Effective Date: August 15, 2026
1. PURPOSE
This Law Enforcement & Government Request Policy (“Guidelines”) outlines how the Platform responds to requests from law enforcement agencies, judicial authorities, regulatory bodies, and government entities (“Requesting Authority”) seeking customer data.
As an EU-based infrastructure provider, the Company is governed by:
Regulation (EU) 2016/679 (GDPR);
the e-Privacy Directive;
applicable national criminal procedure codes;
the European Investigation Order (EIO) framework;
applicable international mutual legal assistance treaties (MLATs).
These Guidelines are designed to:
ensure strict compliance with EU data protection law;
protect the fundamental rights of users, including privacy and due process;
standardize the handling of EIO and cross-border judicial requests;
define strict limitations for Third Country (non-EU) government requests;
prevent unlawful international data transfers under GDPR Chapter V.
2. LEGAL BASIS FOR DISCLOSURE
The Company discloses user data only where a valid legal basis exists under GDPR:
Article 6(1)(c) – Legal Obligation: Compliance with a valid, binding order from a competent EU judicial or administrative authority.
Article 6(1)(d) – Vital Interests: To protect the life or physical integrity of a person in an emergency.
Article 6(1)(f) – Legitimate Interest: In rare cases involving fraud prevention or severe abuse, subject to proportionality and balancing of user rights.
No disclosure occurs absent a documented legal basis.
3. JURISDICTIONAL FRAMEWORK
3.1 Requests from EU Member States
The Company accepts binding orders issued by competent authorities within the European Union, including courts, prosecutors, or investigating judges, provided they:
are issued under valid national criminal or administrative procedure law;
comply with EU legal standards and proportionality principles;
are formally validated (e.g., via European Investigation Order (EIO)) for cross-border execution;
clearly identify the user, data scope, and relevant timeframe.
The Company interprets all requests narrowly and may challenge overbroad or defective requests.
3.2 Requests from Non-EU (Third Countries)
Critical Principle: As an EU-based entity, the Company does not directly respond to subpoenas, warrants, or compulsory orders from non-EU authorities unless one of the following applies:
the request is routed through a Mutual Legal Assistance Treaty (MLAT) and validated by an EU judicial authority;
an applicable international agreement permits lawful cooperation;
a verified emergency involving imminent risk to life exists (see Section 6).
Direct disclosure to a non-EU authority without appropriate legal transfer safeguards constitutes a violation of GDPR Chapter V (International Transfers).
The Company will reject or redirect non-compliant Third Country requests.
4. DATA CATEGORIZATION & AUTHORIZATION LEVELS
The Company applies differentiated scrutiny based on data sensitivity.
4.1 Subscriber Data (Basic Identity)
Examples: name, email address, billing address, registration IP.
Required Authority: A legally valid order consistent with national law. Judicial authorization may be required depending on jurisdiction.
4.2 Traffic & Metadata (Connection Logs)
Examples: timestamps, duration of sessions, source/destination IP addresses, access logs.
Due to European Court of Justice jurisprudence recognizing metadata sensitivity, disclosure typically requires judicial authorization. Police-only requests without judicial validation may be rejected where required by law.
4.3 Content Data (High Sensitivity)
Examples: stored files, AI prompts and outputs, API payloads, private communications, proprietary configurations.
Required Authority: A strict judicial warrant or court order. The Company will reject police-only or administrative orders seeking content data unless validated by a competent judge.
5. USER NOTIFICATION & TRANSPARENCY
5.1 General Rule
Unless legally prohibited, the Company will notify affected users prior to disclosure to allow them to seek judicial remedy.
5.2 Exceptions (Secrecy Obligations)
Notification may be withheld if:
the authority provides a valid non-disclosure or sealing order;
the request relates to statutory secrecy provisions (e.g., anti-terrorism or child protection investigations);
notification would create imminent risk of harm.
5.3 Post-Disclosure Notice
Where secrecy obligations expire, the Company reserves the right to inform users that their data was disclosed.
6. EMERGENCY DISCLOSURE (VITAL INTERESTS)
The Company may disclose limited data without prior judicial authorization where it has a documented good-faith belief that an emergency involving imminent danger of death or serious physical injury requires immediate disclosure.
Requirements:
submission of a formal Emergency Data Request;
signed attestation by a senior official;
description of the imminent threat.
Scope of disclosure is limited to what is strictly necessary.
7. DATA PRESERVATION
The Company may preserve relevant data for a limited period (typically up to 90 days) upon receipt of a valid preservation request pending formal legal process.
Preservation does not constitute disclosure.
8. DATA MINIMIZATION & PROPORTIONALITY
For all disclosures, the Company will:
produce only data specifically identified in the order;
limit disclosure to the relevant time period;
redact unrelated data where feasible;
document the legal basis and scope internally.
The Company does not provide:
real-time surveillance access;
direct system access to authorities;
bulk data exports absent specific legal mandate.
9. COST REIMBURSEMENT
Where permitted under applicable national law, the Company reserves the right to seek reimbursement for reasonable administrative costs associated with responding to requests.
Emergency or child safety requests are generally not subject to cost recovery.
10. SUBMISSION CHANNELS
Requests must be transmitted through secure channels. We do not accept service of process via social media, chat support, or informal communication channels.
All valid legal requests must be submitted in accordance with the guidelines published at: [yourdomain.com/legal/law-enforcement]
Secure Email: legal-requests@[yourdomain].com (Must originate from an official government or law enforcement domain)
PGP Key: [Key ID] (Recommended for transmitting sensitive information)
Requests must include:
official agency identification;
legal authority relied upon;
case reference number;
precise data scope and timeframe.
Incomplete requests may be rejected.
11. TRANSPARENCY REPORTING
Where legally permitted, the Company may publish aggregated statistics regarding:
number of requests received;
jurisdiction of origin;
types of data requested;
percentage complied with;
emergency disclosures.
12. REGULATORY COMPATIBILITY
This Policy is designed to be compatible with:
EU cross-border judicial cooperation mechanisms;
emerging EU electronic evidence procedures;
evolving jurisprudence regarding metadata and proportionality;
international treaty-based cooperation frameworks.
13. POLICY UPDATES
This Policy may be updated to reflect regulatory changes, jurisprudence developments, or operational improvements.
Continued use of the Services constitutes acceptance of the current version.