Acceptable Use Policy

1. About this policy

This Acceptable Use Policy ("Policy") sets out the rules that apply to anyone using services provided by Intellitech I.T. Solutions Limited ("Intellitech", "we", "us"), a company registered in England and Wales with company number 05965200.

It applies to all of our services, including managed IT and support, Microsoft 365 and other cloud services we supply or administer, web and email hosting, domains, servers and virtual machines, network and security services, backup, and any systems, accounts or networks we provide or manage for you (together, the "Services").

This Policy forms part of the agreement between Intellitech and each customer ("you"). If anything in this Policy conflicts with a signed agreement between us, the signed agreement takes priority. You are responsible for ensuring that your employees, contractors, end users and anyone else you allow to use the Services ("Users") comply with this Policy, and for breaches by them as if they were your own.

2. Lawful use

You must use the Services only for lawful purposes and in accordance with the laws of the United Kingdom. Without limitation, you must not use the Services in breach of:

• the Computer Misuse Act 1990;
• the UK General Data Protection Regulation, the Data Protection Act 2018 and the Data (Use and Access) Act 2025;
• the Privacy and Electronic Communications Regulations 2003;
• the Copyright, Designs and Patents Act 1988 and other UK intellectual property legislation;
• the Communications Act 2003 and the Malicious Communications Act 1988;
• the Fraud Act 2006, the Bribery Act 2010 and the Proceeds of Crime Act 2002;
• the Terrorism Acts 2000 and 2006, the Protection of Children Act 1978 and the Online Safety Act 2023; or
• the Sanctions and Anti-Money Laundering Act 2018 and UK export control legislation.

If you access the Services from, or store data in, another country, you are also responsible for complying with the laws that apply to you there.

3. Prohibited content and activity

You must not use the Services to create, store, transmit, publish, link to or otherwise process anything that:

• is illegal, including child sexual abuse material, extremist or terrorist material, or material that incites violence or hatred;
• infringes anyone's intellectual property rights, including unlicensed software, media or other content;
• is defamatory, threatening, harassing, abusive or discriminatory;
• is designed to deceive or defraud, including phishing pages, impersonation of other organisations or individuals, fake shops and investment scams;
• contains or distributes malware, ransomware, spyware, command-and-control infrastructure or other harmful code;
• processes personal data unlawfully, or obtains personal data without a lawful basis; or
• facilitates any of the above for third parties.

4. Security and network abuse

You must not, and must not attempt to:

• gain unauthorised access to any system, account, network or data, whether ours, another customer's or a third party's;
• probe, scan or test the vulnerability of any system or network, or carry out penetration testing, without our prior written agreement;
• interfere with or disrupt the Services, other customers or any network, including denial-of-service attacks, flooding or deliberately consuming excessive resources;
• bypass, disable or interfere with authentication, monitoring, licensing or other security controls, including endpoint protection, multi-factor authentication or conditional access policies we have implemented;
• operate open mail relays, open proxies, anonymising services or unauthorised VPN endpoints;
• forge or falsify network, packet or email header information;
• carry out cryptocurrency mining unless we have expressly agreed to it in writing; or
• use the Services to monitor or intercept other people's data or communications without lawful authority.

5. Accounts, credentials and access

• Keep all usernames, passwords, keys, tokens and multi-factor authentication methods confidential, and do not share accounts between individuals.
• Use multi-factor authentication wherever we have enabled it or recommended it.
• Tell us promptly when a User leaves or no longer needs access, so their access can be removed.
• Do not grant administrative access to the Services to third parties without telling us.
• Tell us without delay if you suspect any account, device or credential has been compromised, or if you become aware of a security incident affecting the Services.

6. Email and electronic marketing

Where the Services include email or other messaging, you must not:

• send unsolicited marketing, or any bulk email, in breach of the Privacy and Electronic Communications Regulations 2003 or UK GDPR;
• send email from addresses or domains you are not authorised to use, or disguise the origin of messages;
• use purchased, rented or harvested mailing lists; or
• continue sending to recipients who have unsubscribed or objected.

Bulk or marketing email should be sent through a dedicated email marketing platform, not through the mailboxes or hosting we provide. We may limit sending volumes to protect the reputation of shared mail infrastructure.

7. Fair use of shared resources

Some Services, such as shared web hosting, run on infrastructure shared with other customers. You must not use those Services in a way that materially degrades performance for others, for example through excessive CPU, memory, storage or bandwidth use, or by using hosting as file storage, a backup target or a media distribution service unless that is what you have purchased. Where usage exceeds your plan, we will contact you to agree a suitable alternative before taking further action, except where immediate action is needed to protect the Services.

8. Data protection

Where you store or process personal data using the Services, you are responsible, as controller, for having a lawful basis, providing privacy information to individuals and responding to their rights requests. Where we process personal data on your behalf, we do so as your processor under the data processing terms in our agreement. Tell us before storing special category data or criminal offence data in any Service, so that appropriate controls can be agreed.

9. Third-party services

Many Services are provided using third-party platforms, including Microsoft 365, Azure and other cloud and software vendors. Your use of those platforms is also subject to the vendor's own terms and acceptable use policies, including Microsoft's Acceptable Use Policy and the Microsoft Customer Agreement where applicable. A breach of a vendor's terms may lead the vendor to suspend the service, independently of us.

10. Monitoring and investigation

We do not routinely monitor the content of your data or communications. However, we operate security monitoring, logging and automated protections as part of the Services, and we may investigate where we receive a complaint, detect suspicious activity or reasonably suspect a breach of this Policy. We will co-operate with law enforcement, regulators and other authorities where required by law, and may disclose information to them in accordance with applicable law.

11. Our response to breaches

If we reasonably believe this Policy has been breached, we may take any action we consider proportionate, taking into account the nature and seriousness of the breach. This may include:

• contacting you to ask that the activity stops or the content is removed;
• removing or disabling access to content;
• suspending or restricting a User, account or Service;
• terminating the affected Services in accordance with our agreement with you;
• reporting the matter to the relevant authorities; and
• recovering reasonable costs we incur as a result of the breach.

Where practical we will give notice before acting. We may act without notice where the breach is serious, is causing or is likely to cause harm to the Services, other customers or third parties, or where we are required to do so by law. Suspension under this Policy does not relieve you of your obligation to pay for the Services.

12. Reporting abuse or security vulnerabilities

To report misuse of any service we provide, or a security vulnerability in our systems, please use our contact form, choose "General enquiry" and start your message with "Abuse report" or "Security report". Include as much detail as you can, such as the URLs, IP addresses, email headers and times involved. If you report a vulnerability in good faith, avoid accessing or changing data that is not yours, and give us reasonable time to fix it before disclosing it publicly, we will not take action against you.

13. Notice and takedown

Where we host content on behalf of customers, we act as a hosting provider under regulation 19 of the Electronic Commerce (EC Directive) Regulations 2002. We do not monitor hosted content, but we will act promptly when we are notified of content that is unlawful or infringes someone's rights, including copyright, trade mark or defamation complaints.

To make a complaint, contact us as described in section 12, starting your message with "Takedown notice", and include:

• your name, organisation (if any) and contact details;
• the exact location of the content, such as the full URL;
• the right or law you believe is being infringed, and why, including details of the work or mark concerned;
• whether you are the rights holder or are authorised to act on their behalf; and
• a statement that the information in your notice is accurate and made in good faith.

When we receive a complete notice, we will:

• acknowledge it and review it promptly;
• notify the customer responsible for the content and, where appropriate, give them an opportunity to respond;
• remove or disable access to the content, or require the customer to do so, where the complaint appears valid or the content is clearly unlawful; and
• tell you what action we have taken.

Where content appears to be child sexual abuse material or terrorist content, or to present an immediate risk of harm, we will disable access without waiting for the customer's response and report it to the appropriate authorities. Notices that are incomplete, abusive or knowingly false will not be acted on. We are not able to adjudicate complex legal disputes between parties; in those cases we may ask the complainant to obtain a court order.

14. Changes to this Policy

We may update this Policy from time to time, for example to reflect changes in law, technology or the Services. The current version is always published on this page. Where a change materially affects you, we will give you reasonable notice.

15. Governing law

This Policy is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, subject to anything different in our agreement with you.