Gateshead Kehilla Building Foundation and The Woodstock Mikvah Limited
Gateshead Kehilla Building Foundation (GKBF) and The Woodstock Mikvah Limited, also known as The Maalos Kedoshim UOHC Mikvah (TWML), protect information about people who use their services, staff, volunteers and other individuals. This policy sets out the standards each organisation follows when collecting, using, sharing and securing personal information. Staff and volunteers must follow it whenever they handle such information.
Each organisation is responsible for the personal information it controls. Where GKBF works with Gateshead Hebrew Congregation (GHC), or either organisation shares a booking platform or service provider, the organisations must establish their respective responsibilities for the information involved. This policy does not, by itself, make all three organisations joint controllers.
Each organisation complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003, as amended. Personal information can identify a living person directly or indirectly. Booking and service information may reveal religious beliefs or other special category information and therefore requires particular care.
Information may include contact and account details, bookings and communications, payment and transaction records, and employment or volunteer records. Each organisation collects only what it needs for a defined purpose, keeps it accurate, and retains it only for as long as necessary under its retention arrangements and legal obligations. Access to mikvah booking and attendance information must be limited to people who need it for their role.
Before using personal information, the organisation identifies and documents an appropriate UK GDPR lawful basis: consent, contract, legal obligation, vital interests, legitimate interests, or another applicable basis. Consent must be freely given, specific, informed and capable of withdrawal; written consent may be appropriate where a record is needed. Employment and volunteer information is handled under the applicable basis for each purpose.
Where information reveals religious belief, health or another special category, the organisation must also identify and document a separate Article 9 condition. This may, where its precise requirements are met, include explicit consent, employment and social protection obligations, vital interests, legal claims, substantial public interest, or the condition for qualifying not for profit bodies with a religious aim. No condition should be assumed to apply merely because the service is a mikvah.
Information is shared only where necessary and lawful, including with GHC where appropriate and with providers supporting bookings, messaging, payments, payroll or other operations. Before sharing, the organisation determines whether the recipient is a separate controller, joint controller or processor, and puts in place the appropriate agreement and safeguards. Processors must act on documented instructions, protect information, report incidents promptly and use subprocessors only with the required authorisation. Mobile numbers and SMS consent information are not sold or shared with third parties or affiliates for their marketing or promotional use.
Paper records must be kept securely and out of sight of unauthorised people, and disposed of securely when no longer needed. Electronic records must be access controlled, protected by strong passwords and appropriate security measures, and stored on approved systems. Sensitive information sent electronically must use an appropriate secure method. Removable media must be secured; information should not be stored on personal devices without authorisation. Staff and volunteers must maintain confidentiality, especially concerning a person’s use of a mikvah.
Anyone who discovers or suspects loss, disclosure, misuse or unauthorised access must promptly contain it where safe and report it to the responsible organisation’s privacy lead without waiting for complete details. The internal target is within six working hours of discovery, and urgent incidents should be reported immediately. Record what happened, when it was discovered, what information and people may be affected, and the steps taken.
The privacy lead assesses and records the risk and decides whether the Information Commissioner’s Office (ICO) and affected individuals must be notified. A reportable UK GDPR breach must be notified to the ICO without undue delay and, where feasible, within 72 hours after the organisation becomes aware of it. Individuals must be notified without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Contractual notifications must also be considered.
For GKBF, the elected president of GHC is the designated privacy lead under the existing GKBF policy. TWML must designate its own responsible privacy contact. Each organisation should confirm whether a formal statutory data protection officer is required before using that title. Its responsible contact oversees this policy, handles concerns and liaises with the ICO where needed.
Individuals may request access, correction, erasure, restriction, portability where applicable, or object to processing. They may withdraw consent where processing relies on consent and may complain to the ICO. Requests need not use a particular form. The relevant organisation verifies identity where reasonably necessary, considers applicable exemptions and responds without undue delay, normally within one month, subject to lawful extensions or pauses. Information about other people must be assessed carefully before disclosure. Objections to direct marketing must be honoured promptly.
1. People who opt in to SMS via our website may receive one time verification codes for account registration or password resets, and relevant booking confirmations, amendments or cancellations.
2. You can cancel the SMS service at any time. Just text "STOP" to the short code. After you send the SMS message "STOP" to us, we will send you an SMS message to confirm that you have been unsubscribed. After this, you will no longer receive SMS messages from us. If you want to join again, just sign up as you did the first time and we will start sending SMS messages to you again.
3. If you are experiencing issues with the messaging program you can reply with the keyword HELP for more assistance, or you can get help directly at sms@mikvah.co.uk
4. Carriers are not liable for delayed or undelivered messages.
5. As always, message and data rates may apply for any messages sent to you from us and to us from you. Message frequency depends on account and booking activity. If you have any questions about your text plan or data plan, it is best to contact your wireless provider.
We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes.
Each organisation should review this policy regularly and when its systems, providers or legal duties change. Privacy requests concerning a particular mikvah should be directed to that organisation through its usual contact channel. SMS support is available at sms@mikvah.co.uk.