Your data, handled properly.

Next State is a specialist permanent recruitment firm working across artificial intelligence, digital assets and quant, covering technical, commercial, operational and leadership roles. We are the data controller for the information described in this notice.

Questions, requests and complaints: use the form on our contact page.

Candidates: your name, email, current role, specialism, location, professional links, the notes you write to us, and your CV if you attach one.

Companies: your name, company, work email, website, the roles you are hiring, your timeline and the brief you send us.

We retain submitted hiring briefs and contact details to review your requirements and, if you engage us, manage your search.

In both cases we also record the date and time you gave consent. We do not use tracking or advertising cookies, and there is no cookie consent banner, because the only browser storage we set is what the site needs to sign you in and to submit a form safely.

We do not ask for special category data (health, ethnicity, beliefs, sexual orientation) or criminal-record data. Please do not include it in a CV or message. If it reaches us unasked, we delete it.

Most data comes directly from you, through a form on this site, by email, or in conversation.

For search work we also look at professional sources that are public or licensed for recruitment: your public profile pages, company websites, conference listings, open-source contributions and professional networks. Where we hold your data without you having contacted us first, we tell you at first contact and give you a one-line way to be removed.

Assessing your suitability for a live search, and contacting you about it: legitimate interests (Article 6(1)(f)). Recruitment is our business, the data is professional rather than private, and you can object at any time.

Representing you to a named client for a named role: consent (Article 6(1)(a)), given in writing, per company and per role.

Keeping you on file for future roles, and any mailing we send: consent (Article 6(1)(a)), withdrawable at any time.

Running a client engagement, invoicing and enforcing terms: contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)) for tax and accounting records.

Keeping the site secure and our records accurate: legitimate interests (Article 6(1)(f)).

Where we rely on legitimate interests we have balanced them against your rights, and we will share that assessment on request.

Your CV and details are read by us. Nothing is sent to a client until you have said yes to that specific company and that specific role, in writing.

We use a small number of processors to run the site and store data: hosting, database, file storage and email delivery providers, all acting on our written instructions under Article 28 data-processing terms. We never sell data and we do not share it for advertising.

We may disclose data where the law requires it, or to professional advisers under a duty of confidence.

Our providers may process data outside the UK and EEA, mainly in the United States. Where that happens we rely on UK and EU adequacy decisions where they apply, and otherwise on Standard Contractual Clauses plus the UK International Data Transfer Addendum.

You can ask us for the list of providers and the safeguard used for each.

Candidate records: up to 24 months from our last meaningful contact, then deleted. We ask before that point whether you want to stay on file.

Unsuccessful applications for a specific role: 12 months, so we can come back to you if a similar role opens.

Client engagement records, contracts and invoices: 6 years from the end of the engagement, for contractual and tax purposes.

Browser storage: sign-in tokens last until you sign out or they expire, and form-safety values last only for your visit. You can ask us to delete your data sooner at any time.

We do not make decisions about you by automated means alone, and we do not profile you in any way that has a legal or similarly significant effect. Any internal ranking or shortlisting is a judgement made by a person, and you can ask us to explain it.

You have the right to be informed, to access a copy of your data, to have it corrected, to have it erased, to restrict how we use it, to data portability, to object to processing based on legitimate interests, and to withdraw consent. Withdrawing consent does not affect anything we did before you withdrew it.

You do not need to give a reason, and we do not charge a fee. We respond without undue delay and within one month of receipt, and will tell you within that month if we need to extend by up to two further months because a request is complex or numerous.

To make a request, see our data rights page, or write to us through our contact page with the words 'data request' as the subject.

CVs are stored in private file storage and are only ever retrieved through short-lived, authenticated links. Access to submissions is restricted to authorised Next State accounts, protected by individual logins and least-privilege database rules. Data is encrypted in transit and at rest.

If a breach is likely to risk your rights we notify the supervisory authority within 72 hours and tell affected people without undue delay.

If you are unhappy with how we have handled your data, tell us first through our contact page. You can then complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113), or to the supervisory authority in your EU country of residence.

We review this notice at least once a year. Material changes are dated here, and we will tell you directly if a change affects how we use data you have already given us.