PRIVACY POLICY

Access Law Online Ltd

1. About this policy

This privacy policy explains how Access Law Online Ltd (“Access Law”, “we”, “us”) collects and uses your personal data, and the rights you have over it. It applies to everyone whose personal data we hold — including people who enquire about our courses, applicants, students and apprentices, employers, website visitors, and our staff and contractors.

We are the data controller for the personal data we hold. We are registered with the Information Commissioner’s Office (ICO) as a data controller under registration number ZB417465. We handle personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. This policy should be read alongside our Data Protection Policy and, for students, our Privacy Notice for Students.

2. Who we are and how to contact us

Access Law Online Ltd is a specialist training provider delivering Council for Licensed Conveyancers (CLC) qualifications in conveyancing and probate. Our registered office is at 2 Lake End Court, Taplow Road, Taplow, Maidenhead, Berkshire, England, SL6 0JQ. Our Data Protection Officer is Louise Ainley, Principal.

If you have any question about this policy or about how we use your personal data, contact the Data Protection Officer at louise.ainley@alo-email.com or 0333 052 3844.

3. The information we collect and why

We collect personal data when you enquire with us, apply for a course, enrol and study, work with us as an employer of an apprentice, visit our website, or work for us. We collect the minimum we need for each purpose. The table below sets out the main categories of personal data we hold, why we use them, and the lawful basis on which we rely.

What we collect	Why we use it (purpose)	Lawful basis
Identity & contact details (name, address, email, phone, date of birth)	To respond to enquiries, process applications and enrolments, and contact you about your studies	Contract; consent (for marketing)
Application & qualification information (prior qualifications, exemptions, employment)	To assess eligibility, admissions and exemptions, and to plan your programme	Contract; legal obligation (apprenticeships)
Learning & assessment records (progress, results, awards, mitigating circumstances, academic misconduct)	To deliver and assess your programme and to award and certify qualifications	Contract; legal obligation
Special category data (health, disability, wellbeing)	To provide support and reasonable adjustments and to safeguard individuals	Explicit consent; or substantial public interest / health & social care (Art. 9)
Financial information (fees, payment details)	To take payment and administer your account	Contract; legal obligation (accounting)
Apprenticeship & employer information	To deliver apprenticeships and meet funding-body requirements	Contract; legal obligation
Website & cookie data	To operate the website and, with consent, to understand usage	Consent; legitimate interests (essential operation)

Where we rely on consent (for example for some marketing), you can withdraw it at any time. Where we rely on a contract or a legal obligation and you do not provide the data, we may be unable to provide the service — for example, we cannot enrol you without the information needed to register you with the awarding body.

4. Special category data

Some of the data we hold is “special category” data — for example information about your health, disability or wellbeing, which you may give us so that we can provide support or reasonable adjustments. We only process special category data where an additional condition under Article 9 of the UK GDPR applies, such as your explicit consent, the provision of health or social care, or reasons of substantial public interest, and we apply appropriate safeguards.

5. Where your data comes from

Most of the personal data we hold comes from you directly. We may also receive data from your employer (for apprenticeships and sponsored study), from referees, and from the awarding and regulatory bodies involved in your qualification.

6. Who we share your data with

We do not sell your personal data. We share it only where necessary to provide our services, meet our legal and regulatory obligations, or with your consent. The main organisations we share data with are:

●       Qualifications Scotland (the UK awarding and accreditation body that replaced the Scottish Qualifications Authority (SQA) in December 2025) and the Council for Licensed Conveyancers (CLC), as the bodies that award and regulate your qualification;

●       for apprenticeships, the relevant government department and funding body, your employer, and any end-point assessment organisation;

●       our service providers (for example our virtual learning environment, IT, payment and communication providers), who act on our instructions under a contract;

●       professional advisers, auditors and regulators where required; and

●       other parties where we are required or permitted to share by law, including to safeguard individuals.

Where we share data routinely, a data sharing agreement is put in place. We tell you about this sharing when you register with us.

7. International transfers

Where any of our service providers store or process personal data outside the United Kingdom, we ensure that an appropriate safeguard required by the UK GDPR is in place before the transfer takes place, and we maintain a record of which providers this applies to and the mechanism relied on.

8. How long we keep your data

We keep personal data only for as long as we need it for the purposes set out in this policy, in line with our Records Management Policy. Retention periods reflect statutory, regulatory and audit requirements — for example, we retain assessment and certification records for the period required by Qualifications Scotland (six years for regulated qualifications, and longer where an appeal or other case remains live). After you cease to be a student, we keep a limited core record of your achievements and award, and any financial records we are required to keep, and securely delete or anonymise the rest when it is no longer needed.

9. How we keep your data secure

We use appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These include controlled access, secure storage, access on a need-to-know basis, staff training, and secure handling of email and devices. Our Data Protection Policy and related procedures set these out in full.

10. Your rights

Under the UK GDPR you have the right to:

●       be informed about how we use your personal data (through this policy and our privacy notices);

●       ask for a copy of the personal data we hold about you (a subject access request);

●       ask us to correct inaccurate data (rectification);

●       ask us to erase your data in certain circumstances;

●       restrict or object to our processing, including objecting to direct marketing;

●       data portability where applicable; and

●       not be subject to solely automated decisions that have a significant effect on you.

To exercise any of these rights, contact our Data Protection Officer using the details above. We will respond within one month, which we may extend by up to two further months for complex requests, in which case we will let you know. There is normally no charge.

11. Cookies

When you use the Access Law website and online store, small files known as “cookies” and similar technologies may be stored on your device. We and our partners, including our store platform provider (Shopify), use cookies for three broad purposes: to make the site work and personalise your experience, to show you relevant advertising, and to carry out analytics. Cookies that are strictly necessary to operate the site are always used; for cookies used for personalisation, advertising and analytics, we will not use them unless you accept them.

When you first visit, you can accept or decline non-essential cookies, and you can refuse them as easily as you can accept them. You can change your choice at any time through our cookie controls or by adjusting your browser settings to refuse or delete cookies. If you decline non-essential cookies, the site will still work, but some features may be less personalised. Registered students will need to allow strictly necessary, per-session cookies to access password-protected areas of the virtual learning environment.

We handle any personal data collected through cookies in accordance with this policy and the Privacy and Electronic Communications Regulations (PECR) and the UK GDPR.

12. Marketing

We will only send you marketing about our courses where you have agreed to receive it, or where we are otherwise permitted to do so. You can opt out at any time using the unsubscribe link in our emails or by contacting us.

13. Complaints

If you are concerned about how we handle your personal data, please contact our Data Protection Officer first so we can put things right. You also have the right to complain to the ICO at any time: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; https://ico.org.uk/concerns/.

14. Changes to this policy

We review this policy annually, and sooner if the law or our practices change. When we make changes we will update the version and date above and publish the current version on our website.

 

Date: 15 June 2026