Government and Third-Party Requests for Data
This page sets out how we respond when a government body, law enforcement agency, intelligence agency, regulator, court or any other third party asks us for data.
It is written down because the honest answer to "what would you do if the police asked for our data?" should not be invented on the day it happens.
Our Position
We do not give voluntary access to personal data for surveillance, intelligence or law enforcement purposes.
We disclose personal data to a public authority only where we are compelled to by a valid legal instrument, and then only the minimum that instrument actually requires.
We challenge a request that is overbroad, defective, or served on the wrong party.
We tell you when someone asks for your data, unless we are legally prohibited from telling you.
We have never received a request or demand from a government authority or intelligence agency for personal data. If that changes, this page changes.
The Law We Are Subject To
Sales Triage is a United Kingdom company with no overseas entities, so UK law applies to us. The instruments that can compel disclosure are principally the Investigatory Powers Act 2016, which governs interception, the acquisition of communications data and technical capability notices; the Police and Criminal Evidence Act 1984, under which production orders may be sought; the Crime (Overseas Production Orders) Act 2019, which operates alongside the UK-US Data Access Agreement; and the Data Protection Act 2018, which provides exemptions covering national security and the prevention and detection of crime.
Some of our suppliers are established in the United States and may be subject to US lawful access powers, including FISA Section 702 and the CLOUD Act. Which supplier holds what, and the transfer safeguard that applies to each, is set out on the Suppliers and Subprocessors page.
Data We Hold For You, and Data We Hold About You
The distinction decides who a request should be served on.
Where you store records in the platform, you are the controller and we are the processor. The data is yours. A request for it should properly be served on you, not on us.
Where we hold data as a controller in our own right, such as account, billing, coaching and training records, a request is properly directed to us and we handle it under the steps below.
What We Do When a Request Arrives
One person handles it. All requests go to the privacy contact named in our Privacy Policy. Nobody else may acknowledge, confirm, deny or respond to a request, or disclose anything in response to one. If a request arrives by phone or in person, we take the requester's details, say that requests must be made in writing, and pass it on the same day. We confirm nothing in that conversation, including whether someone is a client.
We require it in writing. We do not act on a verbal request. We record when it arrived, who made it, under what authority, and any deadline. We preserve the request and all correspondence, and we do not alter or delete anything within its scope. Where a request is urgent we respond with priority, but we still require it in writing.
We check it. In this order:
- Authority. Is there a valid legal instrument behind it, such as a warrant, production order, court order or statutory notice? Is the issuing body entitled to make it? A request citing no legal authority is a voluntary request, and our answer to a voluntary request is no.
- Jurisdiction. Does the issuing body have jurisdiction over us? A direct approach from a foreign authority ordinarily needs to come through a mutual legal assistance treaty or the UK-US Data Access Agreement rather than straight to us.
- Our role in the data. Is it yours or ours? Where it is yours, we tell the requesting body the data belongs to a client, decline to disclose, and direct them to you. Where we are lawfully compelled anyway, we tell you.
- Scope. Is it limited to named individuals, accounts and date ranges, or is it a general request for broad categories of data? Anything requiring us to search or disclose beyond what the instrument names is overbroad.
- Proportionality. Does what is asked for match the stated purpose?
We challenge what does not pass. Depending on the defect, we ask the requesting body to state its legal authority, ask it to narrow the request, point out where it should be served on someone else, or object formally and apply to the issuing court or authority to vary or set aside the instrument. We take legal advice before responding to any request we intend to contest, and on any request involving national security, interception or a non-disclosure requirement.
We disclose the minimum. Where we are satisfied we are lawfully compelled, we disclose only what the instrument requires. We do not volunteer anything outside its scope. We do not give bulk or direct access to systems. We do not hand over encryption keys or credentials unless separately and specifically compelled. We record exactly what was disclosed, to whom, and under what authority.
Telling You
We notify the affected client or individual before disclosure wherever we can, so you have the opportunity to seek your own legal remedy.
We stay silent only where we are legally prohibited, or where notification is deferred by the instrument itself. Where that happens we ask the requesting body to lift or time-limit the restriction and record their answer, we notify you as soon as it expires or is lifted, and where a restriction is indefinite we review it every year and ask again.
This is also a contractual commitment, not only a policy one. Clause 1 of the Data Processing Agreement in our Terms says that where we are required by law to process outside your instructions, we will inform you unless we are legally prohibited.
If a Supplier Receives a Request
We require our suppliers to tell us about any request they receive for data they process on our behalf, and to direct the requesting body to us where they are lawfully able to. When one does, we start at the beginning of this procedure and tell the affected client.
What We Write Down
We log every request we receive, whether or not anything was disclosed. Each entry records when it arrived, who made it, the legal instrument cited, what was sought, whether the data was ours or a client's, what we decided and why, what was disclosed if anything, whether and when we told the affected client, and when any non-disclosure restriction was last reviewed.
The log is kept for six years. It is currently empty.
Asking Us
We will tell any client, on request, whether we have received a government or third-party request affecting their data, as far as we are lawfully permitted to say.
Review
This page is reviewed annually, and whenever we receive a request, establish ourselves in a new jurisdiction, or make a material change to our processing or our supply chain.