§ Data Rights
Your data, your call.
Under the UK GDPR and the EU GDPR you have eight rights in respect of your personal data. Each is exercised the same way: one written request to us, answered within one month, with no fee.
Be informed.
Know what we hold, why we hold it and who we share it with. That is set out in full in our privacy notice.
Access.
Request confirmation that we process your data and a copy of it, together with the purposes, categories of data, recipients and retention periods. This includes your CV and our notes on you. We do not charge for a first request.
Correction.
Tell us anything that is wrong or out of date and we will fix it, and tell anyone we have passed it to.
Erasure.
Ask us to delete your record. We delete it unless we are legally required to keep part of it, in which case we tell you exactly what stays and why.
Restriction.
Ask us to keep your record but stop using it, for example while we check something you have disputed.
Portability.
Ask for the data you gave us in a structured, machine-readable file you can take elsewhere.
Object.
Object to us processing your data on the basis of legitimate interests, including any approach about a role. We stop unless we can show a compelling reason not to.
Withdraw consent.
Withdraw consent for us to represent you to a client, to keep you on file, or to email you. One line is enough, and it takes effect immediately.
§ How to ask
- Send us a message through our contact page, write 'data subject request' as the subject, and tell us which right you wish to exercise. You do not need to give a reason or use any particular form of words.
- We may ask for information reasonably necessary to verify your identity, usually a reply from the address we already hold for you. The response period starts once we can identify you.
- We respond without undue delay and within one month of receipt. Where a request is complex or where you have made several requests, we may extend that period by up to two further months and will tell you within the first month.
- We do not charge a fee. Where a request is manifestly unfounded or excessive we may charge a reasonable administrative fee or refuse it, and will explain why and how to complain.
Next State is the data controller for candidate and client data described in our privacy notice. Contact for all data matters: our contact page.
If you are not satisfied with our response, you can complain to the UK Information Commissioner's Office at ico.org.uk or to the supervisory authority in your EU country of residence.