Data Protection & DPIA

1. Lawful bases for processing

We process personal data under UK GDPR. Each purpose has a specific lawful basis:

• Contract (Art. 6(1)(b)): creating and fulfilling bookings, payments, subscriptions and messaging between clients and companions.
• Legitimate interests (Art. 6(1)(f)): identity and DBS verification of companions, safeguarding monitoring of messages and sessions, fraud prevention and service improvement through outcome analysis.
• Consent (Art. 6(1)(a)): marketing communications, optional wellbeing-profile details beyond those needed for booking, and cookies where required.
• Vital interests (Art. 6(1)(d)): sharing location with our safety team during a live session when there is a risk to life.
• Legal obligation (Art. 6(1)(c)): financial record-keeping and responding to law-enforcement requests.

2. Retention periods

• Booking and payment records: 6 years, for tax and contract-law obligations.
• ID verification documents: deleted within 90 days of verification completing; the verification status is kept for the life of the account.
• Companion applications (unsuccessful): 6 months, then deleted unless the applicant asks us to keep them for future rounds.
• In-app messages: 24 months after the related booking completes, unless needed for a live safeguarding matter.
• Ratings and Connection Index outcomes: 3 years, aggregated and anonymised after that for outcome reporting.
• Wellbeing profiles: kept while the account is active; deleted within 30 days of account closure.
• Location pings: retained only for the duration of the session plus 30 days for safety review.

3. Security controls

• Data encrypted in transit and at rest; hosting on a platform with SOC-aligned controls.
• Sensitive documents (photo ID, DBS certificates) are stored privately and are never publicly accessible; they are viewed only through short-lived signed URLs by authorised reviewers.
• Row-level security on every entity: clients see only their own bookings, messages and profiles; companions see only their assigned bookings; organisation members see only their own organisation's anonymised data.
• Role-based access control (client, companion, organisation, admin) enforced server-side, not just in the interface.
• Least-privilege service roles for automated functions; secrets stored as environment variables, never in code.
• Payment details are never stored by Bondlyy: checkout is handled by our payment provider.

4. Do we need a DPIA? Yes.

A Data Protection Impact Assessment is required because we process data about vulnerable and potentially older adults in a way that involves systematic monitoring (in-session check-ins, optional location sharing, message oversight), and because a breach of our data could materially affect people's wellbeing and safety.

Our DPIA covers: the necessity and proportionality of message oversight and location features, the risks of special-category-adjacent wellbeing data (mood and connection scores), companion vetting data handling, and the safeguards above. It is reviewed whenever we add a feature that touches personal data, and at least annually.

Where profiling is involved, it is limited to companionship matching, is fully explainable to the user, and never makes decisions with legal or similarly significant effect. Clients choose their companion; the score is a recommendation aid.

5. Your rights

• Access, correction, deletion, restriction, portability and objection: all handled through our contact form or by writing to us.
• We respond to data subject requests within one month.
• You can complain to the ICO (ico.org.uk) if you are unhappy with our response.
• Our full Privacy Policy describes what we collect in detail.