Annex B — Acceptable Use Policy (AUP) Vepino

• Material in violation of applicable law
• Material constituting threats, incitement against a group, defamation or harassment
• Sexual material involving minors
• Content promoting violence, terrorism or inciting self-harm

• Phishing and attempts to obtain sensitive information from recipients
• Misleading sender identification or false “from” addresses
• False or misleading subject lines
• Pyramid schemes, chain letters, “make money fast” offers
• Fraudulently marketed products or services

• Distribution of malicious code (malware, viruses, ransomware, spyware or similar)
• Attempts to exploit security vulnerabilities in the Service or with recipients
• Distributed attacks (DDoS) or attempts to overload systems

• Material infringing copyright, trademark or other intellectual property rights
• Material infringing third parties’ personal integrity without basis

Recipients of bulk campaigns (marketing communication) must either:

(a) have given clear consent to receive communication from the Customer, or

(b) have an established business relationship with the Customer where the campaign has valid legal basis, for example legitimate interests (Article 6(1)(f) GDPR) or, for marketing of similar products or services to existing customers, so-called soft opt-in under the Swedish Electronic Communications Act (LEK) / ePrivacy Directive.

It is not permitted to send campaigns to lists that:

• have been purchased, rented or otherwise acquired from a third party
• have been scraped from websites, social media or public registries without the recipient’s knowledge
• have been generated through dictionary attacks, guessing or automated generation of addresses

• The sender name must clearly identify the Customer or the operation on whose behalf the email is sent.
• The “from” address must point to a domain the Customer has the right to use.
• The email must contain a valid physical address for the sender.

All bulk campaigns (marketing communication) must contain a clear and functioning option for the recipient to unsubscribe. Unsubscribes must be processed within five (5) business days.

Transactional emails related to an event (registration confirmations, tickets, receipts, event updates) are exempt from the unsubscribe requirement.

It is not permitted to attempt to circumvent the unsubscribe functionality, for example by re-adding unsubscribed recipients to distribution lists without a new basis, or by formatting marketing-type bulk campaigns as if they were transactional.

Vepino automatically handles:

• removal of hard bounces from sendable recipients
• immediate suspension from further campaigns to recipients who have filed complaints (spam complaints)

The Customer undertakes not to send to addresses that have been inactive for a long time without re-establishment of the relationship.

The Service is intended to be used by the Customer for the Customer’s own operations or operations the Customer represents. It is not permitted to:

• sublicense, resell or otherwise make the Service available to a third party as if the Customer were providing it themselves
• create accounts in the Service for unauthorised third parties
• use the Service to deliver a competing service

Use for events organised in collaboration with a third party (co-organisers, sponsors or partners) is permitted, provided the Customer is the primary sender and responsible party. Access for collaboration partners is granted as authorised users under the Customer’s account.

• It is not permitted to attempt to obtain unauthorised access to the Service, other Customers’ data or underlying infrastructure.
• It is not permitted to attempt to circumvent technical limitations (sending caps, rate limits, security controls).
• It is not permitted to automate use beyond permitted API calls, or to overload the Service with unusually high volumes.

On suspected or confirmed violation of this AUP, the Supplier may take one or more of the following measures, adapted to the severity:

1. Inquiry: The Supplier contacts the Customer for explanation and requests action.
2. Throttling: The Supplier temporarily lowers the sending rate or limits volume.
3. Suspension of specific functions: Email campaigns are paused while other parts of the Service remain available.
4. Full suspension: The Service is made unavailable.
5. Termination: The Agreement is terminated with immediate effect on gross or repeated violation.

On manifestly gross violations (phishing campaigns, malware distribution, illegal content), the Supplier is entitled to take immediate suspension without prior warning, and to inform relevant subprocessors if required to protect the infrastructure.

Suspension or termination resulting from the Customer’s violation of the AUP does not entitle the Customer to refund of prepaid fees.

The Customer shall without undue delay inform the Supplier if the Customer detects or suspects:

• Unauthorised access to their Vepino account
• That Vepino has been used by a third party without permission
• That campaigns have been sent by mistake in breach of this AUP

Suspected violations can be reported to the Supplier via abuse@vepino.com.