This is a translation. The authentic version is the Ukrainian one (https://www.zevshost.net/legal/abuse). In case of discrepancy, the Ukrainian text prevails.
1.1. This Annex sets out how the Provider handles reports of infringements committed using resources provided to Customers, and how measures are applied.
1.2. The Provider handles reports under two independent procedures:
| Procedure | Basis | Section |
|---|---|---|
| A. Copyright | Article 56 of the Law of Ukraine «On Copyright and Related Rights» — a formalised procedure with mandatory statutory deadlines | Section 3 |
| B. General abuse procedure | The Agreement and Annex 1 — all other infringements | Section 4 |
1.3. A report that does not meet the formal requirements of Article 56 may be left without consideration under Procedure A, but this does not release the Provider from considering it under Procedure B where the report discloses indications of a breach of the Agreement.
1.4. Single intake point: abuse@hostvds.net. Postal address: 01021, м. Київ, вул. Мечникова, буд. 8, кімн. 22, Печерський район.
1.5. Every report is assigned a unique reference. The reporter receives an automatic acknowledgement with the reference and the procedure under which the report will be handled.
1.6. All periods run from actual receipt of the report, Kyiv time (Europe/Kyiv), and do not pause on weekends or public holidays, except for periods expressly expressed in business days.
| Class | Examples | Initial response | Measures |
|---|---|---|---|
| P0 — critical | Child sexual abuse material; an active cyberattack from our resources; indications of activity under Art. 255⁴ of the Criminal Code | within 1 hour | Immediate shutdown, preservation of evidence, notification of law enforcement |
| P1 — high | Phishing, malware, C2 panel, ongoing spam campaign | within 4 hours | Content blocking or suspension, demand to the Customer |
| P2 — medium | Copyright infringement, content complaints, amber-category AUP breaches | within 24 hours | Procedure A or a demand to the Customer with a set deadline |
| P3 — low | Contested content, load complaints, yellow category | within 3 business days | Correspondence, demand to remedy |
2.1. The Provider determines the class on the basis of the report's content. The reporter may suggest a class, but this is not binding on the Provider.
2.2. The Provider is under no obligation to carry out general monitoring of Content (clause 6.3 of the Agreement). The duty to act arises upon receipt of a report containing sufficient information to identify the infringement.
This procedure fully reproduces the mechanism of Article 56 of the Law of Ukraine «On Copyright and Related Rights». The deadlines in it are mandatory and cannot be varied by agreement of the parties.
A takedown notice submitted directly to the Provider as a hosting service provider is accepted for consideration only if all of the following are satisfied:
3.1.1. Grounds for approaching the Provider (part seven of Article 56). Such grounds are: - the website owner failed to take, or took only in part, the actions required by parts three, five or six of Article 56; or - the website and WHOIS contain no information about the website owner sufficient to approach them.
The notice must substantiate the existence of such grounds. In the first case it must additionally state when the notice was sent to the website owner, when the owner should have acted, and how the claimant established the owner's contact details.
3.1.2. Submission through a representative. The notice is submitted solely through an attorney (advocate) or an intellectual property representative (patent attorney), with a copy of the document evidencing their authority.
3.1.3. Content of the notice (paragraphs 1, 4, 5, 7 of part two of Article 56):
1) claimant identification details: name, place of residence or registered address,
email or postal address; for legal entities — registration details, register
particulars, registration number;
2) a hyperlink to the digital content or to the web page through which access was
interactively provided;
3) a demand to disable access to the digital content and/or to prevent its further
placement;
4) a statement by the claimant that the information is accurate and that the
existence of the rights has been verified by the attorney or patent attorney
through whom the notice is submitted.
3.1.4. Form of the notice (part fourteen of Article 56): - paper — bearing the handwritten signature of the attorney or patent attorney, sent by registered mail with acknowledgement of receipt; or - electronic — bearing a mandatory qualified electronic signature of the attorney or patent attorney, with a simultaneous unsigned plain electronic copy sent to the same address.
Note. If the QES-signed notice differs in content from the plain electronic copy sent to the same addressee, the notice is deemed not submitted.
| Step | Provider's action | Deadline |
|---|---|---|
| 1 | Leaving the notice without consideration, stating the ground (where grounds under 3.3 exist) | 24 hours |
| 2 | Sending the Customer a copy of the notice with an explanation of its rights, obligations and the consequences of inaction | 24 hours |
| 3 | Awaiting the Customer's action | 24 hours from dispatch of the copy |
| 4 | Disabling access to the content itself if the Customer has not acted | immediately after step 3 expires |
| 5 | Notifying the claimant and the Customer of the measures taken | 48 hours from receipt of the notice |
| 6 | Forwarding the claimant a copy of the Customer's refusal | 48 hours from receipt of the refusal |
| 7 | Restoring access if the claimant has not supplied confirmation that court proceedings have been commenced | 10th business day from dispatch of the copy of the refusal to the claimant |
The Provider leaves a notice without consideration (part eight of Article 56), notifying the claimant within 24 hours and stating the legal ground, where:
1) the notice does not meet the requirements of part seven of Article 56 (clause 3.1
of this Annex);
2) the Provider does not provide services or resources for hosting the website
concerned;
3) the claimant approached the Provider in the absence of the grounds under part
seven of Article 56.
Upon receiving a copy of the notice from the Provider, the Customer must within 24 hours:
The only permissible grounds for refusal are (part four of Article 56):
1) the Customer holds the right to use the content and provides documentary evidence
(unless it is the primary rightsholder);
2) the notice does not comply with the requirements of Article 56.
The Customer's inaction results in the Provider blocking the content itself. The Provider bears no liability to the Customer for this (part two of Article 57 of the Law).
The Provider disables access solely to the digital content identified in the notice. Access to an entire web page is restricted only where disabling access to the individual content item is technically impossible (part thirteen of Article 56).
The notification sent to the claimant contains (part twelve of Article 56): - details of the Provider; - the full information about the Customer provided by it to the Provider, without any change or distortion: full name, address of residence (registered address), correspondence address, telephone number, email address and any other contact information available; - a copy of the Customer's refusal, if one was received.
The Customer is hereby informed and agrees that, where a notice under Article 56 is submitted in respect of it, its contact details will be passed to the claimant to the extent expressly prescribed by law. This constitutes a lawful basis for processing personal data and does not require separate consent.
A claimant is liable for supplying knowingly false information about holding property rights. The Provider records instances of false notices and may take them into account when assessing further reports from the same claimant; the Customer may claim damages directly from the claimant.
A report is considered if it contains:
1) the reporter's contact details (name, email address);
2) precise identification of the resource: IP address, domain name, URL;
3) a description of the infringement;
4) evidence: logs with timestamps and time zone, full email headers, screenshots,
malware samples;
5) the date and time of detection with the time zone.
4.1.1. Anonymous reports are considered where they contain sufficient evidence for the Provider to verify independently. This applies above all to P0 and P1 reports.
4.1.2. Automated reports from recognised organisations (Spamhaus, CERT-UA, Shadowserver, APWG, IWF, NCMEC, national CERTs, domain registrars) are accepted in X-ARF format or in the sender's own format without additional requirements.
Step 1. Registration and classification — within the initial response time under Section 2.
Step 2. Verification. The Provider verifies the infringement using available technical means (requesting the public URL, analysing network traffic, checking node system logs). The Provider does not access the Customer's Content beyond what is necessary for verification and does not access private data without the grounds set out in clause 15.4 of the Agreement.
Step 3. Measures.
| Class | Action |
|---|---|
| P0 | Immediate suspension of the Service (clause 12.3 of the Agreement). Preservation of evidence under clause 8.5 of the Agreement. Notice to the Customer within 24 hours. Notification of law enforcement under Annex 6 |
| P1 | Blocking the specific resource or suspending the Service. Immediate notice to the Customer with a demand to remedy within 24 hours |
| P2 | Demand to the Customer to remedy within 24–72 hours depending on the nature of the issue. On failure — suspension under clause 12.2 of the Agreement |
| P3 | Demand to the Customer with a reasonable deadline, normally 5 business days |
Step 4. Response to the reporter — on the measures taken or on refusal with reasons:
| Class | Response deadline |
|---|---|
| P0 | 24 hours |
| P1 | 48 hours |
| P2 | 5 business days |
| P3 | 10 business days |
Step 5. Closure with the outcome recorded in the register under clause 10.6 of Annex 1.
4.3.1. Reports disclosing indications of the activity described in Section 3 of Annex 1 are handled as class P0 regardless of the source of the report.
4.3.2. The moment such a report is received is recorded to the minute and constitutes the moment the Provider acquired information about possible unlawful activity. From that moment all of the Provider's actions are logged.
4.3.3. Sequence of actions:
1) immediate suspension of the Service without prior notice;
2) preservation of system logs, network data and, where technically feasible, an
image of the virtual server — for 90 days (clause 8.5 of the Agreement);
3) recording in the register: the time information was received, the source, its
content, the measures taken, the time of each action, and the officer who took the
decision;
4) notice to the Customer within 24 hours demanding an explanation within 3 business
days (clause 8.2 of the Agreement);
5) notification of law enforcement under Annex 6;
6) as a result: restoration of the Service if the suspicion is not confirmed, or
termination of the Agreement under clause 8.4 of the Agreement.
Why this matters. Part three of Article 255⁴ of the Criminal Code of Ukraine establishes liability for supplying services to a fraudulent organised group by a person who was aware of the unlawful nature of its activity. The Provider cannot be aware of what it does not know; but once reliable information has been received, inaction becomes evidence of awareness. That is why the response must be immediate and documented.
4.3.4. A Provider that voluntarily informs a law enforcement authority of the creation or activity of such an organised group and actively assists in exposing the persons involved relies on the ground for release from criminal liability provided by part seven of Article 255⁴ of the Criminal Code of Ukraine.
4.4.1. The Provider may decline to consider reports that: - are submitted systematically and are manifestly unfounded; - are aimed at unfair competition or at pressuring the Customer; - concern a dispute about rights that must be resolved by a court (for example, a dispute over domain ownership or the content of a publication).
4.4.2. The Provider is not an arbiter in disputes about the content of information. Where the assessment of content is contested (defamation, disputes about honour and dignity, value judgments), the Provider acts only on the basis of a court decision or another binding decision.
In practice this is the most common scenario for dedicated servers: the complaint reaches not the Provider but the Infrastructure Operator — OVHcloud, Hetzner, Scaleway, WorldStream, MevSpace, myLoc — which then gives the Provider its own, usually very short, deadline to act.
4.5.1. A demand from an Infrastructure Operator is handled at class P1 or higher regardless of the content of the complaint, and at class P0 where indicators under Section 3 of Annex 1 are present.
4.5.2. Shortened deadlines. The period allowed by the Infrastructure Operator is decisive and prevails over the periods set out in Section 4 of this Annex. The Customer is allowed:
| Period allowed by the Operator | Period given to the Customer |
|---|---|
| up to 4 hours | 1 hour |
| 4 to 12 hours | 4 hours |
| 12 to 24 hours | 8 hours |
| over 24 hours | the general rules of Section 4 apply |
The remaining time is used by the Provider to verify remediation and respond to the Operator. If the Customer has not remedied the breach within the period allowed, the Provider suspends the Service under clause 12.3.7 of the Agreement so as to prevent the Operator from shutting the equipment down.
4.5.3. Where the period allowed by the Operator does not permit advance notice to the Customer, the Provider suspends the Service immediately and notifies the Customer within 24 hours (clause 12.3 of the Agreement).
4.5.4. Disclosure to the Operator. To process the complaint the Provider passes the Infrastructure Operator the information needed to evidence the measures taken and, upon the Operator's express demand supported by its own rules, also the Customer's identification and contact details. The legal basis is performance of the contract and legitimate interest (Annex 4).
4.5.5. The Provider cannot override an Infrastructure Operator's decision to shut equipment down. In such a case the Provider takes reasonable steps to restore the Service or migrate it to another platform (clause 5.10 of the Agreement), and the Provider's liability to the Customer is governed by clause 13.9 of the Agreement.
4.5.6. If the Infrastructure Operator's demand proves unfounded, the Provider restores the Service and extends the paid period by the duration of the suspension (clause 12.6 of the Agreement).
5.1. The Customer may send a reasoned objection to the measures taken to abuse@hostvds.net, quoting the report reference.
5.2. The Provider reviews the objection within 3 business days (for class P0 — within 24 hours).
5.3. If the objection is well-founded, the Provider restores the Service and extends the paid period by the duration of the suspension (clause 12.6 of the Agreement).
5.4. For Procedure A the objection process is governed by clause 3.4 of this Annex and has mandatory statutory deadlines.
6.1. The Provider publishes an annual transparency report with anonymised statistics: - number of reports by class and category; - number of measures applied; - number of services restored following objections; - number of state authority requests and number complied with (Annex 6).
6.2. The report is published at /legal/transparency no later than 31 March of
the year following the reporting year.
| Purpose | Address |
|---|---|
| All complaints and abuse reports | abuse@hostvds.net |
| Notices under Article 56 of the Law «On Copyright and Related Rights» | abuse@hostvds.net |
| Law enforcement requests | admin@zevshost.net or abuse@hostvds.net |
| Customer technical support | support@zevshost.net |
| Postal address | 01021, м. Київ, вул. Мечникова, буд. 8, кімн. 22, Печерський район |
| Telephone | +380 44 233 50 44 |