Legal, Privacy & Authority Requests

• the type of request and the document or feature it concerns;
• your name, organisation and role, and a means of contacting you;
• for data subject requests, enough information to locate the data and verify identity;
• for legal or authority requests, the legal basis and the scope of what is sought;
• for security reports, reproduction steps and impact, following the Responsible Disclosure Policy.

Requests are acknowledged within a reasonable period and handled within the timescales required by applicable law. Where the data concerned sits inside a Customer's workspace, we normally act as processor and will refer the request to that Customer as controller while providing reasonable assistance. We may need to verify identity or authority before acting.

Requests from law enforcement, regulators or other public authorities must be made in writing, be signed by an authorised official, identify the legal basis relied upon, and be limited to what is necessary and proportionate.

We review each request for validity and scope, disclose only what we are legally required to disclose, and push back on overbroad or improperly issued requests. Where a request concerns a Customer's data we will notify that Customer so it can seek protective measures, unless we are legally prohibited from doing so or there is a risk to life or safety.

Individuals may also lodge a complaint with the data protection supervisory authority in their country of residence or place of work. The applicable jurisdiction for these documents is Portugal, European Union.

Bracketed values on this page are pending confirmation by the operating legal entity. They are shown openly rather than filled with assumed information so that nothing published here is inaccurate.