HEdway Privacy Statement: Website and General

This Privacy Statement explains how HEdway Group Limited collects and uses personal information when you interact with us through our website or in general business communications. It is one of two HEdway Privacy Statements: this one covers website and general business interactions; a separate Consent-based Privacy Statement applies when you take part in HEdway research activities such as interviews, focus groups, or surveys.

If you have questions about how HEdway handles your personal information, please contact our Data Privacy Officer (DPO) at HEdwayDPO@hedwaygroup.com.

1. Purpose

The purpose of this Statement is to tell you, plainly and completely, what personal information HEdway collects through our website and general business communications, why we collect it, what we do with it, how long we keep it, and what rights you have over it under UK data protection law.

2. Context

HEdway Group Limited (Company number 10646747), and its subsidiaries and trading names, are registered in England and Wales. In this Statement we refer to ourselves as "HEdway", "we", "us", or "our".

The internal HEdway commitments that govern our handling of your personal information are set out in our Data Protection Policy and our Information Security Policy. Both are available on request from our DPO. This Statement is the data-subject-facing expression of those commitments.

3. Information we collect

3.1 Information you provide directly

You may provide information such as your name, professional role, organisation, telephone number, postal address, and email address to enable us to send information, provide updates, and process queries you raise with us.

You may provide additional information when you communicate with us, give us feedback, respond to a HEdway survey, or interact with us during a sales or business development conversation.

3.2 Information we collect when you use our website

When you visit our website, we may collect technical information including browser type, operating system, and the website you visited immediately before coming to ours. This information is used in an aggregated form to analyse how people use our site and to improve our service.

The HEdway website currently sets no cookies. If we introduce cookies that require consent, they will be managed through a cookie banner shown when you first visit the site, and this Statement will be updated.

Our website may contain links to other websites that we do not own or control. We are not responsible for the privacy practices of those other websites; we encourage you to read the privacy statements of any website you visit that collects personal information.

3.3 Information we receive from third parties

We may receive personal information about you from third parties, including business contact databases, sector membership organisations, mutual professional contacts, and (where you are a contact at one of our clients) the client organisation itself. When we do, we protect this information in line with this Statement.

4. How we use the information

We use your personal information to:

• Provide information, updates, and services to you
• Respond to your queries and process your requests
• Conduct business development with senior staff at UK higher education institutions and adjacent sector organisations in their professional roles
• Make you aware of services and opportunities that may be relevant to your professional interests
• Improve our website and services
• Maintain operational records of our business communications and contractual relationships

We may contact you by telephone, email, post, or other communication channels appropriate to the context. You can ask us to stop contacting you at any time using the rights set out in Section 7.

5. The legal grounds we rely on

UK data protection law requires us to have a clear legal basis for processing your personal information. We use three:

• Contract. Where we process your information to perform a contract for goods or services you or your organisation has requested, or to take steps you have requested before entering into a contract. Most of our processing of client and prospect contact information sits here.
• Legitimate interest. Where we have a legitimate business interest that is not overridden by your interests or rights. We use this for business development outreach to senior staff at UK higher education institutions in their professional roles, website analytics, and operational record-keeping.
• Consent. Where you have given us specific consent. We use this for some marketing communications, and it would apply to any non-essential cookies if these are introduced on our website.

A separate basis applies where we collect data through your participation in a HEdway research activity (interview, focus group, survey, or similar). Our Consent-based Privacy Statement is the relevant document in that case.

6. International transfers and use of AI tools

Some of the personal information we process is transferred outside the United Kingdom. This most commonly happens through the AI tools we use to support our project delivery work, whose servers are located outside the UK.

Where we transfer personal information outside the UK, we rely on one of the lawful transfer mechanisms recognised by UK data protection law, which include the UK-US Data Bridge, Standard Contractual Clauses with the UK Addendum, and the UK International Data Transfer Agreement. The specific mechanism for any AI tool processing your personal data is recorded in our Approved Tool Register, maintained by the DPO. You may request information about the specific mechanism in use by contacting our DPO.

We classify AI tools by the data protection they offer. We use only tools that contractually commit not to use your data to train their models, and (for tools whose servers are outside the UK or EU) only those covered by a lawful UK transfer mechanism. We do not use AI tools that lack these protections to process any personal information.

7. Your rights

Under UK data protection law you have the following rights in respect of the personal information we hold about you. To exercise any of them, please email our DPO at HEdwayDPO@hedwaygroup.com.

• The right of access. Request a copy of the personal information we hold about you.
• The right to rectification. Ask us to correct personal information that is inaccurate, out of date, or incomplete.
• The right to erasure. Ask us to delete your personal information in certain circumstances. Where your information has been used in our AI tools, we will action the deletion and confirm completion to you. Where a specific tool's design does not support targeted deletion, we will arrange an alternative form of compliance.
• The right to restrict processing. Ask us to restrict how we process your personal information in certain circumstances.
• The right to data portability. Ask us to transfer your personal information to another organisation in a structured, commonly-used, machine-readable format.
• The right to object. Object to our processing of your personal information for direct marketing, or for certain other purposes including processing based on legitimate interest.
• The right to withdraw consent. Where we are processing your information based on your consent, you can withdraw that consent at any time.
• The right to complain to the Information Commissioner. You can raise a concern or complaint with the Information Commissioner's Office (ICO) at any point. ICO helpline: 0303 123 1113; email: casework@ico.org.uk; postal address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

We respond to requests within one calendar month, extendable by a further two months for complex or numerous requests, with notification of any extension. Routine requests are handled without fee.

8. How long we keep your information

We keep your personal information for as long as you remain a client or prospective client, or for as long as we have a valid business reason to do so. Where your information has been used by HEdway's AI tools in the course of an engagement, the AI tool's project knowledge or memory store containing that information is purged 12 months after contract completion.

After the retention period, your personal information is securely deleted or fully anonymised.

9. Disclosure of your information

We may disclose your personal information to:

• HEdway Members and our suppliers, where they need it to carry out the work we are doing with or for you
• Third parties to comply with a legal requirement, such as a court order or a request from a law enforcement agency
• A potential purchaser, in the event of a sale or transfer of HEdway business assets, under an agreement to maintain confidentiality

Where we share your information with a third party for any of the purposes above, we require them to handle it in line with this Statement.

10. How we protect your information

We have physical, electronic, and managerial measures in place to safeguard your personal information against loss, unauthorised access, modification, or disclosure. The measures are set out in our Information Security Policy, available on request from our DPO.

The transmission and exchange of information across the internet is carried out at your own risk. While we take measures to safeguard against unauthorised disclosures, we cannot guarantee the security of information you transmit to us or receive from us.

11. Updates to this Statement

We may update this Statement from time to time. The updated Statement becomes effective immediately on publication. The version and date of the current Statement are at the end of this document.

12. Contact

For any question about your personal information, or to exercise any of the rights in Section 7, contact our DPO: HEdwayDPO@hedwaygroup.com

HWG-INFO-02-STMT-privacy-website, version 1.1, 19 August 2026. Supersedes version 1.0 (6 April 2026) and the Privacy Statement (Website) last updated May 2022.