Tester Privacy Notice

1. Introduction

This Tester Privacy Notice explains how MyWeb Access, operated by MyVision Oxfordshire, handles personal data relating to disabled user testers.

It applies to:

• tester applicants;
• onboarded testers;
• active testers using the platform or extension; and
• former testers where records are still retained.

2. Who we are

• Data controller: MyVision Oxfordshire
• Service name: MyWeb Access
• Email: support@mywebaccess.co.uk
• Address: MyVision Oxfordshire, Bradbury Lodge, Gordon Woodward Way, Oxford, OX1 4XL

3. Information we collect about testers

We may collect and use the following personal data.

3.1 Application and onboarding information

• name;
• contact details;
• preferred contact method;
• confidence using a computer;
• assistive technology used;
• disability-related information you choose to provide; and
• related onboarding or support information.

3.2 Account and participation information

• platform account details;
• agreement acceptance records;
• submission history;
• quality-review outcomes;
• project participation records; and
• support or communication records.

3.3 Testing and technical submission data

Depending on the testing workflow, we may collect:

• structured quantitative responses;
• qualitative testimonials or comments;
• the assigned website URL, page title and testing step;
• answers, task outcomes, barrier descriptions and friction flags;
• technical or device-context information relevant to the testing workflow; and
• de-identified participation outputs linked to your tester account internally.

The extension does not collect screenshots, page contents, browsing history outside an assigned test, or active task-duration measurements. It checks the current website only when you open the extension or use a testing command. Completed feedback is sent only when you choose Submit.

3.4 Payment administration information

Where relevant, we may collect:

• bank details supplied for payment;
• invoice-related information;
• payment records; and
• related finance administration records.

Bank details are used only to administer tester payments. They are not included in tester feedback or shared with clients or agencies.

4. How we use tester personal data

We use tester personal data to:

• review applications and determine suitability;
• create and manage tester accounts;
• contact testers about opportunities and support matters;
• understand testers' assistive technology and accessibility context;
• provide accessible onboarding and reasonable adjustments;
• manage agreement acceptance and platform access;
• review and quality-check submissions;
• pay testers for accepted work;
• keep internal records;
• improve the service; and
• meet legal, regulatory, accounting, or safeguarding obligations where relevant.

Our use of information received through Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use this information only to provide or improve the extension's disclosed single purpose and its necessary security and operational functions.

5. Lawful bases

We may rely on one or more of the following lawful bases:

• Contract– where processing is necessary to manage your participation under the tester agreement;
• Pre-contract steps– where processing is needed to review your application or onboarding information;
• Legitimate interests– for service operation, quality assurance, support, record-keeping, and service improvement;
• Legal obligation– where we must keep records or comply with legal duties; and
• Explicit consent or another appropriate condition – where required for more sensitive information, depending on the nature of the information provided.

6. Sensitive or accessibility-related information

Because this service is specifically designed around disabled user testing, some information you provide may relate to disability, accessibility needs, or assistive technology use.

We aim to:

• collect only what is reasonably necessary;
• use it only for legitimate service and participation purposes;
• limit access internally to those who need it; and
• avoid sharing direct identifiers with clients.

7. Sharing tester information

We do not share tester names, direct contact details, or bank details with clients or agencies in the normal course of service delivery.

We may share tester information internally within MyVision / MyWeb Access where needed for:

• account creation;
• support;
• quality assurance;
• delivery management;
• finance processing; and
• governance or compliance.

Submitted answers and findings are read by authorised MyWeb Access administrators because human review is necessary to quality-check the work, decide whether it is approved, create the anonymised client-facing version and administer payment. Before the first test, the extension presents this human-review practice and asks for your explicit consent.

We may also share data with third-party providers supporting hosting, storage, communications, or business operations where reasonably necessary and appropriately protected.

8. What clients and agencies may see

Clients and agencies may see only administrator-approved, de-identified tester feedback in reports or through the portal.

This feedback may include:

• a broad assistive technology category;
• barrier descriptions;
• qualitative comments;
• structured responses; and
• lived-experience context relevant to the audit.

Client-facing outputs do not include your name, email address, tester account identifier, bank details, exact assistive technology product, device details, task duration, or internal moderation information. An administrator reviews the client-facing wording and confirms that it contains no tester identity before publication.

9. Retention

We keep tester personal data only for as long as reasonably necessary.

Indicative periods include:

• application and account records: for as long as you remain an active tester, and for a reasonable period afterward where needed for legal, compliance, or operational reasons;
• tester submission data held in backend systems: generally 18 months;
• accepted agreement records: for as long as reasonably needed to evidence participation terms and compliance;
• payment and finance records: for as long as required by law or reasonable accounting and audit practice.

Retention periods may be extended where needed for disputes, fraud prevention, legal obligations, or safeguarding.

10. Security

We use appropriate measures to protect tester data, including:

• access controls;
• secure storage arrangements;
• restricted internal access;
• platform account controls;
• HTTPS for data sent between the extension and the service;
• AES-GCM encryption for locally retained extension drafts and authentication secrets;
• encrypted or controlled server storage where appropriate; and
• internal handling measures for finance and account data.

The extension asks for access to an assigned website only when you choose Start. Local encrypted drafts remain on that Chrome profile until you delete them, uninstall the extension, or the workflow removes them after successful submission.

11. Your rights

You may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate data;
• request deletion in some circumstances;
• object to certain processing in some circumstances;
• request restriction of processing in some circumstances;
• withdraw consent where we rely on consent; and
• complain to the ICO.

To exercise rights or raise questions, contact us using the details in section 2.

12. Reasonable adjustments and accessible communication

MyWeb Access is committed to accessible communication with testers.

You may tell us about:

• your preferred contact method;
• preferred communication style;
• formatting or accessibility needs;
• support needs relating to onboarding or submissions; and
• reasonable adjustments that may help you take part.

We will consider reasonable requests on a case-by-case basis.

13. Changes to this notice

We may update this Tester Privacy Notice from time to time. The latest version may be made available through the platform or other tester communications.

If an extension update changes what data is collected, how it is used or who receives it, we will prominently disclose the change before the new practice begins and obtain fresh consent where required.

14. Contact and complaints

If you have questions or concerns, please contact:

• Email: support@mywebaccess.co.uk
• Address: MyVision Oxfordshire, Bradbury Lodge, Gordon Woodward Way, Oxford, OX1 4XL

If you are unhappy with how we handle your personal data, you can also complain to the Information Commissioner's Office at ico.org.uk.