Public-authority data requests

Contact and complaints

Send requests and privacy complaints to info@pomsoft.net. For an authority request, use the subject “Public-authority data request” and provide the agency, independently verifiable official contact details, applicable legal process and jurisdiction, the accounts and specific records sought, the relevant dates, and any deadline or legal restriction on user notice. Emailing us does not replace legally required service of process.

Do not include passwords, access tokens or unrelated personal information. We verify the requester before arranging any necessary secure exchange. A privacy complaint should describe the concern and a way to contact you; we review it and explain the outcome to the extent legally permitted. We may need to verify account ownership before discussing account-specific information.

Review every request for legality

Pomsoft’s owner is the designated request reviewer. Before disclosing user information, the reviewer must verify the authority’s identity through an independent official source and assess the legal basis, jurisdiction, authenticity, scope and required response. A request, official-looking email or asserted urgency alone is not sufficient authorization.

Unclear legal obligations, cross-border requests, national-security requests, non-disclosure restrictions and other legally complex demands must be escalated to qualified legal counsel before a disclosure decision. Applicable law governs the response; this policy does not expand an authority’s entitlement to data.

Challenge unlawful or excessive demands

We do not voluntarily fulfill requests we determine are unlawful or legally insufficient. We seek clarification, correction or narrowing of vague, excessive or unsupported demands. Where appropriate, we use available lawful procedures, with legal advice, to challenge a demand or restriction. We document why we comply, narrow, challenge or decline a request and continue to meet binding legal obligations.

Disclose the minimum necessary

For a valid request requiring disclosure, we identify only the records we actually hold that are within its lawful scope. The reviewer checks account identifiers, date ranges and fields before release, excludes unrelated people and data, and uses an appropriate secure delivery method to a verified recipient. We do not provide unrestricted access to our systems or disclose passwords, app secrets or authentication tokens as a routine response to a user-record request.

Preservation of records and disclosure are separate decisions: a preservation request does not by itself authorize disclosure. We do not create records we do not hold or collect extra user information merely to satisfy a request. We notify affected users before disclosure where legally permitted and appropriate, unless doing so would create a material safety risk or compromise a legitimate investigation; any delayed or omitted notice and its reason must be recorded and reviewed.

Document decisions and protect case records

We maintain a restricted request register and case file recording receipt and deadlines, the requesting authority and verified contacts, legal process and basis, accounts and data sought, the people involved in review, legal reasoning, challenges or narrowing, the decision, data actually disclosed, delivery details and user-notice decisions. Access is limited to the owner and authorized people with a need to handle the case, subject to applicable confidentiality requirements.

We review case records at closure and at least annually thereafter, retaining only what is needed for legal obligations, accountability and handling disputes. Legal holds are respected; records no longer needed are securely deleted. Request files and user information are not published in public source repositories or public reports.

Urgent requests and oversight

Authorities reporting an imminent threat should clearly identify the emergency, affected person, specific information requested and legal basis. Urgency does not bypass identity verification, legal assessment, minimization or recordkeeping. For immediate danger, contact the appropriate emergency services; this email address is not an emergency-response service.

The owner must follow the handling checklist before responding, review this policy at least annually and after a material change or incident, and brief anyone authorized to handle requests before they access case records. Questions or complaints about this policy can be sent to info@pomsoft.net.