Privacy policy

How your personal information is used

Who is the data controller for the information we collect

This Privacy Notice is provided to meet the requirements of the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA) to explain how we process your personal data in delivering Leeds Send Local Offer. 

Leeds City Council is the data controller for the purposes of the Data Protection Act 2018 and other regulations including the UK General Data Protection Regulation, which means it determines what your data is used for and why it is collected. The purpose of this privacy notice is to tell you about what information we collect about you when you use our service, how we use that information and who we may share it with. The contact details of the data controller are Leeds City Council, Merrion House, 110 Merrion Way, Leeds, LS2 8BB.

Information we may collect

To deliver the Leeds Local Offer (SEND) and respond to your enquiries we may process data in relation to:, we will process data on:

• Name
• Personal email address
• Any information the person voluntarily provides in their message

We collect information directly from you when you complete one of our online forms through the Leeds Local Offer website, or when you request a login to access the Inclusive Mainstream Practice (IMP) guidance using your name and school email address.

Why we process your data 

We use your information to: 

• Communicate with you by email to respond to your query
• Provide you with secure access to the Inclusive Mainstream Practice (IMP) guidance database by sending account details and notifications via GOV.UK Notify.

All the data collected will be treated in strict confidence and in accordance with the requirements of the Data Protection Act 2018 and UK General Data Protection Regulation (UK GDPR). The data provided by you will only be used for the purpose(s) specified.

Lawful basis for processing

When you contact us through a form on the Leeds Local Offer website (for example, to request information or raise a query), we rely on your consent to process your personal data so that we can respond to your enquiry directly or refer to other departments as necessary.

Public Task

• Children and Families Act 2014 – particularly Part 3, which places duties on local authorities to identify, assess, and make provision for children and young people with special educational needs or disabilities (SEND).
• This is supported by the Special Educational Needs and Disability Code of Practice (2015), which requires local authorities to publish and maintain a Local Offer and to provide guidance, tools, and resources to help mainstream settings support inclusion.
• Processing of personal data is therefore necessary for the council to carry out its statutory education and inclusion duties under this legislation.

We will process your data in accordance with UK GDPR. The processing shall be lawful only if and to the extent that the following applies: 

• Article 6(1)(a). Your consent.
• Article 6(1)(e): We need it to perform a public task.

Withdrawing your consent

If you have given consent (for example, by submitting a contact form), you can withdraw your consent at any time by contacting LLO@leeds.gov.uk

Where processing is carried out under Public Task, you still have rights to access, rectify, or erase your personal data where applicable.

Data retention and storage

Our data retention policies and procedures are designed to help ensure that we comply with our legal obligations in relation to the retention. 

Contact and feedback forms:

• Personal data submitted through the site’s contact or feedback forms (such as name, school, and email address) is used only to respond to your enquiry.
• These details are deleted once your query has been resolved, unless there is a clear operational or legal reason to retain them for longer (for example, where a follow-up action is required).

Inclusive Mainstream Practice 

• User account data:
  School name and professional email address are retained for as long as the account remains active.
  Accounts that are inactive for 24 months will be automatically disabled and deleted.
• Audit and activity logs:
  Basic system audit logs (e.g. login timestamps, account creation dates) are retained for 24 months for security and service continuity, after which they are securely deleted or anonymised.
• Notification data (via GOV.UK Notify):
  Message content and delivery details for password resets or system notifications are automatically deleted after 7 days, in line with the Cabinet Office’s retention policy.
  GOV.UK Notify retains internal audit logs of message delivery and deletion for up to one year for monitoring and compliance purposes.
• Backups:
  Encrypted backups of the site and database are performed daily by Krystal Hosting Ltd and retained for 30 days before being securely deleted as part of a rolling cycle.

Who we can share your data with

If a customer uses the feedback form to ask about another service, the Leeds Local Offer team will first check whether the customer is happy for their details to be shared with that service. If they do not wish their details to be shared, the team will instead provide the relevant service information directly in their response.

In addition, we will share your personal data:

• where such disclosure is necessary for compliance with a legal obligation to which we are subject;
• in order to protect your vital interests or the vital interests of another natural person;
• for the purposes of security and prevention of fraud and other criminal activity;
• where such disclosure is necessary for the establishment, exercise, or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

Automated decision making

Your data will not be used for any automated decision making, including profiling. 

Your rights

The following rights under data protection law are applicable for this processing:

• the right to access - you can ask for copies of your personal data
• the right to rectification - you can ask us to rectify inaccurate personal data and to complete incomplete personal data
• the right to restrict processing - you can ask us to restrict the processing of your personal data
• the right to object to processing - you can object to the processing of your personal data
• the right to complain to a supervisory authority - you can complain about our processing of your personal data
• the right to withdraw consent - to the extent that the legal basis of our processing of your personal data is consent, you can withdraw that consent.

These rights are subject to certain limitations and exceptions. You can learn more about your rights through the ‘Your individual rights page on the right, and the Information Commissioner's Office external link. 

You may exercise any of the above rights in relation to your personal data by writing to us, using the contact details provided below.

When your data gets sent to other countries 

The information you provide will not be transferred to another country outside of the UK. 

Contact us

Contact us by email at LLO@leeds.gov.uk

Complaints

If you are unhappy with the way in which your information has been handled, you should speak with the specific service in the first instance. 

Any data protection complaints about how the council has processed your personal data, will be handled in accordance with the council’s Complaints Policy. You can find out how to submit a complaint by visiting this link.

If we cannot resolve your complaint, you can refer to the Information Commissioner if you consider that there has been an infringement of data protection legislation. Further details can be found on the Information Commissioner’s website.

Changes to this notice

We keep our privacy notice under regular review. We will notify you of significant changes to this notice by email or other means as appropriate. This privacy notice was last updated 21/10/2025