Public Authority Request Policy

This policy explains how Artima s.r.o., Company ID 19658451, handles requests from courts, police, regulators and other public authorities for data held in Artima Socials, including data we process on behalf of our customers.

1. Our principles

• We disclose data only when the law obliges us to.
• We disclose as little as possible.
• We tell the affected customer, unless the law forbids it.
• We do not give any authority direct or unrestricted access to our systems, and we have built no "back door" into them.

2. How we review a request

1. Form. The request must be in writing and come from an authority we can verify. We check the identity of the sender independently, not through contact details in the request.
2. Legal basis. The request must cite a valid legal basis that applies to us, under Czech or EU law. A request from an authority outside the EU must go through an international legal-assistance procedure (for example, a mutual legal assistance treaty), unless EU law provides otherwise.
3. Scope. The request must name specific accounts or data and a specific purpose. We refuse or challenge requests that are too broad, unclear or unlawful, including through legal remedies where this is reasonable.
4. Customer data first. Where the data belongs to a customer, we first ask the authority to request it from the customer directly, unless this is impossible or legally prohibited.
5. Emergencies. If a request credibly concerns an imminent risk to someone's life or physical safety, we may act faster, but still require a lawful basis, check its source and limit disclosure to what the law requires.

3. What we disclose

Only the data the request lawfully requires, for the period it names. Data that we do not hold cannot be disclosed. For example, we do not store LinkedIn comments or insights, and erased database data cannot be retrieved from the active database. Audit and publish-attempt records can remain for 24 months, publish-attempt records longer while a publication's outcome is unresolved; webhook records for 30 days from receipt or from the final delivery attempt. Server logs are kept in size-limited files that are overwritten continuously. Technical receipts and deletion-work records can also remain as explained in Privacy section 9. We assess each request against the data actually held and the retention rules in our Privacy Policy.

Encrypted database and server-configuration backups used only for disaster recovery may retain personal data for at most 28 days after account deletion; media files are not included. See Privacy section 9.

4. Notifying customers

We notify the affected customer before disclosure, so they can seek a remedy, unless a law or a court order forbids it. If notice is forbidden only for a time, we notify the customer once the restriction ends.

5. Records and transparency

• We keep an internal record of every request: the authority, its legal basis, what was requested, what we disclosed or refused, and why.
• Access to this register is limited to handling and demonstrating the lawfulness of requests. Records are retained only while needed for the request, associated proceedings or an applicable legal retention duty; any legal hold records its basis and required duration.

6. Contact for authorities

Artima s.r.o., Company ID: 19658451, VAT ID: CZ19658451, with its registered office at nám. T. G. Masaryka 1281, 760 01 Zlín, Czech Republic, registered in the Commercial Register maintained by Krajský soud v Brně, Section C, Insert 135572.

Privacy and request handling: privacy@artima.ai. Formal service of documents: legal@artima.ai.