Privacy notice
Last updated 11 October 2026. Daily DBS is a trading name of AOW Group Ltd ("we", "us"). This notice explains how we handle personal data on this website and in the Daily DBS service. It is written for two audiences: people who visit this site or contact us, and the individuals whose DBS certificate status is monitored through the service by an organisation they work or volunteer for.
Who we are and how to reach us
AOW Group Ltd, company number 14089346, registered office 2nd Floor Sterling House, Langston Road, Loughton, Essex IG10 3TS. We are registered with the Information Commissioner's Office under reference ZB390453. For anything about your data, email privacy@dailydbs.co.uk.
If you visit this website or contact us
When you use the contact form we collect your name, email address, organisation and whatever you write, and we use it to reply to you and, if you ask, to set up an account. Our lawful basis is our legitimate interest in responding to enquiries, or taking steps to enter into a contract with you. We keep enquiries for 12 months unless they lead to an account.
If you sign in to the portal, your browser keeps three things in its local storage on your own device (this is not a cookie): your sign-in session, the choices you make about how your board is shown, and, if you ask to be reminded later about two-factor sign-in, the time to remind you. Signing out removes the session and the display choices; the reminder time stays until you clear your browser's data. If you choose the old portal layout, your browser also remembers that choice (called dailydbs.layout), in this browser only; and if you close a notice in the new layout it remembers which one for that tab only. If you open an email link about an ownership offer before you have signed in, your browser also remembers which organisation it was about (called ddbs_pending_ownership), for one day or until you have signed in, in this browser only. The portal stores nothing else in your browser, and none of it is used to track you.
If your organisation uses Daily DBS to monitor your DBS status
Your organisation, or a partner acting for it, adds you to the service so that your DBS certificate's status on the DBS Update Service can be checked daily. In that relationship your organisation is the data controller and we are its data processor: we act only on its written instructions, under a data processing agreement, and it is the organisation you should contact first with questions about why you are being monitored. You should already have given that organisation permission to check your status.
What we hold about you
- Your name and date of birth as they appear on your DBS certificate, and your certificate number.
- The level of check (Standard or Enhanced) and whether it was issued for paid or voluntary work.
- The record that consent was obtained: the declaration made by your organisation when you are added or imported, and your own recorded consent where you use a collection link.
- The result of each daily check: whether your certificate remains current as no further information has been identified since its issue, or is no longer current, the certificate print date, and the date and time of the check.
What we do not hold
We never see the content of your DBS certificate. The Update Service tells us only whether a certificate remains current as no further information has been identified since its issue, or is no longer current; it does not tell us what any information is. We do not receive criminal record information.
Criminal offence data
A status result indicating that a certificate is no longer current may amount to criminal offence data under Article 10 of the UK GDPR and the Data Protection Act 2018. We process it solely on our customer's instructions, for the purpose of the customer meeting its safeguarding obligations, under a written appropriate policy document, and we restrict access to it to the customer's authorised users and the minimum of our own staff needed to run the service.
Where it is stored and for how long
Data is stored in a database hosted in the United Kingdom and encrypted at rest by our database provider, with access controlled at the database level so that each organisation can only see its own people. Records of people you monitor are kept while they are on checking. If you take a person off checking, or your account is closed, their records and check history are permanently deleted 90 days later, and you can reinstate them or export your data in that time. Check history for people still on checking is kept for 12 months. Copies held in our database provider's backups are deleted when those backups expire and are not restored except to recover from a failure.
Who else sees it
Our sub-processors are a database and authentication provider hosted in London, an application hosting provider running in a London region, a transactional email provider in the European Union region, and a UK payment processor that receives customer billing details only, never certificate data. Each is bound by a written data processing agreement and holds independent security certification. The named list is provided to every customer organisation in its data processing agreement, and your organisation can share it with you. We do not sell, share or use your data for any other purpose.
Your rights
You have the right to ask for a copy of the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, and to complain to the Information Commissioner's Office (ico.org.uk). If we are processing your data on behalf of your organisation we will pass your request to it and help it respond; you can also go to the organisation directly.
Security
You sign in with a one-time link sent to your email, or with your Google or Microsoft account. There are no passwords, so we hold none to guess, reuse or leak. If you use a Google or Microsoft account you can use that provider's two-factor authentication; they confirm your email address to us and we receive your name and email from them, nothing else. You can also protect your sign-in with an authenticator app, and owners and administrators can be required to use it. For a new account it is required: the owners and administrators of a new account have 14 days to set up an authenticator app, and cannot see its records after that until they have. Data is encrypted in transit using TLS and at rest by our database provider. We keep a log of every check and its result, every email we send, every change to who has access, every import, every agreement accepted, and every change to a monitored person's record (what changed and when, though never a name, date of birth or certificate number). We review access regularly and will tell affected organisations without undue delay if a breach ever affects their data.
Changes
We will post any changes to this notice here and, for material changes affecting monitored individuals, tell our customers so they can inform their people.