A matching system for matching a plurality of clients, wherein each client is identified by an identifier and is associated with one or more attributes; and wherein each client comprises a user device under a user's control; the matching system comprising: - an identity anonymization server configured to store in a first local database maintained by the identity anonymization server identity mappings between identifiers of clients and corresponding pseudo identifiers (pCID); - an attribute anonymization server configured to store in a second local database maintained by the attribute anonymization server attribute mappings between attributes and corresponding pseudo attributes (pATT); and - a matching server configured to store pseudo mappings between pseudo identifiers (pCID) and associated one or more pseudo attributes (pATT); wherein - the identity anonymization server, the attribute anonymization server and the matching server are separate computing devices; - the identity anonymization server, the attribute anonymization server and matching server are configured so that at least two of the identity anonymization server, the attribute anonymization server and matching server refuse to collude; - the identity anonymization server and the attribute anonymization server are configured to receive a registration identifier along with an identifier and one or more associated attributes of a first client, respectively; - the identity anonymization server does not receive the one or more associated attributes of the first client; - the attribute anonymization server does not receive the identifier of the first client; - the identity anonymization server is configured, in response to receiving the identifier, to determine a randomly generated pseudo identifier (pCID) for the first client, to assign the pseudo identifier (pCID) to the received identifier and to forward the pseudo identifier (pCID) and the registration identifier to the matcher; - the attribute anonymization server is configured, in response to receiving the one or more attributes, to determine one or more randomly generated pseudo attributes (pATT) for the one or more received attributes that the first client is associated with, to assign the pseudo identifier (pCID) to the received identifier and to forward the pseudo attributes (pATT) and the registration identifier to the matcher; and - the matching server is configured to generate a pseudo mapping between the pseudo identifier (pCID) and the one or more pseudo attributes (pATT) of the first client using the registration identifier. - an identity anonymization server configured to store in a first local database maintained by the identity anonymization server identity mappings between identifiers of clients and corresponding pseudo identifiers (pCID); - an attribute anonymization server configured to store in a second local database maintained by the attribute anonymization server attribute mappings between attributes and corresponding pseudo attributes (pATT); and - a matching server configured to store pseudo mappings between pseudo identifiers (pCID) and associated one or more pseudo attributes (pATT); wherein - the identity anonymization server, the attribute anonymization server and the matching server are separate computing devices; - the identity anonymization server, the attribute anonymization server and matching server are configured so that at least two of the identity anonymization server, the attribute anonymization server and matching server refuse to collude; - the identity anonymization server and the attribute anonymization server are configured to receive a registration identifier along with an identifier and one or more associated attributes of a first client, respectively; - the identity anonymization server does not receive the one or more associated attributes of the first client; - the attribute anonymization server does not receive the identifier of the first client; - the identity anonymization server is configured, in response to receiving the identifier, to determine a randomly generated pseudo identifier (pCID) for the first client, to assign the pseudo identifier (pCID) to the received identifier and to forward the pseudo identifier (pCID) and the registration identifier to the matcher; - the attribute anonymization server is configured, in response to receiving the one or more attributes, to determine one or more randomly generated pseudo attributes (pATT) for the one or more received attributes that the first client is associated with, to assign the pseudo identifier (pCID) to the received identifier and to forward the pseudo attributes (pATT) and the registration identifier to the matcher; and - the matching server is configured to generate a pseudo mapping between the pseudo identifier (pCID) and the one or more pseudo attributes (pATT) of the first client using the registration identifier.