Privacy notice
Last updated 14 September 2026. Daily DBS is a trading name of AOW Group Ltd ("we", "us"). This notice explains how we handle personal data on this website and in the Daily DBS service. It is written for two audiences: people who visit this site or contact us, and the individuals whose DBS certificate status is monitored through the service by an organisation they work or volunteer for.
Who we are and how to reach us
AOW Group Ltd, company number 14089346, registered office 2nd Floor Sterling House, Langston Road, Loughton, Essex IG10 3TS. We are registered with the Information Commissioner's Office under reference ZB390453. For anything about your data, email privacy@dailydbs.co.uk.
If you visit this website or contact us
When you use the contact form we collect your name, email address, organisation and whatever you write, and we use it to reply to you and, if you ask, to set up an account. Our lawful basis is our legitimate interest in responding to enquiries, or taking steps to enter into a contract with you. We keep enquiries for 12 months unless they lead to an account.
If your organisation uses Daily DBS to monitor your DBS status
Your organisation, or a partner acting for it, adds you to the service so that your DBS certificate's status on the DBS Update Service can be checked daily. In that relationship your organisation is the data controller and we are its data processor: we act only on its written instructions, under a data processing agreement, and it is the organisation you should contact first with questions about why you are being monitored. You should already have given that organisation permission to check your status.
What we hold about you
- Your name and date of birth as they appear on your DBS certificate, and your certificate number.
- The level of check (Standard or Enhanced) and whether it was issued for paid or voluntary work.
- The record that you authorised the organisation to check your status.
- The result of each daily check: whether your certificate is still current, whether the Update Service reports new information, the certificate print date, and the date and time of the check.
- Your email address, if the organisation asks us to send you Update Service renewal reminders.
What we do not hold
We never see the content of your DBS certificate. The Update Service tells us only whether a certificate is still current or whether new information exists; it does not tell us what that information is. We do not receive criminal record information.
Criminal offence data
A status result indicating that new information has been recorded may amount to criminal offence data under Article 10 of the UK GDPR and the Data Protection Act 2018. We process it solely on our customer's instructions, for the purpose of the customer meeting its safeguarding obligations, under a written appropriate policy document, and we restrict access to it to the customer's authorised users and the minimum of our own staff needed to run the service.
Where it is stored and for how long
Data is stored in an encrypted database hosted in the United Kingdom, with access controlled at the database level so that each organisation can only see its own people. We keep records while your organisation's account is active and delete them within 90 days of the organisation removing you or closing its account, unless the organisation asks us to export them first. Check history is kept for the same period so that the organisation can evidence its monitoring.
Who else sees it
Our sub-processors are the providers that host the database and application (Supabase, London region; Vercel), send email (Resend, EU region) and process payments (Stripe — customer billing details only, never certificate data). Each is bound by a written agreement. We do not sell, share or use your data for any other purpose.
Your rights
You have the right to ask for a copy of the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, and to complain to the Information Commissioner's Office (ico.org.uk). If we are processing your data on behalf of your organisation we will pass your request to it and help it respond; you can also go to the organisation directly.
Security
Logins use email verification with optional two-factor authentication. Data is encrypted in transit and at rest. Every check and every change to a record is logged. We review access regularly and will tell affected organisations without undue delay if a breach ever affects their data.
Changes
We will post any changes to this notice here and, for material changes affecting monitored individuals, tell our customers so they can inform their people.