State 21 Ltd ICO Registration No: ZA283589

We at State 21 recognise, as Data Controller, that people providing us with information wish to understand why we keep information, how it will be used, who it will be stored with and how it is stored. Our data protection policy sets out our commitment to protecting personal data and how we implement that commitment. Using the ICO principles we have set out answers to key questions.

The type of data we collect.

We collect both personal and, in some circumstances, such as for associates, special category data, typically your full name, address, email address, telephone number, bank account details, your CV, and where a client makes stringent vetting a condition in their contract, we may require you to provide special category relating to your health, religion or membership of a trades union or data relating to you as a victim or involvement in a criminal offence.

Where is it stored?

We store your information on a secure server provided by an ICO registered IT provider. We do not hold your data on our systems any longer than is necessary (we are under a statutory obligation to retain certain data relating to taxation for up to 6 years).

Why is it being collected?

For Students

Because you are attending one of our courses or you have attended one of courses. The purpose of this includes putting together class lists, for Health and Safety in the event of a Fire Alarm or similar occurrence, for communication with your employer regarding attendance and for preparation of certificates.

For Associates

To allow us to both identify and bid for work, and for financial transactions, in the knowledge we can sub-contract some of the work to you. We also use the CRM spreadsheet to quickly identify if our sub-contractors have the required skills areas for opportunities.

We ensure this does not override your own interests, rights or freedoms.

Our Lawful Basis.

For Students

The information is necessary to fulfil our role of providing training to you, for confirming attendance, for Health and Safety and for subsequent issuing of certificates, in accordance with the contract we agree with your employer. It is within our legitimate interests to do so, however, we do so sensitively and without compromising your own rights and freedoms. Article 6(1)(f).

For Associates:

If you are successful in becoming a member of staff or one of our associates your personal information is required as its necessary as part of entering into a contract with us: Article 6(1)(b).

Our business model provides solutions and services to our customers. We provide them with either members of our own staff or our associates with the appropriate skills and expertise to deliver projects or ongoing support. It is within our legitimate interests to do so, however, we do so sensitively and without compromising your own rights and freedoms. Article 6(1)(f).

Some of our contracted clients require our staff and associates to be vetted to a high security clearance, such is the sensitivity of the work. The information required from you may include additional and sensitive information, referred to as special category data or criminal data. This is necessary for the purposes of employment and social security and social protection law. Article 9 (2)(b) and the Data Protection Act 2018, Schedule 1, Part 1.

How will it be used?

For Students:

The data we use is necessary to allow us to deliver our training to you, to inform your employer of attendance and to allow us to issue certificates.  We can also advise your employer of previous attendance on courses, when agreeing future training requirements.

For Associates:

We use the data we store to help us identify the best candidates for roles, we will always talk to you about an opportunity before forwarding your information to a customer or client and only after consultation and agreement with you.

Who will it be shared with?

For Students:

The data will be shared with our team so that the training can be safely delivered. This allows for logging of attendance and for the production of certificates. We will also share the data with your employer to confirm attendance on our courses.

For Associates:

With your permission we share the information with our partner companies, such as SVGC, and with other companies where we may be making a combined bid or where you are supporting a bid.

What if I wish to have my information removed.

For Students:

We will keep the information only as long as is necessary to fulfil our contractual obligations. If at any time you wish to have your information removed, please tell us and we will ensure your information is removed from our system.

For Associates:

We will contact you at regular intervals to ensure that the information we hold is accurate and that you still wish us to hold the information. We will hold your data for as long as you have agreed in your associate agreement. If at any time you wish to have your information removed, please tell us and we will ensure your information is removed from our system.

Your Rights.

You have a right to access your personal data and any such requests made to us shall be dealt with in a timely manner.

 

Your rights include:

 

• The right to be informed about the collection and use of your personal data. This is a key transparency requirement of the legislation.
• The right to access information held about you.
• The right to have inaccurate personal data rectified or completed if incomplete.
• The right to have personal data erased.
• The right to request the restriction or suppression of the processing of their personal data.
• The right to data portability.
• The right to object to the processing of their personal data in certain circumstances.
• Rights in relation to automated decision making and profiling.

 

You also have the right to lodge a complaint with the Information Commissioner Office who can be contacted via their web site www.ico.org.uk

 

The Data Protection Act 2018 does not insist requests to be made in writing, however it will assist us to manage your request more quickly if you were to use either email or letter, accompanied by some form of identification such as a copy of a passport or driving licence. Your request should be directed to: enquires@state21.co.uk

 

In most circumstances no charges will be made. Information will be provided promptly and no later than 30 days following our receipt of your request.

 

Changes to this privacy notice

 

We keep our privacy notice under is reviewed every 12 months. This privacy notice was last updated in July 2025.