Law Enforcement & Data Disclosure Policy

1. Introduction

Phytoventures Ltd ("we", "us", "our") respects the privacy of every individual who uses our services. We also recognise that law enforcement agencies and government authorities may, from time to time, require access to information we hold in connection with the prevention and detection of crime, the apprehension or prosecution of offenders, or the protection of public safety.

This policy sets out our approach to handling such requests. We are committed to protecting the rights of our users while complying with our legal obligations under UK law.

2. Our Commitment

We will only disclose personal data or confidential information to law enforcement or government authorities where we are lawfully required or permitted to do so. We do not voluntarily share user data with any third party, including law enforcement, unless a valid legal basis exists.

Our guiding principles are:

• We will always require a valid legal instrument before disclosing information
• We will scrutinise every request to ensure it is lawful, proportionate, and necessary
• We will disclose the minimum amount of information required to satisfy the request
• We will notify affected users where we are legally permitted to do so
• We will maintain a record of all law enforcement requests received and our responses
• We will never provide "bulk" or "dragnet" access to our systems or data

3. Legal Basis for Disclosure

We may be compelled to disclose information under the following legal instruments:

3.1 Court Orders

A court order issued by a court of competent jurisdiction in England and Wales (or the wider United Kingdom) requiring the production of specific information. We will comply with valid court orders but may challenge orders we believe to be overly broad, disproportionate, or legally deficient.

3.2 Warrants

A warrant issued under the Police and Criminal Evidence Act 1984 (PACE), the Investigatory Powers Act 2016, or other relevant legislation. We will require sight of the original warrant, verify its validity, and ensure it relates specifically to information we hold.

3.3 Production Orders

Production orders issued under Schedule 1 of PACE or the Terrorism Act 2000. We will verify the legal authority of the issuing body and the scope of the order.

3.4 Data Protection Act 2018 Exemptions

Section 45 of the Data Protection Act 2018 provides a limited exemption from certain data protection principles where disclosure is necessary for the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of tax or duty. We will assess each request on its merits and will not rely on this exemption as a blanket justification for disclosure.

3.5 Investigatory Powers Act 2016

We may receive requests under the Investigatory Powers Act 2016, including communications data requests. We will require that any such request is authorised in accordance with the Act and approved by the appropriate authority (including judicial authorisation where required).

3.6 Voluntary Disclosure — Imminent Risk to Life

In exceptional circumstances where there is an imminent and serious risk to life or physical safety, we may voluntarily disclose limited information to law enforcement without a formal legal instrument. Any such disclosure will be made at the sole discretion of a senior member of the Phytoventures leadership team, will be limited to the minimum necessary to address the immediate risk, and will be fully documented.

4. Our Process

4.1 Receipt and Logging

All law enforcement requests must be submitted in writing to our designated contact point (see Section 9). Upon receipt, the request will be logged, assigned a reference number, and reviewed by a senior member of the Phytoventures team.

4.2 Verification

We will verify the identity and authority of the requesting officer or agency. We will confirm that the legal instrument presented is valid, in scope, and relates to information we actually hold.

4.3 Legal Review

For complex or sensitive requests, we may seek independent legal advice before responding. We reserve the right to challenge any request we believe to be unlawful, disproportionate, or outside the scope of the legal instrument presented.

4.4 Proportionality Assessment

We will assess whether the request is proportionate and necessary. We will not disclose more information than is strictly required to satisfy the legal obligation.

4.5 Disclosure

Where we determine that disclosure is required, we will provide the information in a secure manner. We will maintain a record of what was disclosed, to whom, and under what legal authority.

4.6 User Notification

Where we are legally permitted to do so, we will notify any affected users that their information has been requested or disclosed. We recognise that some legal instruments prohibit notification (for example, where notification would prejudice an investigation). In such cases, we will comply with the non-disclosure requirement but will notify the user as soon as we are legally permitted to do so.

5. What We Will Not Do

• We will not provide law enforcement with direct access to our systems, servers, or databases
• We will not install or facilitate the installation of surveillance equipment or "backdoors"
• We will not comply with informal or verbal requests for information — all requests must be in writing
• We will not disclose information to foreign law enforcement agencies unless the request is made through appropriate mutual legal assistance channels or is otherwise authorised under UK law
• We will not retain data longer than our stated retention periods solely to facilitate potential future law enforcement requests
• We will not create, fabricate, or alter records in response to any request

6. Medical Cannabis Patients

We are acutely aware that many of our users are medical cannabis patients in the United Kingdom. Medical cannabis has been legal on prescription in the UK since 1 November 2018. We will not:

• Treat a user's status as a medical cannabis patient as grounds for disclosure to law enforcement
• Disclose prescription or health-related information unless specifically compelled by a valid legal instrument
• Cooperate with requests that appear to target individuals solely on the basis of their legal use of prescribed medical cannabis
• Share user data with any regulatory body related to cannabis unless legally compelled to do so

We will challenge any request that we believe is motivated by prejudice against medical cannabis patients or that seeks to criminalise lawful, prescribed medical treatment.

7. Data We Hold

For transparency, the types of data we may hold include:

• Client names, email addresses, phone numbers, and business addresses
• Invoice and payment records
• Support ticket content
• Project files and communications
• Event booking and attendance records
• Survey responses (where Phytoventures is the data processor)
• Login timestamps and IP addresses (retained for security purposes)
• Account activity logs

We do not hold medical records, prescription information, or clinical data. We do not record or monitor the content of private communications between users.

8. Transparency

We believe in transparency about law enforcement engagement. Subject to any legal restrictions on disclosure, we intend to publish an annual transparency report summarising:

• The number of law enforcement requests received
• The number of requests complied with (in full or in part)
• The number of requests challenged or refused
• The legal instruments relied upon
• The number of users notified

9. Contact

Law enforcement requests should be submitted in writing to:

Email: [email protected]
Subject line: Law Enforcement Request — [Reference/Case Number]

Postal address:
Phytoventures Ltd
Belmont Suite, Chorley New Road, Horwich, Bolton, England, BL6 6HG
United Kingdom

All requests must include the name and warrant number or badge number of the requesting officer, the name and contact details of the issuing agency, a copy of the relevant legal instrument (warrant, court order, production order, etc.), a clear description of the information sought, and the legal basis for the request.

Informal, verbal, or unsigned requests will not be actioned.

10. Governing Law

This policy is governed by the laws of England and Wales, including the Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR), the Police and Criminal Evidence Act 1984, and the Investigatory Powers Act 2016.

11. Changes to This Policy

We may update this policy from time to time. Any changes will be published on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

Phytoventures Ltd
Company Number: 16388003
Registered in England and Wales