Tester Privacy Notice

1. Introduction

This Tester Privacy Notice explains how MyWeb Access, operated by MyVision Oxfordshire Ltd, handles personal data relating to disabled user testers.

It applies to:

• tester applicants;
• onboarded testers;
• active testers using the platform or extension; and
• former testers where records are still retained.

2. Who we are

• Data controller: MyVision Oxfordshire Ltd
• Service name: MyWeb Access
• Email: support@mywebaccess.co.uk
• Address: MyVision Oxfordshire, Bradbury Lodge, Gordon Woodward Way, Oxford, OX1 4XL

3. Information we collect about testers

We may collect and use the following personal data.

3.1 Application and onboarding information

• name;
• contact details;
• preferred contact method;
• confidence using a computer;
• assistive technology used;
• disability-related information you choose to provide; and
• related onboarding or support information.

3.2 Account and participation information

• platform account details;
• agreement acceptance records;
• IP address and browser user-agent information recorded for sign-in security, agreement evidence and protected account changes;
• submission history;
• quality-review outcomes;
• project participation records; and
• support or communication records.

3.3 Testing and technical submission data

Depending on the testing workflow, we may collect:

• structured quantitative responses;
• qualitative testimonials or comments;
• the assigned website URL, page title and testing step;
• answers, task outcomes, barrier descriptions and friction flags;
• technical or device-context information relevant to the testing workflow; and
• normal request, record-creation and record-update timestamps.

The extension does not collect screenshots, copy page body content, monitor browsing outside an assigned test, or actively measure task duration. It does transmit the assigned domain and URL, and the current page title where available, while you work on that assignment.

3.4 When extension data is sent

1. Sign-in sends the authentication information needed to verify your account and establish a session.
2. For a 1.4 beta assignment, saving the assignment-specific access setup creates the initial server draft. For an older assignment without that setup step, Start creates it. The draft includes the assigned URL and page title, where available, plus relevant technical context such as browser, operating system, screen size and extension version.
3. Start or Resume requests Chrome access only to the assigned website.
4. Save Draft sends the current draft to the service.
5. Submit sends the completed review for authorised human review.
6. If you are offline, queued work remains encrypted in that Chrome profile until you choose to retry sending it.

3.5 Payment administration information

Where relevant, we may collect:

• bank details supplied for payment;
• invoice-related information;
• payment records; and
• related finance administration records.

Bank details are used only to administer tester payments. They are not included in tester feedback or shared with clients or agencies.

4. How we use tester personal data

We use tester personal data to:

• review applications and determine suitability;
• create and manage tester accounts;
• contact testers about opportunities and support matters;
• understand testers' assistive technology and accessibility context;
• provide accessible onboarding and reasonable adjustments;
• manage agreement acceptance and platform access;
• allow authorised staff to read findings for quality review, audit delivery and payment administration;
• pay testers for accepted work;
• keep internal records;
• maintain the security and reliability of the service; and
• meet legal, regulatory, accounting, or safeguarding obligations where relevant.

Our use of information received through Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use this information only to provide or improve the extension's disclosed single purpose and its necessary security and operational functions.

5. Lawful bases

We use the following lawful bases according to the purpose and information involved:

• Contract – for assignment, submission, payment-eligibility and necessary communication processing that is objectively required to perform the tester agreement;
• Pre-contract steps – where processing is needed to review your application or onboarding information;
• Legitimate interests – for service operation, quality assurance, support, record-keeping, and service improvement;
• Legal obligation – where we must keep records or comply with legal duties; and
• Consent and explicit consent – consent under Article 6(1)(a), together with the explicit-consent condition in Article 9(2)(a), for the optional assignment-specific access information described in section 6.

6. Sensitive or accessibility-related information

Because this service is specifically designed around disabled user testing, information about disability, access needs or assistive technology may reveal health information about you. This is special-category personal data and receives additional protection under data-protection law.

MyVision Oxfordshire Ltd asks for this optional information only to understand the context of the accessibility problems you identify and, where relevant, to include a human-approved broad access-method description in a future report. Before each pilot assignment, the extension offers three choices: use a saved access profile for that test, change the access details for that test, or continue without sharing access-profile information.

The first two choices require a separate explicit-consent action under Article 9(2)(a). Declining does not require a consent checkbox and does not affect your ability to complete the assignment, receive payment or be considered for future work.

Assignment-specific details do not silently update your reusable tester profile and are not used for future matching. You can withdraw the assignment-specific consent through Settings. You can also stop future use of your reusable profile without disabling your account or existing assignments.

We aim to:

• collect only what is reasonably necessary;
• use it only for legitimate service and participation purposes;
• limit access internally to those who need it; and
• avoid sharing direct identifiers with clients.

7. Sharing tester information

We do not share tester names, direct contact details, or bank details with clients or agencies in the normal course of service delivery.

We may share tester information internally within MyVision Oxfordshire Ltd, including the MyWeb Access service, where needed for:

• account creation;
• support;
• quality assurance;
• delivery management;
• finance processing; and
• governance or compliance.

Submitted answers and findings are read by authorised MyWeb Access administrators because human review is necessary to quality-check the work, decide whether it is approved, prepare audit delivery and administer payment. The extension prominently explains this operational processing before testing begins. That acknowledgement is separate from, and is not, the explicit consent for optional access information.

We may also share data with third-party providers supporting hosting, storage, communications, or business operations where reasonably necessary and appropriately protected.

8. What clients and agencies may see

During this pilot, findings are not published through the client portal. Authorised MyWeb Access staff may review approved findings and incorporate them into the active accessibility audit and its deliverables. Any later client-dashboard publication remains subject to separate publication controls and human approval.

Material incorporated into the audit may include:

• a broad assistive technology category;
• barrier descriptions;
• qualitative comments;
• structured responses; and
• lived-experience context relevant to the audit.

Client-facing output will not include your name, email address, tester account identifier, bank details, exact assistive technology product, device details, task duration, or internal moderation information. An administrator reviews the client-facing wording and checks for direct tester identifiers before inclusion.

A broad access-method description can be included only while the relevant assignment-specific consent is active and after human approval. Withdrawing optional access information removes it from unpublished drafts and projections. Withdrawal cannot automatically recall information already included in a completed report, although it stops future use.

9. Retention

We keep tester personal data only for as long as reasonably necessary.

The periods or criteria used for each category are:

• application and account records: while an application is being considered or the tester account remains active, followed by the period needed to close outstanding assignments, payments, support matters or disputes and meet applicable legal obligations;
• tester drafts, answers and findings: while needed to quality-review and pay for the work, prepare and support the relevant accessibility audit, respond to challenges and meet the associated contractual or legal record-keeping need;
• accepted agreement and access-profile consent records: for the period needed to evidence the applicable participation terms, consent, withdrawal and compliance decisions;
• payment and finance records: for the period required by applicable accounting, tax and audit obligations;
• encrypted backup archives: 35 days, after which the archive object is deleted and only minimum deletion evidence is retained; and
• material approved for a future client report: according to the contractual and legal record-keeping need for that audit, subject to the separate publication controls described in section 8.

Retention periods may be extended where needed for disputes, fraud prevention, legal obligations, or safeguarding.

10. Security

We use appropriate measures to protect tester data, including:

• access controls;
• secure storage arrangements;
• restricted internal access;
• platform account controls;
• HTTPS for data sent between the extension and the service;
• AES-GCM encryption for locally retained extension drafts and authentication secrets;
• encrypted or controlled server storage where appropriate; and
• internal handling measures for finance and account data.

The extension asks for access to an assigned website only when you choose Start. Local encrypted drafts remain on that Chrome profile until you delete them, uninstall the extension, or the workflow removes them after the server confirms submission or abandonment. If abandonment is requested while offline, the extension shows that deletion is pending until the server confirms it, then clears local and queued copies.

11. Your rights

You may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate data;
• request deletion in some circumstances;
• object to certain processing in some circumstances;
• request restriction of processing in some circumstances;
• withdraw consent where we rely on consent; and
• complain to the ICO.

The extension Settings screen provides pre-addressed email links for correction, erasure and restriction requests. You can also email privacy@myvision.org.uk. Requests are handled through a governed manual process.

12. Reasonable adjustments and accessible communication

MyWeb Access is committed to accessible communication with testers.

You may tell us about:

• your preferred contact method;
• preferred communication style;
• formatting or accessibility needs;
• support needs relating to onboarding or submissions; and
• reasonable adjustments that may help you take part.

We will consider reasonable requests on a case-by-case basis.

13. Changes to this notice

We may update this Tester Privacy Notice from time to time. The latest version may be made available through the platform or other tester communications.

If an extension update changes what data is collected, how it is used or who receives it, we will prominently disclose the change before the new practice begins and obtain fresh consent where required.

14. Contact and complaints

If you have questions or concerns, please contact:

• Email: privacy@myvision.org.uk
• Address: MyVision Oxfordshire, Bradbury Lodge, Gordon Woodward Way, Oxford, OX1 4XL

If you are unhappy with how we handle your personal data, you can also complain to the Information Commissioner's Office at ico.org.uk.