Government and law enforcement requests

1. What this policy covers

This policy applies when a government body, a court, a regulator, the police or any other public authority asks Dona Labs LLC ("Dona") for personal data about a person. That includes data of our Customers and of the people who use their CRM, and data of the people who message or call a business served by Dona through WhatsApp, Instagram, SMS or the phone, including data we receive from platforms such as Meta.

For the data of the people who contact a business, the business is the controller and Dona is its processor. We handle these requests on the business's behalf, as described in our Data processing agreement, and we involve the business whenever the law allows it.

This policy is binding on everyone who works for Dona. Only the legal contact named below, or a person they designate, may answer a request from an authority.

2. How to send us a request

Requests must be made in writing to legal@joindona.com, from an official address of the requesting authority, and must identify the authority and the officer responsible, the legal basis of the request, the specific account, person, phone number or Instagram account concerned, the period of time, and the exact data requested.

We accept requests served through the legal process applicable to Dona in the United States (a subpoena, a court order, a search warrant or an equivalent instrument). Authorities from other countries should use the mutual legal assistance procedures or a letter rogatory, or ask the business that controls the data directly. We do not answer requests sent through informal channels or by telephone.

In an emergency involving an imminent risk of death or serious physical harm, we may disclose the information strictly necessary to address the emergency, provided the request explains the nature of the emergency and why it cannot wait for the regular legal process. Emergency requests are reviewed and recorded like any other.

3. How we review every request

Before disclosing anything, we review that the request is legally valid and binding: that it comes from a competent authority, that it rests on a valid legal instrument under the applicable law, that it is properly signed and served, and that its scope is specific and proportionate. Where it is useful, we consult outside counsel.

If we consider that a request is not valid, is overly broad, lacks a sufficient legal basis, conflicts with the law applicable to Dona or to the data, or conflicts with the terms under which a platform shared the data with us, we object to it and, where appropriate, we ask the authority to narrow it or we challenge it before the competent court. We may refuse to comply until the defects are cured.

We also check that the request does not ask for more than the law allows. We do not act on requests that target people for exercising lawful rights, or that are unrelated to a legitimate investigation.

4. We disclose the minimum

When a request is valid, we disclose only the specific data that it lawfully requires, for the specific accounts and period it names, and nothing more. We do not give authorities direct access to our systems, we do not disclose access tokens, passwords or credentials, and we do not disclose data in bulk.

Where the request can be satisfied with less (for example, confirming that an account exists instead of handing over its messages), we disclose less. Each disclosure is approved by the legal contact.

5. Notice to the business and to the person

We notify the affected business before disclosing data about its contacts, so that it can inform the person or object to the request, unless the law or a court order prohibits it, or an emergency makes it impossible. When the prohibition ends, we send the notice.

If the request concerns a Dona Customer or a user of its CRM, we notify them in the same way. Where a platform requires us to inform it of requests concerning the data it shared with us, we do so.

6. What we record

We keep a record of every request, whether or not we comply with it: the date it was received, the requesting authority, the legal basis it invoked, the data it asked for, our review and our decision with its reasons, any objection or challenge, what was disclosed and when, and whether and when the business or the person was notified.

These records are kept for five years, under the same security measures as the rest of our data. We can confirm to a Customer, on request, whether its account has been the subject of a request, unless the law prohibits it.

7. Contact

Requests from authorities: legal@joindona.com. Questions about this policy or about your personal data: privacy@joindona.com. This policy complements our Privacy policy and our Data processing agreement.