Version 1.0
Effective: September 2026
Last reviewed: September 2026
1. About AccessWays
AccessWays provides independent Non-Medical Help (NMH) support to students in higher education, including support funded through Disabled Students’ Allowance (DSA).
For the purposes of UK data protection law, AccessWays, trading as AccessWays, is the data controller for personal information processed in connection with AccessWays services.
Translations are provided for convenience only. If there is any inconsistency or difference in meaning, the English version shall prevail.
Contact details
Email: [email protected]
Website: accessways.thkwong.uk
Questions about this Privacy Notice or the use of your personal information can be sent using the contact details above.
2. Personal information we collect
The information AccessWays collects depends on the services you receive and how those services are funded or arranged.
This may include your name and preferred name; contact details; university or higher education provider; relevant course or study information; DSA entitlement and support information; information contained in relevant DSA documentation; Student Finance identifiers or other information required for DSA administration and invoicing; accessibility, communication and learning preferences; information you choose or need to provide about disability, neurodivergence, health or support needs; agreed support arrangements, plans and goals; appointment, attendance and session information; session records and timesheets; communications; feedback and complaints; safeguarding or welfare information where relevant; information necessary for financial, invoicing, audit, insurance or regulatory purposes; and technical and security information generated through use of AccessWays online services.
AccessWays aims to collect only information that is relevant and reasonably necessary for the purpose for which it is being used. Information concerning health or disability may constitute special category personal data and receives additional protection under data protection law.
3. Where we obtain information
Most personal information is provided directly by you. Where necessary for arranging, delivering, funding or verifying your support, AccessWays may also receive relevant information from Student Finance England or the Student Loans Company; your university or higher education provider; a Needs Assessment Centre; another DSA or NMH organisation involved in arranging your support; or another person or organisation where you have asked or authorised information to be provided.
Where information is obtained from another source, AccessWays will provide the relevant privacy information in accordance with applicable data protection requirements.
4. How and why we use your information
AccessWays may process personal information where necessary to respond to enquiries and establish whether AccessWays can provide the requested support; arrange, deliver and personalise NMH support; understand accessibility, communication and support requirements; prepare and maintain appropriate support arrangements and records; manage appointments and communicate about support; record and verify support sessions; prepare and administer timesheets; verify DSA entitlement and approved support; administer DSA-funded services and submit invoices; respond to queries, complaints or disputes; maintain the safety, integrity and security of AccessWays systems and services; manage safeguarding or serious welfare concerns where processing or disclosure is lawful and necessary; establish, exercise or defend legal claims; maintain appropriate financial and business records; meet insurance requirements; and comply with applicable legal, DSA, Department for Education, Student Finance, Student Loans Company, audit and regulatory requirements.
5. Lawful bases for processing
AccessWays processes personal information only where there is an appropriate lawful basis.
Depending on the particular processing activity, this may include:
Contract — Article 6(1)(b): where processing is necessary to take steps at your request before providing a service or to provide and administer services agreed with you.
Legal obligation — Article 6(1)(c): where processing is necessary for AccessWays to comply with an applicable legal obligation.
Legitimate interests — Article 6(1)(f): where processing is necessary for legitimate interests such as operating and securing AccessWays services, maintaining appropriate business records, responding to disputes, preventing misuse and protecting AccessWays’ legal interests, provided those interests are not overridden by your rights and interests.
Consent — Article 6(1)(a): where consent is the appropriate lawful basis for a particular optional use of personal information. Where processing relies on consent, you may withdraw that consent.
The lawful basis used depends on the purpose and circumstances of the processing. AccessWays does not rely on a statement that use of its services constitutes blanket consent to the processing of personal information.
6. Disability, health and other special category information
AccessWays may need to process information concerning disability, neurodivergence, health or related support needs in order to provide appropriate NMH support.
Where special category personal data is processed, AccessWays will identify both an appropriate Article 6 lawful basis and an applicable condition under Article 9 of the UK GDPR and, where required, the Data Protection Act 2018.
Depending on the circumstances and legal requirements, relevant conditions may include explicit consent or an applicable condition established by UK law.
AccessWays will not process special category information merely because it may be useful. Processing will be limited to information reasonably necessary and proportionate for the relevant purpose.
Where AccessWays relies upon a condition requiring an Appropriate Policy Document, that document will be maintained as required by law.
7. Confidentiality and sharing information
Information discussed or provided in connection with NMH support will normally be treated as confidential. AccessWays does not sell personal information.
Personal information will only be shared where there is an appropriate reason and lawful basis for doing so. Where special category information is involved, an applicable additional condition will also be identified where required.
Depending on the circumstances, information may be shared with Student Finance England or the Student Loans Company; the Department for Education; your higher education provider or relevant disability/support service; a Needs Assessment Centre; organisations involved in administering or verifying DSA-funded support; professional advisers, insurers or relevant regulatory bodies where necessary; IT and service providers processing information on behalf of AccessWays; or public authorities or other organisations where disclosure is required or permitted by law.
AccessWays may also disclose relevant information where this is lawfully necessary to address a safeguarding concern, protect vital interests, investigate suspected fraud or wrongdoing, comply with a legal requirement, or establish, exercise or defend legal claims.
Disclosure will, where reasonably possible, be limited to information necessary and proportionate for the relevant purpose. AccessWays cannot guarantee absolute confidentiality where disclosure is required or permitted by law.
8. Session records, attendance and verification
AccessWays may maintain records necessary to demonstrate what support has been provided, including dates, times, duration, type of support and appropriate session records.
Students may be required to confirm or verify that support has taken place where this forms part of the relevant DSA administrative or payment process. Information required for invoicing or verification may be provided to the relevant funding or administrative body where necessary.
9. How long we keep information
AccessWays keeps personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, financial, contractual, insurance, DSA, audit and regulatory requirements.
Different records may therefore have different retention periods. Factors considered when determining retention periods include the purpose for which the information is held; DSA and Department for Education requirements; financial and taxation requirements; applicable limitation periods; insurance requirements; potential complaints, disputes or legal claims; safeguarding considerations; and whether information is required for audit or regulatory purposes.
AccessWays maintains a Data Retention Schedule setting out retention arrangements for relevant categories of information.
When information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.
10. Information security
AccessWays takes reasonable and appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, accidental loss or destruction.
Depending on the system and information concerned, these measures may include access controls and strong authentication; restricting access to information to people who require it; secure devices and accounts; encryption where appropriate; software and security updates; secure backup arrangements; appropriate password management; secure disposal of records and devices; and procedures for identifying and responding to personal data breaches.
No electronic system can be guaranteed to be completely secure. AccessWays nevertheless takes proportionate measures appropriate to the nature and sensitivity of the information processed.
11. Online services and service providers
AccessWays may use third-party technology and service providers to operate its website, student portal, learning platform, communications, appointments, video sessions, document storage, invoicing, backups and other administrative functions.
Where another organisation processes personal information on behalf of AccessWays, AccessWays will take appropriate steps to ensure that suitable data protection arrangements are in place.
Some technology providers may process or store information outside the United Kingdom. Where personal information is transferred internationally, AccessWays will ensure that an appropriate lawful transfer mechanism or safeguard is used where required by UK data protection law.
Information about relevant providers and international transfer safeguards can be requested by contacting AccessWays.
12. Your data protection rights
Depending on the circumstances and the lawful basis used for processing, you may have rights including the right to be informed about how your personal information is used; request access to your personal information; have inaccurate or incomplete information corrected; request erasure in certain circumstances; request restriction of processing in certain circumstances; object to certain processing; data portability where applicable; and withdraw consent where processing is based on consent.
These rights are not absolute and some rights do not apply to every type of processing.
Where applicable, you have the right to object to processing based on legitimate interests.
AccessWays may need to verify your identity before responding to a request.
To exercise a data protection right, contact: [business email]
13. Automated decision-making
AccessWays does not currently use solely automated decision-making, including profiling, to make decisions about students that produce legal or similarly significant effects.
If this changes, this Privacy Notice will be updated and appropriate safeguards will be implemented.
14. Cookies and website analytics
The AccessWays website may use cookies or similar technologies that are necessary for the website or student systems to operate.
Where technologies requiring consent are used, appropriate information and consent choices will be provided. Further information will be available in the AccessWays Cookie Notice where applicable.
15. Data protection complaints
If you believe AccessWays has handled your personal information incorrectly or has not complied with data protection law, you can make a data protection complaint.
Please contact: [email protected]
AccessWays will acknowledge, consider and respond to data protection complaints in accordance with applicable requirements and will inform you of the outcome.
You also have the right to complain to the UK’s independent data protection regulator, the Information Commissioner’s Office (ICO). You do not have to give up your right to contact the ICO in order to use AccessWays services.
16. Changes to this Privacy Notice
AccessWays may update this Privacy Notice where its services, systems, legal obligations, DSA requirements or data-processing activities change.
Material changes will be communicated where appropriate. The current version, together with its effective date, will be available through the AccessWays website.