Law Enforcement

1. Who we are

Affinitee is operated by Fiddlekube, registered with the Netherlands Chamber of Commerce (KVK) under number 86409778, Callistoweg 10, 2516 BH 's-Gravenhage.

2. Our principles

• We disclose member data to authorities only on a valid legal order, in an emergency as described in section 6, or where the law requires us to report, as described in section 10.
• Every request is reviewed by the person at Affinitee responsible for legal requests. Requests are never handled by automated systems or by general support staff alone.
• We disclose only the data the order covers, for the period it names.
• We keep a record of every request, how we assessed it and what we disclosed.

3. Sending a request

Send requests to matchmaker@affinitee.eu with "Law enforcement request" in the subject line, on official letterhead, in Dutch or English. Please include:

• your name, position, authority and contact details;
• the legal basis for the request, with a copy of the order where one applies;
• the account concerned, identified by email address or phone number, and the period you are asking about;
• the specific information you need.

An urgent demand made by phone must be confirmed in writing within three days, as the Dutch Code of Criminal Procedure requires. We do not accept requests made through the website's contact or report forms, through chat or on social media.

4. How we handle a request

1. We confirm receipt within two working days.
2. We verify that the request is genuine by contacting the issuing authority through contact details we look up ourselves, not the details given in the request.
3. We check the legal basis and the scope. If a request is unclear, broader than the order allows or has no valid legal basis, we ask the authority to clarify or narrow it, and we refuse it if that does not happen.
4. We collect only the data the order covers.
5. We send it as an encrypted file to the verified official address of the authority, with the password sent separately. We never send data to a personal or unverified address.
6. We record the request, our assessment and what we disclosed.

5. Legal basis

We disclose member data to Dutch authorities in response to a valid demand under the Dutch Code of Criminal Procedure (Wetboek van Strafvordering):

• identifying data (name, address, place of residence, postal address, date of birth, sex and administrative characteristics of the account) on a demand from an investigating officer under Article 126nc, when a crime is suspected;
• other stored data, such as event registrations and payment records, on a demand from a public prosecutor under Article 126nd. For an offence that does not allow pre-trial detention (Article 67(1)), that demand needs the prior written authorisation of an examining magistrate (rechter-commissaris);
• sensitive data, such as compatibility test answers about religion, health or sexual life, and the content of chat messages, only for a serious offence where the investigation urgently requires it, on a demand from a public prosecutor with the prior written authorisation of an examining magistrate, under Articles 126nf and 126ng. A demand for chat content covers only messages that clearly come from, are meant for or relate to the suspect.

Authorities in other EU member states can send a European Production Order or a European Preservation Order under Regulation (EU) 2023/1543 to the address in section 3. We answer a European Production Order within 10 days, or within 8 hours in an emergency, as the Regulation requires.

Other foreign authorities should make their request through the competent Dutch authorities, using mutual legal assistance or, within the EU, a European Investigation Order.

6. Emergencies

If there is an imminent risk of death or serious harm, put "Emergency" in the subject line and describe the risk. We handle emergency requests on the day we receive them. After confirming the request with the authority, we may disclose the information needed to prevent the harm without waiting for an order, as Article 6(1)(d) of the GDPR permits. We ask for the usual order afterwards.

7. What we hold

For an active account, we may hold:

• name, email address, phone number, date of birth, gender, city and country, and the other profile details the member gave, such as relationship status and who they want to meet;
• compatibility test and introduction answers, and the profile photo;
• chat messages and images, which are not end-to-end encrypted;
• socials a member saved or swapped in a chat;
• the result of an optional ID check (passed or not, 18 or over, whether the date of birth matched the profile, and when). The ID document and selfie are held by our verification partner, Didit, not by us;
• reports and blocks made by or about the account;
• how we handled each report about the account, and whether the account is or was suspended or closed, with dates;
• event registrations, and records of credits bought and used;
• the time of the most recent login.

We do not store members' IP addresses with their account or keep a login history. IP addresses are used only to limit repeated attempts, in short-lived counters that are not linked to an account. Card and bank details are held by our payment provider, Stripe, not by us; we hold only Stripe's payment references.

When a member deletes their account, we erase their name, contact details, date of birth, compatibility test answers, photo, the images they sent in chat, their socials and the result of their ID check, and Didit deletes the ID document and selfie. We keep the messages they sent, which remain visible to the people they sent them to, reports and blocks involving the account, payment, credit and event registration records, which Dutch tax law requires us to keep for 7 years, and coded fingerprints of the email address, which cannot be turned back into the address.

8. Preservation requests

On a demand from a public prosecutor under Article 126ni, or a written request from an authority while it obtains one, we preserve specific stored data that could otherwise be lost or changed, for up to 90 days. The period can be extended once, by up to 90 days. Preserved data is not disclosed until we receive a demand that permits disclosure.

9. Telling the member

We tell the member about a request for their data, unless the law or the order prohibits it, or telling them would put someone at risk or harm an investigation. If you need us not to tell the member, say so in the request and give the reason.

10. Reports on our own initiative

If we learn of information suggesting a criminal offence that threatens someone's life or safety, such as the sexual exploitation of a minor, we promptly inform the police and share the relevant information we hold, as Article 18 of the Digital Services Act requires. We also preserve that data.

When a member reports fraud, such as a romance scam, we review the account involved, suspend it if the report is credible, preserve its data and tell the member how to report it to the police. We then disclose that data on a valid request, as described above.

11. Questions about this policy

Questions about this policy can be sent to matchmaker@affinitee.eu.