Acceptable Use Policy (AUP)

1. Purpose and application

The purpose of this Acceptable Use Policy is to protect recipients, the Customer, Koll, the Service and Third-Party Services from misuse. The AUP applies to the Customer, all Users, the Customer's integrations, and all communications transmitted through the Service.

The Customer is responsible for ensuring that Users are familiar with the AUP and that use of the Service is properly monitored within the Customer's organisation.

2. General requirement

The Service may be used only for lawful, appropriate contact conducted in good faith. Use must be consistent with the stated company identity and the Customer's actual activity. On request, the Customer must be able to demonstrate its right to use the stated company, brand, name and phone number.

3. Misuse of identity and caller information

The Service may not be used to:

• impersonate another person, company, authority or organisation without right;
• falsify, mask or misleadingly present the caller's name, company, number, reason for calling or other information;
• use a number or brand that the Customer does not control or is not authorised to use;
• obtain trust through false or materially misleading information;
• commit fraud, phishing, payment fraud, pretexting or other deceptive conduct; or
• circumvent identifiers or security measures of Koll, an operator or a communications channel.

The reason for calling must truthfully and sufficiently clearly describe the purpose of the contact. It must not promise a benefit, agreement, official status, urgency, or an existing customer relationship that does not actually exist.

4. Harassment, unlawful content and recipient intent

The following is prohibited in the Service:

• harassing, threatening, coercive, degrading, hostile, discriminatory, sexually inappropriate or otherwise unlawful content or conduct;
• repeated contact after a recipient has clearly objected to contact, or where there is otherwise no lawful basis for continuing contact;
• frightening a recipient, creating false urgency, or disclosing sensitive information to bystanders;
• transmitting malware, dangerous links, or unauthorised tracking technologies;
• content infringing copyright, trademark, privacy, trade secrets or other third-party rights; and
• using the Service to plan, carry out or conceal a crime.

5. Direct marketing, mass communications and automation

The Customer may use the Service for marketing or sales only if the contact complies with applicable law and the Customer observes obligations relating to consent, opt-outs, do-not-contact lists, identification and identifiability of marketing messages.

The Service is not intended for automated robocalls, random number generation, disruptive mass messaging, or systematic message flooding. Such use is prohibited without Koll's prior written approval and a documented lawfulness assessment.

The Customer must not circumvent usage limits by splitting a campaign across multiple accounts, switching numbers, or using integrations in a manner intended to avoid detection of misuse.

6. Fair use and volume limits

Use of the Service must correspond to the calling team size stated in the order confirmation and to the Customer's normal business activity. The fixed monthly price covers reasonable and customary business use.

The Customer commits to fair use: the Service is not used for mass communication, and usage must not materially exceed the assumptions underlying the agreement, such as the stated team size or normal call and message volumes.

An exceptionally high volume, or volume that deviates from normal business use — including delivery of SmartCards to exceptionally expensive countries — is billed separately.

Before taking restrictive measures, Koll contacts the Customer and, where necessary, agrees on usage limits, a change of package size or additional charges. This does not limit the rights under section 10 "Monitoring and enforcement" in urgent cases of misuse.

7. Personal data and sensitive information

Only personal data necessary for the contact and use of the Service may be entered into the Service. A visible reason for calling, a SmartCard, or an SMS, RCS or other message may be seen by a person using the recipient's device or connection. The Customer must therefore phrase content in accordance with the principles of data minimisation and confidentiality.

A visible reason for calling or an unprotected message field must not include:

• information about health, diagnosis, treatment, sexuality, ethnic origin, religion, political opinion, or trade union membership;
• information about suspected offences, criminal convictions, or security measures;
• passwords, one-time codes, payment card details, banking credentials, or access keys;
• national identity numbers, or passport or other identity document numbers; or
• other information whose disclosure could cause significant harm to the data subject.

If a use case requires processing of high-risk personal data elsewhere in the Service, this must be agreed with Koll in advance, and the Customer must carry out the necessary impact assessment and additional safeguards.

8. Security and technical misuse

The following is prohibited with respect to the Service or related systems:

• attempting unauthorised access, exploiting vulnerabilities, or exceeding access rights;
• overloading, disrupting or denial-of-service attacks against the Service, or unreasonable use of capacity;
• using malicious code, viruses, bots or unauthorised automation;
• circumventing technical limits, billing, logging, authentication or security measures;
• using interfaces contrary to documentation or agreed restrictions; and
• testing the Service in a manner that could jeopardise the Service or other customers' data, without Koll's prior written permission.

9. Specifically restricted uses

Without Koll's prior written approval, the Service may not be used for emergency services, safety-critical alerts, automated decision-making producing legal or similarly significant effects for a person, or for high-risk activity where a disruption of the Service could reasonably be expected to cause death, personal injury or significant property damage.

The Service may not be used in violation of sanctions or export control rules, nor for activity that Koll reasonably assesses as jeopardising the safety of the Service, communications networks, recipients, or general trust.

10. Monitoring and enforcement

Koll has no general obligation to pre-screen the Customer's communications. However, Koll may process usage and log data to detect and investigate misuse, fraud, security threats and breaches of the agreement in accordance with applicable law.

If Koll has justified reason to suspect a breach of the AUP, Koll may:

• request clarification and corrective measures from the Customer;
• restrict a particular feature, integration, User, number or communications channel;
• suspend the Service in an urgent situation;
• remove or block clearly unlawful content to the extent within Koll's control;
• report the matter to the provider of a communications channel or a competent authority where permitted or required by law; or
• terminate the agreement in accordance with the Terms.

A measure must be proportionate to the circumstances. Koll aims to notify the party affected of the measure and its basis, unless doing so would jeopardise the investigation, security or compliance with law.

11. Reporting misuse and changes to the AUP

Suspected misuse of the Service can be reported to hannu.nissinen@koll.to. Where possible, the report should include the time of the event, the number or company identity used, a description of the message, and any other information that would help the investigation.

Koll may update the AUP in accordance with section 23 of the Terms. Urgent security, misuse and legal changes may be implemented more quickly if necessary to protect the Service or recipients.