Last updated: 21 October 2026
This policy explains how ST HECS Limited collects and uses personal information from clients, candidates and staff, and from visitors to sthecs.co.uk.
Who we are
ST HECS Limited provides education staffing, healthcare staffing and cleaning services across Luton, Bedfordshire and Hertfordshire. We are registered in England and Wales, company number 14900093, and we are the data controller for the information described here.
Contact: info@sthecs.co.uk · 07766 300175 · 5 Brook Street, Luton LU3 1DS.
What we collect
- Enquiries and clients: your name, organisation, email, phone number and the details of the staffing or cleaning service you need. If you become a client, we also keep booking, site access and invoicing records.
- Candidates and staff: your CV, contact details, work history, qualifications, references, right-to-work documents, availability, and the bank and tax details we need to pay you.
- Background checks: we run DBS checks through our provider, uCheck. Staff working with children or vulnerable adults have an Enhanced check with barred list. Cleaning staff have a Basic or Standard check. This involves identity documents and the result of the check.
- Website usage: with your consent, Google Analytics records how visitors use the site (pages viewed, approximate location, device and browser).
- Security data: our website security and spam-filtering tools process IP addresses and browser details to block spam and attacks.
Why we use it
- To reply to your enquiry, provide quotes and deliver our services. This is necessary to perform a contract with you or to take steps at your request before one.
- To find you suitable work, place you with clients, and pay you. This is necessary for your contract with us and to meet our legal obligations (right-to-work, tax and employment law).
- To run background checks for safeguarding. We process criminal record information only where the law allows it. That covers roles with children or vulnerable adults, and roles where our clients require it to protect their premises and people.
- To keep our website secure. This is based on our legitimate interests.
- To understand how the website is used, with Google Analytics. This is based on your consent, which you can withdraw at any time.
We do not sell your personal information.
Sharing with clients and providers
If you are a candidate, we share relevant details with clients when we put you forward for, or place you in, an assignment. That includes your name, experience, qualifications and confirmation of your checks. We tell you before we put you forward.
We also use providers that help us run the business: uCheck for DBS checks, our website host, Google (Analytics, Workspace and Business Profile), WhatsApp (if you message us there), email, payroll and accounting tools, and our bank. Some of these providers process data outside the UK. Where they do, they rely on UK adequacy decisions or standard contractual safeguards.
Cookies and analytics
When you first visit, a banner asks whether you accept analytics and marketing cookies. Until you choose, Google Analytics runs with storage denied and sets no analytics cookies. If you accept, Google Analytics sets cookies such as _ga and _ga_*, which last up to two years.
We also set a necessary cookie, cookieadmin_consent, to remember your choice for up to one year. You can change your choice at any time with the cookie icon on the page, or by clearing cookies in your browser.
How long we keep it
- Enquiries that do not become work: up to 2 years.
- Client, payroll and financial records: 6 years after the end of the tax year, as UK law requires.
- Candidate records: while you are registered with us, and for a reasonable period afterwards.
- Background check information: only for as long as we need it for safeguarding and compliance.
- Analytics data: 14 months in Google Analytics.
Your rights
You can ask to see, correct or delete the information we hold about you. You can also object to or restrict how we use it, ask for a copy to move elsewhere, and withdraw consent at any time. Some records must be kept by law even if you ask us to delete them. Email info@sthecs.co.uk and we will reply within one month.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk.
Changes
We may update this policy from time to time. The date at the top shows when it last changed.