Acceptable Use Policy

This policy covers purchased services and their authorised users. It supports lawful use, protection of people and infrastructure stability. Enforcement is proportionate, reasoned and respects fundamental rights. It imposes no general duty to monitor all data.

Illegal content/activities, child sexual abuse material, unlawful threats/incitement, fraud and infringement of IP, personal data or confidentiality are prohibited. A report alone does not establish illegality. We assess applicable law and specific evidence; vague “offensiveness” is not an unlimited basis to remove lawful expression.

Malware, phishing, botnets, DDoS, credential theft, unauthorised access/scanning of others, other-tenant data extraction and evasion of isolation, quotas or billing are prohibited. Do not disrupt infrastructure/users. Security tests need recorded authorisation and scope through [SECURITY_TEST_CONTACT]. Good-faith vulnerability reporting differs from malicious exploitation. Complete [RESOURCE_POLICY: mining, proxies, load testing and special workloads] without vague excessive-use limits.

No spam, spoofing, unlawful bulk communications or purchased lists without lawful basis. Follow applicable consent/objection rules, identify senders and provide working unsubscribe where required. Manage bounces/complaints and do not bypass sending limits. Routine compliance does not require unlawful wholesale disclosure of private communications.

Do not use Copilot for fraud, unlawful manipulation/material or rights infringement. Submit only data you are entitled to process. Personal/sensitive data needs suitable instructions, lawful conditions and an approved data flow. Third-party AI terms must be shown before activation; the AUP does not generally approve unknown providers.

Report at [DSA_NOTICE_URL_OR_EMAIL] in Greek or English with precise location/URL and further identifiers where needed, explanation of illegality, evidence, name/email where required and a good-faith statement of accuracy/completeness. Certain child-related offences have a statutory identity exception. We acknowledge when contact details exist and assess promptly, diligently, objectively and without arbitrariness. We communicate decisions/remedies where required. Notifier identity is not disclosed without lawful need.

Use the minimum necessary measure: warning, correction, restriction of specific material/endpoint, temporary suspension and termination for serious/repeated violations. Give prior notice unless urgent or prohibited by law. Where DSA applies, clear reasons state measure/duration/scope, facts, automation, legal/contractual basis and remedies, subject to statutory exceptions. [MODERATION_AUTOMATION_AND_HUMAN_REVIEW] is unverified.

Request review at [APPEAL_CONTACT] with supporting evidence. Human review by a competent person not bound by the first decision is proposed. Define [APPEAL_PERIOD_AND_RESPONSE] without limiting mandatory rights. The proposal does not establish a current working process. If a service is an online platform, assess additional internal-complaint/out-of-court duties and lawful small-enterprise exemptions; neither universal applicability nor absence is assumed.

We comply with lawful orders, minimise disclosure and notify where permitted. Apply DSA notification duties for suspected serious crimes threatening life/safety where legal conditions are met. [DSA_AUTHORITY_CONTACT] and [DSA_USER_CONTACT] are functional distinct contact points in Greek/English. No blanket contractual immunity exists; liability exemptions require activity-specific legal conditions. Classification, registration and transparency duties need counsel/EETT assessment.