Law Enforcement and Regulator Requests

Applies to: Requests made to Shogram by regulators, law-enforcement bodies and other public authorities
Summary of changes: Initial request-handling framework; no jurisdiction-specific disclosure rule is asserted.
Contact: [LEGAL/PRIVACY CONTACT]

Draft for review. Authority, legal-process and notice rules vary by country. Qualified counsel must approve this Policy, the request-validation process and any retention or disclosure obligations before publication.

In plain words

If a public authority asks Shogram for information, the request should be checked for authenticity, authority, scope and legal basis. Only information that may lawfully be disclosed should be provided, and the disclosure should be recorded. We may be unable to notify an affected person if law prohibits notice or an urgent risk makes it inappropriate.

1. Request channels and verification

Authorities should direct requests to [LEGAL/PRIVACY CONTACT] using [VERIFIED SECURE CHANNEL]. A request should identify the requesting body and official, legal authority, person or account concerned, requested information, relevant time period, purpose and response deadline.

The Platform should verify the requester and legal process independently using trusted contact details, not contact information supplied only in the request. Emergency requests must identify the emergency, the person at risk and the specific information needed.

2. Review, scope and response

Authorized personnel and counsel should review each request for jurisdiction, validity, scope, necessity, proportionality, confidentiality and any right to challenge. Where lawful, the Platform should seek clarification or narrow an overbroad request. The Platform should not disclose information merely because a request is informal or uses official letterhead.

The Platform may preserve specifically identified information where it has a valid legal basis and a defined preservation scope. Preservation is not the same as disclosure. Legal holds must be access-controlled and reviewed according to [RETENTION/REVIEW PROCESS].

3. Information that may be held

Depending on the service and request, the Platform may process account/contact information, device identifiers, verification and scan records, Reports and attachments, Company/KYC records, payment references, session/security records and audit logs. A request does not mean every category exists for a person or can lawfully be disclosed. See the Privacy Policy and Data Retention Policy for the final category and retention schedule.

The Platform should disclose only information within the valid scope and permitted by law. Credentials, signing secrets, unrelated user data and broad datasets should not be provided unless a clear legal basis requires it and counsel approves the response.

4. Notice to affected people

Where lawful and appropriate, the Platform should notify the affected person before disclosure or after any restriction expires, unless notice is prohibited, would create a serious risk, could compromise an investigation or is otherwise not appropriate under [COUNTRY/LAW]. The notice decision and reason should be recorded.

5. Logging and transparency

The Platform should keep a restricted record of the requester, authority checked, legal basis, scope, information preserved or disclosed, reviewer, date, notice decision and any challenge. Retention and reporting rules must be set by the privacy owner and counsel. Public transparency statistics must not identify a person, Company or investigation unless lawfully authorized.

6. Contact and complaints

Public authority requests: [LEGAL/PRIVACY CONTACT]
Privacy/DPO: [DPO EMAIL]
Operator: [COMPANY LEGAL NAME] · Address: [ADDRESS]

How to complain

If you believe information was handled improperly, contact [DPO EMAIL] or [COMPLAINTS ROUTE — pending]. Any right to challenge a disclosure or complain to an external authority depends on [COUNTRY/LAW] and must be confirmed by qualified counsel.

Change log