# Acceptable Use Policy — English Summary

Plain-English summary of `aup-nl.md` (AUP), version 1.0, effective 30 September 2026. The Dutch text is legally binding.

## Scope

The AUP applies to **all online services** of Rule Step B.V. (hosting, VPS, app-hosting, domains, email, certificates, licenses, backups). It does not apply to consulting services — confidentiality and professional standards for consulting live in AVC Art. 7.

## Key takeaways per article

- **Art. 1 — Definitions.** AUP, Consument (B2C), Bedrijfsklant (B2B), Diensten, Infrastructuur, Illegale Inhoud.
- **Art. 2 — Applicability.** Clickwrap acceptance required for B2C. 6:193h/6:193j BW protection preserved.
- **Art. 3 — Prohibited activities.** Illegal content (incl. CSAM, terrorism), spam, malware, botnets, unauthorized cryptomining, DDoS, phishing, IP infringement, vulnerability scanning, illegal gambling, cybersquatting. B2C: legitimate speech/criticism carve-out.
- **Art. 4 — Copyright & Notice-and-Takedown.** EU framework only (no DMCA). **Notice via abuse@rulestep.com.** Required content. **5-working-day assessment.** Expeditious action per art. 14 E-Commerce Directive. 14-day counter-notification per art. 14 DSA. UDRP for domains. B2C vrijwaring limited.
- **Art. 5 — Law enforcement cooperation.** WvSv + Telecommunicatiewet basis. **No voluntary disclosure.** Inform client unless prohibited. **AVG art. 6(1)(c) and (e)** for B2C (R2-fix preserved).
- **Art. 6 — Escalation (3 tiers).** (1) Warning 24h, (2) Suspension 48h, (3) Termination 30-day data export. Immediate termination only for severe violations (CSAM, terrorism, DDoS). **B2C: 7-day restoration term** for minor breaches (6:193 BW).
- **Art. 7 — Mandatory reporting.** **CSAM → politie + meldpunt per Wet meldplicht kindermisbruik + WvSv 151c/d** (R2-fix preserved). Terrorism per applicable law. NIS2 24h early warning + 72h full report. Domain abuse per ICANN mechanisms.
- **Art. 8 — DSA transparency.** Hosting classification (art. 14 ECD / art. 6 DSA). **NOT an online platform** (art. 3(h) DSA). Voluntary transparency report. Anonymous reporting mechanism. Digital services functionaris only if status changes.
- **Art. 9 — NIS2.** Conditional on Rule Step's classification under Cbw (NIS2-implementatie).
- **Art. 10 — Duration.** B2C max 1-month notice; 14-day withdrawal right (AVO Art. 3 exceptions).
- **Art. 11 — Liability.** B2B cap. **B2C: 12-month rolling + EUR 20,000 direct max (excl. death/injury/intent); EUR 1,000,000 indirect cap.**
- **Art. 12 — Disputes.** dutch law; B2B Amsterdam; B2C domicile + SGC Geschillencommissie + ODR.

## Notable adjudications

- All R2-fixes preserved: Strafvordering 151c/151d, Wet meldplicht kindermisbruik (replaces "meldcode"), AVG 6(1)(c/e).
- 6:193h/6:193j BW sprinkled throughout.
- abuse@rulestep.com address per D-2.

For full legal text, see `aup-nl.md`.