Law Enforcement Guidelines
Last updated 22 October 2026
This page is for police officers, safeguarding professionals and others acting under legal authority who need information from The Village Aunty. It sets out what we hold, what we do not hold, what we need from you, and how quickly you will hear back.
It is published so that an officer does not have to guess, and so that a member can read exactly what the rules are. We take these requests seriously and we do not obstruct them. We also do not hand over a member's private words without proper authority.
If someone is in immediate danger, email hello@thevillageaunty.co.uk with URGENT at the start of the subject line, and see Emergency disclosure below. We will not require formal process before acting to prevent a risk to life.
1. Who to contact
| Routine requests | hello@thevillageaunty.co.uk, subject line beginning POLICE REQUEST |
|---|---|
| Risk to life, urgent | hello@thevillageaunty.co.uk, subject line beginning URGENT |
| Service by post | Shaykh Mohammed Muneeb, trading as The Village Aunty Soothill Business Park Soothill Lane Batley West Yorkshire WF17 6NX |
| Data controller | Shaykh Mohammed Muneeb, a sole trader established in the United Kingdom |
We accept requests by email. A scanned or digitally signed document on force letterhead, sent from a verifiable police or government domain, is sufficient. We do not require the original by post. We may telephone the force's switchboard to confirm that a named officer exists before we disclose anything.
There is one of us. Please do not assume a 24-hour desk. Urgent email is monitored; routine email is answered within five working days, and substantive responses within fourteen days unless the request is complex, in which case we will tell you so and give you a date.
2. What we do not hold
This matters more than the list of what we do hold, because it will save you time. Several things an investigator would normally expect from an online service do not exist here, by design rather than by deletion.
- No identity documents. None. No passport or driving licence images, no scans, no selfies, and no document numbers. Identity checking is performed by our verification provider, who never passes the document to us: we receive only a pass or a fail and the date. There is no upload facility in our software and never has been. If you need the document itself, or any detail from it, you must approach the provider named in section 4, who holds it under their own retention policy.
- No messages between members. The service has no messaging feature of any kind. Members cannot write to one another. There is therefore no message content, no chat history and no direct-message metadata to produce, for any member, at any date.
- No photographs. There is nowhere on the service to upload one. Where a photograph is exchanged after both families accept, it is exchanged between them directly and does not pass through or rest on our systems.
- No payment card details. Payments are processed by Stripe. We never see or store a card number. Transaction records must be sought from Stripe.
- No location data. No GPS, no device location, no tracking. A member's town is only what they typed on a form.
- No telephone call or SMS records. We are not a telecommunications operator and we do not carry communications. Requests under the Investigatory Powers Act 2016 for communications data cannot be satisfied by us.
3. What we may hold
Subject to the retention periods below, and only where the member has provided it:
| Account | Name, email address, date of birth, town or city, telephone number if given, the date the account was created, and whether it is active, suspended or closed |
|---|---|
| The introduction | The member's answers about themselves and what they are seeking, and their own free-written passages. The free-written passages and some sensitive answers are encrypted at rest and we can decrypt them while the service is running |
| Guardian | The name and email address of the wali or family contact the member nominated |
| Verification | That a check was attempted, whether it passed or failed, the provider's reference for it, and the date. Not the document, and no detail taken from it |
| Proposals | Which members were introduced to which, when, what each side decided, and the text of the letters sent |
| Sign-in | Email address and IP address of a sign-in link request, and the IP address and browser user-agent of a session |
| Complaints | Reports made by or about a member, the reason, the detail (encrypted), and what we decided |
| Staff access log | An append-only record of which staff member opened which member's file, and when. This is often the most useful thing we have in a complaint about misuse |
| Removals | That an account was removed, the reason, who decided, and a one-way fingerprint of the email address, retained even after erasure where the reason was safeguarding |
Retention, so you know whether it still exists
- Sign-in request records: 30 days. If you need the IP address used to request a sign-in link, you must reach us inside 30 days or it is gone. This is the shortest and most time-critical item we hold. Ask us to preserve it immediately (see section 6).
- A closed account: erased within 30 days of the member closing it, and immediately on their request.
- Safeguarding and removal records: retained after erasure, under Article 17(3) of the UK GDPR.
- Everything else: for as long as the account exists.
4. Our processors, for requests we cannot satisfy
Where the information you need is not ours, it is likely to be held by one of these. We will confirm on request which of them holds a given category, but we cannot compel them for you.
| Identity documents and verification reports | Stripe Identity (Stripe, Inc.) |
|---|---|
| Payments, cards, refunds, chargebacks | Stripe Payments UK Ltd |
| Database hosting | Railway Corp. The database is in the EEA (EU West), not the UK |
| Website hosting | Krystal Hosting Ltd, United Kingdom |
5. What legal authority we require
United Kingdom police and public authorities
We will disclose personal data to a UK police force or other competent authority for the prevention or detection of crime, the apprehension or prosecution of offenders, or the safeguarding of a child or adult at risk, in reliance on the exemption at Schedule 2, Part 1, paragraph 2 of the Data Protection Act 2018.
Please send, on force letterhead:
- The requesting officer's name, rank, collar or warrant number, force, and a force-domain email address and switchboard number we can call back on.
- A unique reference for the investigation.
- The statutory ground relied on, and confirmation that the request is necessary and proportionate, and that complying would be likely to prejudice the matter were we to refuse.
- A specific description of what you want, with a date range. "All data held" on a named member will be met with a request to narrow it. The narrower the request, the faster you will get it.
- The identifier you have: an email address is best, then a full name with a date of birth. We cannot search on a telephone number or an IP address reliably.
- Whether you require us not to notify the member, and the reason.
We will accept a court order, a production order under Schedule 1 to the Police and Criminal Evidence Act 1984, or a witness summons, and we will comply with its terms.
Requests from outside the United Kingdom
We are established in the United Kingdom and governed by UK law. We do not disclose member data to a foreign authority on the strength of a foreign order alone. Please proceed through mutual legal assistance, a letter of request, or an applicable international agreement, and have the request made effective in the United Kingdom, or obtain an order from a court of England and Wales. The emergency route in section 7 is open to you regardless of jurisdiction.
Civil parties, employers, and private individuals
We do not disclose one member's information to another member, to a family member, to a suspicious relative, to a private investigator, or to a solicitor acting in a civil matter, without a court order or the clear consent of the person concerned. This includes a parent asking about an adult child. We appreciate that this will sometimes be unwelcome, and we apply it without exception.
A member wanting their own data does not need any of this. That is a subject access request and it is free. It is handled under the Privacy Notice.
A person who says an account was created about them without their consent
This is a deliberate exception to the paragraph above, and it is worth setting out here because the person raising it is often a safeguarding professional or an officer acting for somebody else.
Where a person tells us that an account has been created about them, or in their name, without their consent, we act without requiring them to prove control of the registered email address, and they do not need an account of their own. We suspend the account immediately, which withdraws any proposal, and we close and erase it once we are satisfied the complaint is genuine. We will not tell the registrant who raised it.
Note the limit: this lets us act, not disclose. We will confirm to that person that the account has been dealt with. We will not hand them the registrant's identity, contact details or answers without a court order, because the person who created the account may be the person they most need protecting from, and we cannot always tell which way round it is. If you need those details for an investigation, section 5 applies as usual.
6. Preservation requests
If you may later need information but do not yet have your authority in order, ask us to preserve it now. Email hello@thevillageaunty.co.uk with the identifier and what you want held.
We will take the material outside the ordinary deletion routine and hold it for 90 days, renewable once on request. This matters most for the 30-day sign-in records, and for an account the member may be about to close. Once an erasure has run it cannot be undone, by us or by anyone.
A preservation request is not a disclosure request. We will hold the material and disclose nothing until proper authority arrives.
7. Emergency disclosure
Where there is an imminent risk to a person's life or of serious physical harm, we will disclose what is necessary to prevent it without waiting for formal process, relying on vital interests under Article 6(1)(d) and Article 9(2)(c) of the UK GDPR.
Email hello@thevillageaunty.co.uk with URGENT at the start of the subject line, and tell us the nature of the threat, who is at risk, why it is immediate, and how to reach you now. We will respond as quickly as a one-person service can.
Please understand the limits of this route. We are a sole trader, not a 24-hour operations centre, and we have no out-of-hours telephone desk. Email us, but if a person is in immediate danger do not wait on our reply. The emergency services, the local authority safeguarding team and the Forced Marriage Unit can all act faster than we can, and we would rather you used them and told us afterwards.
We log every emergency disclosure, including what was disclosed and the reasoning, and we will provide that log to the ICO or a court on request.
8. Reports we make ourselves
We do not only respond to requests. Where our own review of a complaint leads us to believe that a child is at risk, that an adult is at risk of harm, forced marriage or coercion, or that a criminal offence such as fraud has been committed against a member, we will report it ourselves, to the police, to the relevant local authority safeguarding team, to the Forced Marriage Unit, or to Action Fraud as appropriate. We do not require the member's permission to do so and we will not treat it as confidential.
9. Telling the member
Our default is to tell a member that their information has been requested, and what was provided, because we think people are entitled to know. We will not do so where:
- a court order or statutory provision prohibits it;
- you tell us, with a reason, that notification would prejudice the investigation;
- notification would itself create a risk to someone's safety.
Where notification is deferred rather than prohibited, we will ask you when we may proceed, and we will tell the member afterwards.
10. Costs and what we will not do
We do not charge for responding to a lawful request from a UK public authority.
We will not: build a new tool or run bulk analysis for you; hand over the entire register; place a member under ongoing monitoring absent an order that requires it; or produce something we have told you we do not hold, however the request is reworded. If you believe we hold something we have said we do not, tell us why and we will look again properly.
11. Challenging a request
We will seek legal advice, and may object or ask a court to narrow a request, where it appears to us unlawful, disproportionate, overbroad, or directed at a member's protected beliefs or lawful religious practice rather than at a criminal matter. Doing so is not obstruction; it is the controller's duty under Article 5(1)(c) of the UK GDPR.
Nothing on this page limits our obligations under the law, grants rights beyond it, or constitutes legal advice. Where this page and the law differ, the law governs.