Acceptable Use Policy

Last Modified: June 22,2016

1. Purpose and application

1.1 This Acceptable Use Policy (AUP) is designed to protect SVAAPTA, its customers, users, networks, systems and third parties from unlawful, abusive, insecure or disruptive use of the Services.

1.2 This AUP applies only where it is incorporated into a Master Services Agreement, SOW, Order Form, Support Agreement or other contract. It is primarily intended for hosting, managed infrastructure, platform, email, network, communications and similar technical services.

1.3 The Client is responsible for compliance with this AUP by its employees, contractors, end users, customers and any person using the Services through the Client's account, systems or credentials, except to the extent misuse results from SVAAPTA's own breach or security failure.

1.4 SVAAPTA does not ordinarily monitor Client Content for editorial purposes. However, SVAAPTA may investigate suspected abuse and take proportionate protective action where reasonably necessary to comply with law, protect systems or third parties, or enforce this AUP.

2. Prohibited use

2.1 The Client must not use, permit or knowingly facilitate use of the Services for any activity described in this clause.

2.2 Illegal activity. Using the Services in a manner that violates applicable law, regulation, court order or legally binding regulatory requirement.

2.3 Harm, threats or harassment. Using the Services to threaten, harass, abuse, exploit or unlawfully harm another person, including minors.

2.4 Fraud or deceptive schemes. Operating or promoting fraud, scams, pyramid or Ponzi schemes, deceptive offers, impersonation, phishing or other materially misleading activity.

2.5 Forgery or impersonation. Falsifying headers, source information, identities, domains, sender details or network information to deceive recipients or conceal unlawful activity.

2.6 Unsolicited or abusive messaging. Sending or facilitating spam, unlawful unsolicited marketing, unsolicited bulk messaging, mail bombing or other abusive electronic communications, subject to Part B.

2.7 Unauthorised access. Attempting to access another account, system, service, network, data or security control without permission.

2.8 Malicious code or harmful tooling. Introducing, distributing or operating malware, ransomware, viruses, worms, Trojan horses, credential theft tools or code designed primarily to damage, disrupt, intercept or exfiltrate systems or data.

2.9 Network disruption. Conducting denial-of-service attacks, excessive scanning, intentional service interference or activity that materially degrades networks, systems or services.

2.10 Intellectual-property infringement. Using the Services to knowingly infringe copyright, trade marks, patents, trade secrets, database rights or other proprietary rights.

2.11 Unlawful collection or misuse of personal data. Collecting, scraping, using or disclosing personal information unlawfully or without an appropriate legal basis where one is required.

2.12 Unauthorised resale. Reselling, sublicensing or materially sharing Services where the applicable SOW or Order Form does not permit it.

2.13 Security negligence. Knowingly maintaining insecure configurations or credentials in a way that creates a material risk of unlawful or abusive use after SVAAPTA has given reasonable notice of a required remedial action.

2.14 Excessive resource abuse. Using resources in a manner that materially and unreasonably impairs other customers or the shared service, where applicable service limits have been notified.

2.15 Prohibited content. Hosting or transmitting content that is unlawful to possess or distribute in the relevant jurisdiction, or content that SVAAPTA is legally required to remove or restrict.

3. Client security responsibilities

• Keep account credentials confidential and use multifactor authentication where required or reasonably available.

• Maintain supported software, patches and configurations where these are within the Client's control.

• Configure systems so they are not knowingly usable by third parties for unlawful relay, spam, attacks or other abuse.

• Notify SVAAPTA promptly of suspected compromise, credential theft, malware, unauthorised access or abuse involving the Services.

• Cooperate reasonably with SVAAPTA in investigating and remediating abuse or security incidents.

4. Investigation and protective action

4.1 SVAAPTA may investigate credible reports or indicators of a violation and may request information reasonably necessary to understand the issue.

4.2 Depending on severity, urgency, legal requirements and risk, SVAAPTA may take one or more of the following actions:

• issue a written warning or remediation request;

• rate-limit, block or restrict affected traffic, messages, ports, credentials or functions;

• temporarily suspend an affected account, service or component;

• remove or disable access to content where legally required or reasonably necessary to prevent material harm;

• require password resets, patching, configuration changes or other security remediation;

• terminate the affected Service or Agreement in accordance with the governing contract;

• recover reasonable administrative or reactivation costs where expressly permitted by the applicable contract;

• preserve or disclose information where required by law, court order or competent authority.

4.3 Where practicable and consistent with security and legal obligations, SVAAPTA will give notice before or promptly after material suspension or restriction and will seek to limit action to the affected Service or risk.

4.4 Immediate action may be taken without prior notice where SVAAPTA reasonably believes delay could cause material security harm, ongoing abuse, legal exposure, network disruption or damage to SVAAPTA or third-party infrastructure or reputation.

4.5 Restoration may be conditional on satisfactory remediation, verification, payment of any properly due charges and reasonable assurance that the violation will not recur.

5. Reporting suspected abuse

5.1 Reports of suspected abuse should be sent to legal@svaapta.co.uk.

5.2 Where available, reports should include the affected domain/account, relevant IP address, date and time with time zone, full email headers or logs, screenshots, URLs and other evidence sufficient to investigate the allegation.

5.3 SVAAPTA may request additional information before taking action and is not required to disclose confidential investigative information to a complainant.

6. Client content and third-party complaints

6.1 The Client is responsible for Client Content and for obtaining rights and permissions required to host, transmit or make it available through the Services.

6.2 SVAAPTA may forward credible complaints to the Client and request a response or remedial action within a reasonable period, except where immediate removal or restriction is required by law or necessary to address urgent harm.

6.3 SVAAPTA does not adjudicate complex private disputes over ownership or rights unless required by law or the governing contract. It may require the parties to pursue appropriate legal or dispute-resolution channels.

7. Policy updates

7.1 SVAAPTA may update this AUP from time to time to reflect changes in law, technology, security threats, service design or industry practice.

7.2 Material changes will be notified or published in the manner stated in the governing Services Agreement. Changes will not retrospectively create liability for conduct that complied with the policy in force when it occurred.