# ACCEPTABLE USE POLICY (AUP) ## Rule Step B.V. [besloten vennootschap; private limited liability company] --- **Version:** 1.0 **Date of entry into force:** 30 September 2026 This Acceptable Use Policy ("AUP") is, in addition to the General Terms and Conditions ("AW"), the Supplementary Terms and Conditions Online Services ("AVO") and the Order Form, applicable to every use of the online services of Rule Step B.V. (hosting, VPS, app-hosting, domain name registration, e-mail, certificates, licences, back-up). For consulting services, this AUP does not apply; the confidentiality and professional standards are set out in the Supplementary Terms and Conditions Consulting (AVC Art. 7). Definitions from the AW (AW Art. 1.1) and AVO (AVO Art. 1.1) apply mutatis mutandis. --- ## Article 1 — Definitions In this AUP, the following is understood by: 1.1. **AUP**: this Acceptable Use Policy. 1.2. **Consumer** (Consument): a natural person who does not act for purposes connected with his trade, business, craft or professional activity (B2C), as referred to in article 6:231 et seq. BW (Dutch Civil Code). 1.3. **Business Customer** (Bedrijfsklant): a Customer (Klant) who is not a Consumer (Consument) (B2B). 1.4. **Services** (Diensten): the hosting, domain registration and related online services offered by Rule Step. 1.5. **Infrastructure** (Infrastructuur): the physical and virtual servers, network components and related facilities, including the dedicated servers and Virtual Private Servers (VPS) supplied by hosting partners. 1.6. **Illegal Content** (Illegale Inhoud): information that is in conflict with applicable law, including but not limited to child pornographic material (CSAM [Child Sexual Abuse Material]), terrorist content, and content that infringes intellectual property rights. --- ## Article 2 — Applicability and Scope **Statutory basis:** AW Art. 1.3 and 1.4; Book 6 Section 3 BW (Dutch Civil Code). ### 2.1 Part of the agreement 2.1.1 This AUP forms part of the agreement between Rule Step and the Customer with respect to online services. By making use of the services, the Customer accepts the provisions of this AUP. 2.1.2 Consumers accept this AUP by express electronic acceptance (clickwrap) when purchasing the services, in accordance with articles 6:231a and 6:234 BW (Dutch Civil Code). Mere awareness (browsewrap) is insufficient for the formation of the agreement with Consumers. ### 2.2 Consumer protection 2.2.1 Clauses that are disadvantageous to the Consumer and that are in conflict with mandatory law, in particular articles 6:237 (grey list (grijze lijst)) and 6:236 (black list (zwarte lijst)) of the Dutch Civil Code (Burgerlijk Wetboek) concerning unreasonable clauses, do not apply to Consumers and are deemed not to have been agreed. Article 6:231 et seq. BW provides that unreasonable clauses are not binding on the Consumer. --- ## Article 3 — Prohibited Activities **Statutory basis:** NIS2 Directive (NIS2-richtlijn) (2022/2555); Telecommunications Act (Telecommunicatiewet); Code of Criminal Procedure (Wetboek van Strafvordering); Mandatory Reporting of Child Abuse Act (Wet meldplicht kindermisbruik). ### 3.1 General prohibition 3.1.1 The Customer is prohibited from using the services for activities that are in conflict with any applicable law, public order, good morals, or the requirements of a stable and secure infrastructure that may reasonably be imposed. ### 3.2 Specifically prohibited activities Without prejudice to the general prohibition, the Customer is expressly prohibited from: (a) hosting, storing, distributing or otherwise making available Illegal Content, expressly including but not limited to: child pornographic material and child sexual abuse material (CSAM), terrorist content, and extremely violent images or videos; (b) sending or facilitating unsolicited commercial communication (spam), including sending e-mails to recipients who have not given their consent therefor, as well as operating open mail relays or open proxy servers; (c) distributing, storing or executing malware, ransomware, spyware, viruses, Trojan horses, worms, or other malicious code; (d) hosting, managing or facilitating components of botnets, or using the Infrastructure for Command and Control (C2) infrastructure; (e) carrying out cryptographic mining (crypto mining) without the express, prior and written consent of Rule Step. Carrying out crypto mining on shared or virtual infrastructure (VPS) is prohibited at all times. On dedicated servers (toegewijde servers), crypto mining is permitted exclusively if express written consent has been granted therefor and the associated specific surcharges have been paid; (f) carrying out, participating in, or facilitating Distributed Denial of Service (DDoS) attacks or other network attacks; (g) phishing, fraud, or the unlawful obtaining of login credentials, financial data or other confidential information; (h) committing infringement of the intellectual property rights of third parties, including the unlawful copying, distribution or making available of copyright-protected works, trademarks, or patents; (i) exploiting security vulnerabilities without express and written consent, scanning networks of third parties, or unlawfully obtaining access to systems of third parties; (j) offering illegal gambling games or facilitating games of chance without the required licences; (k) registering domain names with the aim of selling these (cybersquatting) to the rights holders, registering domain names for phishing purposes, or registering domain names that infringe the trademark or trade name rights of third parties. ### 3.3 B2B/B2C variation 3.3.1 The prohibited activities apply correspondingly to Consumers. However, a prohibition that is formulated so broadly that it unnecessarily restricts legitimate use, such as the expression of justified criticism or protest, does not apply to Consumers insofar as this is in conflict with the protection of article 6:231 et seq. BW. Legitimate expressions of opinion or criticism are deemed not to constitute illegal content or abuse. --- ## Article 4 — Copyright and Notice-and-Takedown **Statutory basis:** Copyright Act 1912 (Auteurswet 1912); E-Commerce Directive (2000/31/EC) articles 6-8; EU Digital Services Act (Regulation 2022/2065). ### 4.1 Legal framework 4.1.1 Rule Step maintains a formal notice-and-takedown procedure for handling complaints concerning infringement of intellectual property rights and illegal content. The Digital Millennium Copyright Act (DMCA) does not apply to Rule Step; exclusively the EU framework (Copyright Act (Auteurswet), E-Commerce Directive, DSA) applies. ### 4.2 Notice 4.2.1 A report of infringement must be submitted in writing and with sufficient specificity to Rule Step (abuse@rulestep.com), containing: (i) identification of the protected work, (ii) the location of the infringing content on the Infrastructure, (iii) the contact details of the rights holder, and (iv) a statement that the report is made in good faith and that the reporter is authorised to act on behalf of the rights holder. ### 4.3 Expeditious action 4.3.1 If Rule Step receives a lawful and sufficiently specific report, Rule Step acts expeditiously by removing the content in question or disabling access thereto, in order to be able to invoke the safe harbor provisions of article 14 E-Commerce Directive. ### 4.4 Counter-notification (tegenmelding) 4.4.1 The Customer has the right to submit a counter-notification if it is of the opinion that the content has been unlawfully removed. The counter-notification must be submitted within fourteen (14) calendar days after the removal. Rule Step will restore the removed content if the counter-notification complies with the statutory requirements and the original reporter does not institute legal proceedings within the statutory period, in accordance with article 14 DSA and article 7 E-Commerce Directive. ### 4.5 UDRP and WHOIS 4.5.1 For domain names, the Uniform Domain-Name Dispute-Resolution Policy (UDRP) process applies. Complaints about WHOIS data are handled in accordance with the ICANN rules. ### 4.6 Indemnification by Customer for own content 4.6.1 [B2B] The Customer indemnifies Rule Step against all claims of third parties arising from infringement of intellectual property rights with respect to content placed by the Customer on the Infrastructure. 4.6.2 [B2C] The indemnification obligation of article 4.6.1 is limited, for Consumers, to cases in which the Consumer was aware or should have been aware of the infringement, in accordance with article 6:231 et seq. BW. A Consumer is not deemed to waive his or her rights under the Copyright Act (Auteurswet) or the DSA. --- ## Article 5 — Cooperation with Law Enforcement Authorities **Statutory basis:** Code of Criminal Procedure (Wetboek van Strafvordering); Telecommunications Act (Telecommunicatiewet); AVG (GDPR) articles 6(1)(c) and (e). ### 5.1 Compliance with lawful requests 5.1.1 Rule Step cooperates fully with lawful requests from Dutch and European law enforcement authorities and intelligence services, insofar as these requests are based on a valid legal basis, including a warrant (bevelschrift), order (last) or coercive order (dwangbevel). ### 5.2 No voluntary disclosure 5.2.1 Data of the Customer is disclosed exclusively pursuant to a valid legal order or a statutory obligation. Rule Step does not voluntarily provide data to government authorities, unless a statutory obligation to do so exists. ### 5.3 Information to Customer 5.3.1 Rule Step informs the Customer about a request from an authority, unless this is legally prohibited, for example in the context of a criminal investigation in which a duty of confidentiality has been imposed. ### 5.4 NIS2 notification 5.4.1 In the context of NIS2 obligations, Rule Step reports significant incidents to the competent authority (CSIRT/NL), as set out in the SLA (Art. 6.2). ### 5.5 WHOIS disclosure 5.5.1 For domain names, Rule Step cooperates with WHOIS disclosure requests from law enforcement officials and complies with valid court decisions concerning registrant data, in accordance with the ICANN rules and the applicable privacy legislation (see AVO Art. 4.5). ### 5.6 AVG basis B2C 5.6.1 [B2C] If the Customer is a Consumer, Rule Step carries out the processing of personal data for investigative purposes exclusively if this is required pursuant to article 6(1)(c) AVG (GDPR) (necessary to comply with a legal obligation) or, insofar as applicable, article 6(1)(e) AVG (GDPR) (necessary for the fulfilment of a task in the public interest), read in conjunction with the Uitvoeringswet AVG [GDPR Implementation Act] and the Wetboek van Strafvordering [Dutch Code of Criminal Procedure]. The Consumer is protected against arbitrary or unlawful provision of data. ### 5.7 Privacy Policy 5.7.1 The processing of personal data by Rule Step is at all times subject to the Privacy Policy of Rule Step. Questions and requests relating to personal data may be directed to the FG/DPO [Functionaris voor de Gegevensbescherming; Data Protection Officer] via privacy@rulestep.com. --- ## Article 6 — Escalation Procedure and Enforcement **Statutory basis:** Articles 3:40, 6:248 and 6:231 et seq. BW (Dutch Civil Code). ### 6.1 Three-stage escalation 6.1.1 In the event of a suspected violation of this AUP, Rule Step applies an escalation procedure, which consists of three stages, unless the nature of the violation requires immediate termination. ### 6.2 Stage 1 — Warning 6.2.1 Rule Step sends a written warning to the Customer, in which the violation is described and the Customer is given a period of twenty-four (24) hours to cease the violation and to remedy the damage. ### 6.3 Stage 2 — Suspension 6.3.1 If the Customer does not comply with the warning within the set period, or in the event of a repeated violation, the services are suspended. The Customer is given a period of forty-eight (48) hours to rectify the violation and to submit a statement that future violations will be prevented. ### 6.4 Stage 3 — Termination 6.4.1 If the suspension does not lead to rectification, the agreement is dissolved with immediate effect. The Customer is given a period of thirty (30) days to export his or her data, after the expiry of which the service-related data is permanently deleted. Administrative and financial data are retained for as long as required pursuant to the applicable laws and regulations, including the Algemene wet inzake rijksbelastingen (AWR) [General State Taxes Act], which prescribes a retention period of seven (7) years. ### 6.5 Immediate termination 6.5.1 In the event of serious violations, including the hosting of child pornography, terrorist content, or the carrying out of DDoS attacks, Rule Step is entitled to suspend the services immediately and without prior warning, or to dissolve the agreement, in order to prevent further damage to the Infrastructure or to third parties. ### 6.6 Domains — specific escalation 6.6.1 For domains, the escalation procedure comprises: (i) written warning, (ii) DNS redirection or suspension, and (iii) cancellation of the domain name in accordance with ICANN policy. In the event of a valid court order, the domain name is suspended immediately. ### 6.7 B2B/B2C variation 6.7.1 [B2C] For Consumers, immediate termination is permitted exclusively in the event of serious violations that entail a statutory obligation to intervene. In the case of minor violations by Consumers, Rule Step always first offers a reasonable cure period of at least seven (7) days, unless the nature of the violation requires that the Infrastructure be secured immediately. A provision that gives Rule Step the power to terminate the agreement with a Consumer for a non-essential reason is deemed to be an unreasonable clause within the meaning of article 6:231 et seq. BW and is null and void. --- ## Article 7 — Reporting Obligations **Statutory basis:** Code of Criminal Procedure (Wetboek van Strafvordering) (articles 151c and 151d); Mandatory Reporting of Child Abuse Act (Wet meldplicht kindermisbruik); Telecommunications Act (Telecommunicatiewet) (article 11.5); Counter-Terrorism Act (Wet ter bestrijding van terrorisme); NIS2 Directive. ### 7.1 CSAM reporting obligation 7.1.1 If Rule Step becomes aware of the existence of child pornographic material or indecent representations of a child on its Infrastructure, Rule Step reports this without delay to the police and the reporting point organisations, in accordance with the Wet meldplicht kindermisbruik and articles 151c and 151d of the Wetboek van Strafvordering. ### 7.2 Terrorist content 7.2.1 If Rule Step becomes aware of terrorist content, Rule Step reports this in accordance with the applicable counter-terrorism legislation. ### 7.3 NIS2 notification 7.3.1 In the context of NIS2 obligations, Rule Step reports significant incidents that have an impact on the availability, integrity or confidentiality of the services. The early warning is reported to CSIRT/NL within twenty-four (24) hours after detection of the incident, followed by a full report within seventy-two (72) hours. ### 7.4 Domain names 7.4.1 Domain names that are associated with identified criminal activities are reported to the relevant authorities, as well as via the ICANN abuse reporting mechanisms. ### 7.5 B2B/B2C variation 7.5.1 The reporting obligations apply to both Business Customers and Consumers. When reporting personal data of Consumers, Rule Step implements the necessary safeguards to protect the privacy of the Consumer in accordance with the AVG (GDPR), and does not make any excessive or unlawful reports. --- ## Article 8 — DSA Transparency and Content Moderation **Statutory basis:** Regulation (EU) 2022/2065 (DSA); Directive 2000/31/EC (E-Commerce Directive). ### 8.1 Hosting classification 8.1.1 Rule Step qualifies as a hosting provider within the meaning of article 14 E-Commerce Directive and article 6 DSA (Regulation 2022/2065), insofar as Rule Step provides online services. Rule Step does **not** qualify as an online platform within the meaning of article 3 under h DSA, unless the nature of the service provision changes in the future. As such, articles 13-14 DSA (transparency reports and digital services officer) do not apply to Rule Step, unless and insofar as Rule Step also qualifies as an online platform. ### 8.2 Voluntary transparency 8.2.1 Rule Step publishes, on a voluntary basis, an annual overview of content moderation actions and complaints received. If Rule Step qualifies in the future as an online platform within the meaning of the DSA, a transparency report will be drawn up at least once per year. ### 8.3 Reports by third parties 8.3.1 Rule Step offers a simple and accessible mechanism for reporting the presence of alleged illegal content on the Infrastructure. These reports can be made anonymously via abuse@rulestep.com. ### 8.4 Digital services officer 8.4.1 If and insofar as Rule Step qualifies as an online platform within the meaning of the DSA, Rule Step appoints a digital services officer who acts as the single point of contact for government authorities, and whose contact details are made public. Until that time, the general contact address of Rule Step serves as the point of contact for government authorities. ### 8.5 Handling of reports 8.5.1 If a Customer or third party reports illegal content, Rule Step handles the report without undue delay and informs the reporter of the decision taken. --- ## Article 9 — NIS2 Security Obligations **Statutory basis:** NIS2 Directive (2022/2555); Cybersecurity Act (Cyberbeveiligingswet, Cbw). ### 9.1 Conditional application 9.1.1 The applicability of the NIS2 obligations depends on the classification of Rule Step under the implementing legislation. The obligations mentioned in this article apply exclusively insofar as Rule Step qualifies as an essential or important entity within the meaning of the NIS2 Directive and the national legislation based thereon. ### 9.2 Security measures 9.2.1 Insofar as the NIS2 obligations apply, Rule Step takes appropriate and proportionate technical and organisational measures to manage the risks to the security of the network and information systems. The concrete measures are described in the Data Processing Agreement (Verwerkersovereenkomst, DPA Annex C) and the Privacy Policy (PP Art. 8). ### 9.3 Customer obligations 9.3.1 The Customer is obliged to also take appropriate security measures itself with respect to the systems and applications managed by it on the Infrastructure, including the timely installation of security updates, the use of strong authentication, and the restriction of access rights. 9.3.2 The failure by the Customer to take sufficient security measures, as a result of which the Infrastructure of Rule Step or of third parties is endangered, is regarded as a violation of this AUP. --- ## Article 10 — Duration and Termination **Statutory basis:** AW Art. 8. ### 10.1 Entry into force and term 10.1.1 This AUP enters into force at the moment the Customer purchases the services and remains applicable during the term of the agreement. 10.1.2 Termination of the agreement leaves the validity of this AUP unaffected insofar as it relates to prior violations and liabilities. ### 10.2 Termination by notice (opzegging) B2B 10.2.1 [B2B] Business Customers are bound by the notice periods agreed in the main agreement. ### 10.3 Termination by notice (opzegging) B2C 10.3.1 [B2C] Consumers have the right to terminate the agreement concerning the services by notice at any time, with a notice period of no more than one (1) month, unless the nature of the service does not permit a shorter period. ### 10.4 B2C withdrawal 10.4.1 [B2C] Consumers enjoy a right of withdrawal (herroepingsrecht) of fourteen (14) calendar days upon online registration, in accordance with the applicable distance selling legislation (articles 6:230o/p BW). The exceptions to the right of withdrawal are set out in AVO Art. 3. --- ## Article 11 — Liability **Statutory basis:** AW Art. 9 and 10. ### 11.1 B2B liability 11.1.1 For Business Customers, the liability of Rule Step is limited to the amount that the Business Customer has paid to Rule Step in the twelve (12) months preceding the damage-causing event, with a maximum of fifty thousand euros (EUR 50.000) per event. Indirect damage, consequential damage, loss of profit and loss of data are excluded from compensation. ### 11.2 B2C liability 11.2.1 [B2C] For Consumers, the exclusion of indirect damage and consequential damage does not apply if and insofar as this exclusion is in conflict with mandatory law, in particular article 6:236 (black list (zwarte lijst)) and article 6:237 (grey list (grijze lijst)) BW. The liability of Rule Step towards Consumers is unlimited insofar as it concerns death, bodily injury, intent or deliberate recklessness. For all other damage (direct and indirect), the liability of Rule Step towards Consumers is capped at EUR 1,000,000 per event, in order to respect article 6:231 et seq. BW. 11.2.2 Nothing in this AUP serves to limit or exclude the liability of Rule Step for death or personal injury resulting from negligence. ### 11.3 Damage due to enforcement 11.3.1 Rule Step is not liable for damage resulting from the Customer acting in violation of this AUP, nor for damage resulting from the enforcement of this AUP by Rule Step, including the suspension or termination of the services. --- ## Article 12 — Dispute Resolution **Statutory basis:** AW Art. 16; Brussels I bis. ### 12.1 Dutch law 12.1.1 Dutch law applies to this AUP and the agreements arising therefrom. ### 12.2 Forum B2B 12.2.1 [B2B] Disputes are submitted to the competent court in the arrondissement [judicial district] in which Rule Step B.V. has its statutory seat (Amsterdam), without prejudice to the jurisdiction of the court in the place of residence of the Consumer if the Consumer so chooses. ### 12.3 Forum B2C 12.3.1 [B2C] The Consumer may choose the court in the arrondissement of his or her place of residence, in accordance with AW Art. 16.2, without prejudice to the right to have recourse to the courts. --- ## Execution This AUP has been adopted by the management board (bestuur) of Rule Step B.V. and enters into force on 30 September 2026. Place: Amsterdam, the Netherlands Date: 30 September 2026 ________________________________________ **J.J. van Grondelle** Director (alleen/zelfstandig bevoegd [solely/independently authorised]) --- *For reports of illegal content or notice-and-takedown: abuse@rulestep.com* *For questions about privacy: privacy@rulestep.com*