Our baseline
Sansa Group AB does not provide Yieldline personal data to a public authority merely because it has been asked. We require a verified and binding lawful basis or a narrowly documented emergency basis recognized by applicable law. Informal, voluntary, overbroad, improperly served, or out-of-jurisdiction requests do not authorize disclosure.
Four mandatory controls
| Control | What we do | Release gate |
|---|---|---|
| Legality review | Verify the authority, jurisdiction, legal basis, compulsory power, service, scope, and conflicts with Swedish, EU, contractual, or customer obligations. | A documented assessment supports the request. |
| Challenge | Reject, clarify, narrow, seek a protective measure, or appeal where there are reasonable grounds to consider a request invalid, unlawful, overbroad, or disproportionate. | A challenge is resolved and disclosure is procedurally required. |
| Data minimization | Limit any response to the named tenant, identifiers, fields, and dates; exclude secrets and unrelated people or customers; prefer redaction or less identifying data. | The final package matches the minimum lawful scope. |
| Documentation | Keep the original request, assessment, narrowing steps, approvals, notices, production manifest, package hash, transfer record, and closure decision. | The Privacy Lead and a second authorized officer approve release. |
Customer notice and confidentiality
We notify the affected customer or person before disclosure when legally permitted and reasonably possible. If notification is prohibited, we document and review the restriction, consider challenging it, seek a waiver where appropriate, and notify when the restriction expires or is lifted. Request records are restricted to personnel who need them for legal review, secure production, and oversight.
Emergency requests
An asserted emergency involving imminent risk of death or serious physical harm does not bypass verification, necessity, proportionality, minimization, or documentation. We verify the requester through an official channel, disclose only what is necessary under a recognized legal basis, and complete independent review as soon as practicable.
Cross-border safeguards
Our process reflects GDPR accountability and data-minimization principles and the public-authority safeguards in Clause 15 of the European Commission Standard Contractual Clauses. Where a request could conflict with transfer obligations, we involve qualified counsel and pursue available challenge or protective measures.
Related information appears in our Privacy Notice, Data Processing Agreement, and Subprocessor list.
Contact
Public authorities should send formal requests through an official channel to support@sansavision.com. Customers and data subjects can use the same address for questions about this policy. Do not send passwords, access tokens, or unrelated personal data.