Government requests

This procedure applies to any request concerning data held by TrustData, whether it is:

• Client Data, that is, analytics data collected through the Service on behalf of an advertiser client, for which TrustData acts as a processor;
• account data, that is, the identity, email address and billing details of Service users, for which TrustData acts as a controller.

It applies regardless of which authority issues the request, French or foreign.

No data is disclosed before the request has been reviewed. The review is carried out by TrustData's legal representative, assisted where appropriate by external counsel, and covers:

• the authenticity of the request and the standing of its author;
• the legal basis relied upon, which must be expressly cited in the request;
• the jurisdiction of the requesting authority over TrustData;
• the specificity of the request: the data sought, the data subjects concerned and the period covered must be identified. A general or exploratory request is refused;
• the proportionality of the data sought to the purpose pursued.

Authorities outside the European Union. A judgment of a court or a decision of an administrative authority of a third country does not, on its own, constitute a valid legal basis for disclosing or transferring data (Article 48 GDPR). Such a request is acted upon only where it rests on an international agreement in force, in particular a mutual legal assistance treaty. Failing that, it is refused and its author is directed to that route.

Where the review concludes that a request has no legal basis, exceeds the jurisdiction of its author, is insufficiently specific, or disproportionately interferes with the rights of the data subjects, TrustData:

1. suspends any disclosure of data;
2. notifies the requesting authority in writing of the grounds for its refusal;
3. pursues the available remedies: application to have the request set aside, challenge before the competent court, referral to counsel;
4. maintains the refusal until an enforceable decision has determined the challenge.

The same commitment binds our sub-processors established outside the European Union, under Clause 15 of the Standard Contractual Clauses (Implementing Decision (EU) 2021/914): notification of the request, challenge of manifestly unlawful requests, and disclosure limited to the minimum permissible.

Where a request is found to be valid, disclosure is limited to what is strictly necessary:

• only the categories of data expressly covered by the request are extracted. No full export of an account or a database is produced on the basis of a targeted request;
• the extraction is bounded by the period stated in the request;
• data not concerning the named data subjects is removed or redacted before transmission;
• where the purpose pursued can be met with aggregated or pseudonymised data, that is offered first;
• transmission takes place over an encrypted channel, and temporary extracts are deleted once the request has been met.

Where a request concerns Client Data, TrustData informs the client without delay so that it may exercise its own rights, in accordance with Article 28 GDPR and our DPA, unless a legal prohibition on disclosure prevents this.

In that case, TrustData:

• seeks to have the prohibition lifted or its duration limited;
• informs the client as soon as the prohibition ceases to have effect;
• keeps a record of the prohibition and of the steps taken.

Every request received is recorded in an internal register, whether it was acted upon, restricted or refused. The register records:

• the date of receipt and the requesting authority;
• the legal basis relied upon;
• the categories of data and the period covered;
• the action taken (disclosure, partial disclosure after minimisation, or refusal) and the grounds for it;
• the people involved in the review and the response;
• the date and channel of transmission, where applicable.

The register is kept for five years. It may be produced to the competent supervisory authority and, so far as the law permits, to the client concerned.

Any request from a public authority must be addressed in writing to:

TRUSTDATA - Legal representative

7 rue Cail, 75010 Paris, France

[email protected]

A request sent through any other channel (support, social media, telephone) is not acted upon, and its author is directed to this address.