Law Enforcement Request Policy

1. Purpose

This policy outlines how Curve (hereinafter referred to as "we") handles requests from law enforcement agencies regarding data access, account freezes, information disclosure, and investigative cooperation, in accordance with our user data protection obligations.

2. Our Position on Law Enforcement Requests

We respect the privacy of our users and cooperate with lawful and legitimate law enforcement requests within the bounds of applicable laws. We do not disclose user data to any government or agency without valid legal grounds.

3. Requirements for Requests

We will only respond to law enforcement or regulatory requests that meet one or more of the following criteria:

• The request originates from a law enforcement agency with proper legal jurisdiction;

• The request is accompanied by valid legal process, such as a court order, subpoena, search warrant, or data preservation notice;

• The request clearly states the legal basis, the scope of requested data, and the investigative purpose.

4. Submission Process

We do not accept informal or verbal requests via unofficial channels. Each request must include:

• The name, department, address, and contact information of the requesting agency and officer;

• Specific information identifying the user(s) involved (e.g., account ID, email, transaction ID);

• The scope and time frame of the requested data;

• The legal basis for the request and the purpose of the investigation.

5. Emergency Requests

If a law enforcement agency reasonably believes there is an emergency involving serious physical harm, terrorism, major fraud, or child exploitation, it must clearly label the request as "EMERGENCY". We will prioritize such requests to the extent permitted by law.

6. Data Disclosure Principles

We disclose only the minimum amount of data legally required, and we strictly comply with the following data protection laws and standards:

• EU General Data Protection Regulation (GDPR), Articles 6 and 23;

• United Kingdom General Data Protection Regulation (UK GDPR);

• California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA);

• U.S. Electronic Communications Privacy Act (ECPA);

• Any other applicable national data protection laws.

We do not disclose any user identity, transaction, communication, or financial data without a valid legal mandate.

7. User Notification

Where permitted by law, we will make reasonable efforts to notify affected users about data requests, unless:

• We are legally prohibited from doing so;

• The law enforcement agency explicitly requests non-disclosure;

• Prior notice could compromise the investigation or pose a risk to life or safety.

8. Data Preservation Requests

We accept data preservation requests related to criminal investigations or legal proceedings. Data will be preserved for a maximum of 90 days, unless extended by a valid court order.

9. International Requests

We do not respond to cross-border law enforcement requests from foreign jurisdictions unless:

• The request is made via a valid Mutual Legal Assistance Treaty (MLAT); or

• It complies with an approved international data transfer framework.

10. Legal Review

All law enforcement requests are subject to review by Curve’s legal team to ensure compliance with applicable data privacy and protection laws.

11. Policy Updates

This policy may be updated from time to time to reflect changes in applicable law. We recommend that law enforcement agencies consult the latest version before submitting any requests.