Scope and Responsibility
This policy applies to requests from government entities, law enforcement agencies, courts, regulators, and other public authorities for personal data or personal information associated with Yvatar users. Only authorized personnel may review and respond to such requests, with legal counsel consulted when appropriate.
Required Legal Review
We require each request to be reviewed for authenticity, jurisdiction, legal authority, validity, and scope before disclosing user data. We may require the requesting authority to provide a written request, valid legal process, and sufficient information to identify the account and data sought. Emergency requests are evaluated under applicable law and must describe the nature of the emergency and the information requested.
Challenging Unlawful or Overbroad Requests
We reject or challenge requests that we reasonably determine are unlawful, invalid, improperly served, outside the requesting authority's jurisdiction, or overbroad. When appropriate and legally permitted, we seek clarification, narrowing, withdrawal, or judicial review before disclosing data.
Data Minimization
When disclosure is legally required, we disclose only the minimum information reasonably necessary to comply with the valid request. We interpret requests narrowly, limit disclosures to the accounts, data categories, and time periods specified, and do not provide voluntary bulk access or direct access to Yvatar systems.
Documentation and Accountability
We maintain an internal record of requests and our responses, including the requesting authority, date received, legal process and jurisdiction, data and users involved, reviewers and decision-makers, legal reasoning, any challenge or narrowing effort, the response date, and the information disclosed. Records are retained and protected in accordance with applicable legal, security, and retention requirements.
User Notice
We seek to notify affected users before disclosure when legally permitted and when notice would not create a risk of harm. If notice is prohibited or must be delayed, we may provide notice after the restriction expires when legally permitted.
Secure Disclosure
Any required disclosure must use a method appropriate to the sensitivity of the information. Access is limited to personnel and service providers who need it to process the request and who are subject to applicable confidentiality and data-protection obligations.
Contact
Questions about this policy may be directed to Agents of SEO LLP through the support channel provided by Yvatar.