Does Plum have a law enforcement data sharing policy?

​

How Xoxoday Plum Handles Law Enforcement Requests

While Xoxoday Plum does not publish a standalone public document dedicated exclusively to law enforcement data sharing, it operates under a strict internal framework aligned with applicable legal standards. Every law enforcement request — regardless of jurisdiction or agency — goes through a formal review process before any data is considered for disclosure. The process begins the moment a request is received. It is immediately escalated to Xoxoday Plum’s designated Data Protection Officer (DPO) and the internal legal team. This dual-review structure ensures no single department can unilaterally approve a disclosure. The DPO evaluates the request against applicable data protection laws, including GDPR where relevant, while the legal team verifies the legitimacy and enforceability of the legal instrument presented.

​

What Qualifies as a Valid Legal Request

Xoxoday Plum requires formal legal documentation before any data sharing takes place. This includes court orders, search warrants, or equivalent instruments issued by a competent legal authority and specific in scope. Informal inquiries, verbal requests, or letters without proper legal standing are declined. This standard applies consistently across all geographies where Xoxoday Plum operates. For organizations running employee recognition programs integrated with HR systems such as Workday, SAP SuccessFactors, or Darwinbox, this means that personal reward histories, redemption records, and profile data are not accessible to external parties outside of this validated legal process.

​

Alignment with Security and Compliance Standards

This approach is consistent with Xoxoday Plum’s broader information security posture, supported by certifications including ISO 27001 and SOC 2 Type II. Both frameworks require documented controls around data access and disclosure, and those controls extend explicitly to law enforcement scenarios. Organizations undergoing their own compliance audits can request evidence of these controls through Xoxoday Plum’s security and trust programs.

​

What This Means for Enterprise Customers

Enterprise teams evaluating Xoxoday Plum as part of a vendor risk assessment can expect that employee data managed through Xoxoday Plum is protected from unauthorized disclosure. The requirement for formal legal review before any law enforcement response creates an internal checkpoint that mirrors the due-diligence controls enterprises themselves apply to sensitive data. If your organization requires a Data Processing Agreement (DPA) or a security questionnaire response detailing Xoxoday Plum’s law enforcement disclosure process, these can be obtained through the official vendor onboarding and compliance channels. Learn more: Xoxoday Plum Help Centre — Process, Strategy & Methodology