Law-Enforcement, Regulatory and Government Requests Policy

6membership will comply with a valid and binding legal obligation applicable to 6Clement Joshua, the 6membership service, the relevant records and the circumstances.

Cooperation must remain connected with the authority and purpose stated in the request.

Application, membership, identity, guardian, payment, complaint and security information is treated as protected information unless a lawful basis permits or requires disclosure.

The existence of a government investigation does not make every record public or remove applicable privacy safeguards.

A disclosure should be reasonably necessary for the lawful purpose identified by the requesting authority.

Information unrelated to the identified person, event, offence, transaction, proceeding or regulatory matter should not be disclosed merely because it is technically available.

The scope and sensitivity of the disclosure should remain proportionate to the legal authority, seriousness of the matter, affected rights and information requested.

A request for one verified transaction should not ordinarily result in disclosure of an applicant’s complete identity-document history.

6membership should disclose only the categories, fields and period necessary to satisfy the valid request.

Where a smaller record can satisfy the legal obligation, a larger collection should not be supplied.

Material preservation and disclosure decisions should be recorded with the request, reviewer, legal basis, scope, action, date and transmission result.

An administrator must not make an unrecorded disclosure through a personal email account or messaging service.

The Privacy Notice governs ordinary personal-information processing.

The Security Policy governs secure access and transmission.

The Retention Policy governs legal holds and preservation periods.

This Policy applies to valid orders, warrants, summonses, subpoenas, production orders, preservation orders and other binding processes issued by a court or tribunal with appropriate jurisdiction.

The exact terminology and effect depend on the applicable law and proceeding.

This Policy applies to requests from Nigerian police, cybercrime, anti-fraud and other law-enforcement bodies acting within powers granted by law.

The agency name alone does not establish that the individual officer or requested action is authorised.

This Policy applies to lawful requests from the Nigeria Data Protection Commission, consumer authorities and other competent regulators responsible for matters affecting 6membership.

This Policy applies to valid tax, payment, financial-crime, sanctions, accounting and transaction-related requests issued under applicable authority.

A request for financial records must remain limited to the relevant legal or regulatory purpose.

A ministry, department, agency, commission or other government body may submit a request where it possesses legal authority over the subject matter.

A general public function does not automatically authorise access to private membership records.

A foreign authority request is assessed under the cross-border provisions of this Policy.

A foreign official’s direct email is not automatically binding on a Nigerian operator.

A private person, company, lawyer or litigant may seek information through a valid civil, criminal or regulatory process.

A private demand letter or allegation does not by itself create authority to disclose another person’s protected information.

A preservation request asks 6membership to prevent specified records from being deleted or altered while lawful process is obtained or an investigation continues.

Preservation alone does not authorise disclosure.

A production or disclosure request seeks identified records or information.

6membership will determine whether the process is valid, binding and sufficiently specific before producing protected information.

A request may seek testimony, a records certification, an affidavit or confirmation concerning how identified records are maintained.

6membership may require appropriate notice, legal process and reasonable preparation time.

An authority may seek restriction of an account, application, membership, card, certificate, verification record or communication route.

The request must identify the legal authority and affected resource sufficiently.

A regulator may request information about compliance controls, incidents, policies, providers, audits or responses to affected persons.

6membership may provide explanatory or aggregate information where the request does not require individual records.

A competent authority may seek inspection of relevant records, controls or evidence within its legal mandate.

Inspection access should be supervised, documented and limited to the authorised scope.

A request alleging imminent danger, serious physical harm, child exploitation or another urgent threat may receive accelerated review.

Urgency does not remove the requirement for authenticity, lawful authority and necessity.

An unsolicited telephone call claiming to be from an authority does not automatically authorise disclosure.

The caller may be directed to submit the request through an authenticated written channel.

A request sent from an unrelated personal email account will not ordinarily be treated as authenticated official process.

The requester may be required to use a verifiable agency, court or professional channel.

A direct message, public comment or social-media post is not an appropriate channel for requesting private applicant or member information.

A requester’s statement that the affected person agreed does not automatically establish valid consent or authority.

Where disclosure relies on the person’s authorisation, 6membership may require a verifiable written instruction and identity confirmation.

Private investigators, employers, landlords, lenders and other private persons do not receive government authority merely because they are investigating a matter.

They must provide an appropriate lawful basis, consent or valid legal process.

A journalist or media organisation may request public information or comment but is not entitled automatically to private application, identity, payment or membership records.

A request must not be granted merely because it is supported by a politically influential person, public official, donor, member or associate.

The same legal review standards apply regardless of status or personal relationship.

Electronic authority requests may be submitted to legal@6membership.com unless a different legally required method applies.

Security incidents and urgent technical concerns may also be copied to security@6membership.com.

The availability of an email address does not mean that every court document may be served validly by email.

A requester remains responsible for complying with applicable procedural and service requirements.

The request should include a complete, readable copy of the instrument, supporting authority and any referenced schedule defining the records sought.

An incomplete screenshot or cropped page may be insufficient.

The request should identify the issuing body, responsible officer, official position, agency address, official email, telephone number and reference number.

Sensitive orders and produced records should use a secure transmission method appropriate to their content.

A requester may be asked to provide an approved secure exchange route rather than ordinary unencrypted email.

6membership may acknowledge receipt and assign an internal Authority Request Reference.

Acknowledgement does not confirm validity, compliance or the existence of responsive records.

Application, privacy-request, complaint and general-contact forms should not be used to transmit sealed warrants, confidential orders or sensitive authority material unless the form expressly supports that function.

6membership may verify the requesting body through an official directory, published contact channel, known provider route or independently obtained contact information.

Contact details supplied only inside the disputed request should not be the sole verification method where fraud is suspected.

The identity, position and authority of the named requester may be verified before information is disclosed.

An official email address supports verification but may not be sufficient where compromise or impersonation is suspected.

6membership may examine signatures, stamps, seals, reference numbers, issuing court, dates, schedules and other indicators of authenticity.

The service may contact the issuing office independently where confirmation is required.

An electronically issued instrument may be accepted where its authenticity, issuing authority and legal validity can be established.

A pasted image of a signature does not prove validity by itself.

A suspected fake authority request may be restricted, preserved as evidence and reported through appropriate security or lawful channels.

No protected record should be disclosed while authenticity remains materially unresolved.

6membership may reconfirm an unusual, high-volume, highly sensitive or technically intrusive request even where the requester was authenticated previously.

The method and result of requester verification should be recorded without copying unnecessary official identity information.

A compulsory request should identify the written law, court power, regulatory mandate or other authority supporting the requested action.

A general statement that the information is needed for investigation may be insufficient where formal process is required.

The requesting body must possess authority concerning the offence, proceeding, regulatory function, tax matter, consumer issue or other stated subject.

The process must be capable of binding 6Clement Joshua, the 6membership service or the relevant record holder under applicable law.

A body’s authority over another company or country does not automatically extend to 6Clement Joshua, 6membership or records outside the body’s lawful reach.

A court order should come from a court with jurisdiction over the proceeding, person, operator, records or legally relevant connection.

6membership may seek legal clarification where jurisdiction is uncertain.

The request must remain effective at the time action is taken.

An expired, withdrawn, stayed, set-aside or superseded process should not be relied upon as current authority.

Where a request conflicts with another law, order, privacy requirement, privilege or binding restriction, 6membership may seek clarification, narrowing or judicial direction.

Where compliance is not compulsory, any voluntary disclosure must still have a lawful basis, legitimate purpose, necessary and proportionate scope and appropriate safeguards.

Voluntary cooperation must not be used to bypass a legal process that would ordinarily be required, and personal-data disclosure must remain limited to what the applicable lawful basis actually permits.

Where a request involves personal data or creates a material privacy risk, 6membership may obtain documented review from its authorised privacy, data-protection or legal function before disclosure.

The review may address the legal competence of the requesting authority, the protection measures available, the scope of the order or directive, applicable data-subject rights, necessity, proportionality and whether a less intrusive method can satisfy the lawful purpose.

Where appropriate under Nigerian data-protection law, a documented DPO opinion may form part of that assessment. This internal review does not authorise disobedience of a finally binding court order.

The request should identify the relevant person through sufficient and lawful information, such as name, verified email, Application Reference or Membership ID.

A common name alone may be insufficient where it could identify several people.

The request should describe the record categories sought, such as application status, payment record, policy acceptance, membership status or security event.

A demand for all information must explain why that breadth is authorised and necessary.

The request should identify an appropriate date or event range where the matter does not require the complete history.

6membership may ask the requester to narrow an unlimited period.

The requested records should have a reasonable connection with the investigation, proceeding, regulatory function or other lawful purpose.

Information belonging to unrelated applicants, household members, guardians, payers or administrators should be excluded or redacted unless the legal process covers them.

Requests for identity documents, younger-person records, security credentials, private photographs or detailed payment information require particularly clear authority and necessity.

6membership may produce existing responsive records or provide an appropriate explanation of its systems.

The service does not create a false record, rewrite history or state facts not supported by the retained evidence.

A preservation request may suspend ordinary deletion of identified records.

The preserved information remains protected and is not disclosed until separate lawful authority permits or requires disclosure.

The preservation request should identify the person, record categories, relevant period and legal authority.

6membership may seek clarification where the scope would preserve unrelated systems or records.

A preservation action remains effective only for the period stated by the applicable law or instrument, or for the justified period of a documented legal hold.

A legal hold should identify its scope, reason, responsible person, review date and release condition. It should be reviewed and released when the lawful basis or evidential need ends rather than remaining open indefinitely.

Preservation applies to responsive records within 6membership’s possession or control when the duty is received.

It does not guarantee recovery of information already deleted lawfully before the request arrived.

A request to preserve future or continuously generated information requires clear legal authority and technical scope.

An ordinary preservation request should not be interpreted automatically as authority for continuous surveillance.

Preserved records remain subject to restricted access, integrity controls and confidentiality.

The hold must not make the records accessible to ordinary administrators who did not previously require them.

Creation, modification, review, responsible person, scope, reason, release and resulting deletion of a material hold should be recorded.

6membership will identify records reasonably responsive to the valid request.

Records outside the authorised scope should be excluded.

Before disclosure, responsive material should be reviewed for scope, third-party information, privilege, security risk, technical secrets and legal restrictions.

Information outside the authorised scope may be redacted where redaction permits lawful production of the remaining record.

A redaction should not alter the meaning of the produced information deceptively.

Records may be produced in a reasonably accessible electronic format supported by the production system.

6membership is not required to expose live database access merely because records are stored electronically.

Where authorised and appropriate, 6membership may certify that produced records were extracted from identified systems or explain relevant field meanings.

Certification must not claim certainty beyond what the records support.

Passwords, secret keys, reusable tokens and protected provider credentials should not be produced as ordinary account records.

Where a court specifically addresses security material, 6membership may seek protective conditions or legal clarification.

The production record should identify what was disclosed, when, by whom, under which authority and through which secure channel.

Emergency treatment may apply where the requester describes a credible and imminent risk of death, serious physical harm, child exploitation, abduction or another grave emergency.

General urgency or administrative convenience does not satisfy this threshold.

The request should identify the threatened person, nature of the emergency, connection to the requested records, information needed and reason ordinary legal process cannot be obtained in time.

6membership may use expedited methods to verify the requesting agency and officer.

Accelerated review must not become unauthenticated disclosure.

Where lawful disclosure is justified, only the information reasonably necessary to address the emergency should be supplied.

Where disclosure is not compelled by a binding instrument, personal-data processing must still rest on an applicable lawful basis. In an appropriate emergency this may include vital interests or public interest where the legal conditions are satisfied, and the processing must remain necessary and proportionate.

The emergency does not create authority for unrelated historical or commercial information.

6membership may require the requester to provide confirming legal process or written documentation after an urgent disclosure where applicable.

Notice to the affected person may be delayed where immediate disclosure would worsen the danger, compromise the response or violate law.

The notice position should be reviewed when the emergency ends.

The emergency request, verification, decision, information disclosed and responsible reviewer should be recorded promptly.

A court process should include the issuing court, case or proceeding reference, date, authorised signature or authentication, affected person and required action.

The instrument should state clearly whether it requires preservation, production, testimony, restriction, non-disclosure or another action.

6membership should not infer a broader command than the document supports.

6membership will identify the stated compliance date and any procedure for seeking clarification, extension, variation or review.

A technically or legally impossible deadline may be raised with the issuing authority.

A sealed order or valid confidentiality restriction will be handled through restricted access.

Its existence and contents must not be disclosed contrary to the applicable order or law.

6membership may seek clarification, narrowing, protective conditions, variation or lawful review where an instrument is ambiguous, overbroad, technically unsafe or jurisdictionally defective.

A good-faith legal challenge or request for clarification must not become concealment, alteration or destruction of responsive records.

Final compliance should be documented against the specific command and records produced.

A regulator request should identify the matter, statutory or regulatory mandate and information required for the regulator’s function.

6membership may provide records, explanations, assessments and evidence required lawfully by the Nigeria Data Protection Commission.

The response should remain accurate and should not conceal a known breach, complaint or processing activity.

A competent consumer authority may request records relating to disclosures, pricing, applications, payments, refunds, communications or complaint handling.

Another person’s private information should be limited where it is not necessary to resolve the consumer matter.

A regulator may request policies, audit records, risk assessments, provider details or evidence of corrective action.

Confidential technical material may require secure handling or protective arrangements.

Where a competent regulator issues a binding corrective requirement, 6membership will record, assign and track the required action.

The service must distinguish a recommendation from a legally binding direction.

A regulator may refer or investigate a complaint submitted by an applicant, member, payer or other affected person.

The complainant must not be subjected to retaliation merely for using the regulatory process.

A regulatory response should distinguish verified facts, current implementation, planned work, unresolved issues and reasonable inference.

An intended future control must not be represented as already active.

Responsive records may include an internal transaction reference, Flutterwave transaction identifier, amount, currency, verified status, payer relationship, refund record and associated application.

6membership ordinarily does not control complete card credentials processed by the payment provider.

Some payment records may be held directly by Flutterwave, banks, card networks or other financial institutions.

6membership may identify the relevant provider where appropriate but cannot guarantee that it can obtain records outside its possession or control.

Valid tax and accounting requests may cover invoices, receipts, payment status, refunds and related financial records.

Identity documents unrelated to the financial requirement should not be included automatically.

A competent authority may seek records connected with stolen payment methods, false identities, duplicate refunds, chargeback abuse or other suspected financial misconduct.

Where applicable law requires restriction, reporting or disclosure connected with sanctions or financial-crime controls, 6membership will assess and document the obligation.

A record must distinguish internal refund approval, submission to Flutterwave, provider acceptance, processing and final result.

The authority response must not describe an unsubmitted or rejected refund as completed.

Payment and financial-compliance rules are governed further by the payment and anti-fraud policies.

A request from a foreign authority does not automatically bind 6Clement Joshua or the 6membership service merely because it is valid under the foreign authority’s domestic law.

A foreign requester may be required to use an applicable Nigerian court, authority, mutual-assistance, recognition or other lawful process.

The required route depends on the request and applicable law.

Any non-compulsory disclosure to a foreign authority must have a lawful basis, legitimate purpose and appropriate privacy and cross-border transfer safeguards under applicable Nigerian data-protection law.

Where personal data is transferred outside Nigeria, the transfer must satisfy the applicable cross-border transfer framework or a recognised special circumstance, such as a compelling legal duty, legal claim, qualifying vital interest or public interest where its conditions are met.

Voluntary disclosure must not be used to avoid protections that would apply through formal legal process.

A credible foreign emergency request involving imminent serious harm may receive accelerated review.

The requester, emergency, lawful basis and minimum necessary information must still be verified.

Where a foreign request conflicts with Nigerian law, another binding obligation or affected-person rights, 6membership may seek legal advice, narrowing or appropriate judicial direction.

An authorised cross-border production must use appropriate technical and organisational safeguards for the information involved.

A service provider may receive a request directly under laws applying to that provider.

6membership may not be notified where the provider is legally prohibited from doing so.

Where lawful, appropriate and not prohibited, 6membership may notify an affected person before or after disclosing their information.

Notice may allow the person to seek legal advice or exercise an available right.

Notice will not be provided where a valid law, court order or binding confidentiality requirement prohibits it.

Notice may be delayed where it would create an imminent safety risk, facilitate destruction of evidence, compromise an investigation or expose another person unlawfully.

The reason for delay should be documented.

A temporary non-disclosure position should be reviewed when the stated restriction or risk ends.

6membership may seek permission to notify the person where appropriate.

A notice may identify the requesting authority, general record categories, date and available contact or complaint route.

Details may be limited where fuller disclosure remains prohibited or unsafe.

An affected person must not use notice to alter, destroy or conceal lawfully preserved records.

The person retains the right to seek lawful review or advice.

Where lawful and operationally appropriate, 6membership may publish aggregate information about authority requests without identifying affected persons or exposing investigations.

6membership may refuse or pause a request that cannot be authenticated or that lacks required legal authority.

6membership may ask the requester to narrow a request that seeks unrelated people, unlimited time periods, entire databases or information disconnected from the stated matter.

A request may be paused while unclear identifiers, record categories, dates, technical terms or required actions are clarified.

6membership may explain that specified records do not exist, were never collected, were deleted lawfully or are not within its possession or control.

The service must not fabricate responsive records.

Where permitted, 6membership may seek narrowing or protective conditions where the request creates a disproportionate privacy, confidentiality, security or third-party-rights impact.

Confidential legal advice, privileged communications and other protected material may be withheld or addressed through an appropriate legal process where applicable.

Privilege must not be asserted falsely to conceal ordinary business records or misconduct.

Where a request is finally determined to be valid and binding, 6membership will comply according to its lawful terms.

Clarification or challenge must not be used to destroy evidence or evade a binding obligation.

Authority requests should be accessible only to authorised legal, privacy, security and administrative personnel whose role requires them.

Responsive records should be exported through a controlled server or administrative process.

An administrator should not copy entire production tables where a limited export satisfies the request.

Produced records should preserve relevant timestamps, identifiers and context without deceptive alteration.

Where a record is converted or redacted, the production process should be documented.

Sensitive production should use encrypted or otherwise appropriately protected transmission.

Access links should be purpose-limited, expire where practical and be delivered to a verified recipient.

6membership may request confirmation that the authorised recipient received or accessed the production.

Receipt does not determine how the authority may use the information under its own legal obligations.

A protected copy or production manifest may be retained while reasonably required for accountability, dispute resolution, an active legal hold, a legal claim or proof of compliance.

Temporary working exports should be deleted when they are no longer required. Retaining a production copy for possible future usefulness is not by itself a sufficient reason for indefinite storage.

A production sent to an unauthorised recipient, exposed through an insecure link or otherwise compromised must be assessed as a security incident and possible personal-data breach.

A provider may receive a request directly concerning information held within its service.

The provider’s response is governed by applicable law, its role and its own authority-request process.

Where permitted, 6membership may request that a provider notify it before disclosing information connected with the service.

A provider may be prohibited from giving notice.

A provider relationship does not authorise every provider employee to access or disclose 6membership information.

Provider access should remain limited to authorised operational and legal purposes.

The internal case record may include the Authority Request Reference, requester, legal instrument, verification, affected systems, legal basis, scope, decisions, disclosure manifest and communications.

Authority-request, preservation and disclosure records may be retained while the request, preservation duty, legal hold, compliance dispute or another applicable time-bound legal requirement remains active.

For Nigerian personal-data processing, when the original purpose has been accomplished and no separate law provides a time-bound retention obligation, continued storage must follow the post-purpose limits and safeguards in the Data Retention, Deletion and Records Policy, including the applicable six-calendar-month rule. Retention for the defence of a legal claim or due diligence must use appropriate technical and organisational safeguards.

Unnecessary duplicate exports should be deleted sooner, and every continuing legal hold should remain scoped, documented and periodically reviewed.

6membership may publish aggregate counts or categories of requests where reporting is lawful, accurate and does not expose protected investigations or individuals.

A zero figure must not be published unless the underlying records support it.

The approved provider list explains the principal service categories that may hold or process relevant information.

Courts, law-enforcement agencies, regulators and other competent authorities may submit formal requests to legal@6membership.com.

The requester remains responsible for satisfying any separate formal-service requirement.

Urgent phishing, impersonation, exposed credentials, cybercrime and active security incidents may also be reported to security@6membership.com.

An applicant, member, guardian, payer or other person may raise a concern about authority-related processing through privacy@6membership.com.

A person may complain about an inaccurate disclosure, excessive scope, failure to provide lawful notice, improper retention or another authority-request handling issue.

6membership may be unable to disclose a sealed request or legally restricted information while the restriction applies.

Nothing in this Policy prevents an affected person from contacting a competent court, the Nigeria Data Protection Commission, a consumer authority or another appropriate body where that right applies.

A complaint or legal challenge must not be used to destroy preserved evidence or obstruct a binding process.

A person must not face retaliation merely for raising a genuine privacy or procedural concern.

This Policy should be reviewed against actual request types, legal developments, provider arrangements, security controls and production capabilities.

This Policy may be updated to reflect new laws, court processes, regulators, service providers, technical systems, reporting obligations and cross-border procedures.

A material update will be handled through the central policy-update framework.