Government Data Request Policy

No user data is disclosed to a public authority until the request has been reviewed to confirm it has a proper legal basis. That review checks that the request is in writing, comes from an identifiable and competent authority, cites the law or instrument it is made under, and covers data we actually hold.

Responsibility for this review sits with the ZIP.GY director / data controller. Operational staff and dispatch team members are not permitted to release user data to an authority on their own initiative and must escalate any such request immediately.

We do not treat a request as valid simply because it comes from an authority. Where a request appears to lack legal basis, to be overly broad, to be improperly served, or to conflict with the privacy rights of our users, we will push back — by seeking clarification or narrowing, by formally objecting, by requiring a court order where one is legally necessary, and by obtaining legal advice and contesting the request before the appropriate body where that is warranted.

We will not voluntarily hand over user data in the absence of a lawful obligation to do so.

Where we are lawfully required to disclose data, we release only the specific records and specific fields the request actually compels, limited to the individuals and the time period named. We do not provide whole-account exports, bulk data sets, or unrelated records as a convenience.

Anything outside the scope of the request — other users, other trips, payment credentials, or data we hold for a different purpose — is withheld.

We keep an internal record of each request from a public authority. That record includes the date received and the requesting authority, the legal instrument relied upon, the data requested, the legal reasoning applied and the decision reached, who at ZIP.GY made and approved the decision, any external legal advisor involved, exactly what data was disclosed or the grounds for refusal, and the date of our response.

These records are retained so that our handling of any request can be reviewed and accounted for after the fact.

Where we are legally permitted to do so, we will inform an affected user that their data has been requested, so that they have the opportunity to seek their own legal advice. We will not notify a user where a valid legal instrument prohibits us from doing so.