3. How we store your personal information
Your information is securely stored. Personal data may be held in electronic form (for example, emails, databases, spreadsheets, CCTV) or in physical filing systems.
We collect personal details from you for different reasons and so we might keep it for different lengths of time. Our Data Retention, Archiving and Destruction Policy states how we keep and dispose of personal information and the time period we keep your information.
4. Your data protection rights
Under data protection law, you have rights including:
- Your right of access
You have the right to ask us for copies of your personal information. - Your right to rectification
You have the right to ask us to rectify personal information you think is inaccurate or incomplete. You can also request that we restrict all processing of your data while we consider your rectification request. - Your right to erasure
You have the right to ask us to erase your personal information in certain circumstances. We retain our data in line with our Data Retention, Archiving and Destruction Policy which follows the Records Management Code of Practice 2021.
View the Records Management Code of Practice 2021 - Your right to restriction of processing
You have the right to ask us to restrict the processing of your personal information in certain circumstances. - Your right to object to processing
You have the right to object to the processing of your personal information in certain circumstances. - Your right to data portability
You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one calendar month to respond to you. You will need to provide adequate information for our staff to be able to identify you, for example, a current passport or driver’s licence and clear guidance regarding the information you wish to access. This is to make sure that data is not shared with the wrong person inappropriately and we are able to deal with your request in a timely manner.
5. Caldicott Guardian Responsibilities
Leeds Jewish Welfare Board (LJWB) has appointed a Caldicott Guardian to oversee the protection, ethical use, and appropriate sharing of confidential personal information, particularly health and social care data. The Caldicott Guardian acts as the organisation’s “conscience” for information governance and ensures that the Caldicott Principles are upheld across all LJWB services.
The Caldicott Guardian is responsible for:
- Ensuring that all uses of confidential information comply with the Caldicott Principles, including justifying the purpose for using confidential data and ensuring the minimum necessary information is used.
- Providing expert advice on the lawful and ethical use of confidential information, especially where information sharing decisions are complex or sensitive.
- Reviewing and approving information-sharing agreements with partner organisations such as the NHS, local authorities, and safeguarding bodies.
- Overseeing internal processes for handling confidential information, including access controls, staff training, incident reporting, and confidentiality procedures.
- Supporting staff and volunteers by offering guidance on confidentiality, information governance, and best practice.
- Acting as a point of escalation for concerns about the use or disclosure of confidential information.
- Working closely with the Data Protection Officer (DPO) to ensure alignment between Caldicott requirements and UK GDPR obligations.
Contact details for the Caldicott Guardian can be obtained by contacting GDPR@ljwb.co.uk.
6. How to contact us
Please contact us if you have any questions or concerns about the information we hold about you:
Governance and GDPR
Leeds Jewish Welfare Board
Marjorie and Arnold Ziff Community Centre
311 Stonegate Road
Leeds
LS17 6AZ
Contact channels
Email: GDPR@ljwb.co.uk
Telephone: 0113 268 4211
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. We would, however, like to have the opportunity to deal with your concerns before you approach the ICO, so please do contact us in the first instance.
The ICO’s contact details
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
ICO contact channels
Helpline number: 0303 123 1113
ICO website: www.ico.org.uk
Leeds Jewish Welfare Board is a data controller registered with the ICO, reference: ZA005264.
The Caldicott Guardian can be contacted at GDPR@ljwb.co.uk and the Caldicott Guardian Register can be found at: digital.nhs.uk/services/organisation-data-service/view-or-update-registers#caldicott-guardian
7. Changes to our privacy notice
We regularly review our privacy notice. This was last reviewed in May 2026.
This webpage version has been formatted from the original PDF for improved readability on screen and use within Elementor.
Please find PDF version here
- Introduction
This is Leeds Jewish Welfare Board’s Privacy Notice. As a subsidiary of LJWB this policy and any reference therein also applies to the Leeds Kosher Kitchen CIC.
As part of the services we offer, we are required to process personal data. We are committed to being transparent about why we need your personal data and what we do with it. This Privacy Notice explains how we hold and process your personal information. It also explains your rights when it comes to your data.
We are what is known as a data controller. This means we have control over how your details are used and what we do with this information.
For further information about our data protection policies and procedures, please contact us:
Leeds Jewish Welfare Board (LJWB) Marjorie & Arnold Ziff Community Centre 311 Stonegate Road Leeds LS17 6AZ | Email: hello@ljwb.co.uk Telephone: 0113 268 4211 Website: www.ljwb.co.uk |
- About the information we collect
By law, we need to have a lawful basis for processing your personal data. Under UK General Data Protection Regulation (UK GDPR), the lawful bases we can rely on for processing this information are:
(a) Your consent.
(b) We have a contractual obligation.
(c) We have a legal obligation.
(d) We have a vital interest.
(e) We need it to perform a public task.
(f) We have a legitimate interest.
Special category data is personal data that needs more protection because it is sensitive. The UK GDPR defines special category data as:
- personal data revealing racial or ethnic origin;
- personal data revealing religious or philosophical beliefs;
- personal data revealing political opinions;
- personal data revealing trade union membership;
- data concerning health;
- data concerning a person’s sex life or sexual orientation;
- genetic data;
- biometric data (where used for identification purposes).
Additional legal conditions are in place for processing special category data.
Most of the personal information we process is provided to us directly by you for one of the following reasons:
Service users, residents, clients and customers
| ||
What type of data do we have?
| Why do we have this data? | Where do we process your data? |
Basic details and contact information e.g. name, address, date of birth, next of kin. Financial details e.g. details of how you pay us for care or your funding arrangements. Images e.g. photos, videos. | To provide high-quality and appropriate care, support, and services. To assist in assessment of eligible funding. To ensure the safety and reduce the vulnerability of you, your family or other members of the community. To manage and administer activities and events. To comply with regulatory and legal obligations, such as reporting to Care Quality Commission and the local authority. To investigate and respond to any complaints. To support marketing or fundraising activities. | This is collected from or shared with: – You or your legal representatives. – Third parties, for example, other parts of the health and care system such as the GP or social workers; the local authority; you your family or friends with your permission; for safeguarding purposes; law enforcement agencies if we have to by law or court order; social media to showcase certain events or activities with your permission. We do this face to face, or via phone, email, post, website, video conferencing, or application forms. We will only permit the use of pre-authorised fully encrypted secure and approved apps for communication. |
Special category data: Health and social care data, which might include physical or mental health data. Information about your religion, race and ethnicity, or sexual orientation. | ||
We process your data because: | ||
– We have a legal obligation to process your data, generally under the Health and Social Care Act 2012 or Mental Capacity Act 2005. – We process special category data because it is necessary for us to provide and manage our services; we are required to provide data to our regulator; and it is necessary for us due to social protection law (e.g. safeguarding). – We have a legitimate interest in marketing our services and showcasing our community centre. – We may also process your data with consent. If we need to ask for your permission, we will explain clearly what we need the data for and how you can withdraw consent at any time. We will offer you a clear choice and ask that you confirm to us that you consent. | ||
Relatives or friends
| ||
What type of data do we have?
| Why do we have this data? | Where do we process your data? |
Basic details and contact information e.g. name, address.
| To provide high-quality and appropriate care, support, and services. | This is collected from or shared with: – You or your legal representatives. – Third parties, for example, your family or friends with your permission; other parts of the health and care system such as the GP or social worker. We do this face to face, or via phone, email, post, website, video conferencing, or application forms. We will only permit the use of pre-authorised fully encrypted secure and approved apps for communication. |
We process your data because: | ||
– We have a legitimate business interest in holding next of kin and lasting power of attorney information about the individuals who use our service and keeping emergency contact details for our staff and volunteers. – We may also process your data with consent. If we need to ask for your permission, we will explain clearly what we need the data for and how you can withdraw consent at any time. We will offer you a clear choice and ask that you confirm to us that you consent.
| ||
Supporters, funders and donors
| ||
What type of data do we have? | Why do we have this data? | Where do we process your data? |
Basic details and contact information e.g. name, address, email, phone number. Financial information e.g. bank account details; whether you are a UK taxpayer. Historic donations including donations to the charity shop.
| To administer donations and grants. To enable us to claim gift aid on your donation or take regular payments with your consent e.g. direct debit. To inform you of our work and invite you to activities or events. In limited circumstances, to inform you of work of our partners. To ask for your support. Recording pledges of future support. | This is collected from or shared with: – You. – Event organisers. – Third parties with your permission, e.g. HMRC for gift aid claims; external fundraising platforms.
We do this face to face, or via phone, email, post, website, video conferencing, or donation forms. We will only permit the use of pre-authorised fully encrypted secure and approved apps for communication. |
We process your data because:
| ||
– We have a legitimate business interest in holding contact and financial details to process donations and claim gift aid. – We may also process your data with consent. If we need to ask for your permission, we will explain clearly what we need the data for and how you can withdraw consent at any time. We will offer you a clear choice and ask that you confirm to us that you consent. You may opt out of receiving any marketing communication at any time by sending an email to GDPR@ljwb.co.uk or contacting us at the details above.
| ||
Staff and volunteers
| ||
What type of data do we have?
| Why do we have this data? | Where do we process your data? |
Basic details and contact information e.g. name, address, date of birth, sex, National Insurance number, right to work documentation, emergency contact details. Employment or volunteering history e.g. hours of work, holidays. Confidential references. Financial details e.g. bank, insurance, pension, tax details. Qualifications or training records. Images e.g. ID photo, CCTV. Evidence of a Disclosure and Barring Service (DBS) check. | To provide a safe and professional service. To process applications for employment or volunteering. To support you in your work. To pay you. To provide you with updates on our work and further opportunities. For statistical purposes such as equal opportunities monitoring. | This is collected from or shared with: – You or your legal representatives. – Third parties that we have a legal reason to share your data with. These include HMRC; pension providers; external payroll provider; insurance companies; DBS Service; organisations we have a legal obligation to share information with such as CQC, Companies House, Charity Commission; law enforcement agencies if we have to by law or court order. We do this face to face, or via phone, email, post, website, video conferencing, or application forms. We will only permit the use of pre-authorised fully encrypted secure and approved apps for communication. |
Special category data: Health and social care data, which might include physical or mental health data. Information about your religion, race and ethnicity, trade union membership or sexual orientation, with your permission.
| ||
We process your data because:
| ||
– We have a legal obligation under UK employment law. – We have a legitimate interest e.g. where relevant we provide data about your training in order to claim training funding repayments. – We are required to provide data to our regulator, the Care Quality Commission (CQC), as part of our public interest obligations and local authority funders and safeguarding boards. – We process special category data because it is necessary for us to process requests for sick pay or maternity pay, or to make reasonable adjustments in the workplace. – If we request your criminal records data, it is because we have a legal obligation to do this due to the type of work you do. This is set out in the Data Protection Act 2018 and the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975. We do not keep a record of your criminal records information (if any). We do record that we have checked this. – We may also process your data with consent. If we need to ask for your permission, we will explain clearly what we need the data for and how you can withdraw consent at any time. We will offer you a clear choice and ask that you confirm to us that you consent. | ||
Suppliers and contractors | ||
What type of data do we have? | Why do we have this data? | Where do we process your data? |
Basic details and contact information e.g. contact name, business name, address. Financial details e.g. payment information, insurance, going concern information. Qualifications, certifications you may hold, and memberships e.g. CHAS. Contract details. | To contact you to talk about our business needs. To pay you for any goods and services received. To enable specialist work to be undertaken and evidence ability to do so. | This is collected from or shared with: – You or your legal representatives. – Third parties that we have a legal reason to share your data with. These could include e.g. our bank, external auditor. We will only permit the use of pre-authorised fully encrypted secure and approved apps for communication. |
We process your data because: | ||
– We have a legal or contractual obligation to pay you for goods or services received. – We have a legitimate business interest to talk to you about your goods or services and your experience in providing these. | ||
If we wish to use your personal data for a new purpose which is different from the original purpose for which you gave your data to us, we will provide you with an additional privacy notice to explain the new use prior to commencing the processing.
If you are aged 16 or under
For children under the age of 16, consent from parents or legal guardian is needed before personal data is processed. Children aged 16 or under must get permission from parents or legal guardian before any personal data is shared on the LJWB website.
Our website and cookies
In order to provide you with the best experience while using our website, we process some data about you. We use cookies to provide you with a better browsing experience and keep a track of visitor browsing patterns. We do not use cookies to identify you as an individual.
The cookie setting on our website is set to “allow cookies”. When you first access our website and periodically thereafter, you will be asked for consent to our use of cookies.
If you do not wish to allow the use of cookies, you can disable them through your browser settings. Please note that if you disable cookies, our website may not function properly.
CCTV and images
CCTV data is processed in accordance with the Surveillance Camera Code of Practice (https://www.gov.uk/government/publications/update-to-surveillance-camera-code) and in line with our CCTV Policy.
We occasionally capture images of our services for marketing and fundraising purposes, such as sharing videos of our events on social media or photographs in the local press. Further details of when images are being captured is available at our community centre reception or by speaking to the service manager.
National data opt-out
At this time, we do not share any data for planning or research purposes for which the national data opt-out would apply. We review all of the confidential client information we process on an annual basis to see if this is used for research and planning purposes. If it is, then individuals can decide to stop their information being shared for this purpose. You can find out more information at https://www.nhs.uk/your-nhs-data-matters/
- How we store your personal information
Your information is securely stored. Personal data may be held in electronic form (for example, emails, databases, spreadsheets, CCTV) or in physical filing systems.
We collect personal details from you for different reasons and so we might keep it for different lengths of time. Our Data Retention, Archiving and Destruction Policy states how we keep and dispose of personal information and the time period we keep your information.
- Your data protection rights
Under data protection law, you have rights including:
- Your right of access.
You have the right to ask us for copies of your personal information.
- Your right to rectification
You have the right to ask us to rectify personal information you think is inaccurate or incomplete. You can also request that we restrict all processing of your data while we consider your rectification request.
- Your right to erasure
You have the right to ask us to erase your personal information in certain circumstances. We retain our data in line with our Data Retention, Archiving and Destruction Policy which follows the Records Management Code of Practice 2021
(https://transform.england.nhs.uk/information-governance/guidance/records-management-code/)
- Your right to restriction of processing
You have the right to ask us to restrict the processing of your personal information in certain circumstances.
- Your right to object to processing
You have the the right to object to the processing of your personal information in certain circumstances.
- Your right to data portability
You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one calendar month to respond to you. You will need to provide adequate information for our staff to be able to identify you, for example, a current passport or driver’s licence and clear guidance regarding the information you wish to access. This is to make sure that data is not shared with the wrong person inappropriately and we are able to deal with your request in a timely manner.
- How to contact us
Please contact us if you have any questions or concerns about the information we hold about you:
Governance and GDPR Leeds Jewish Welfare Board Marjorie and Arnold Ziff Community Centre 311 Stonegate Road Leeds LS17 6AZ | Email: GDPR@ljwb.co.uk Telephone: 0113 268 4211 |
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. We would, however, like to have the opportunity to deal with your concerns before you approach the ICO so please do contact us in the first instance.
The ICO’s contact details:
| |
Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF | Helpline number: 0303 123 1113 ICO website: https://www.ico.org.uk |
Leeds Jewish Welfare Board is a data controller registered with the ICO, reference: ZA005264.
- Changes to our privacy notice
We regularly review our privacy notice. This was last reviewed in May 2024.