Law Enforcement Policy
Last updated: 30 October 2026
About this policy
This policy sets out how Brabo Group Ltd ("we", "us") handles requests about Brabo from police, prosecutors, courts and other public authorities ("authorities"). It covers brabo.team, trialportal.org and the Brabo apps. If you use Brabo and have a question about your own data, see our Privacy Policy or Support.
1. Who we are
1.1Brabo Group Ltd is a private company limited by shares, registered in England and Wales under company number 17558873, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom.
1.2We are subject to the law of the United Kingdom and, for the service we offer to people in the European Union, to the EU law that applies to it.
2. Point of contact
2.1Our single point of contact for authorities is owlbert@brabo.team, with "Request from an authority" in the subject, or by post to our registered office.
2.2This includes UK authorities and Ofcom under the Online Safety Act 2023, and authorities of EU Member States, the European Commission and the European Board for Digital Services under Article 11 of the Digital Services Act (Regulation (EU) 2022/2065).
2.3We communicate in English and may ask for a translation of a request in another language before acting on it.
2.4We do not accept requests through any other channel, including Brabo itself, social media, our staff's personal accounts or our service providers.
3. What we require
3.1We disclose or preserve user data, or take other action at an authority's request, only where valid legal process that binds us requires it. That means:
(a)an order, warrant or notice from a competent UK court or authority under UK law;
(b)a European Production Order or European Preservation Order under Regulation (EU) 2023/1543, where that Regulation applies to us; or
(c)an order under an international agreement that binds us, such as the UK–US Data Access Agreement.
3.2Every request must be in writing and state:
(a)the issuing authority and the official responsible for it;
(b)the legal basis for the request and why it binds us;
(c)the account concerned, by Brabo username, Emerald Chat username or user ID, or registered email address;
(d)the data or action requested and, where relevant, the time period; and
(e)a contact address for our reply and any deadline.
3.3Requests sent by email must come from an official address of the issuing authority.
3.4Other authorities must use mutual legal assistance procedures through the UK Central Authority.
4. Requests we refuse
4.1We do not act on requests that don't meet section 3, including informal or "voluntary" requests, invalid or non-binding orders, requests we cannot verify, requests that are overly broad, and requests for data we do not hold.
4.2We verify every request before acting on it.
4.3Where we believe an order is unlawful, disproportionate or overly broad, we may ask for it to be narrowed or challenge it.
4.4Declining a request is not an admission that any data exists or does not exist.
5. Preservation
5.1On a valid preservation order, we preserve the data we still hold for the period the order requires or, if it states none, for 90 days.
5.2We disclose preserved data only once we have received and verified an order for its disclosure.
6. Emergencies
6.1An authority that believes a person faces an imminent risk of death or serious physical injury can send an emergency request to the point of contact, with "Emergency" in the subject. It must explain the emergency and how the data requested will help prevent it, and must come from a verifiable official source.
6.2We may disclose the limited data needed to deal with the emergency where the law permits. We may ask for valid legal process afterwards.
6.3Where we suspect a criminal offence involving a threat to a person's life or safety, we inform the competent authorities as the law requires, including under Article 18 of the Digital Services Act.
7. Notifying users
7.1We notify users before we disclose their data to an authority, unless the law or the order prohibits it or notice would put someone at risk of harm.
7.2Where we delay notice, we notify the user once the prohibition or risk has ended.
8. Data we hold
8.1Our Privacy Policy describes the personal data we hold and how long we keep it. We can only provide data we hold when a valid request is verified.
8.2We do not hold identity documents or the images taken during age and identity checks. Didit Identity Spain, S.L. holds them, and requests for them must go to Didit.
8.3We do not hold data held by Emerald Chat (Connected Software Inc.). Requests for it must go to Emerald Chat.
9. Content orders
9.1Notices from Ofcom under the Online Safety Act 2023, orders to act against illegal content under Article 9 of the Digital Services Act and requests for information under Article 10 go to the point of contact and must meet sections 3 and 4.
9.2We tell the issuing authority what action we have taken.
10. General
10.1This policy does not create rights for any third party, and does not waive any right, objection, privilege or immunity of ours or our users.
10.2We may update this policy at any time. The date at the top shows when it last changed.
10.3This policy is governed by the law of England and Wales.
10.4Security researchers should use our Vulnerability Disclosure Policy.