# SUPPLEMENTARY TERMS AND CONDITIONS ONLINE SERVICES ## Rule Step B.V. [besloten vennootschap; private limited liability company] --- **Version:** 1.0 **Date of entry into force:** 30 September 2026 These Supplementary Terms and Conditions Online Services ("AVO") are, in addition to the General Terms and Conditions of Rule Step B.V. (hereinafter: "AW") and — insofar as applicable — the Order Form, applicable to every agreement between Rule Step B.V. and a Customer with regard to online services: hosting, VPS, app hosting, domain registration and management, e-mail, certificates, licences and back-up. Definitions from the General Terms and Conditions (AW Art. 1.1) apply mutatis mutandis. The AVO contain exclusively rules that are specific to online services; generic rules are set out in the AW. The Service Level Agreement (SLA), the Acceptable Use Policy (AUP) and the Data Processing Agreement (Verwerkersovereenkomst, DPA) form, insofar as applicable, part of the agreement as annexes. --- ## Article 1 — Definitions and Applicability ### 1.1 Additional definitions In these Supplementary Terms and Conditions, the following is understood by: a. **Online services**: the hosting, VPS, app hosting, domain registration and management, e-mail, certificate, licence and back-up services offered by Rule Step; b. **Hosting services**: the making available of server space, computing power, network connection and storage capacity for the hosting of websites, applications and digital content of the Customer; c. **Managed hosting**: a hosting variant whereby Rule Step provides the operating system, the security updates, the monitoring and the technical support; d. **Self-managed VPS**: a virtual private server of which the Customer itself manages the operating system, the security and the configuration; e. **App hosting**: the hosting of container-based applications (for example via Coolify, HestiaCP); f. **Domain name services**: registration, management, renewal, transfer and DNS configuration of domain names via upstream registrars (Realtime Register, TransIP, Gandi.net) and registries (SIDN, ICANN); g. **Upstream registrar**: the party with which Rule Step has an agreement for the technical registration of domain names, being Realtime Register, TransIP or Gandi.net; h. **Registry**: the authority that manages a top-level domain, being ICANN for gTLDs, SIDN for .nl domains, or another ccTLD registry; j. **SLA**: the Service Level Agreement of Rule Step, in which the service levels and response times for hosting, domains and back-up are further laid down; l. **AUP**: the Acceptable Use Policy of Rule Step, in which the prohibited activities and the escalation procedure are laid down; m. **DPA**: the Data Processing Agreement (Verwerkersovereenkomst) of Rule Step, concluded on the basis of article 28 AVG (GDPR); n. **WHOIS**: the public register of domain name data that is maintained by registries and registrars, insofar as still applicable under the AVG (GDPR). ### 1.2 Applicability 1.2.1 These Supplementary Terms and Conditions are applicable to every agreement with regard to online services, in addition to the General Terms and Conditions and the Order Form. In the event of conflict, the Order Form prevails over these Supplementary Terms and Conditions, and these Supplementary Terms and Conditions prevail over the General Terms and Conditions, without prejudice to the protection of the Consumer pursuant to article 6:231 et seq. BW (Dutch Civil Code). 1.2.2 These Supplementary Terms and Conditions do not apply to consulting services. For those services, the Supplementary Terms and Conditions Consulting (AVC) apply. 1.2.3 The Customer must, in addition to these Supplementary Terms and Conditions, also comply with the AUP, the SLA (insofar as hosting/domains are procured) and the DPA (insofar as Rule Step processes personal data on behalf of the Customer). --- ## Article 2 — Description of the Online Services ### 2.1 Hosting variants 2.1.1 **Managed hosting**: fully managed server environment including operating system management, security updates, monitoring and technical support, with the uptime guarantee laid down in the SLA. 2.1.2 **Self-managed VPS**: virtual private servers for which the Customer itself is responsible for operating system management, security and configuration. The uptime guarantee of the SLA is not applicable to self-managed VPS (see SLA Art. 7). 2.1.3 **App hosting**: container-based hosting via Coolify/HestiaCP or comparable platforms. The specific characteristics and service levels are stated in the Order Form and/or the SLA. 2.1.4 The specific technical characteristics (CPU cores, RAM, storage capacity, bandwidth, management level) are stated in the Order Form. ### 2.2 Domain name services 2.2.1 Rule Step provides domain name services consisting of: (a) registration of domain names via upstream registrars (Realtime Register, TransIP, Gandi.net); (b) management of DNS records and nameserver configuration; (c) transfer (verhuizing) of domain names to and from Rule Step; (d) renewal and management of existing domain name registrations. 2.2.2 Rule Step is not a registry and has no influence on the availability of domain names, the processing time of registrations, or the policy of the relevant registries (such as SIDN for .nl domains or ICANN for gTLDs). ### 2.3 E-mail, certificates, licences and back-up 2.3.1 **E-mail**: e-mail hosting including mailbox, IMAP/POP3/SMTP access, anti-spam and anti-malware, insofar as agreed. 2.3.2 **Certificates**: SSL/TLS certificates (for example via Let's Encrypt or a commercial CA), insofar as agreed. 2.3.3 **Licences**: software licences offered or resold by Rule Step (including but not limited to panel licences, virtualisation licences or application licences), insofar as agreed. 2.3.4 **Back-up**: automated back-up of customer data according to the 3-2-1 principle, as further specified in the SLA (Art. 8) and these Supplementary Terms and Conditions (Art. 8). --- ## Article 3 — Right of Withdrawal Exceptions [B2C] **Statutory basis:** Articles 6:230o, 6:230p BW (Dutch Civil Code); Directive 2011/83/EU article 16. ### 3.1 Hosting services [B2C] 3.1.1 For hosting services, the right of withdrawal (AW Art. 3.2) lapses as soon as Rule Step has fully performed the service, provided that the Consumer has beforehand expressly requested immediate performance and has acknowledged that the right of withdrawal lapses as soon as the hosting service has been fully performed, in accordance with article 16 under c WRD in conjunction with article 6:230p paragraph 3 BW (Dutch Civil Code). ### 3.2 Domain name registration [B2C] 3.2.1 For domain name registration, the right of withdrawal lapses as soon as the registration has been confirmed by the upstream registrar and the domain name has become operational, provided that: (a) it concerns digital content that is not supplied on a tangible medium; (b) the Consumer has beforehand expressly consented to immediate performance; (c) the Consumer has acknowledged that the right of withdrawal lapses as soon as the registration has been confirmed, in accordance with article 16 under a and c WRD. ### 3.3 Information obligation 3.3.1 Rule Step informs the Consumer prior to the agreement about the applicability of the exceptions in this article, in accordance with AW Art. 3.2.3. --- ## Article 4 — Domain Name-Specific Rules **Statutory basis:** ICANN Registrar Accreditation Agreement (RAA); ICANN Consensus Policies; SIDN Reglement [SIDN Regulations]; UDRP; AVG (GDPR) articles 6(1)(b) and (f). ### 4.1 Registrar terms and RAA 4.1.1 Domain name registrations via Rule Step are subject to the terms of the relevant upstream registrar and registry, including the Registrar Accreditation Agreement (RAA) of ICANN for gTLDs, the SIDN Reglement (Regulations) for .nl domains, and the Uniform Domain-Name Dispute-Resolution Policy (UDRP). 4.1.2 The Customer declares to be familiar with these terms and undertakes to comply with them. In the event of conflict between these Supplementary Terms and Conditions and the registry terms, the registry terms prevail insofar as mandatorily prescribed. ### 4.2 ICANN/RAA resale 4.2.1 Insofar as Rule Step acts as reseller of domain names via an upstream registrar, the upstream registrar remains the contractual counterparty vis-à-vis the registry. The Customer is the registrant (rechthebbende) [rights holder] of the domain name; Rule Step makes no claim to ownership of the registered domain names. ### 4.3 Expiry and renewal 4.3.1 Domain names are registered for the period stated in the Order Form (usually one (1) year). Renewal takes place after explicit confirmation by the Customer, unless automatic renewal has been agreed. 4.3.2 Rule Step is not liable for the expiry (expiratie) of domain names if the Customer does not timely instruct renewal, or if the Customer does not actively maintain the e-mail address for renewal notifications. Rule Step sends a reminder in good time. ### 4.4 Waiver and reactivation 4.4.1 After expiry of a domain name, a grace period (usually 0-30 days) applies during which reactivation is possible at the customary renewal price. Thereafter the domain name may end up in a redemption period with additional costs. 4.4.2 The Customer is itself responsible for monitoring the expiry dates. Rule Step cannot guarantee that a domain name can be reactivated at all times after expiry; this depends on the policy of the registry. ### 4.5 WHOIS and AVG 4.5.1 For .nl domains, the WHOIS is closed to the public; registrant data cannot be retrieved via WHOIS. 4.5.2 For gTLDs, Rule Step applies a GDPR-compliant WHOIS policy: non-essential personal data of the Customer are shielded by default (GDPR-default). Publication of WHOIS data requires a separate, active and specific consent (opt-in) from the Customer, which is not bundled with other conditions. 4.5.3 [B2C] For Consumers, WHOIS data are fully shielded by default. A Consumer may at any time request shielding; Rule Step will implement this without delay. ### 4.6 ICANN transfer to third countries 4.6.1 For gTLD registrations, transfer of registrant data to ICANN in the United States may be necessary. Rule Step applies appropriate safeguards, as set out in the Data Processing Agreement (DPA Art. 10). ### 4.7 Lock period 4.7.1 After registration or modification of registrant data, a lock period of sixty (60) days applies for gTLDs, during which a transfer to another registrar is in principle not permitted (IRTP, ICANN Transfer Policy). Rule Step informs the Customer beforehand about this lock period. ### 4.8 Notice-and-takedown [online services] 4.8.1 Rule Step acts, insofar as Rule Step provides online services, as hosting provider within the meaning of article 14 of Directive 2000/31/EC (E-Commerce Directive) and article 6 of Regulation (EU) 2022/2065 (DSA [Digital Services Act]). Rule Step is not an online platform within the meaning of article 3 under h DSA. 4.8.2 Anyone who is of the opinion that unlawful information is offered or stored via the infrastructure of Rule Step may address a notice-and-takedown request to Rule Step by e-mail (abuse@rulestep.com), stating: identity and contact details of the notifier, the relevant URL or IP address, a description of the allegedly unlawful information or activity, and the legal ground on which the unlawfulness is based. 4.8.3 Rule Step assesses the request without delay, but at the latest within five (5) working days, and acts, if in its opinion there is a justified request, without delay by removing the relevant information or disabling access to it, in accordance with article 16 DSA. The detailed procedure is included in the AUP (AUP Art. 4). 4.8.4 Rule Step has no general monitoring obligation (article 15 E-Commerce Directive) and is not obliged to proactively search for facts or circumstances that point to unlawful activities. --- ## Article 5 — Payment for Online Services **Statutory basis:** AW Art. 5; ICANN RAA. ### 5.1 Hosting and other periodic services 5.1.1 Hosting services and other periodic online services are invoiced monthly in advance, unless a deviating schedule has been agreed in the Order Form (for example annual prepayment). The payment term is fourteen (14) days after the invoice date. ### 5.2 Domain name registration — prepayment 5.2.1 Domain name registrations are paid in advance, in accordance with the pre-payment model of the upstream registrar. Rule Step invoices the Customer for the registration costs and renewal costs, including any registry surcharges and ICANN fees. 5.2.2 The Customer bears the risk of non-payment; Rule Step may suspend or cancel the domain name registration or renewal if payment is not forthcoming, with due observance of the warning period of article 7.3. ### 5.3 Licences and certificates 5.3.1 Licences and certificates are invoiced in advance for the agreed term. Upon renewal, the rates applicable at that time apply. --- ## Article 6 — Additional Obligations of the Customer **Statutory basis:** AW Art. 4.2; AUP. ### 6.1 Correct registrant data 6.1.1 The Customer is obliged to provide correct and current registrant data (name, address, e-mail, telephone) and to update these without delay upon changes, in accordance with ICANN/SIDN requirements. 6.1.2 If the Customer provides incorrect or outdated data, Rule Step is entitled to ask the Customer for correction and updating and, in the absence thereof, to suspend the domain name in accordance with ICANN/SIDN policy. ### 6.2 Compliance with AUP 6.2.1 The Customer is obliged to comply with the Acceptable Use Policy (AUP) when using the online services, including the prohibited activities (AUP Art. 3) and the escalation procedure (AUP Art. 6). ### 6.3 Security 6.3.1 The Customer is responsible for taking appropriate security measures with regard to its systems, applications and accounts on the infrastructure of Rule Step, including the use of strong passwords, MFA where available, the timely installation of security updates and the limitation of access rights. ### 6.4 Indemnification for own content [B2B] 6.4.1 [B2B] The Customer indemnifies Rule Step against all claims of third parties that arise from content that has been hosted, stored or distributed by the Customer on the infrastructure of Rule Step, including claims on the ground of infringement of intellectual property rights or unlawful content. For Consumers, this indemnification obligation applies only insofar as the Consumer was or should have been aware of the unlawfulness. --- ## Article 7 — Suspension, Shutdown and Termination **Statutory basis:** AW Art. 7; ICANN/SIDN rules; AUP Art. 6. ### 7.1 Hosting — suspension in case of non-payment 7.1.1 Suspension (opschorting) of hosting services in case of non-payment shall not take place earlier than fourteen (14) days after the Customer has been placed in default, and after Rule Step has offered the Customer a reasonable period of seven (7) days to still pay. 7.1.2 [B2C] The Consumer at all times receives a reasonable period to still fulfil his payment obligations, before Rule Step proceeds to suspension. ### 7.2 Hosting — shutdown in case of AUP violation 7.2.1 In the event of a violation of the AUP, Rule Step applies the escalation procedure of AUP Art. 6: warning (24 hours), shutdown (schorsing) (48 hours), termination (30 days data export). 7.2.2 Immediate shutdown is permitted in the event of serious violations (AUP Art. 6.6), including hosting of child pornography, terrorist content or the committing of DDoS attacks. 7.2.3 [B2C] For the Consumer, a remedy period of at least seven (7) days applies in the case of minor violations, in accordance with AUP Art. 6.8. ### 7.3 Domains — suspension and cancellation 7.3.1 Domain names can be suspended (hold) or cancelled on the ground of: (a) court order; (b) UDRP/URS decision; (c) SIDN dispute resolution scheme (Geschillenregeling) for .nl domains; (d) non-payment by the Customer, with due observance of article 7.3.2; (e) violation of the AUP or the registry policy. 7.3.2 In the event of non-payment of a domain name registration, the Customer is warned in writing at least thirty (30) days in advance, in accordance with ICANN guidelines. After suspension, the Customer retains, during the grace period laid down in the registry policy, the right to export his data (see AVO Art. 8). ### 7.4 Provision of data to authorities 7.4.1 Rule Step provides data to authorities exclusively on the ground of a statutory obligation (article 6(1) under c or e AVG (GDPR), Wetboek van Strafvordering [Dutch Code of Criminal Procedure], Telecommunicatiewet [Dutch Telecommunications Act]). The procedure is set out in AUP Art. 5. --- ## Article 8 — Back-ups, Data Return and Migration upon Termination **Statutory basis:** Articles 6:248 BW (Dutch Civil Code); 6:271 BW (Dutch Civil Code). ### 8.1 Back-up policy 8.1.1 Rule Step makes, for Customers with hosting services, automated back-ups according to the 3-2-1 principle: three copies, on two different media, one of which off-site. The back-up frequency and retention period are stated in the SLA (Art. 8). 8.1.2 Back-ups are intended exclusively for business continuity and disaster recovery. The Customer is deemed to himself maintain additional back-ups for critical data. ### 8.2 Data return upon termination 8.2.1 Upon termination of the hosting services, for whatever reason, the Customer may request export of his data. Rule Step enables the Customer to export his data, during a period of thirty (30) days after termination, in a structured, commonly used and machine-readable format. 8.2.2 After expiry of the period referred to in paragraph 8.2.1, the customer data will be securely deleted, in accordance with the Data Processing Agreement (DPA Art. 9). Insofar as Rule Step still maintains back-ups, these will likewise be deleted or anonymised within ninety (90) days after termination. 8.2.3 If the Customer requests assistance with data return after termination outside the period referred to in paragraph 8.2.1, Rule Step may charge a reasonable fee for the recovery work. ### 8.3 Migration assistance [free reasonable assistance upon termination of hosting services] 8.3.1 If Rule Step terminates the hosting services (for whatever reason that is attributable to Rule Step), Rule Step shall, upon termination, provide the Customer with reasonable assistance with migration to another provider, up to a maximum of four (4) hours of work per Customer without extra costs. This assistance comprises the provision of data export, the answering of technical questions about the existing configuration, and the granting of access to DNS and other technical data that are necessary for a smooth transition. 8.3.2 Additional migration assistance above the four hours referred to in paragraph 8.3.1 will be invoiced on the basis of the applicable hourly rate. ### 8.4 Costs of transfer for domains 8.4.1 Upon termination of domain name registrations, any transfer costs of the upstream registrar or registry shall be borne by Rule Step, unless the termination is the result of non-payment or AUP violation by the Customer. --- ## Article 9 — Intellectual Property (Online Services) **Statutory basis:** AW Art. 13; Auteurswet 1912 [Dutch Copyright Act 1912]. ### 9.1 Customer content 9.1.1 The Customer retains all intellectual property rights in the content, software and materials placed by him on the hosting infrastructure. Rule Step makes no claim to these rights. 9.1.2 The Customer grants Rule Step a non-exclusive, worldwide, non-transferable licence to process the content of the Customer solely insofar as necessary for the performance of the agreement (storage, transmission, back-up). This licence ends upon termination of the agreement, without prejudice to the retention obligations in back-ups (article 8.2.2). ### 9.2 Domain name registration rights 9.2.1 The Customer is the rights holder of the domain name registration rights insofar as these belong to the Customer according to the policy of the relevant registry. Rule Step provides exclusively registration services and makes no claim to intellectual property rights in the registered domain names. ### 9.3 Rule Step tooling 9.3.1 Rule Step retains all intellectual property rights in its own hosting platforms, management tools, templates and working methods that are made available to the Customer. --- ## Article 10 — Liability (Online Services) **Statutory basis:** AW Art. 9 and 10. ### 10.1 Liability cap 10.1.1 The liability of Rule Step under online services is limited in accordance with AW Art. 9 (12-month rolling cap + EUR 50.000 absolute cap for B2B; mandatory statutory minimums for B2C). ### 10.2 Specific exclusions 10.2.1 Without prejudice to AW Art. 9.3, Rule Step is not liable for: (a) damage arising from domain names not being available, or not being available in time, due to the actions of registries (such as ICANN, SIDN), upstream registrars or other third parties; (b) damage as a result of loss of domain names caused by actions of the relevant registry, unless there is intent or deliberate recklessness on the part of Rule Step; (c) [B2B] damage as a result of the loss or corruption of data, unless the Customer demonstrates that the loss is the result of prior intent or deliberate recklessness on the part of Rule Step. 10.2.2 [B2C] The exclusion of liability for the loss or corruption of data is legally valid only insofar as the Consumer also has a reasonable opportunity to regularly make back-up copies, in accordance with article 6:231 et seq. BW (Dutch Civil Code). ### 10.3 Exclusion of indirect damage 10.3.1 The exclusion of indirect damage applies in accordance with AW Art. 10, with due observance of the limitations for B2C. --- ## Article 11 — Force Majeure (Online Services) **Statutory basis:** AW Art. 11; 6:75 BW (Dutch Civil Code). ### 11.1 Service-specific force majeure 11.1.1 Without prejudice to AW Art. 11.2, the following are regarded as force majeure in the context of online services: (a) failures at data centres of hosting partners (Germany and other EEA [European Economic Area] countries); (b) failures at upstream providers and network backbone suppliers; (c) failures, actions and decisions of domain name registries, including ICANN, SIDN and other gTLD and ccTLD registries; (d) failures at upstream registrars (Realtime Register, TransIP, Gandi.net) which prevent the domain name registration, renewal or transfer; (e) failures in payment traffic whereby payment processing is impossible. ### 11.2 Consequences 11.2.1 The consequences of force majeure (suspension, 90-day period, B2C dissolution) are laid down in AW Art. 11.3. --- ## Article 12 — Applicable Law, Forum and Disputes (Online Services) **Statutory basis:** AW Art. 15 and 16; Brussels I bis; UDRP; SIDN Dispute Resolution Regulations (Geschillenregeling). ### 12.1 Applicable law 12.1.1 Dutch law applies to online services, with due observance of the mandatory policy of ICANN and the relevant registry, insofar as this policy is mandatorily prescribed. ### 12.2 Forum 12.2.1 For B2B, the competent court in the arrondissement [judicial district] in which Rule Step B.V. has its statutory seat (Amsterdam) is competent. For B2C, the Consumer retains the choice of the court of his place of residence (AW Art. 16.2). ### 12.3 UDRP and SIDN disputes 12.3.1 Domain name disputes that fall under the Uniform Domain-Name Dispute-Resolution Policy (UDRP) of ICANN for gTLDs, or under the Dispute Resolution Regulations (Geschillenreglement) of SIDN for .nl domains, are settled separately in accordance with the applicable procedures, without prejudice to the right of the Customer to bring the matter before the competent court. --- ## Article 13 — Final Provisions ### 13.1 Precedence 13.1.1 In the event of conflict between these Supplementary Terms and Conditions, the General Terms and Conditions and the Order Form, the hierarchy of AW Art. 1.4 applies. In the event of conflict with mandatory registry terms, the latter prevail. ### 13.2 Nullity 13.2.1 If one or more provisions of these Supplementary Terms and Conditions are null and void or voidable, the remaining provisions remain in full force. --- ## Execution These Supplementary Terms and Conditions Online Services have been adopted by the management board (bestuur) of Rule Step B.V. and enter into force on 30 September 2026. Place: Amsterdam, the Netherlands Date: 30 September 2026 ________________________________________ **J.J. van Grondelle** Director (alleen/zelfstandig bevoegd [solely/independently authorised]) --- *For questions about these Supplementary Terms and Conditions Online Services: hello@rulestep.com* *For notice-and-takedown: abuse@rulestep.com* *For privacy: privacy@rulestep.com*