Acceptable Use Policy
UNPUBLISHED DRAFT · legal-review-2026-10-22 · For legal review; not an active policy. Open decisions: ../REVIEW-NOTES.md. Translations do not certify national compliance; no prevailing language has been designated.
A01. Scope and provider
These rules cover professional use of enabled modules by the business and its authorised users. Proposed provider: [ФИРМА], company identification number [ЕИК], [СЕДАЛИЩЕ И АДРЕС], represented by [ПРЕДСТАВИТЕЛ], VAT number [ДДС НОМЕР, АКО Е ПРИЛОЖИМО]. Contact: [КОНТАКТЕН ИМЕЙЛ]; personal data: [КОНТАКТ ЗА ЛИЧНИ ДАННИ]. The rules do not make the provider the seller of the business's goods.
A02. Lawful content and customer relationships
The business publishes only content for which it has rights and the necessary basis. Illegal offers, fraudulent orders/reservations, fabricated ratings, voucher and points abuse, impersonation and misleading prices or terms are prohibited. The business is responsible for its product information, allergens, consumer rights and applicable fiscal duties. A software feature does not certify their legal fulfilment.
A03. Security and resources
Unauthorised access, attempts to cross business boundaries, extraction of others' data, malicious code, limit circumvention and availability disruption are prohibited. Security testing requires prior written authorisation and an agreed scope. Passwords, PINs and session tokens must be protected; departing staff access must be revoked. Sharing that undermines individual permissions and accountability is not allowed.
A04. Data and messages
Customer data and loyalty history must not be used for incompatible purposes, unlawful monitoring or unsolicited communications without the required basis. Special categories or identity documents must not be uploaded without a separately approved basis and protection. Marketing, operational notifications and browser push permission are distinct. Twilio is a planned integration and these rules do not announce an available SMS service.
A05. Reports and measures
Reports may be sent to [КОНТАКТЕН ИМЕЙЛ] with a description, relevant identifiers and contact details, without unnecessary personal data or public disclosure of vulnerabilities. Proposed measures include clarification, requests to correct, restrictions on specific content/access and suspension where necessary. They must be proportionate; where permissible, the business receives reasons and an opportunity to challenge. An immediate risk or legal prohibition may require immediate action.
A06. Open procedures
Specific response periods, appeal procedures and effects on fees/data are not agreed; they must be finalised with the terms. DSA and P2B applicability depends on the actual model and requires separate assessment. No continuous monitoring or assurance that every abuse will be detected is promised. Authorities' lawful powers and affected persons' rights are preserved.