Privacy Policy

The Natter Network is for people aged 65 or over who live in the United Kingdom or the Channel Islands.

A senior adult's profile may be set up and managed by a relative, friend, carer or organisation on their behalf where that person has the appropriate permission or authority to do so. The senior adult must confirm by telephone before any matching begins.

We do not knowingly maintain profiles for anyone under 18.

Account information

We collect:

• your name;
• your email address;
• your mobile telephone number, if you provide one; and
• whether you are using the service for yourself or registering or managing a profile for a relative, carer or organisation.

Profile information

We collect information that you choose to provide for your profile, including:

• your first name;
• age;
• gender;
• postcode;
• interests;
• personality words;
• conversation topics;
• call preferences; and
• a short "about" paragraph.

We use your postcode to work out a broad geographic area, such as "West Yorkshire". We do not show your full postcode to other members.

Because members can enter free-text information, profile information may occasionally contain information that is sensitive or falls within a special category of personal data under UK data protection law.

Telephone verification

Where telephone verification is used, we collect the telephone number being verified and whether verification was successful.

The one-time verification codes are handled by our telephony provider, Twilio. We do not use your verification code for any other purpose.

Identity verification

There are two verification routes. The Photo ID verified route uses a British passport or a driving licence from the UK, Jersey, Guernsey or the Isle of Man, with a liveness check and a face match. The Address & age verified route uses a proof-of-address document plus a separate date-of-birth document, which confirms an address and an age but is not a photo-ID check. Which route you used is shown on your profile as a badge.

Whichever route is used, we record:

• whether the check has not started, is pending, verified or failed;
• which verification route was used, such as passport, driving licence, or proof of address together with proof of date of birth;
• whether relevant liveness, face-match and UK-location checks passed;
• the reference associated with the verification check; and
• where returned by the verification provider, the verified date of birth, name and gender.

We use this information to confirm that a profile is accurate and that members meet our eligibility requirements.

Where you verify through our identity-verification provider, Didit, the photograph of your document and the live selfie are captured and held by Didit under its own privacy and retention arrangements. We receive the verification outcome and the limited information described above — we do not receive or store those document images, selfies or verification videos.

Where you instead use the proof-of-address route, you upload a date-of-birth document to us directly. That document is stored by us, in private storage that is not publicly accessible, together with the name and date of birth read from it. It is used only to confirm your eligibility, is visible only to authorised staff carrying out that check, and is never shown to other members. It is deleted when your profile is deleted.

Payment and membership information

Where you take out a membership or make a donation, your payment is processed by our payment provider, Stripe.

We retain information necessary to record the transaction, such as:

• whether a payment was made;
• the amount;
• the date;
• membership or donation status; and
• transaction or payment references where supplied.

We do not receive or store your full card details ourselves. Stripe processes payment card information through its own systems.

Call recordings

Calls between members made through The Natter Network are recorded for safety, quality and service purposes. Recordings are securely stored and retained in accordance with this privacy policy.

Both people on the call hear a spoken notice at the start of every call before they are connected.

The audio itself is held by our telephony provider, Twilio. We keep only a reference to the recording, the connection it belongs to, and how long it lasted.

Recordings are stored securely. They are not routinely browsable by staff and can only be listened to by authorised safety administrators where this is necessary in connection with an active report or safety case.

Call recordings are never made available to other members.

We separately keep limited call metadata, such as when a call took place and how long it lasted. Call metadata does not include the content of the call.

Consent and agreement records

We keep records showing:

• who agreed to our Terms and Privacy Policy;
• when they agreed;
• which version they agreed to; and
• where relevant, a relative, carer or organisation's confirmation that they have the person's agreement or authority to register and manage a senior adult's profile.

These records help us demonstrate what was agreed and when.

Service and safety records

We may keep records of:

• matches and connections;
• calls, including dates, times and durations;
• feedback;
• blocks;
• reports;
• safeguarding and safety cases;
• enforcement decisions and actions; and
• information needed to investigate suspected fraud, abuse or misuse of the service.

Information contained in a report or safety case may include information provided by one member about another member.

Technical information

We keep basic technical information needed to operate, secure and troubleshoot the service, including error and diagnostic logs.

Providing the service

We use account and profile information to create and manage your account, operate the service, assess compatibility and suggest people you may enjoy talking to.

We do not sell your personal information.

Matching

We use information such as your interests, personality words, conversation topics, age, broad area and call preferences to identify people who may be compatible with you and to suggest potential connections.

Matching is a core part of the service. We do not use your profile information for advertising.

Payments and donations

We use payment and membership information to process membership fees and donations, confirm membership status, deal with payment-related issues, and meet applicable accounting, tax and legal obligations.

Essential service communications

We use your contact details to send communications that are necessary or reasonably expected as part of your relationship with The Natter Network, including:

• account and security messages;
• information about your account;
• match suggestions;
• call and service notifications;
• safeguarding and safety notices; and
• important information about changes to the service, Terms or this Privacy Policy.

These communications are not optional where they are necessary to operate the service, protect members or provide important information about your account.

Re-engagement communications

We may send re-engagement emails to members who have become inactive or whose membership or activity has lapsed.

For example, we may contact an inactive member to let them know that they have lapsed and that there are people they may be compatible with.

These communications are intended to encourage you to return to and use The Natter Network and may therefore constitute direct marketing.

We will only send re-engagement or other marketing communications where we have an appropriate lawful basis and comply with applicable direct-marketing rules.

Where applicable, you will be given a way to opt out of re-engagement and other marketing communications without opting out of essential service, account or safety messages.

We will keep an appropriate record of marketing preferences and opt-outs so that we can respect them.

Verification and eligibility

We use telephone and identity-verification information to confirm identity, eligibility and the accuracy of profile information, and to reduce fraud and misuse.

Safety and safeguarding

We use service records, reports, blocks, recordings and other relevant information to investigate concerns, protect members, prevent abuse and fraud, enforce our rules and take appropriate safeguarding action.

Where necessary and lawful, information may be shared with law enforcement, safeguarding authorities, professional advisers or other appropriate organisations to protect someone from harm or comply with a legal obligation.

Legal and regulatory purposes

We may process and retain information where necessary to comply with legal or regulatory obligations, establish or defend legal claims, or maintain appropriate records relating to payments, safeguarding, enforcement or other legal matters.

Under UK data protection law, we must have a lawful basis for using personal information.

Depending on the processing involved, we rely on one or more of the following.

Consent

We rely on consent where consent is the appropriate legal basis, including for relevant optional uses of information and, where applicable, certain marketing communications.

You can withdraw consent at any time where we rely on consent.

Withdrawal does not affect processing that was lawful before consent was withdrawn.

Performance of our contract with you

We process information where it is necessary to provide the service you have asked us to provide, including creating and managing your account, operating matching and connections, processing membership payments and providing essential service communications.

Legitimate interests

We may process information where it is necessary for our legitimate interests, or those of another party, and those interests are not overridden by your rights and interests.

Our legitimate interests include:

• keeping members safe;
• protecting potentially vulnerable members;
• preventing and investigating fraud, abuse and misuse;
• investigating reports and complaints;
• maintaining the reliability and security of the service;
• enforcing our rules; and
• protecting members, staff and the service from harm.

We consider the impact of processing on people's rights and whether the processing is necessary and proportionate.

For call recording and review, we consider the privacy impact particularly significant because some members may be vulnerable adults. Access is therefore restricted to authorised safety administrators dealing with an active report or safety case, recordings are retained for a limited period, and every recorded call carries a spoken notice.

Legal obligation

We may process information where this is necessary to comply with a legal or regulatory obligation, such as applicable accounting, tax or other legal record-keeping requirements.

Some information may fall within the special categories of personal data under UK data protection law.

This may include information about health or other sensitive matters that someone chooses to include in profile text, reports, safety cases or call recordings.

Where we process special category information, we will only do so where a valid Article 9 condition applies in addition to an Article 6 lawful basis.

Depending on the circumstances, this may include explicit consent or a condition relating to safeguarding, substantial public interest, legal claims or another condition permitted by law.

We only process special category information where necessary for the relevant purpose and where the applicable legal requirements are satisfied.

We do not sell personal information and we do not allow advertising networks or third-party advertisers to use your information for advertising.

We may share personal information with service providers that help us operate the service where they need the information to perform their services.

Our principal providers currently include:

Where a provider acts as our data processor, we use appropriate contractual arrangements as required by law.

Some providers may act as independent controllers for particular processing, including where they have their own legal or regulatory obligations. Where this applies, their own privacy information may also apply.

Other disclosures

We may also disclose information where necessary and lawful to:

• professional advisers;
• law enforcement;
• safeguarding authorities;
• courts or regulators;
• parties involved in legal proceedings; or
• other appropriate organisations where necessary to protect people from harm or comply with the law.

We do not share your private contact details or other private account information with other members.

A member you are connected with will see only the limited profile information needed for the service:

• your first name;
• your approximate age;
• a broad area such as "West Yorkshire";
• your interests; and
• your photograph, if you have added one and chosen to make it visible.

Other members do not see your:

• surname;
• email address;
• telephone number; or
• full postcode.

We aim to use UK- or EU-hosted systems where practical.

Some of our service providers or their subprocessors may process personal information outside the UK, including in the United States.

Where UK data protection law treats this as a restricted transfer, we will use an appropriate legal mechanism and safeguards.

Depending on the destination and arrangement, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

We will also use any additional safeguards or assessments required by law.

You can contact us for further information about the safeguards applicable to a particular international transfer.

A relative, carer or organisation may set up and manage a senior adult's profile where they have the person's agreement or appropriate authority.

For a managed profile, we may record:

• who registered the profile;
• their relationship to the senior adult;
• any organisation name;
• confirmation that they have the person's agreement or authority; and
• information needed to administer the profile.

The person managing the profile may be able to see and edit the profile information they are authorised to manage.

The senior adult must confirm by telephone before any matching begins.

The senior adult can ask us to remove a manager's access at any time.

The senior adult remains the person whose personal information is being processed. Their data protection rights continue to apply.

If a manager and the senior adult disagree about the account or management of the profile, we may need to restrict or pause access while we establish what authority or instructions apply.

Adding a photograph is optional. You can create a profile, complete verification, take part in matching and receive suggestions without one.

If you do not add a photograph, you are not shown in the public member listings on our website. This does not affect matching or suggestions, which happen privately.

Your photograph is shown to connected members by default as part of your profile, unless you switch photo sharing off in your privacy settings.

A separate setting controls whether your first name and photograph may be featured on The Natter Network website. This is also on by default, and only members with a photograph appear on the public site.

A third setting controls whether you choose to provide an optional testimonial that we may publish. This setting is off by default.

Photo sharing and website featuring are on by default so that other members can see who they are talking to. You can turn either off at any time, and your photograph is never used for advertising or sold to third parties.

We take member safety seriously.

Where we receive a report or identify a safety concern, we may review relevant information, including account information, information submitted through reporting tools, service records, call metadata and, where relevant, a call recording.

Access to call recordings is limited to authorised safety administrators and only where necessary for an active report or safety case.

We may take action such as:

• contacting a member about a concern;
• restricting or suspending an account;
• preventing further contact;
• investigating suspected fraud, abuse or misconduct; or
• reporting or disclosing information to an appropriate authority where required or permitted by law.

Because safety information may remain relevant after an account has closed, some safety, safeguarding and enforcement records may be retained longer than ordinary account information.

We keep personal information only for as long as we reasonably need it for the purposes described in this Privacy Policy, taking account of legal, safeguarding, security and operational requirements.

Where a specific retention period is not stated, we retain information only for as long as reasonably necessary for the purpose for which it was collected.

Our current retention periods are:

• Profile and account information: while your account is open, then deleted within 30 days of closure.
• Photographs: while your account is open, unless deleted earlier, then deleted on the same 30-day schedule as profile data.
• Payment and membership records: generally up to 6 years where required for accounting, tax or legal purposes.
• Call metadata and feedback: 12 months.
• Call recordings: 90 days, then automatically deleted, unless attached to an open safety or safeguarding case. In that situation, the recording may be retained until the case is resolved and for any additional period reasonably necessary for legal or safeguarding purposes.
• Consent and agreement records: up to 6 years.
• Safety reports, blocks and enforcement records: up to 6 years where reasonably necessary to protect members, investigate repeated misconduct or establish, exercise or defend legal claims.
• Technical logs: routinely purged, typically within 90 days.
• Marketing preferences and opt-outs: retained for as long as necessary to honour your preferences and demonstrate compliance with applicable marketing rules.
• Identity documents, selfies and verification videos captured by Didit: not held by us. Their retention is determined by Didit's own policy.
• Date-of-birth documents uploaded to us through the proof-of-address route: held in private storage while your account is open and deleted when your profile is deleted.

Where information is held in backups, it may remain in an encrypted backup for a limited period until the backup is securely overwritten in accordance with our backup and disaster-recovery process.

We use technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Our current controls include:

• an access-controlled database;
• row-level security so that an account can only access its own records;
• private storage for photographs;
• short-lived links when photographs need to be shared;
• restricted access to call recordings, reachable only through an open safety case;
• private storage for date-of-birth documents, with staff-only access;
• access controls for administrative and safety functions; and
• telephone-number masking and call bridging so members do not receive each other's personal telephone numbers.

No internet transmission or storage system can be guaranteed to be completely secure.

If we become aware of a personal data breach, we will deal with it in accordance with our legal obligations, including notifying the ICO or affected individuals where required.

Telephone numbers are never shown to other members.

Where private-number calling is used, calls are bridged through our calling platform so that each participant can communicate without the other participant receiving their personal telephone number.

We may retain limited call metadata even where call content is not retained.

We use cookies and similar technologies, including local storage, that are necessary to operate the website and keep you signed in. We also use optional cookies only if you accept them.

Optional cookies (only with your consent). If you click "Accept" on our cookie banner, we load tags from Google (Google Analytics and Google Ads), Meta (Facebook and Instagram Pixel), Microsoft (Microsoft Advertising) and Hotjar. These companies receive details of the pages you visit, your device and browser, and events such as creating an account or starting a free month. We use this to understand how the site is used and to measure and improve our adverts. We do not send your name, telephone number, email address or postcode to them. If you click "Reject", none of these load.

Changing your mind. You can withdraw or change your choice at any time using "Cookie settings" at the bottom of every page. We keep a record in your browser of your choice, when you made it and which version of this notice you saw.

Our own measurement. When you arrive from an advert or a search result, we store a random visitor reference in a first-party cookie for up to 90 days, together with the campaign details included in the web address. It contains no name, telephone number, email address or postcode and is never sold.

Necessary cookies may be used to:

• maintain a secure login session;
• authenticate you;
• protect the service against misuse;
• remember essential technical settings, including your cookie choice; and
• provide functionality that you have requested.

Businesses or organisations may apply to become partners or be listed by The Natter Network.

If you submit a partner application, we may collect and store information such as:

• business or organisation name;
• website;
• contact email address; and
• the description or information you provide about your organisation.

We use this information to review and manage partner applications, communicate with applicants and operate any resulting partner relationship.

Partner application information is separate from member profile information.

We retain partner application information for as long as reasonably necessary to deal with the application and any resulting relationship, and for longer where required for legal or business-record purposes.

Most of the information we hold comes directly from you.

We may also receive information from:

• a relative, carer or organisation managing a profile with appropriate authority;
• Twilio, in relation to telephone verification or calling services;
• Didit, in relation to identity-verification results;
• Stripe, in relation to payment transactions;
• other members, where they submit feedback, blocks or safety reports;
• professional advisers; and
• public authorities where information is lawfully provided.

Where information comes from another source, we will provide the information required by law where applicable.

Depending on the circumstances, you have the right to:

• ask for a copy of your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete personal information;
• ask us to restrict certain processing;
• object to certain processing, including processing based on legitimate interests where applicable;
• receive certain personal information in a portable format;
• withdraw consent where we rely on consent; and
• object to direct marketing.

These rights are subject to legal conditions and exceptions and may not apply in every circumstance.

For example, we may need to retain particular information to comply with the law, establish or defend legal claims, or protect other members.

You can edit much of your profile through Settings and can close your account there.

If a relative or organisation has been managing your profile, you can ask us to remove their access at any time. This does not affect your other rights over your personal information.

You can make a privacy request by emailing:

hello@thenatternetwork.co.uk

We normally respond to a valid request within one month, subject to the applicable legal rules and any lawful extension.

We may need to ask for information to verify your identity before responding.

Essential service, account, security and safety communications may still be sent where necessary even if you opt out of marketing.

Where we send optional re-engagement or other marketing communications, we will provide an unsubscribe mechanism or other appropriate preference control.

Unsubscribing from re-engagement or marketing messages will not normally affect your ability to receive essential service and safety messages.

Where you withdraw marketing consent or opt out of a marketing communication method, we will keep an appropriate record of that preference so that we can honour it.

We will comply with applicable UK rules governing direct marketing and electronic communications.

Email hello@thenatternetwork.co.uk and tell us:

• what you are asking for;
• the email address associated with your account; and
• enough information for us to identify you safely.

You do not have to use a particular form of words.

If you find it difficult to use the website, we will try to provide reasonable assistance with privacy requests.

We hope we can resolve any privacy concern directly, so please contact us first where possible.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

ICO website: ico.org.uk

ICO telephone: 0303 123 1113

You do not have to wait for us to respond before contacting the ICO.

If we make a significant change to how we use personal information, we will update the version date above and, where appropriate, tell members by email or through the service.

We will not make a materially different use of your personal information without providing the information or obtaining consent where required by law.

For privacy questions, requests or complaints:

We collect information so that The Natter Network can operate, suggest compatible people, process memberships and donations where applicable, and help keep members safe.

We do not sell your personal information.

We do not give your private contact details to other members.

Other members see only limited information from your profile.

Your photograph is private unless you choose to share it.

Document photographs and selfies taken by our verification provider are not stored by us. A date-of-birth document uploaded through the proof-of-address route is stored privately by us and seen only by staff carrying out that check.

Your card details are not stored by us; Stripe handles payment card information.

Calls between members are recorded for safety, quality and service purposes, with a spoken notice at the start of every call.

We may send inactive members re-engagement emails encouraging them to return to the service. These are treated separately from essential service and safety messages and can be opted out of where applicable.

Businesses applying to become partners may provide business contact and application information, which we use to process their application and manage any resulting relationship.

You can ask us what information we hold about you, ask us to correct it, and in many circumstances ask us to delete it.

We keep information only for as long as reasonably necessary, although payment, consent, safety and legal records may need to be kept longer.

For privacy questions, contact hello@thenatternetwork.co.uk.