# ANNEX 3 # CUSTOMER INFORMATION VERIFICATION POLICY to the Public Agreement (Offer) for the Provision of Hosting Services by LLC «HOST VDS» Version **1.0** of **17 September 2026** --- > **This is a translation.** The authentic version is the Ukrainian one > (). In case of discrepancy, the Ukrainian text prevails. ## 1. The governing rule **1.1.** **By default the Provider does not collect or store copies of documents proving the Customer's identity.** To conclude the Agreement and use the Services it is sufficient for the Customer to supply the information it enters itself at registration (clause 4.1 of the Agreement) and to confirm its contact details. **1.2.** The Provider requests documents supporting the information supplied **only in the cases expressly listed in Section 3 of this Annex** — principally where a law enforcement authority or a rightsholder has approached the Provider about the Customer, or another ground arises that requires the Provider to establish the Customer's identity. **1.3.** The scope of any request is always limited to what the specific ground requires. The Provider does not request documents «just in case». **1.4. Why it is done this way.** This is a deliberate choice, not a shortcut, and it rests on three provisions: 1) **Part four of Article 7 of the Law of Ukraine «On Electronic Commerce»:** a seller «має право вимагати від іншої сторони **лише такі відомості, без яких укладення та виконання зобов'язань за електронним договором неможливе**». Routinely collecting passport copies from every Customer does not meet that test. 2) **Article 24 of the Law of Ukraine «On Personal Data Protection»** and Article 32 of Regulation (EU) 2016/679 require security measures appropriate to the risk. Identity documents are among the most sensitive categories of data. Holding them without appropriate technical safeguards is more dangerous for the Customer than not holding them at all. 3) **Part one of Article 57 of the Law of Ukraine «On Copyright and Related Rights»** requires the Provider to include in the contract the Customer's obligation to **state accurate information about itself** and to report changes without delay (clause 4.3 of the Agreement). What the law requires is that contractual obligation of the Customer, not continuous documentary checking by the Provider. **1.5.** The Provider is not a primary financial monitoring entity and does not carry out measures required by anti-money-laundering legislation. This Policy is purely contractual. --- ## 2. Three stages of verification ### Stage 1. Baseline check — all Customers, automatic, no documents | Check | Content | |---|---| | Email address | Confirmation by link or code | | Telephone number | Confirmation by one-time code | | Payment instrument | Successful payment authorisation; payer name matching Account data | | Technical signals | Registration IP address, time zone, indications of anonymising services — recorded, but not in themselves grounds for refusal or for a document request | No documents are requested at this stage. ### Stage 2. Purpose declaration — no documents Applied where risk indicators are triggered (Section 4). The Customer provides a written explanation in the Client Area in the form set out in Section 5. **No document copies are requested at this stage.** ### Stage 3. Documentary verification — only on the triggers in Section 3 Applied **solely** where one of the grounds listed in Section 3 exists. The scope is the minimum that ground requires. Handling of documents is governed by Section 7. --- ## 3. Triggers for documentary verification **3.1.** The Provider may request documents supporting the information supplied by the Customer **only where one of the following grounds exists**: 1) **an approach by a law enforcement authority, a court or another authorised body** concerning the Customer, its Service or its Content; 2) **a copyright takedown notice** submitted under Article 56 of the Law of Ukraine «On Copyright and Related Rights», or another substantiated rightsholder complaint whose handling requires the Customer's identity to be established; 3) **a demand from an Infrastructure Operator** supported by its own rules (clause 5.9 of the Agreement; clause 4.5.4 of Annex 2); 4) **reasonable suspicion of a breach of Section 8 of the Agreement**, as defined in clause 8.3 of the Agreement; 5) **indications that the information supplied by the Customer is inaccurate**, where this prevents the Provider from discharging its duty under part twelve of Article 56 of the Law of Ukraine «On Copyright and Related Rights» (to pass the Customer's contact details to a claimant without change or distortion): correspondence repeatedly undelivered, the telephone number unreachable, the payer's name repeatedly not matching Account data without explanation; 6) **an express requirement of law** or a binding decision of an authorised body. **3.2.** This list is **exhaustive**. Documents are not requested on any other basis — in particular not merely because of the order value, the tariff plan chosen or the Customer's country. **3.3.** A request states: the documents required, **the ground from the list in clause 3.1**, the deadline and the consequences of non-compliance. The Customer is not obliged to act on a request that does not state its ground. --- ## 4. Risk indicators > Triggering an indicator is **not a ground for requesting documents**. It is a > ground for a purpose declaration (Stage 2) and for closer attention to the > Service. Documents are requested only on the triggers in Section 3. ### 4.1. Standard indicators | No. | Indicator | |---|---| | R-01 | Mismatch between payer name and Account data | | R-02 | Registration using a disposable email address | | R-03 | Refusal to provide a telephone number, or a number that does not accept calls | | R-04 | A new Customer ordering a large number of identical services | | R-05 | Payment on the Customer's behalf by a third party without explanation | | R-06 | Multiple Accounts sharing identical technical signals | | R-07 | Change of contact details shortly after registration | | R-08 | Discrepancy between the stated and the actual country of operation | ### 4.2. High-level indicators | No. | Indicator | |---|---| | H-01 | **Ordering a significant number of IP addresses without explaining their purpose** | | H-02 | **Ordering resources with a characteristic VoIP load profile** (large numbers of concurrent UDP sessions, SIP traffic) without any declared telecoms activity | | H-03 | **Ordering configurations typical of calling infrastructure**: many minimal-resource nodes, high outbound connection volume, no inbound traffic | | H-04 | The Customer previously had an Agreement terminated under clause 12.4 of the Agreement | | H-05 | Technical signals matching a previously blocked Account | | H-06 | Payment from instruments previously linked to confirmed breaches | | H-07 | Declared activity falls within the list in Section 8 of Annex 1 without the required approval | | H-08 | The Customer or related persons appear on sanctions lists | | H-09 | Receipt of a report concerning the Customer from a law enforcement body, CERT or recognised organisation | | H-10 | Content imitating third-party brands hosted on the Customer's resources | **4.3.** Triggering any indicator in list 4.2 makes a purpose declaration mandatory (Stage 2). Indicators H-08 and H-09 are at the same time triggers for documentary verification under sub-clauses 1 and 6 of clause 3.1. **4.4.** The Provider records the triggering of each indicator in the Account with the date, time and source. That record forms part of the evidence base of the Provider's good faith and **contains no personal data of third parties**. --- ## 5. Purpose declaration **5.1.** The declaration is submitted in the Client Area and contains: 1) a description of the activity for which the Service is ordered; 2) a list of domain names to be hosted (if any); 3) whether bulk mailings are planned; if so, a description of the source of the address list and of the consent mechanism; 4) whether services will be provided to third parties (reselling, VPN, file sharing, mail services); if so, a description of the complaints handling mechanism; 5) whether telephony, VoIP or auto-dialling systems will be used; if so, a description of the purpose, the source of numbering capacity and confirmation that subscribers have consented to being called; 6) confirmation of having read Section 3 of Annex 1 and an undertaking not to engage in the activity described there. **5.2.** The declaration is signed by electronic signature with a one-time identifier (Article 12 of the Law of Ukraine «On Electronic Commerce»). **5.3.** **Providing a knowingly false declaration is a material breach of the Agreement** and a ground for termination under clause 12.4.4 of the Agreement. **5.4.** The declaration contains no document copies and is retained for the term of the Agreement and **3 years** thereafter. --- ## 6. Deadlines and consequences **6.1. Deadlines:** | Situation | Deadline | |---|---| | Purpose declaration | **3 business days** | | Documents on a trigger under Section 3 | **5 business days** | | Documents on a trigger arising from an authority's or Operator's demand with a shorter deadline | **the deadline stated in that demand** | | Confirmation that contact details remain current | **10 business days** | **6.2.** The deadline may be extended on the Customer's reasoned request, except where it is set by an authorised body's or an Infrastructure Operator's demand. **6.3. Consequences of non-compliance:** | Situation | Consequence | |---|---| | Purpose declaration not provided | Suspension of the Service (clause 12.2 of the Agreement) with at least 24 hours' warning | | Documents not provided on a Section 3 trigger | Suspension (clause 12.2); on the trigger in sub-clause 4 of clause 3.1 — suspension under clause 8.3 of the Agreement | | Not remedied within 30 days of suspension | Termination of the Agreement (clause 12.4.3) | | Knowingly false documents or declaration provided | Termination (clause 12.4.4); treatment of funds — clause 13.10 of the Agreement | **6.4.** The Provider reviews submitted documents within **2 business days** and notifies the Customer of the outcome. On a positive outcome, restrictions are lifted immediately. **6.5.** If a verification-related suspension proves unjustified, the paid period is extended by the duration of the suspension (clause 12.6 of the Agreement). --- ## 7. Handling documents: verify, do not retain > This is the key Section. The Provider deliberately does not build an archive of > identity documents. **7.1. Procedure.** Documents are submitted through a secure form in the Client Area (not by email and not through messengers), are checked by an authorised officer of the Provider, and **are deleted once the check is complete**. **7.2. What remains.** In place of the document the Provider keeps a **record of the check**, stating: the date and time of the check; the ground from the list in clause 3.1; the type of document presented (without its number and without a copy); the outcome — whether the details matched the Account data; and the officer who carried out the check. That record is kept for the term of the Agreement and **3 years** thereafter. **7.3. When a document is nevertheless retained.** Only where its retention is expressly required by law or by an authorised body's demand (in particular a data preservation demand under clause 8.5 of the Agreement). In that case the document is stored **encrypted**, with restricted access, for the period stated in the demand, and is destroyed immediately once that period ends. The Customer is notified of such retention in the manner set out in clause 16.3 of the Agreement, save where notice is prohibited. **7.4. Minimising scope.** The Provider accepts documents with redacted details that the particular ground does not require — in particular the document number, place of birth, and information about marital status and children. It is enough that the name is legible and that the document is valid. **7.5. Access.** Only staff authorised to carry out verification have access to the submission form and to the records of checks. Every access is logged. **7.6. Disclosure to third parties.** Documents and records of checks are not disclosed to third parties. Exceptions: the cases set out in Section 16 of the Agreement and Annex 6; disclosure to an Infrastructure Operator under clause 7.7 of this Annex. **7.7. Disclosure to an Infrastructure Operator.** Upon the express demand of an Infrastructure Operator supported by its own rules, the Provider passes it the **identification and contact details** of the Customer whose Service is hosted on that Operator's equipment — to the extent necessary to process a complaint or comply with an authorised body's demand. **Document copies are not passed to Infrastructure Operators** unless expressly required by a binding decision of an authorised body. The Customer is notified in the manner set out in clause 16.3 of the Agreement. **7.8. The legal basis for processing** is the necessity of performing the contract and compliance with the Provider's obligation under part one of Article 57 of the Law of Ukraine «On Copyright and Related Rights» (Article 11 of the Law of Ukraine «On Personal Data Protection»; for data subjects in the EU — Articles 6(1)(b) and 6(1)(c) GDPR). Detailed processing terms are set out in Annex 4. --- ## 8. Keeping contact details current **8.1.** The Customer must keep its contact details current (clause 4.3 of the Agreement). Once a year the Provider automatically invites the Customer to confirm them in the Client Area. **8.2.** Repeat documentary checks are **not carried out**. Documents are requested again only when a new trigger under Section 3 arises. --- ## 9. Appeals **9.1.** The Customer may appeal a verification requirement, the scope of documents requested, or the outcome, by sending a reasoned objection to support@zevshost.net. **9.2.** The objection is reviewed within **3 business days** by an officer who did not take the contested decision. **9.3.** If the Customer considers the scope of information requested excessive having regard to part four of Article 7 of the Law of Ukraine «On Electronic Commerce», it may demand that the list be reduced. The Provider must either justify each document by reference to a ground in clause 3.1, or reduce the list.