Criminal-Records Check Policy (DBS and International Equivalents)

HeyLocals is the UK-facing brand of ACL Travel S.r.l. Società Benefit, an Italian travel organiser. Our participants travel to partner organisations across 15 countries. Many of our placements bring participants into contact with children or adults at risk.

This policy explains how we use criminal-records checks as part of our safer-recruitment process for staff and participants — and, importantly, what our position is and is not, given that we are an Italian company rather than a UK employer or charity.

We set out here:

• What we require, by role and by country of residence;
• How we handle the fact that the UK’s Disclosure and Barring Service (DBS) is the relevant sector-standard benchmark for participants resident in the UK, even though we are not a UK-based body;
• How we handle disclosure information;
• What we will not do with the data;
• The rights of any person undergoing a check.

This is the single most important thing to understand about this policy, so we say it up front.

We are not:

• A UK charity or UK-registered employer;
• A UK “regulated activity provider” within the meaning of the Safeguarding Vulnerable Groups Act 2006;
• A UK registered body under Part V of the Police Act 1997 (we cannot and do not submit DBS applications directly).

We are:

• An Italian commercial company (S.r.l. Società Benefit);
• Subject to Italian company, civil and criminal law, including D.Lgs. 39/2014 implementing EU Directive 2011/93 on the verification of criminal record for those working in regular contact with minors;
• A travel organiser under the Codice del Turismo (D.Lgs. 79/2011), with the duties of care owed by such operators to their customers and to third parties affected by their activities;
• A seller of travel packages to UK and EU consumers, with the duties those contractual relationships imply under UK and EU consumer law.

Our approach is therefore a verification model, not a submission model. We require each applicant to obtain the appropriate criminal-records certificate for their country of residence, from the competent national authority, and to present it to us. We verify the certificate; we do not issue it.

For UK residents, the sector-standard benchmark is an Enhanced DBS certificate with Children’s Barred List check. The applicant obtains this through their own employer, through an existing Update-Service-linked certificate, or through a commercial UK umbrella body. For residents of other countries, the equivalent national certificate applies. Italian residents obtain a certificato penale from the competent Procura.

Everything in this policy follows from that starting point.

This policy is developed with reference to:

Italian law

• D.Lgs. 39/2014, implementing Directive 2011/93/EU, which requires the verification of the criminal record (certificato penale ex art. 25-bis DPR 313/2002) of persons engaged in professional activities involving regular contact with minors;
• Codice Penale, in particular Artt. 600-bis, 600-ter, 600-quater, 609-quater, 609-undecies (offences against minors and offences of adescamento);
• D.Lgs. 196/2003 (Codice Privacy) and Regulation (EU) 2016/679 (GDPR), in particular Art. 10 on processing of criminal-offence data;
• Codice del Turismo (D.Lgs. 79/2011) on the duties of travel organisers.

UK law and standards (applied voluntarily as sector-standard best practice)

• Safeguarding Vulnerable Groups Act 2006;
• Protection of Freedoms Act 2012;
• Police Act 1997 (Parts V and VI);
• Rehabilitation of Offenders Act 1974 and Exceptions Order 1975, as amended;
• DBS Code of Practice;
• Data Protection Act 2018 and UK GDPR.

Where conflict is possible, the standard that provides higher protection to the child prevails.

DBS: the Disclosure and Barring Service, a UK government body that issues criminal-records certificates and maintains the Children’s and Adults’ Barred Lists.

Basic DBS check: shows unspent convictions and conditional cautions only. Anyone in the UK can apply for one, for any purpose.

Standard DBS check: shows spent and unspent convictions, cautions, reprimands and final warnings held on the Police National Computer (subject to filtering). Only available for specific statutory purposes.

Enhanced DBS check: as Standard, plus any additional information held by local police that they judge relevant. Only available for specific statutory purposes, including working with children or adults at risk.

Enhanced DBS check with Barred List check(s): as Enhanced, plus a check of the Children’s Barred List, the Adults’ Barred List, or both.

DBS Update Service: a subscription service allowing an individual to keep their DBS certificate up to date and allowing authorised recipients to check it online.

ICPC (International Child Protection Certificate): a UK-issued criminal-records check, available to UK nationals and long-term UK residents travelling overseas to work with children. Issued by the National Crime Agency’s ACRO Criminal Records Office.

Certificato penale ex art. 25-bis DPR 313/2002: the Italian criminal-record certificate specifically required for those engaged in professional activities with minors, issued by the Procura della Repubblica.

Self-declaration: a signed statement in which an applicant discloses relevant criminal or safeguarding history directly to HeyLocals.

Regulated activity (children): a UK legal term defined in the Safeguarding Vulnerable Groups Act 2006. Most short-term overseas volunteer placements fall outside its scope as a matter of strict legal definition.

HeyLocals uses criminal-records checks as one element of a wider safer-recruitment process. No check, on its own, makes a person safe to work with children. Our approach rests on four layers:

1. Safer recruitment — values-based interviewing, two verified references, probing of motivations and attitudes.
2. Criminal-records checks — obtained by the applicant from the competent authority in their country of residence, verified by HeyLocals.
3. Self-declaration — a signed declaration of any relevant history that a criminal-records check might not capture.
4. Ongoing supervision, training and conduct standards — the Code of Conduct, the “two-adult rule,” partner oversight, and the reporting routes in the Safeguarding Policy.

A criminal-records certificate is a snapshot, not a guarantee. It tells us about recorded history in one jurisdiction at a moment in time; it does not predict future behaviour; it does not cover unreported harm, allegations that did not lead to conviction, or behaviour in jurisdictions other than the one issuing the certificate. For this reason, no placement decision is ever made solely on the basis of a criminal-records check.

6.1 Staff and in-house volunteers (any nationality), for roles involving contact with children

All applicants must provide criminal-records certificates covering each country in which they have been resident for six months or more over the preceding five years, in the form customary for work with minors in that country:

• Italian residents: certificato penale ex art. 25-bis DPR 313/2002 (the specific certificate required by D.Lgs. 39/2014 for activities involving minors), issued within the last 6 months.
• UK residents: Enhanced DBS certificate with Children’s Barred List check, obtained via the applicant’s own employer, existing Update-Service-linked certificate, or a commercial UK umbrella body; issued within the last 3 years and linked to the Update Service, or otherwise obtained afresh.
• Residents of other EU/EEA countries: the national equivalent certificate for work with minors (Führungszeugnis in Germany, extrait de casier judiciaire in France, certificat de bonne vie et mœurs / uittreksel strafregister in Belgium, certificado de antecedentes penales in Spain, etc.), issued within the last 6 months.
• Residents of countries outside the EU/EEA: the national criminal-records certificate issued by the competent authority, within the last 6 months, with certified translation to English or Italian.

Applicants must also sign a Safeguarding Self-Declaration (Appendix A) and accept our Code of Conduct.

6.2 Participants (fee-paying volunteers) on placements involving children

Short- and medium-term volunteer travel sits in a specific legal position. Under Italian D.Lgs. 39/2014 the strict requirement for the certificato penale applies to employment relationships with minors in Italy; it does not by its terms extend to fee-paying participants travelling abroad. Under UK law, most short overseas placements do not meet the strict definition of “regulated activity,” which means that an Enhanced DBS with Barred List check is frequently not legally required.

Nonetheless, as a matter of policy, HeyLocals requires all participants whose placement involves direct contact with children to provide:

• A valid criminal-records certificate from their country of residence, as follows:
  • UK residents: Enhanced DBS with Children’s Barred List check, issued within the last 3 years and linked to the Update Service (so that we can verify its status online), OR obtained afresh via a commercial UK umbrella body (we can provide a list of recognised providers). Where an Enhanced check is not available on eligibility grounds for the specific role, a Basic DBS plus an ICPC from ACRO (issued within the last 6 months).
  • Italian residents: certificato del casellario giudiziale issued by the Procura della Repubblica within the last 6 months. Where the participant can obtain the more specific certificato penale ex art. 25-bis through their current employer (e.g. schools, sports clubs, youth-work organisations), this is preferred.
  • Other EU/EEA residents: national equivalent certificate issued within the last 6 months.
  • Residents of non-EU/EEA countries: national equivalent certificate issued within the last 6 months, with certified translation.
• A signed Safeguarding Self-Declaration (Appendix A).
• A signed Code of Conduct (in the Safeguarding Policy, Appendix B).
• Completion of the pre-departure safeguarding training module.

For placements of 4 weeks or longer involving direct contact with children, UK-resident participants are additionally required to provide an ICPC from ACRO, issued within the last 6 months, regardless of whether they also hold an Enhanced DBS.

6.3 Participants whose placement does not involve contact with children

For placements that do not bring participants into direct or recurring contact with children (certain environmental, conservation, or adult-focused construction placements where children are not present), a signed Safeguarding Self-Declaration is required. A Basic DBS check, or equivalent national check, may also be required at the discretion of the DSL depending on the specific context of the placement.

6.4 Overseas partner staff

HeyLocals requires all partner organisations to apply a documented vetting process to their own staff and local volunteers, including:

• Local criminal-records check (where such a check exists and is reliably available);
• Two verified references;
• A values-based interview;
• A signed code of conduct aligned with HeyLocals’ Code.

Where the host country does not operate a reliable or accessible criminal-records system, the partner uses enhanced reference-checking, longer probation, and additional supervision, and describes these measures in writing in the Partner Safeguarding Agreement.

Because we are not a UK registered body and cannot submit DBS applications directly, UK-resident participants must obtain the required check through one of the following routes:

1. Through an existing employer that is a DBS registered body (school, NHS trust, youth organisation, local authority, charity). Many applicants already hold an Enhanced DBS for professional reasons. If the certificate is:
   • at the correct level (Enhanced with Children’s Barred List check);
   • for the correct workforce (child);
   • issued within the last 3 years;
   • subscribed to the DBS Update Service;
   then we can verify it online with the applicant’s written permission, and no new check is required.
2. Through the DBS Update Service, if previously subscribed. See guidance at www.gov.uk/dbs-update-service.
3. Through a commercial UK umbrella body, such as uCheck, Personnel Checks, Disclosure Services, GBG, or a charity-sector provider such as thirtyone:eight. The applicant, not HeyLocals, is the end user; HeyLocals acts as the recipient who verifies the issued certificate. The applicant is responsible for the fees charged by the umbrella body, typically in the order of £50–£70 for an Enhanced DBS at the date of this policy.
4. For an ICPC, directly via ACRO (www.acro.police.uk) at approximately £75 at the date of this policy.

We will provide clear written guidance to each applicant on which route is applicable to them, as part of the pre-booking information.

Where a participant lives in the UK but is not a UK citizen, they obtain the UK Enhanced DBS for UK records and a criminal-records certificate from each of their other recent countries of residence.

We will accept an existing DBS certificate only if all of the following are true:

• The certificate is at the correct level (Enhanced with Children’s Barred List for child-facing placements);
• The workforce type on the certificate (child, adult, or child and adult) covers the role;
• The certificate was issued within the last 3 years and the applicant is actively subscribed to the DBS Update Service, so that we can verify it online and confirm no new information has been added since issue;
• The applicant provides the original certificate (not a photocopy) for us to view before we accept it;
• The applicant has not undertaken work or activity since issue that might have given rise to new relevant information not covered by the certificate.

Where any of these conditions are not met, a new check is required.

The DBS Update Service allows authorised recipients to verify, online and at no additional cost, whether anything has changed on an applicant’s certificate since issue. Subscription is the applicant’s decision. We strongly encourage it for repeat participants.

10.1 International Child Protection Certificate (ICPC)

Issued by ACRO, the ICPC is the standard supplementary check for UK nationals and long-term UK residents travelling overseas to work with children. HeyLocals requires an ICPC, issued within the last 6 months, from:

• UK-resident participants whose role overseas would have qualified as regulated activity if carried out in the UK, but for which a UK Enhanced DBS is not eligible;
• UK-resident participants on placements of 4 weeks or longer involving direct contact with children;
• Any UK-resident participant where, in the judgement of the DSL, a UK-only criminal-records check alone is insufficient.

The ICPC fee is the applicant’s responsibility unless HeyLocals has agreed otherwise in writing.

10.2 Italian certificato penale ex art. 25-bis DPR 313/2002

For Italian residents, this is the specific certificate required by D.Lgs. 39/2014 for activities involving regular contact with minors. It is issued by the Procura della Repubblica and shows any conviction or ongoing proceeding for a sexual or violent offence against a minor that would bar the individual from working with minors in Italy. Italian-resident participants are required to provide it, or the general certificato del casellario giudiziale as a minimum where the specific one is not available.

10.3 National criminal-records certificates (other countries)

As set out in Section 6.

10.4 Safeguarding Self-Declaration

All participants, staff and in-house volunteers in child-facing roles complete a written Safeguarding Self-Declaration (Appendix A). It asks about:

• Any criminal conviction, caution, reprimand or final warning, spent or unspent, of any kind, in any jurisdiction;
• Any pending charge or ongoing investigation;
• Any previous safeguarding allegation, whether or not it resulted in formal action;
• Any previous removal or dismissal from a role involving children or adults at risk;
• Any bar or restriction imposed by a regulatory or professional body.

The self-declaration is asked in these terms because for roles of this kind, under both Italian D.Lgs. 39/2014 and, for UK-applicable purposes, the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 as amended, certain otherwise-spent or filtered convictions may still be relevant.

Non-disclosure of information that is later discovered will be treated as material breach of contract and will result in removal from the programme, irrespective of whether the underlying conviction would, on its own, have led to refusal.

10.5 References

Two references are sought for every child-facing role and verified directly with the referee. At least one referee must have known the applicant in a professional or similar structured capacity, and at least one must be able to comment on the applicant’s suitability to work with children.

11.1 Making decisions

A criminal record does not automatically disqualify an applicant from a role. HeyLocals assesses each case on its specific facts, taking into account:

• The nature and seriousness of the offence;
• How long ago it occurred;
• Any pattern of offending;
• Whether the applicant has since completed a sentence, rehabilitation or treatment;
• The relevance of the offence to the role applied for;
• The level of contact with children or adults at risk in the role;
• The applicant’s own account of the circumstances (which we invite before making a decision).

11.2 Automatic bars

Certain matters are automatic bars to a role involving contact with children:

• Inclusion on the UK Children’s or Adults’ Barred List;
• A conviction or caution for a “never-filtered” offence under DBS filtering rules (most serious violent and sexual offences);
• A conviction for an offence that would, under Italian D.Lgs. 39/2014, bar the applicant from working with minors in Italy;
• An outstanding charge for a serious violent or sexual offence;
• A history of safeguarding allegations consistent with a pattern of risk;
• Non-disclosure of relevant information on the self-declaration.

11.3 Discretionary cases

Where disclosure information is not an automatic bar, the DSL conducts a risk assessment, in writing, documenting:

• The information disclosed;
• The factors weighed;
• The decision reached;
• Any conditions or mitigations (e.g. supervision, restricted role, additional training);
• The reasoning.

The applicant is invited to provide their own written account before the decision is made and is informed of the decision and the basis for it. Applicants have a right of appeal, as set out in Section 15.

11.4 The “relevance” test

A conviction for an unrelated minor matter, long ago, is not treated the same as a conviction that bears directly on the role. Proportionality and relevance guide every decision.

11.5 Reporting of safeguarding concerns that arise from a check

Where disclosure information indicates that a child may currently be at risk, the DSL follows the reporting procedure in the Safeguarding Policy (Section 17), which may include referral to Italian authorities (Procura, Telefono Azzurro 19696, Emergenza infanzia 114), UK authorities (DBS referral where appropriate, NSPCC, LADO), or host-country authorities.

Criminal-records certificates and related data constitute “criminal offence data” and “special category” data under Regulation (EU) 2016/679 (GDPR), the Italian Codice Privacy and — for UK residents — the Data Protection Act 2018 and UK GDPR. Our handling of this data follows the standards in the DBS Code of Practice (for UK data) and Italian Garante guidance (for Italian data), and is described in our Privacy Policy.

Specifically:

• We view but do not retain original criminal-records certificates. We record the certificate number, issue date, level of check, and disclosure outcome (clear / disclosure made, with separate documented decision if the latter) in our secure recruitment record for the individual. We do not photocopy or store original certificates beyond what is necessary for the decision.
• Where a certificate has led to a recruitment decision requiring further records (risk assessment, conditions imposed), those records are stored securely and separately from general personnel files.
• Access to criminal-records information is strictly limited to the DSL, the Deputy DSL, and the relevant recruiting manager.
• The information is retained for the duration of the individual’s engagement with HeyLocals and for a defined period after termination, in line with the Safeguarding Policy retention schedule. It is then securely destroyed.
• The information is used only for the purpose for which it was collected (suitability for the specific role).
• It is not shared with any third party other than as required by law.
• Applicants have the usual rights under GDPR: a right of access (Subject Access Request), a right of rectification, and a right to complain to the competent supervisory authority (the Garante per la protezione dei dati personali in Italy, the Information Commissioner’s Office in the UK, or the supervisory authority of the applicant’s own country of residence).

The DSL is responsible for ensuring compliance with these standards.

For UK applicants, the Rehabilitation of Offenders Act 1974 and Exceptions Order 1975 (as amended, including following the Supreme Court’s 2019/2020 rulings) provide that certain older or minor convictions become “spent” and are filtered from Standard and Enhanced DBS certificates. Some offences (serious violent and sexual offences) are never filtered.

For roles at HeyLocals involving contact with children or adults at risk, we ask UK applicants to disclose spent as well as unspent convictions on the Safeguarding Self-Declaration, other than those that would be filtered under current DBS rules.

For Italian applicants, the certificato penale and casellario giudiziale reflect the rules on riabilitazione and estinzione under Italian law. We apply the same principle: a record that has been formally estinto is not treated as disclosable, except where specific law (such as D.Lgs. 39/2014 for work with minors) extends the disclosure obligation.

Applicants are entitled to take their own advice (in the UK, from the free service Unlock; in Italy, from a civil lawyer or a patronato) before completing their self-declaration.

• Enhanced DBS check (UK) obtained via a UK umbrella body: typically £50–£70. Paid by the applicant. The “free DBS check for volunteers” concession under UK law applies only where a UK registered body submits the application for a genuine volunteer; we are not a UK registered body, and so this concession is not directly available through us.
• Basic DBS check (UK): £18 at time of writing. Paid by the applicant.
• DBS Update Service subscription: £16 per year at time of writing. The applicant’s decision; where HeyLocals requires it for a specific role, it is reimbursed.
• ICPC (UK): approximately £75 at time of writing. Paid by the applicant unless specifically agreed otherwise.
• Italian certificato penale and casellario giudiziale: approximately €16 (marca da bollo plus diritti) at time of writing. Paid by the applicant.
• Other national certificates: national fees apply. Paid by the applicant.
• Certified translations of non-UK / non-Italian certificates: paid by the applicant.

HeyLocals does not mark up the cost of any check.

1. At the point of application, the participant discloses prior checks held and completes the Safeguarding Self-Declaration.
2. HeyLocals provides written guidance on the specific certificate(s) required for the applicant’s country of residence and role.
3. If an existing Enhanced DBS subscribed to the Update Service is held and meets Section 8 conditions, HeyLocals verifies it online with the applicant’s written permission.
4. If a new check is required, the applicant obtains it through the appropriate national route and submits the original (or, in specific circumstances, a certified digital copy) to HeyLocals.
5. In parallel, references are taken up and, where required, ICPC or other supplementary certificates are obtained.
6. The DSL reviews the completed file before travel and approves, declines, or seeks further information.
7. Outcomes are communicated to the applicant in writing, with reasons where the outcome is negative.

Appeals. An applicant who is declined may appeal in writing within 14 days. The appeal is determined by an administrator of ACL Travel S.r.l. who was not involved in the initial decision. That decision is final internally.

Complaints may be addressed to the DSL, to the administrators, or externally:

• To the Garante per la protezione dei dati personali (Italy, data-protection matters): www.garanteprivacy.it.
• To the Information Commissioner’s Office (UK, data-protection matters affecting UK residents): www.ico.org.uk.
• To the DBS (UK, certificate-content disputes): www.gov.uk/dbs.
• To Unlock (UK, advice for people with criminal records): www.unlock.org.uk · 01634 247350.

Travel cannot proceed without a completed file.

• This policy is reviewed at least annually by the DSL and approved by the administrators of ACL Travel S.r.l.
• Any material change to DBS law, DBS fee rules, filtering, Italian D.Lgs. 39/2014 or the Rehabilitation of Offenders Act triggers an immediate review.
• The DSL reports annually to the administrators on the number and types of checks undertaken, without identifying individuals, and on any lessons learned. A summary is included in the Società Benefit relazione d’impatto annuale.

HeyLocals — internal

• Designated Safeguarding Lead: Andrea Tonetti · [email protected] · phone contact and applicable availability provided in the Pre-Departure Pack
• Deputy DSL: Giovanni Sala · [email protected] · phone contact and applicable availability provided in the Pre-Departure Pack
• General queries on this policy: [email protected]
• Data Protection contact: [email protected]
• PEC: [email protected]
• By post, UK: WeWork, Aviation House, 125 Kingsway, London WC2B 6NH, United Kingdom
• By post, Italy: ACL Travel S.r.l., Piazza Durante 24, 20131 Milano, Italy

UK external

• DBS: www.gov.uk/dbs · 03000 200 190
• ACRO (ICPC): www.acro.police.uk
• Unlock: www.unlock.org.uk · 01634 247350
• Information Commissioner’s Office: www.ico.org.uk · 0303 123 1113
• NSPCC Helpline: 0808 800 5000

Italian external

• Ministero della Giustizia (information on certificato penale): www.giustizia.it
• Garante per la protezione dei dati personali: www.garanteprivacy.it
• Telefono Azzurro: 19696
• Emergenza infanzia: 114

To be completed in writing by every applicant for a role involving contact with children or adults at risk, before any placement decision. Completed forms are held confidentially by the DSL.

Part 1 — Personal details

• Full name (and any previous names):
• Date of birth:
• Current address:
• Addresses for the last 5 years:
• Countries of residence for the last 5 years:
• Nationality (or nationalities):
• Role applied for:

Part 2 — Declarations

For the purposes of this declaration, “conviction” includes spent as well as unspent convictions, in any jurisdiction (other than those that would be filtered from a UK Enhanced DBS or fall under Italian estinzione rules for non-safeguarding-relevant offences); “caution” includes reprimands, final warnings and conditional cautions; “allegation” includes formal complaint, investigation or disciplinary action, irrespective of outcome.

1. Have you ever been convicted of, or cautioned for, any criminal offence, in any jurisdiction? Yes / No
2. Are you currently the subject of any pending criminal charge, investigation or prosecution, in any jurisdiction? Yes / No
3. Have you ever been the subject of any safeguarding allegation, disciplinary process, or dismissal in connection with a role involving children or adults at risk? Yes / No
4. Are you, or have you ever been, included on the UK Children’s Barred List, the UK Adults’ Barred List, or an equivalent barring list in any jurisdiction? Yes / No
5. Are you subject to any restriction, prohibition or notification requirement imposed by a court, the police, or a regulatory body, in any jurisdiction, including any sexual-offences notification requirement, sexual-harm prevention order, or equivalent? Yes / No
6. Have you ever been refused a Basic, Standard or Enhanced DBS certificate, an Italian certificato penale, or an equivalent check in another jurisdiction, on the basis of disclosure information? Yes / No
7. Are there any matters not covered above that you believe HeyLocals should be aware of in assessing your suitability for this role? Yes / No

If the answer to any of questions 1-7 is Yes, please provide full details on a separate sheet.

Part 3 — Statement

I confirm that the information I have provided is true and complete. I understand that HeyLocals will use this information, together with any criminal-records check obtained, to assess my suitability for the role. I understand that any false, misleading or incomplete answer will be treated as material breach of contract and may result in my immediate removal from the programme, referral to statutory authorities, and a lifetime ban from HeyLocals and partner programmes.

I understand that I may withdraw this declaration before it is relied on, in which case my application will not proceed further.

1. Applicant name and role applied for
2. Date of receipt of information
3. Source of information (DBS / ICPC / Italian certificato penale / other national certificate / self-declaration / third party / other)
4. Summary of information disclosed
5. Nature and seriousness of the offence(s)
6. Date(s) of the offence(s) and time elapsed
7. Pattern (single incident / repeat)
8. Completion of sentence / rehabilitation / treatment
9. Relevance to the role applied for
10. Level of contact with children or adults at risk in the role
11. Applicant’s own account (attached)
12. Available mitigations (supervision, restricted duties, training, etc.)
13. Decision: (a) accept without condition / (b) accept with conditions (specified) / (c) decline
14. Reasoning
15. Communication to applicant (date, method, content)
16. Appeal outcome (if any)
17. Reviewing administrator (if applicable)