Requests from police, prosecutors and authorities
Version 1.0, valid from 14 August 2026.
This document describes how SPREQ handles requests and orders from investigative services, regulators and courts. It is intended for users who want to know where they stand, and for authorities wishing to submit a request.
This English text is a translation provided for convenience. The Dutch version is the legally binding one.
1. Guiding principle
We cooperate with requests that rest on a valid legal basis under Dutch or European law. We do not provide more than we are obliged to, and no more than we actually hold.
We do not build a back door into our encryption and will not do so voluntarily either.
2. What we do hold
Depending on when the request is made, we may hold:
| Data | Retention period |
|---|---|
| Account details: phone number or username, creation date | for as long as the account exists |
| Profile details: name, photo, type, subscription | for as long as the profile exists |
| Business Verified details: Chamber of Commerce (KVK) number, address, domain, contact person | for as long as the status is active, and 2 years thereafter |
| IP addresses and connection timestamps | a maximum of 30 days |
| Failed login attempts and rate limits | a maximum of 30 days |
| Delivery data for messages not yet delivered | a maximum of 72 hours |
| Encrypted messages and files not yet delivered | a maximum of 72 hours, and we cannot decrypt them |
| Payment and invoicing data | 7 years under the tax retention obligation |
| Reports and measures taken | 1 year |
3. What we do not hold
- the content of messages, files or conversations
- users' conversation history
- recordings of conversations
- a historical record of who communicated with whom
- backups of user data
- a key that can unlock encrypted content
There is currently no interception obligation in the Netherlands for number-independent chat services. We are not set up for interception and cannot provide live interception.
4. How to submit a request
Authorities can submit a request via:
- Email: legal@spreq.nl
- Post: Netron ICT, Virulyweg 43 B, 7602 RG Almelo, for the attention of Legal
A request must contain:
- the name of the body and of the official handling it, with contact details
- the legal basis for the request
- a signature or other proof of authority
- a precise description of the data requested
- identification of the account or profile: phone number, username or profile ID
- the relevant period
- whether a prohibition on informing the user applies, and on what grounds
We communicate in Dutch and English.
5. How we handle a request
| Step | What we do |
|---|---|
| 1 | We verify that the request comes from a competent authority |
| 2 | We check the legal basis and the scope |
| 3 | Where there is doubt, we ask for clarification or seek legal advice |
| 4 | If the request is too broad, we ask for it to be narrowed |
| 5 | We provide only the data we actually hold and that falls within the scope |
| 6 | We record every request and every decision in a separate audit log |
Response time: within 10 working days, or sooner in an emergency where there is danger to persons.
6. Emergencies
Where there is an immediate danger to a person's life or safety, we may provide data straight away on the basis of a reasoned emergency request. We ask for written confirmation and a formal legal basis afterwards.
7. Informing the user
We inform the user concerned about a request, unless:
- doing so is prohibited by law
- there is a judicial or prosecutorial order to keep it confidential
- informing them would create an immediate danger to persons
Once the prohibition lapses, we inform the user after all.
8. Requests from abroad
We handle requests from foreign authorities through the established mutual legal assistance channels, or on the basis of a European order that applies directly. We do not honour a direct request that lacks a valid legal basis under Dutch or European law.
9. Orders under the Digital Services Act
Orders to remove illegal content (Article 9 DSA) or to provide information (Article 10 DSA) are handled under the same procedure. We confirm receipt without undue delay and inform the authority of the action we have taken.
Our point of contact for authorities is dsa@spreq.nl.
10. Costs
For extensive requests we may charge a reasonable fee for the costs incurred, in so far as the law permits.
11. Transparency
We keep track of how many requests we receive, from which bodies, and how often we have provided data. As soon as it is permitted and required, we will publish these figures annually on spreq.nl.