Law Enforcement & Data Disclosure Policy
How Phytoventures Ltd handles requests for information from law enforcement and government authorities.
1. Introduction
Phytoventures Ltd ("we", "us", "our") respects the privacy of every individual who uses our services. We also recognise that law enforcement agencies and government authorities may, from time to time, require access to information we hold in connection with the prevention and detection of crime, the apprehension or prosecution of offenders, or the protection of public safety.
This policy sets out our approach to handling such requests. We are committed to protecting the rights of our users while complying with our legal obligations under UK law.
2. Our Commitment
We will only disclose personal data or confidential information to law enforcement or government authorities where we are lawfully required or permitted to do so. We do not voluntarily share user data with any third party, including law enforcement, unless a valid legal basis exists.
Our guiding principles are:
- We will always require a valid legal instrument before disclosing information
- We will scrutinise every request to ensure it is lawful, proportionate, and necessary
- We will disclose the minimum amount of information required to satisfy the request
- We will notify affected users where we are legally permitted to do so
- We will maintain a record of all law enforcement requests received and our responses
- We will never provide "bulk" or "dragnet" access to our systems or data
3. Legal Basis for Disclosure
We may be compelled to disclose information under the following legal instruments:
3.1 Court Orders
A court order issued by a court of competent jurisdiction in England and Wales (or the wider United Kingdom) requiring the production of specific information. We will comply with valid court orders but may challenge orders we believe to be overly broad, disproportionate, or legally deficient.
3.2 Warrants
A warrant issued under the Police and Criminal Evidence Act 1984 (PACE), the Investigatory Powers Act 2016, or other relevant legislation. We will require sight of the original warrant, verify its validity, and ensure it relates specifically to information we hold.
3.3 Production Orders
Production orders issued under Schedule 1 of PACE or the Terrorism Act 2000. We will verify the legal authority of the issuing body and the scope of the order.
3.4 Data Protection Act 2018 Exemptions
Section 45 of the Data Protection Act 2018 provides a limited exemption from certain data protection principles where disclosure is necessary for the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of tax or duty. We will assess each request on its merits and will not rely on this exemption as a blanket justification for disclosure.
3.5 Investigatory Powers Act 2016
We may receive requests under the Investigatory Powers Act 2016, including communications data requests. We will require that any such request is authorised in accordance with the Act and approved by the appropriate authority (including judicial authorisation where required).
3.6 Voluntary Disclosure — Imminent Risk to Life
In exceptional circumstances where there is an imminent and serious risk to life or physical safety, we may voluntarily disclose limited information to law enforcement without a formal legal instrument. Any such disclosure will be made at the sole discretion of a senior member of the Phytoventures leadership team, will be limited to the minimum necessary to address the immediate risk, and will be fully documented.
4. Our Process
4.1 Receipt and Logging
All law enforcement requests must be submitted in writing to our designated contact point (see Section 9). Upon receipt, the request will be logged, assigned a reference number, and reviewed by a senior member of the Phytoventures team.
4.2 Verification
We will verify the identity and authority of the requesting officer or agency. We will confirm that the legal instrument presented is valid, in scope, and relates to information we actually hold.
4.3 Legal Review
For complex or sensitive requests, we may seek independent legal advice before responding. We reserve the right to challenge any request we believe to be unlawful, disproportionate, or outside the scope of the legal instrument presented.
4.4 Proportionality Assessment
We will assess whether the request is proportionate and necessary. We will not disclose more information than is strictly required to satisfy the legal obligation.
4.5 Disclosure
Where we determine that disclosure is required, we will provide the information in a secure manner. We will maintain a record of what was disclosed, to whom, and under what legal authority.
4.6 User Notification
Where we are legally permitted to do so, we will notify any affected users that their information has been requested or disclosed. We recognise that some legal instruments prohibit notification (for example, where notification would prejudice an investigation). In such cases, we will comply with the non-disclosure requirement but will notify the user as soon as we are legally permitted to do so.
5. What We Will Not Do
- We will not provide law enforcement with direct access to our systems, servers, or databases
- We will not install or facilitate the installation of surveillance equipment or "backdoors"
- We will not comply with informal or verbal requests for information — all requests must be in writing
- We will not disclose information to foreign law enforcement agencies unless the request is made through appropriate mutual legal assistance channels or is otherwise authorised under UK law
- We will not retain data longer than our stated retention periods solely to facilitate potential future law enforcement requests
- We will not create, fabricate, or alter records in response to any request
6. Medical Cannabis Patients
We are acutely aware that many of our users are medical cannabis patients in the United Kingdom. Medical cannabis has been legal on prescription in the UK since 1 November 2018. We will not:
- Treat a user's status as a medical cannabis patient as grounds for disclosure to law enforcement
- Disclose prescription or health-related information unless specifically compelled by a valid legal instrument
- Cooperate with requests that appear to target individuals solely on the basis of their legal use of prescribed medical cannabis
- Share user data with any regulatory body related to cannabis unless legally compelled to do so
We will challenge any request that we believe is motivated by prejudice against medical cannabis patients or that seeks to criminalise lawful, prescribed medical treatment.
7. Data We Hold
For transparency, the types of data we may hold include:
- Client names, email addresses, phone numbers, and business addresses
- Invoice and payment records
- Support ticket content
- Project files and communications
- Event booking and attendance records
- Survey responses (where Phytoventures is the data processor)
- Login timestamps and IP addresses (retained for security purposes)
- Account activity logs
We do not hold medical records, prescription information, or clinical data. We do not record or monitor the content of private communications between users.
8. Transparency
We believe in transparency about law enforcement engagement. Subject to any legal restrictions on disclosure, we intend to publish an annual transparency report summarising:
- The number of law enforcement requests received
- The number of requests complied with (in full or in part)
- The number of requests challenged or refused
- The legal instruments relied upon
- The number of users notified
9. Contact
Law enforcement requests should be submitted in writing to:
Email: [email protected]
Subject line: Law Enforcement Request — [Reference/Case Number]
Postal address:
Phytoventures Ltd
Belmont Suite, Chorley New Road, Horwich, Bolton, England, BL6 6HG
United Kingdom
All requests must include the name and warrant number or badge number of the requesting officer, the name and contact details of the issuing agency, a copy of the relevant legal instrument (warrant, court order, production order, etc.), a clear description of the information sought, and the legal basis for the request.
Informal, verbal, or unsigned requests will not be actioned.
10. Governing Law
This policy is governed by the laws of England and Wales, including the Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR), the Police and Criminal Evidence Act 1984, and the Investigatory Powers Act 2016.
11. Changes to This Policy
We may update this policy from time to time. Any changes will be published on this page with an updated "Last updated" date. We encourage you to review this policy periodically.
Phytoventures Ltd
Company Number: 16388003
Registered in England and Wales