Privacy Notice
This notice explains what personal data DBS Support collects when you apply for a check through us, why, who we share it with, how long we keep it, and what rights you have over it.
1. Who we are
DBS Support Ltd is a trading name of Llewelyn Enterprises Ltd, registered in England & Wales, No. 08862064, of 9 Chapel Street, Mumbles, Swansea SA3 4NH. We are the data controller for the personal data described in this notice.
2. Information we collect
To process your application, we collect: your name, date of birth, gender and any former names; your address history; contact details (email, phone); identity document details and images; a personal identification number where relevant; payment details; and technical data such as your IP address, browser and device information, collected automatically when you use our site.
If you don’t provide the information a given check requires, we won’t be able to complete it — we’ll always tell you what’s mandatory versus optional at the point we ask for it.
3. Criminal record data
The purpose of our service is to obtain a criminal record check on your behalf, so the certificate itself — including any conviction, caution, reprimand or warning it discloses, and any barred-list status for Enhanced checks — is information about criminal offences. This is a distinct, especially sensitive category of data under UK data protection law (separate from the “special category” data described in section 4).
We only process this data because it’s necessary to provide the check you (or your employer, on your behalf) have applied for, under the statutory scheme operated by the Disclosure & Barring Service and Disclosure Scotland. We don’t use it for any other purpose, and access to it within DBS Support is restricted to staff who need it to process your application.
4. Digital identity verification (TrustID)
Where you choose, or are required, to verify your identity using our digital identity verification route, we and our identity verification partner, TrustID, will process the following in addition to the data in section 2:
- images of your identity document (for example your passport or biometric ID card);
- a facial image or short video captured for liveness and facial-matching purposes;
- the outcome and confidence level of that verification check.
TrustID is a Digital Verification Service certified under the UK Digital Identity and Attributes Trust Framework (DIATF). It processes this information as our data processor and does not use it for any other purpose.
Your facial image and document images are special category biometric data under Article 9 UK GDPR. We only process this data with your explicit consent, given at the point you choose the digital identification route. You don’t have to use this route — you can ask to complete identity verification manually instead, at no disadvantage to your application, and withdrawing consent at any point before your check is completed will move you to the manual route.
We keep the audit trail of your digital identity check for a minimum of 2 years, in line with DBS’s digital identity verification guidance — longer than the general retention period in section 8, for this data specifically.
5. Our legal bases for processing
We rely on the following, depending on what we’re doing with your data:
- Contract: processing your application is necessary to provide the check you’ve asked us for.
- Legal obligation: where we’re required to handle or retain information in a particular way under DBS/Disclosure Scotland rules or other law.
- Legitimate interests: for running and improving our service securely (for example fraud prevention, and understanding how our site is used) — we don’t use this basis where it would be outweighed by your own rights and interests.
- Consent: for biometric data if you choose digital identity verification (section 4), and for any marketing communications (section 10) — you can withdraw this at any time.
6. Who we share your data with
We share your data with: the Disclosure & Barring Service and/or Disclosure Scotland, to obtain your certificate; identity verification providers, currently CBS Screening Limited and, where you choose the digital route, TrustID; the Post Office, if you verify your identity in branch; the employer or organisation that requested your check, where applicable; and service providers who support our IT, hosting and payment systems. Every third party we use is only given the data it needs to do its job, and must handle it securely and in line with this notice and the law. We don’t sell your data, and we don’t share it with anyone else unless the law requires it.
7. International transfers
We and our processors are UK-based, and we don’t expect your data to leave the UK in the ordinary course of providing your check. Where any of our identity verification providers do transfer data outside the UK, they do so only with appropriate safeguards in place, as required by UK data protection law.
8. How long we keep your data
Once a recruitment decision has been made (or, for a Basic check you’ve applied for yourself, once it’s complete), we don’t keep Disclosure information for any longer than necessary — generally up to 6 months, other than the limited audit record DBS’s e-bulk system retains for longer. Digital identity verification data is kept for the longer, distinct 2-year period set out in section 4.
9. Cookies
We do not set or access first-party cookies on your computer. You can control or restrict cookies generally through your browser settings at any time.
10. Marketing
We will only contact you with marketing or promotional material by email, phone or post if you’ve actively opted in to this. You can withdraw your consent and stop these communications at any time, free of charge, by contacting us using the details in section 13.
11. Keeping your data secure
We maintain appropriate physical, electronic and managerial safeguards to protect the data we hold, and we review these regularly. If we ever become aware of a breach affecting your data, we’ll act promptly to contain it and, where the law requires it, notify you and the ICO.
12. Your rights
Subject to some exemptions that apply to Disclosure information (including the retention periods in section 8), you have the right to:
- Access the personal data we hold about you, free of charge.
- Correct any of it that’s inaccurate or incomplete.
- Erasure — ask us to delete data we no longer have a valid reason to keep.
- Restrict how we use your data in certain circumstances.
- Object to processing based on our legitimate interests.
- Portability — receive data you’ve given us in a portable format, where we process it by consent or contract.
- Withdraw consent at any time, where we rely on it (this won’t affect anything we did before you withdrew it).
To exercise any of these, contact us using the details in section 13. We aim to respond within one month, and we may need to verify your identity first.
13. Contact us
If you have any questions about this notice or how we handle your data, contact us at support@dbs-online.org.uk.
14. Complaints
We’d welcome the chance to put things right directly if you’re unhappy with how we’ve handled your data — please contact us first using the details above. You also have the right to complain to the Information Commissioner’s Office (ICO) at any time, at ico.org.uk or on 0303 123 1113.
15. Changes to this notice
We may update this notice from time to time to reflect changes in our services or the law. The current version will always be available on this page.
About us
REGISTERED DBS UMBRELLA BODY 30157900009
DBS Support Ltd is a trading name of Llewelyn Enterprises Ltd t/a DBS Support Ltd, registered in England & Wales, No. 08862064.