Abuse – Takedown and Law Enforcement Procedure
1. Purpose and roles
This procedure sets how IGMS LTD receives and handles abuse reports, illegal-content notices, GDPR requests and requests from law enforcement and other authorities. The abuse contact is hello@igms.com.cy, handled by George Sarris (Director). Where a service is delivered with a hosting or infrastructure partner, we instruct the partner to take the technical action (for example suspension or removal) and keep the same record.
2. Contact points
| Matter | Contact |
|---|---|
| Abuse reports, illegal content, law enforcement and authority requests | hello@igms.com.cy, subject "Abuse" (in English or Greek) |
| GDPR requests and personal-data notices | hello@igms.com.cy, subject "GDPR" |
| General and complaints (redress) | hello@igms.com.cy, subject "Complaint" |
3. Handling steps
| Step | Activity | How |
|---|---|---|
| 1 | Receive and log | Every report, notice or request is logged with a reference, date and time, sender, channel and the service concerned. |
| 2 | Classify | S1 critical: child sexual abuse material, terrorist content, imminent threat to life or safety. S2 security abuse: malware, botnets, phishing, spoofing, denial-of-service. S3 fraud and other policy breaches. S4 copyright. S5 GDPR request. S6 request from an authority. |
| 3 | Acknowledge | Same day for S1; within 2 business days for all others (the sender is told the reference). |
| 4 | Verify and preserve | Identify the client and service, check the evidence, and preserve logs and a copy of the evidence. For child sexual abuse material we do not copy or circulate the material; we record the location and report it. |
| 5 | Act | S1: disable access at once and report to law enforcement. S2: suspend within 24 hours of verification. S3: contact the client and require correction within a stated period (normally 2 business days), then suspend if not corrected. S4: remove infringing material promptly on a valid notice. Terminate for repeat or serious violations; serious terminations are not reactivated. |
| 6 | Inform the client | The client receives a statement of reasons (action, scope and duration, facts, clause relied on, whether a notice triggered it, redress options), unless the law prohibits it or the matter involves a serious offence threatening life or safety. |
| 7 | Close and record | The outcome, dates and decisions are recorded; the sender is told the outcome where appropriate. Records are kept for the period required by law (default five years). |
| 8 | Review | Numbers, timings and repeat cases are reported to the management review. Complaints (redress) are reviewed by a person who did not take the original decision where possible. |
4. Law-enforcement and authority requests (S6)
- Check that the request comes through an official channel and that it identifies the authority, the legal basis and the data or action requested. If there is doubt, verify with the authority by independent means.
- Take legal advice where needed. Provide only what is required and lawful, in a secure way, and keep a copy of the request and what was provided.
- Tell the client unless the request or the law prohibits it. Orders under the Digital Services Act (to act against illegal content or to provide information) are answered without undue delay and the authority is told what was done.
- Where we learn of a suspected offence threatening life or safety, we inform the competent authority on our own initiative.
5. GDPR requests and notices (S5)
Requests to access, correct, erase, restrict, object or port data are sent to hello@igms.com.cy. We verify identity, answer within one month (extendable where the law allows, with an explanation), and log the request. A personal-data breach is assessed at once and, where required, notified to the Cyprus Commissioner for Personal Data Protection within 72 hours and to the affected persons without undue delay.
6. Targets
| Item | Target |
|---|---|
| Acknowledge | Same day (S1); within 2 business days (others) |
| Act on verified S1 | Immediately; within 24 hours at the latest |
| Act on verified S2 | Within 24 hours |
| Client correction period (S3) | Normally 2 business days |
| GDPR request | Within one month |
This document was last updated on Oct 12, 2026