Nearoute Limited General Terms of Service

Effective date: 2026.9.28
Last updated: 2026.10.3

These General Terms of Service (the Terms) govern the data-centre, Internet data centre (IDC), Internet service provider (ISP), hosting, computing, equipment, connectivity, and Internet number resource services supplied by Nearoute Limited, a company incorporated in the Hong Kong Special Administrative Region of the People's Republic of China (Nearoute, we, us, or our).

They apply to Services contracted through nearoute.com, vps.nearoute.com, other Nearoute-operated ordering channels, or an accepted written quotation, service order, or agreement. The websites and customer portals are together the Websites, and individually a Website. A listing of a service category does not mean every feature or location is available or included in every Order.

The company-wide scope of this revision includes cloud and VPS services, dedicated and rented servers, customer-owned server colocation, cabinet and rack-space rental, power and cross-connect services, remote hands and agreed managed services, IP Transit, network bandwidth and capacity, private or point-to-point connectivity where ordered, IP address leasing, and permanent transfers of IP address registration rights. Sections 1 to 25 contain the general terms; Schedules A to E contain the terms for particular Services.

Important service conditions

• Illegal and criminal use is prohibited across all Services. The legal compliance and acceptable use provisions apply to customers, authorised users, and relevant downstream use.

• The Order determines what you buy. Capacity, locations, handover points, charges, minimum commitments, renewal arrangements, and any SLA must be agreed for the relevant Service. A cabinet does not automatically include power, and a port speed does not automatically guarantee Internet throughput.

• Retail Cloud Services retain their specific payment rules. Available Account balance is used for renewal; unpaid Services are suspended; affected virtual servers are scheduled for permanent deletion 72 hours after non-payment suspension. These rules do not authorise disposal of customer-owned equipment or reversal of a completed IP transfer.

• Backups are not included by default. An expressly purchased backup or managed service is governed by its agreed scope.

• Voluntary refunds are for verified service quality problems only, unless an accepted Order expressly offers another remedy. Mandatory rights, payment corrections, deposits, and repayment for undelivered Services are treated separately.

• Lawful investigations may require disclosure or preservation of relevant data. The verification and evidential safeguards in Section 13 apply.

This revision does not retrospectively replace an existing signed agreement or impose new duties on a completed transaction. Its application to existing Orders is subject to the agreed amendment process and Section 23.

1 The agreement and its scope

1.1 Services means the specific data-centre, hosting, equipment, network, IP resource, or related services accepted in an Order. Order means an accepted quotation, service order form, statement of work, online order, or other written service specification identifying the supply and commercial terms. Account means a customer account or billing relationship with Nearoute, whether or not a self-service portal is used. Customer Data means information, software, files, configurations, and content stored, transmitted, or otherwise processed in connection with your Services.

1.2 Customer Equipment means hardware you own or are entitled to place in a facility. Nearoute Equipment means hardware supplied for use or rental by us or our suppliers, without a separate agreed transfer of ownership. Retail Cloud Services means standard prepaid VPS or cloud-server subscriptions ordered through our self-service platform, unless a separately negotiated Order expressly provides otherwise. IP Resources means IP address blocks and associated registration, use, or routing permissions identified in the Order; a right to use an address during a service term is distinct from a permanent registry transfer.

1.3 You accept these Terms by affirmative acceptance in an ordering process or by signing or otherwise expressly accepting an Order that incorporates them. Merely visiting a Website, making an enquiry, receiving a quotation, or receiving an unaccepted invoice does not create a paid commitment. An Order becomes binding when accepted by both parties through the stated process or confirmed by our authorised representative. Any service-commencement or acceptance procedure in the Order then applies.

1.4 The agreement includes these Terms and the applicable Schedules, the accepted Order, any expressly applicable service level agreement (SLA), our Acceptable Use Policy (AUP) provided as part of contracting, and any separately signed master agreement. Mandatory law prevails. Subject to it, a signed master agreement prevails unless it expressly permits an Order to vary the relevant provision; the accepted Order then prevails over the relevant Schedule and the general Terms for the matters it expressly addresses. A relevant Schedule prevails over an inconsistent general provision on the same service-specific matter. An SLA governs its specified measurements and credits, without overriding non-excludable rights. No commercial document authorises unlawful use.

1.5 The AUP supplements Sections 8 to 12 and does not override the express commercial, consumer, privacy, or liability protections in this agreement. Our Privacy Policy and its Personal Information Collection Statement explain personal data handling; neither replaces a legally required data processing agreement or separate consent. Facility rules and material supplier restrictions must be identified or made available before contracting, except for subsequent lawful and proportionate emergency safety measures.

1.6 You and your mean the contracting customer. An individual accepting for an organisation must have authority to bind it. The agreement is with Nearoute Limited unless another contracting supplier is expressly identified and agreed. A subcontractor's involvement does not by itself turn Nearoute into a broker or release it from obligations undertaken as principal. Where we act only as a disclosed broker or agent for a particular transaction, the Order must identify that role, the principal, our own obligations, and any fee before acceptance.

1.7 These Terms apply to consumer and business customers according to their actual legal status. A service described as business, enterprise, dedicated, or wholesale does not by that label alone remove a customer's mandatory consumer rights. Only the Schedules relevant to the purchased Services apply; a mixed Order may engage more than one Schedule.

2 Eligibility accounts and authorised contacts

2.1 An individual contracting in their own name must be at least 18 and legally capable of entering the agreement, or older where applicable law requires it. An organisation must be lawfully entitled to obtain and use the Services, and its representative must have the required authority.

2.2 Provide accurate legal customer, contact, billing, and payment information and update material changes promptly. A customer using the retail portal may maintain one customer Account unless we approve additional Accounts. Agreed separate billing entities, enterprise Accounts, subaccounts, and authorised user profiles are permitted; they must not be used to conceal the true customer or evade restrictions.

2.3 We may request proportionate information to verify identity, payment authority, signatory authority, eligibility, ownership of equipment, or rights in IP Resources. We will explain the relevant purpose and handle personal data under Section 13 and the Privacy Policy. Do not submit passwords, private keys, or unnecessary identity documents through an unsecured channel.

2.4 An enterprise or facility customer must nominate appropriate billing, technical, security, and site-access contacts. A network customer must provide a reachable operational or abuse contact appropriate to the service, including an out-of-hours contact where agreed or necessary for urgent incidents. Tell us which contacts may authorise chargeable work, reboots, disconnections, equipment collection, route changes, or transfers. We may require additional verification for sensitive or irreversible instructions.

2.5 We may decline an unaccepted Order or restrict a Service where required verification is incomplete, supplied information is materially false, payment is unauthorised, or the supply would be unlawful. Money collected for an Order we decline before supply will be returned, subject to any lawful payment restriction and any separately authorised, actually performed work.

2.6 You must not sell or transfer an Account, misrepresent ownership or authority, or bypass a suspension through replacement Accounts. A contractual assignment, equipment transfer, or IP registry transaction must follow the applicable agreement and procedure; it is not effected merely by sharing portal credentials.

3 Account security and authorised users

3.1 You must protect your Account credentials, API tokens, root or administrator credentials, SSH keys, and recovery information. Use strong authentication and enable multi-factor authentication where available. Limit administrative access to people who need it.

3.2 You are responsible for instructions issued by authorised users and contacts and for taking reasonable steps to prevent unauthorised use of Accounts, access cards, management interfaces, and network control systems. Notify us promptly of suspected compromised credentials, unauthorised site access, or service activity and cooperate with reasonable containment measures. Sensitive equipment or registry instructions may require verification beyond possession of a login.

3.3 Providing another person with access does not release you from your obligations. You must require your users to follow the acceptable use restrictions and promptly address violations that you know, or reasonably ought to know, are occurring. Responsibility for unauthorised charges or losses will be determined under these Terms and applicable law; this section does not transfer responsibility for our own security failures to you.

4 Service scope delivery and responsibilities

4.1 We will supply the agreed Services with reasonable care and skill. The Order should identify the service category, quantities and specifications, location or endpoints, ownership of relevant equipment, delivery and handover requirements, price, billing basis, term, and any SLA. Only expressly included features are part of the supply. A requested category does not imply unlimited management, redundancy, insurance, power, network transit, or backup.

4.2 Unless expressly purchased, computing services are unmanaged: you administer guest operating systems, applications, licences, patches, access permissions, encryption, and backups. For Customer Equipment, you also maintain the equipment unless a maintenance service is agreed. For connectivity, the parties' responsibilities meet at the agreed physical or logical handover point. We remain responsible for infrastructure and tasks within our agreed scope.

4.3 Delivery may depend on payment, verification, capacity, site readiness, carrier installation, permissions, or registry approval. Dates are binding only to the extent agreed, but an estimate does not permit indefinite or unexplained delay. We will communicate material delay and available remedies. Customer-caused delay, reserved-capacity charges, and third-party non-cancellable costs apply only on a disclosed and accepted basis.

4.4 Retail Cloud billing starts when the Service is made available, unless its Order clearly states another lawful basis. For other Services, billing starts at the agreed ready-for-service or acceptance milestone. If no milestone is stated, it starts when the agreed Service is demonstrably available at the handover point and we notify you. A material failure to meet the agreed acceptance criteria must be addressed; an acceptance process may not remove rights concerning hidden defects or mandatory remedies.

4.5 Support and remote hands cover only the purchased tasks. Work outside that scope requires acceptance of its scope and charging basis before it begins. Emergency action necessary to protect people, equipment, or the network may be taken without advance approval, but does not authorise an undisclosed penalty or unrelated work charge. No general 24-hour staffing, response, repair, uptime, or restoration guarantee is created by these Terms.

4.6 You must use Services within agreed specifications and provide reasonable cooperation needed to deliver them. Shared capacity differs from expressly dedicated capacity. We cannot use a general shared-resource disclaimer to reduce a dedicated commitment. Site certifications, route diversity, dual-feed power, and protected capacity exist as contractual commitments only to the extent identified in the Order; these Terms do not assert a certification or licence we have not identified.

4.7 Services are not supplied as fail-safe systems for uses where interruption or malfunction could directly endanger human life or cause serious physical harm unless expressly agreed. Design application continuity, redundancy, and recovery arrangements appropriate to your use. This does not remove our own duty of reasonable care.

4.8 Nearoute must obtain and maintain authorisations required for the Services it actually undertakes to supply, and customers must obtain those required for their own activities. An Order does not grant a customer a telecommunications licence, a property interest in a data centre, or an unrestricted right to resell a regulated service. We will identify a material regulatory or supply limitation before acceptance where known.

5 Charges billing and deposits

5.1 Prices, currencies, taxes, billing intervals, and charging units must be disclosed before acceptance. Depending on the Order, charges may include recurring service or capacity fees, installation and cross-connect fees, hardware rental, power consumption, remote hands, excess usage, and IP transfer consideration. Retail Cloud Services are prepaid. Credit terms, invoicing in arrears, minimum commits, and staged payments for other Services apply only if agreed.

5.2 Metered or burstable billing must identify the measurement point, unit, period, direction or aggregation method, committed amount, and overage rate or other consequence. Section D4 addresses percentile bandwidth billing. Our records are the initial basis of measurement, not conclusive evidence immune from challenge. We will investigate a reasonable dispute and provide relevant records or a comprehensible calculation, subject to confidentiality and security restrictions.

5.3 Powering off a server, leaving a cabinet empty, disconnecting your device, advertising no routes, or using less than a committed capacity does not by itself cancel reserved Services or a minimum commitment. Charges continue on the agreed basis until the effective termination or expiry. Separately ordered facilities or carrier services must be cancelled under their own agreed terms.

5.4 Report billing errors promptly. We will investigate genuine disputes and correct confirmed overpayments, duplicate charges, or unauthorised payments as required. Undisputed properly due amounts remain payable. Raising a genuine dispute does not by itself establish fraud or authorise punitive enforcement. A reasonably contested charge must be assessed before being treated as established debt.

5.5 A fixed price for an agreed committed term will not be increased merely by posting a new price list. Agreed indexation, expressly accepted variable inputs, or changes required by law are handled under the Order. Otherwise, a recurring price increase requires at least 30 days' advance notice and must take effect at a permitted renewal or variation point. Notice must also allow a meaningful opportunity to exercise the applicable non-renewal right; a late notice cannot force a customer into an increased-price renewal it had no opportunity to decline.

5.6 Installation or third-party commitment costs are payable only if disclosed and accepted. If an Order is cancelled before delivery, any retained amount must correspond to an agreed lawful charge for work done or a substantiated non-recoverable commitment, taking account of mitigation and mandatory rights. Calling a fee non-refundable does not excuse non-performance or remove a mandatory remedy.

5.7 A security deposit is distinct from prepaid Account balance and an advance service payment. Its purpose, amount, permitted deductions, and return conditions must be agreed. We may apply it only to properly due sums or substantiated liabilities within those conditions, provide an accounting, and return any unused refundable amount within a reasonable time after settlement. A deposit is not automatically forfeited on termination.

5.8 You are responsible for charges imposed by your own payment provider or currency conversion arrangements. We will not add an undisclosed processing, reconnection, or administration charge. Charges for an expressly agreed minimum term or early termination remain subject to Section 6 and applicable law.

6 Terms renewal and cancellation

6.1 The Order must distinguish its initial term, any minimum service or capacity commitment, renewal term, required non-renewal notice, and cancellation process. A fixed commitment is not created merely because we issue an invoice. In the absence of an agreed automatic-renewal provision, a non-retail Order does not automatically renew into a new minimum commitment; any continued supply and charging basis must be agreed.

6.2 For Retail Cloud Services, available Account balance is automatically applied to the renewal invoice when renewal falls due, unless renewal has been cancelled beforehand. Sufficient balance renews the Service for its stated billing period. If balance pays only part, the remainder is due by the original deadline; partial payment does not extend it. For other Services, applying Account balance or renewing automatically requires the arrangement stated in the Order or a separate authorisation. Payment of an existing invoice does not itself extend a minimum term.

6.3 Account-balance renewal is distinct from automatic top-up or recurring collection from a card or bank account. Any external recurring payment mandate requires its own necessary authorisation. Cancellation should also address any separately established payment subscription so that further payments are not collected unintentionally.

6.4 Paid Account balance is advance credit for Services, not a deposit-taking or investment product. It earns no interest and is not transferable between customers without approval. Promotional credit and its disclosed conditions are separate. Paid balance cannot be treated as promotional credit or given an undisclosed expiry. Subject to the Order and mandatory law, change of mind or non-use alone does not create a cash-redemption right. We must nevertheless return funds that these Terms require to be returned, including amounts for Services we can no longer supply.

6.5 Renewal amounts and due dates must be communicated through the agreed billing channel; Retail Cloud customers receive a renewal or invoice reminder. Keep contact details current. We will comply with any legally required reminder or consent requirement. A business Order's advance cancellation deadline must be clearly disclosed, not introduced only on a renewal invoice.

6.6 Retail Cloud renewal can be stopped through the customer area's cancellation function or support if it is unavailable. A cancellation received before renewal prevents that renewal and ordinarily takes effect at the end of the paid period unless immediate termination is requested. For other Services, give written notice using the agreed channel and notice period. Unless the Order fixes a minimum term or another cancellation requirement, you may end a periodic Service at the end of its current billing period by notice received before that period ends.

6.7 An early-termination charge applies only if expressly agreed before the commitment and enforceable under applicable law. It must reflect the accepted commitment and applicable rules on compensation, mitigation, and penalties. We will not charge both the full future price and duplicative cancellation costs for the same loss. No early-termination charge applies merely because you exercise a mandatory right or terminate for an uncured material breach giving that right.

6.8 A downgrade, partial cancellation, relocation, circuit change, or capacity reduction may require a change Order. Existing commitments do not disappear solely because you request a change, but additional charges and a new term require agreement. Ending one Service does not automatically end others or reverse a completed IP transfer. Equipment return and IP lease termination follow the relevant Schedules.

7 Service quality complaints credits and refunds

7.1 Our voluntary service-fee refund policy covers verified service quality problems only, unless an accepted Order expressly provides a different refund or credit arrangement. There is no general trial or change-of-mind refund. Choosing an unsuitable specification, using less than reserved capacity, not needing a conforming Service, or finding a lower price elsewhere is not a quality defect. Mandatory rights and amounts repayable for other reasons remain protected.

7.2 A quality problem is a material failure within our responsibility to meet the Order or our service obligations. It may concern computing resources, rented hardware, agreed power or environmental conditions, service at a network handover point, an agreed management task, or a deliverable in an IP transaction. Applicable acceptance criteria and any SLA inform the assessment; absence of a percentage uptime promise does not excuse breach of an express specification.

7.3 A fault caused solely by your equipment, software, access network, configuration, unlawful use, or exceeding disclosed limits is not a quality failure attributable to us. Neither is a fault solely outside the agreed service boundary or an interruption solely excused by Section 21. These exclusions do not apply to the extent our failure contributed, conflict with an express commitment, or remove a mandatory remedy. A customer-owned disk failure and a failure of a disk we contracted to maintain must not be treated as the same allocation of responsibility.

7.4 Report an issue through the agreed support channel with the Service or circuit identifier, time and duration, observed symptoms, and available evidence. We may seek reasonable cooperation and explain our assessment. Do not disclose passwords or private keys unnecessarily. A refund cannot depend solely on an unsupported internal assertion that no fault exists.

7.5 We will, where appropriate, repair, repeat the affected work, replace failed rented equipment, re-provision, or provide an agreed equivalent within a reasonable time and without significant inconvenience. Materially recurring or unremedied failure, or a failure giving an immediate legal right, may entitle you to terminate the affected Service and receive the applicable refund. For a Service unusable throughout the paid period, a full service-fee refund for that period is appropriate; a partial-period failure is assessed by its duration and extent, with unused prepayments returned on a justified termination. More favourable mandatory remedies prevail.

7.6 An expressly applicable SLA may provide a specific service-credit process, calculation and claim period. For a business customer it may define an exclusive contractual credit remedy for a defined availability metric only if that limitation is expressly agreed, clear and legally enforceable. It does not silently replace remedies for different breaches, an undelivered service, or non-excludable obligations. Credits and damages for the same loss may be adjusted to avoid double recovery.

7.7 Approved monetary refunds will normally go to the original payment source; if that is not technically possible, we will agree a lawful alternative. We will not force Account credit in place of money you are entitled to receive. We will initiate an approved refund within 14 calendar days of approval or sooner if legally required. Provider processing time may be additional. No undisclosed administration charge will be deducted for our own failure.

7.8 Payment corrections, return of a refundable security deposit, refund of an unfulfilled Order, and repayment after our permanent inability to supply are not discretionary change-of-mind refunds. IP transfer completion, unsuccessful transfers, registry fees and any escrow release are addressed in Schedule E. Once a permanent transfer completes, a customer's change of mind alone does not require its reversal, but fraud, breach of an express assurance, or mandatory remedies remain actionable.

7.9 Nothing here excludes mandatory cancellation, withdrawal, repair, price reduction, refund, damages, or other rights. Where separate consent is required to start supply during a withdrawal period, it must be obtained in the ordering process. A genuine bank or payment-provider dispute is permitted; deliberately fraudulent chargebacks are prohibited. Contacting us first is encouraged but is not a condition of exercising a legal right.

8 Compliance with law and prohibition of criminal use

8.1 You must not use, or permit the use of, any Service to commit, attempt, organise, promote, facilitate, conceal, or knowingly support unlawful or criminal activities. This prohibition covers the server, its storage, IP addresses, network traffic, websites, applications, proxy or relay functions, and any other resource supplied by Nearoute.

8.2 You must comply with all laws, regulations, and binding orders applicable to you or your use of the Services, including those of:

• the Hong Kong Special Administrative Region, including national laws lawfully applicable in Hong Kong;

• the People's Republic of China, including Mainland China laws where applicable to you, your activities, your users, or the relevant transaction;

• the country or territory in which you reside, are established, or access or operate the Services;

• the location of the relevant infrastructure, and other jurisdictions whose laws apply to the people, activities, or data involved.

8.3 As a separate contractual condition of acceptable use, we also prohibit using the Services to carry out or knowingly support activities prohibited by the laws of Hong Kong or Mainland China, even where the customer or server is located elsewhere. This condition defines what Nearoute permits on its Services; it does not state that every Mainland China law applies territorially in Hong Kong or another jurisdiction. We will apply this condition only in a manner consistent with laws binding on us. If relevant requirements conflict, you must notify us and stop the affected use unless a lawful and compliant arrangement is available.

8.4 You are responsible for obtaining licences, registrations, permissions, and consents required for your own activities. These may include requirements relating to telecommunications, internet information services, regulated financial activities, content distribution, cybersecurity, personal information, and cross-border data transfers. Purchasing a server from a Hong Kong company does not grant you a licence to operate a regulated business or exempt your activities from applicable law.

8.5 Nearoute provides infrastructure, not approval of your business model or content. Availability of a technical feature, successful provisioning, or a delay in enforcement does not mean that a use is lawful or permitted. We remain responsible for legal obligations that apply to Nearoute itself.

9 Prohibited activities

The following activities are prohibited, whether performed directly, through an intermediary, or through tools or infrastructure that you knowingly provide for the activity:

9.1 Fraud and financial crime. Scams, phishing, fraudulent investment or trading platforms, unlawful fundraising, pyramid schemes, payment-card fraud, theft of digital assets, money laundering, or knowingly providing infrastructure to collect, move, or conceal criminal proceeds.

9.2 Unauthorised system access and attacks. Hacking without authorisation, credential theft or stuffing, brute-force attacks, exploiting systems without permission, intercepting communications unlawfully, denial-of-service or distributed denial-of-service attacks, and operating attack-for-hire, booter, or stresser services.

9.3 Malicious software and compromised infrastructure. Creating or distributing malware for harmful purposes, ransomware, botnet command-and-control systems, malicious payload delivery, or infrastructure used to steal data, compromise devices, or conceal an attack. Legitimate security work remains subject to Section 10 and all other applicable restrictions.

9.4 Illegal markets and regulated activities. Unlawful gambling, betting or lottery operations; illegal trade in drugs, weapons, counterfeit goods, stolen accounts, credentials or payment data; human trafficking; and financial, communications, or other regulated services operated without the authorisations they require.

9.5 Sexual exploitation and unlawful sexual content. Child sexual abuse or exploitation material, grooming, trafficking, non-consensual intimate images, and synthetic material depicting such abuse or exploitation. Pornographic or obscene material is also prohibited where its creation, possession, hosting, or distribution violates Section 8. A claim that material is fictional or AI-generated does not excuse a prohibited use.

9.6 Unlawful harm and threats. Credible threats, incitement to violence, facilitation of terrorism, unlawful harassment or stalking, and unlawful conduct endangering national security or public safety. This section is applied to the prohibited conduct and relevant legal requirements, not merely to a customer's identity.

9.7 Privacy and personal data violations. Unlawful collection, access, disclosure, sale, or trafficking of personal information; unlawful surveillance; doxxing; identity theft; and processing or transferring personal data without a required lawful basis, notice, consent, or safeguard.

9.8 Intellectual property violations. Hosting or distributing infringing software, media, databases or other material; counterfeit services; unlawful circumvention of protection measures; or otherwise infringing copyright, trade marks, trade secrets, or other protected rights. You must hold the necessary rights to content and software you use.

9.9 Spam and messaging abuse. Sending or facilitating unsolicited bulk messages, fraudulent messages, deceptive sender identities, or unlawful marketing by email, SMS, messaging platforms, or other channels. Using our infrastructure to collect responses to spam sent elsewhere is also prohibited. See Section 10 for email requirements.

9.10 Misuse of network resources. Source-address spoofing, route hijacking, unauthorised interception, deliberately creating amplification or reflection traffic, or operating insecure open relays or other services that facilitate material abuse. You must not interfere with another customer's resources or the security and stability of our infrastructure.

9.11 Evasion and platform abuse. Circumventing billing, quotas, access controls, verification, sanctions or service restrictions; exploiting promotions through duplicate identities; falsifying records; or concealing activity in order to defeat legitimate abuse prevention. Encryption and ordinary security tools do not themselves constitute evasion.

9.12 Knowing assistance. Selling access, renting servers, providing transit or proxy capacity, or otherwise knowingly helping another person undertake prohibited activities. Describing a Service as “bulletproof”, “offshore”, or “anonymous” does not exempt it from these restrictions.

10 Email security testing and resource use

10.1 You are responsible for maintaining the security of services that generate outbound traffic from your assigned resources. Legitimate email must comply with applicable marketing and anti-spam laws, use accurate sender information, and provide an effective opt-out where required. You must not use purchased or unlawfully obtained recipient lists, open mail relays, or forged headers. We may restrict outbound mail ports or sending volumes where reasonably necessary to prevent abuse and will disclose general product restrictions before purchase.

10.2 Security testing is allowed only against systems for which you have the owner's valid permission and within the agreed scope. Testing our infrastructure or another customer's Service requires the relevant owner's written authorisation. Stress tests or other tests that could affect shared infrastructure require our prior written approval as well. Authorisation from one target does not permit attacks on unrelated systems or unrestricted internet scanning.

10.3 You must remain within the CPU, memory, storage, traffic, port-speed, and other limits disclosed for your plan. Any shared-resource fair-use threshold or sustained-use limit must be disclosed before it is applied as a contractual restriction. Ordinary use within expressly purchased dedicated capacity is not abuse merely because it is sustained.

10.4 We may take proportionate action where measured activity materially degrades other customers' Services, threatens infrastructure, or exceeds agreed limits. Where there is no urgent risk, we will explain the issue and allow a reasonable opportunity to reduce usage, correct the configuration, or choose an appropriate plan. Urgent protective action may include rate limiting, isolating a process, filtering traffic, or temporary suspension.

10.5 A plan's data-transfer allowance is distinct from its connection speed. The Order must specify how usage is counted, the billing or reset period, and whether excess usage results in throttling, suspension, or an accepted overage charge. Terms such as “unmetered” do not mean unlimited physical capacity, but do not permit an undisclosed transfer quota either. We will not impose a new overage price retrospectively.

10.6 Crypto-mining, public proxy services, VPNs, Tor relays or exit nodes, peer-to-peer applications, and similar workloads are subject to these Terms and any restrictions clearly stated in the Order. Technical capability is not permission to operate them unlawfully. They are prohibited where they breach Section 8, facilitate abuse, or violate disclosed product limits. No such workload may be marketed as exempt from law or abuse enforcement.

11 Abuse reports and enforcement

11.1 Reports should identify the affected IP address, URL or other resource, the relevant time and time zone, the alleged violation, available evidence, and a way to contact the reporter. Please avoid sending unrelated personal data or unlawful material itself where a safe reference is sufficient. Reports can be made through the contact channels in Section 25.

11.2 We will assess credible reports and relevant technical evidence and may ask for an explanation, corrective action, or proof of authority. For an ordinary abuse notice, you must respond substantively within 24 hours of delivery to your registered or designated operational contact and meet the stated remediation deadline. This applies to hosted resources, circuits, transit traffic, leased IP Resources, and other affected Services. An automated acknowledgement is insufficient. If delivery fails, we will use another available contact method where practicable. The obligation to act immediately against a genuine emergency is addressed below.

11.3 We may act immediately without advance notice where reasonably necessary to stop an ongoing attack, serious unlawful activity, an imminent security threat, material harm to others, or to comply with a binding legal requirement. The 24-hour response period is not a right to continue harmful activity. Protective measures may include blocking traffic, disabling a resource, isolating a server, restricting access to content, suspending a Service, or terminating Services in serious or repeated cases.

11.4 We will choose measures proportionate to the issue and, where practicable, limit them to affected resources. We will provide the reason and relevant remedial steps when lawful and reasonably possible. We may restrict the entire Account where a narrower measure cannot reasonably contain the risk, or where violations are serious, deliberate, or repeated.

11.5 You may request a review through support and submit relevant evidence. We will consider a reasonable challenge and correct a mistaken restriction. A restriction may remain in place while a genuine risk or legal obligation continues. We do not need to await a criminal conviction before taking justified contractual or protective action, but a complaint alone is not conclusive proof of guilt.

11.6 We may preserve relevant evidence and will cooperate with competent authorities in accordance with the legal and evidential requirements in Sections 13.8 to 13.13. A request from a private complainant or a foreign authority does not automatically entitle the requester to your data.

11.7 Any charge for damage or remedial work must have a lawful basis, be reasonably attributable to your breach, and be supported by evidence. We do not impose an undisclosed automatic “abuse fine”. Consumer protections and the responsibility of Nearoute for its own conduct remain applicable.

12 Copyright and other rights complaints

12.1 Rights holders or authorised representatives may report suspected infringement through our published contact channels. A useful notice identifies the protected work or right, the specific allegedly infringing material and its location, the reporter's contact information and authority, and the factual basis for the complaint. Notices should be accurate and made in good faith.

12.2 We may seek further information, notify the customer, restrict the affected material, or terminate Services for substantiated serious or repeated infringement. Customers may provide evidence of ownership, licence, legal permission, mistaken identification, or another relevant defence. Restoration will depend on the applicable legal process and the circumstances.

12.3 Where a particular notice-and-takedown or counter-notice procedure is legally applicable, including a procedure under the United States Digital Millennium Copyright Act (DMCA), we will handle the matter in accordance with the requirements applicable to us. These Terms do not represent that Nearoute automatically qualifies for any statutory safe harbour. Any designated-agent details and jurisdiction-specific procedure will be published separately where required.

13 Customer Data privacy and lawful disclosure

13.1 You retain your rights in Customer Data. You grant us only the permissions necessary to host, transmit, reproduce technically, secure, and otherwise process it to provide the Services, carry out your lawful instructions, and meet applicable legal obligations. These permissions do not authorise us to sell your content or use it to train general-purpose AI models.

13.2 We handle Account, billing, support, and operational personal data for administering Accounts, verifying and processing payments, supplying and supporting the Services, maintaining security, preventing fraud and abuse, and meeting applicable legal obligations, subject to this section and applicable law. Our Privacy Policy provides further information about data categories, sources, recipients, cookies, retention, and individual rights, and includes our Personal Information Collection Statement. We will provide any additional privacy information and collection notices required by law when collecting personal data. You may contact us through Section 25 to make a personal data enquiry or exercise an applicable right of access or correction. You must provide any required notices and obtain any necessary permissions for personal data you upload or process on behalf of others. If a separate data processing agreement is legally required for your use, it must be put in place before that processing begins.

13.3 Where we process Customer Data on your behalf, we will use it for the agreed service purposes and your lawful instructions, except where the law requires otherwise. We will restrict access to authorised personnel, apply appropriate confidentiality obligations and security measures, and require relevant service providers to protect the data entrusted to them. Outsourcing does not remove our own contractual or statutory responsibilities.

13.4 A chosen server, data-centre, or circuit endpoint location is the location expressly stated in the Order. It does not by itself locate all account administration, support, payment, network transit, security, or registry processing there. The Privacy Policy addresses site access records, relevant surveillance, operational records, and public registry contacts where applicable. Processing locations and cross-border arrangements must be disclosed as required, and a material change to an agreed data-residency commitment requires the applicable notice and consent.

13.5 We may collect operational logs and use proportionate automated or manual measures for service operation, billing accuracy, security, and abuse investigation. We do not promise that Services are anonymous or that no logs exist. Access to Customer Data must be reasonably necessary for a legitimate service or legal purpose and limited accordingly; these Terms do not grant unrestricted access to your private communications.

13.6 If we become aware of a security incident materially affecting the confidentiality, integrity, or availability of Customer Data within our responsibility, we will inform affected customers without undue delay, provide information reasonably available to us, and cooperate with remediation and applicable notification duties. We will provide reasonable assistance with legally required personal data requests within our role and service scope.

13.7 We retain and delete data in accordance with the purposes for which it is held, applicable legal requirements, Section 16, and any applicable privacy or personal information collection notice provided to you. A requirement to retain billing records or evidence does not mean that an operational copy of your server will remain available for recovery.

13.8 Binding legal requirements. We will cooperate with a competent law enforcement agency, court, regulator, or other authority acting within its legal powers, including by preserving, producing, or permitting lawful access to relevant information where required by a valid and binding warrant, court order, statutory production requirement, or other enforceable legal process. We will take reasonable steps to verify the requester's identity, authority, the authenticity and scope of the process, and its applicability to us. We are not required to await a criminal conviction or independently prove the underlying offence before complying with a binding requirement.

13.9 Requests supported by sufficient evidence. Where disclosure is legally permitted but not compulsory, we will cooperate and disclose relevant information if, after reasonable assessment, we are satisfied that the requester is a competent authority and that credible supporting documents or other evidence provide sufficient objective grounds for the disclosure to be lawful, necessary, and proportionate to the stated investigation or protective purpose. Where we rely on the crime-related exemption in section 58 of Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486), the relevant statutory conditions must be met, including that non-disclosure would be likely to prejudice the qualifying purpose. An unsupported allegation, informal assertion of authority, or request for information without an adequate legal basis is not sufficient. We may seek clarification, narrow an excessive request, or decline a request that does not satisfy these requirements.

13.10 Information that may be provided. To the extent lawfully required or justified under Sections 13.8 or 13.9, disclosure may include relevant Account and verification details, business and operational contacts, billing and payment records, assigned IP Resources and routing records, login or site-access records, surveillance or equipment-custody records where actually held, IP transaction documents, relevant operational or network logs, support communications, and relevant Customer Data. We disclose only information we hold or lawfully control, limit it to the justified scope, and protect unrelated customers' information. These Terms do not represent that every listed record exists or grant an independent power of search, interception, seizure or decryption beyond applicable law.

13.11 Requests from outside Hong Kong. An overseas request does not automatically have binding effect on Nearoute merely because it is issued by a foreign authority. We will assess the applicable Hong Kong law, any other law binding on the relevant data or operation, and any required recognition, mutual legal assistance, or other lawful process. We will not transfer information internationally where that transfer would itself breach applicable law.

13.12 Notice and preservation. Where lawful and appropriate, we will notify the affected customer of a request or disclosure. Notice may be delayed or withheld where prohibited by law, where it would prejudice a legitimate investigation, or where it would create a material risk of harm or destruction of evidence. We may preserve relevant information for as long as lawfully required or reasonably necessary for the permitted purpose, even if the Service has otherwise ended. Preservation does not guarantee continued server access or recovery.

13.13 These provisions explain our policy on cooperation and disclosure; they do not constitute blanket customer consent to unrestricted disclosure. We remain responsible for complying with applicable personal data and confidentiality requirements, documenting the basis for a disclosure, and protecting information that is retained or disclosed.

14 Backups and recovery

14.1 No backup service is included by default. Unless your Order expressly includes backups, you must arrange and maintain your own independent copies of Customer Data, configurations, encryption keys, and anything else necessary to recover your application.

14.2 Redundant disks, replication, snapshots, and infrastructure resilience are not a substitute for an independent, tested backup. Copies stored only on the same server or within resources scheduled for deletion may be lost together. You must test your recovery process and keep copies outside the affected Service.

14.3 If you purchase a backup or snapshot feature, its scope, schedule, retention, storage location, price, and recovery process are those disclosed for that feature. We will perform the purchased backup service with reasonable care and skill. Unless expressly agreed, it does not guarantee recovery to a specific point in time or within a specific time.

14.4 Reinstallation, disk replacement, downsizing, restoration, deletion, and some configuration changes may overwrite or destroy data. You must review warnings and export necessary data before authorising such actions. We will take reasonable care when performing actions within our responsibility and will not rely on your backup obligations to exclude liability that cannot legally be excluded.

15 Suspension termination and service exit

15.1 For Retail Cloud Services, an amount properly due but unpaid at the due time results in suspension, subject to an expressly agreed extension or applicable law. Other Services follow their agreed payment and cure provisions. If a non-retail Order has no payment-cure provision, we will give written notice of non-payment and a reasonable opportunity to pay before suspension, except where an immediate legal or security measure is necessary. Uncompleted payment does not extend an agreed deadline, and a genuine dispute is assessed under Section 5.4.

15.2 Retail Cloud virtual servers suspended for non-payment are scheduled for permanent deletion 72 continuous hours after suspension. The period includes weekends and public holidays. We will communicate the suspension and deletion time through the registered email or portal. All amounts properly due for restoration must be settled before that deadline. After it passes, assume the affected virtual server and data are unrecoverable, even if a scheduled deletion job has not yet completed.

15.3 A Retail Cloud payment successfully reconciled before the deadline permits restoration after reasonable processing and necessary security checks, not an instantaneous restart guarantee. Later payment does not recover deleted data. We will account for money received for a Service that cannot be restored rather than misrepresenting the payment as successful restoration.

15.4 The 72-hour deletion rule does not apply automatically to rented physical servers, Customer Equipment, cabinets, circuits, IP Transit, IP leases, or completed permanent IP transfers. For other Nearoute-hosted data, the Order or relevant Schedule governs sanitisation and export. For customer-owned hardware, suspension of power or connectivity does not authorise erasing its disks, taking ownership, disposing of it, or refusing every means of lawful recovery. Site exit follows Schedule C; IP Resources follow Schedule E.

15.5 The Retail Cloud period is not a guaranteed recovery window following deletion you request, immediate cancellation, reinstallation, serious abuse requiring lawful deletion, or a binding legal order. Powering off an active paid Service does not start that period. A lawful preservation obligation may require limited retention without requiring continued operation.

15.6 For a remediable material breach, we will normally give notice and a reasonable opportunity to correct it. Abuse notices follow Section 11 and the AUP. Immediate action is permitted for an ongoing attack, serious or repeated breach, imminent harm, or binding legal requirement. Measures may include restricting a route, circuit, access credential, power feed, or server as appropriate, and must be proportionate to the risk. Suspension of one service will not automatically suspend unrelated Services unless reasonably necessary to contain a common risk or authorised by a lawful, expressly agreed cross-default provision.

15.7 Customer cancellation follows Section 6. Ending a minimum-term Order early may engage an agreed lawful charge. Immediate cancellation can end access to the affected logical resources, but does not by itself authorise disposal of physical property or reversal of registry rights. We will explain material exit consequences through the applicable process.

15.8 We cannot end a committed-term Service merely for convenience before its agreed expiry unless the Order expressly gives that right with its applicable consequences. For an uncommitted Service or permitted non-renewal by us, we will normally give at least 30 days' notice and a reasonable opportunity for migration or collection. We will return unused prepaid fees and paid balance we can no longer apply. A legal requirement or urgent threat may require shorter notice, with as much lawful assistance as reasonably practicable.

15.9 Suspension does not itself cancel an agreed term or reserved capacity. Properly disclosed charges may continue during a customer-caused suspension; charges arising from our failure remain subject to remedies. After termination, no new recurring renewal period will be charged, but lawful accrued sums, an enforceable early-termination charge, or agreed storage or exit work may remain payable. We must avoid double recovery and account for refundable deposits and prepayments.

15.10 Serious or repeated abuse can justify permanent termination and refusal of new Orders. This does not authorise punitive forfeiture or retention of amounts exceeding what is lawfully due. Safe equipment collection, lawful evidence preservation, customer data handling, and completed transfer rights continue to be governed by their applicable provisions.

16 Data export equipment and resource return

16.1 Export your data and arrange migration before a relevant expiry or deletion deadline. Self-service export remains your task for unmanaged computing. Paid migration or recovery assistance needs a separate agreement and does not extend a deadline unless confirmed in writing. For other Services, the Order and relevant Schedule govern physical handover, route migration, and removal work.

16.2 Cloud resources may be deleted under Schedule A and Section 15.2. Rented physical-server storage may be sanitised and reused under Schedule B. Customer-owned disks or devices are governed by Schedule C, not a general cloud deletion rule. A separately purchased backup or storage product has its own agreed service term and retention requirements.

16.3 Residual information in recovery systems will be protected and removed through the applicable retention cycle, except for justified legal preservation. It is not a promised recovery facility. A need to retain limited billing records or evidence does not permit indiscriminate indefinite retention of server contents.

16.4 We may reclaim addresses supplied under a temporary assignment or lease when that entitlement lawfully ends, following Schedule E and any agreed notice or renumbering arrangements. You must cease announcements and remove DNS or other references you control at the relevant time. A completed permanent transfer is not a temporary assignment and is not reclaimed merely because another Nearoute Service ends.

16.5 Return Nearoute Equipment and collect Customer Equipment through the applicable Schedule. The parties must cooperate in identifying items and documenting the handover. Nothing here creates a self-executing right to confiscate or sell customer property, and no ordinary data deletion instruction is treated as permission to destroy a customer's physical storage device.

17 Availability maintenance and network limitations

17.1 We will take reasonable steps to maintain Services and remedy faults. No general uptime percentage, power configuration, route diversity, latency, throughput, recovery time, hardware replacement time, or credit scheme exists unless agreed. Express specifications and the duty of reasonable care remain binding. Different Services in one Order may have different SLAs and handover boundaries.

17.2 We may perform maintenance, security updates, replacements, and reasonably necessary migrations. Give reasonable advance notice of planned material interruption and coordinate facility access or change windows where agreed. Emergency maintenance may proceed without advance notice, with information as soon as practicable. Any SLA maintenance exclusion applies only within its agreed scope.

17.3 Connectivity partly depends on other networks, destination systems, and routing. We do not guarantee universal reachability, acceptance of an IP address by every website, third-party geolocation, a particular traffic ratio, or a fixed route unless expressly promised. Network scope and measurements are governed by Schedule D. Third-party involvement does not remove responsibility for a Service we undertook to provide.

17.4 IP Resources may be a temporary service assignment, a standalone lease, or a permanent registry transfer. The Order and Schedule E determine which. A temporary address may be changed for a justified operational or legal reason, with notice and reasonable migration assistance where practicable; this does not allow a unilateral substitution of an expressly contracted permanent transfer or reversal of an already completed transfer.

17.5 DDoS protection and scrubbing are supplied only to the purchased scope. No measure guarantees absorption of every attack. Proportionate filtering, rate limiting, temporary traffic blocking, or isolation may be necessary to protect infrastructure. Being an attack victim is not itself a breach. A protection service we specifically sold remains subject to its agreed obligations and cannot be disclaimed merely because an attack occurred.

17.6 Applicable SLAs describe measurements, exclusions, evidence and claim procedures. We will not treat monitoring at an unrelated point as proof of availability at the contracted handover. Credits may prevent duplicate recovery but do not replace non-excludable consumer remedies or other obligations unless lawfully and expressly agreed as described in Section 7.6.

18 Our intellectual property and third-party products

18.1 Nearoute and its licensors retain their rights in the Website, platform, branding, software, and documentation they supply. You receive only the access rights necessary to use the purchased Services during their term. You may not misrepresent your relationship with Nearoute or use our branding to imply endorsement.

18.2 Third-party software, operating system images, licences, and optional integrations may carry additional terms that must be made available where relevant. You must comply with valid licence restrictions and are responsible for licences for software you install yourself. Open-source licence rights are not removed by these Terms.

18.3 Third-party terms do not eliminate obligations Nearoute itself has agreed to perform. Services purchased independently from another provider are governed by your agreement with that provider.

19 Responsibility for loss

19.1 Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be excluded or limited. In particular, liability to a consumer arising under Hong Kong's Supply of Services (Implied Terms) Ordinance (Cap. 457), to the extent it cannot be excluded or limited, remains unaffected. The restrictions elsewhere in these Terms are subject to this section.

19.2 If you deal as a consumer, we are responsible under applicable law for loss caused by our breach of this agreement or failure to use reasonable care and skill. We do not exclude a loss merely by labelling it “indirect”, “data loss”, or “consequential” where doing so would remove a remedy that the law protects. Ordinary rules on causation, foreseeability, and reasonable mitigation apply where relevant.

19.3 These additional limits apply only to business customers, not consumers. Subject to Section 19.1, a separately agreed allocation of risk and any applicable reasonableness requirement, we exclude loss of profit, revenue, business opportunity, anticipated savings, goodwill, and indirect or consequential loss. Aggregate liability for an event or related series is limited to the fees paid or payable for the affected recurring Services in the 12 months before the first event; if supplied for less than 12 months, use 12 months of recurring fees at the immediately preceding rate. For an affected one-off supply or permanent IP transfer, use the total agreed price of that supply instead; if the claim concerns distinct recurring and one-off supplies, include the relevant amounts without duplication. This is not a zero-liability cap for a transaction with no recurring fee. Refund obligations expressly arising under these Terms are not capped by this paragraph. Liability for physical damage to or loss of Customer Equipment remains subject to applicable law and any expressly agreed equipment-value or insurance arrangement; the exclusions do not remove liability that cannot lawfully be limited.

19.4 Each party must take reasonable steps to reduce a loss when it becomes aware of the relevant problem. Your responsibility for backups and security will be considered to the extent it actually affects the loss and as permitted by law. It does not release us from non-excludable obligations or responsibility for our own conduct.

19.5 Except for express commitments in the Order and warranties or conditions that cannot legally be excluded, we do not promise uninterrupted, error-free operation or suitability for a purpose you have not disclosed and we have not agreed to support. No general disclaimer overrides an express Service specification or mandatory consumer protection.

19.6 Subject to Section 19.1, we are not liable for a failure or delay excused under Section 21, or for the act of preserving or disclosing information that we lawfully and properly undertake in accordance with Sections 13.8 to 13.13. This does not excuse an unlawful or excessive disclosure, our failure to use reasonable care, or liability that cannot legally be excluded.

20 Claims arising from your conduct

20.1 If you act as a consumer, you are responsible only for losses and claims for which you are liable under applicable law. You are not required by these Terms to indemnify Nearoute for its own negligence, breach of contract, or unlawful conduct.

20.2 If you purchase in the course of a business, you will indemnify Nearoute against reasonable third-party claims, damages, and necessary legal costs to the extent directly caused by your unlawful use, material breach of the acceptable use policy, or infringement of a third party's rights. This obligation does not apply to the extent the claim is caused by Nearoute's own breach, negligence, or unlawful conduct, and applies only where lawful and reasonable.

20.3 We must promptly notify you of a relevant claim, provide reasonable information, and allow a reasonable opportunity to participate in its defence. We must mitigate loss. Neither party may agree to a settlement that admits liability or imposes a non-monetary obligation on the other without that party's written consent, not to be unreasonably withheld.

21 Force majeure and related exclusions

21.1 A Force Majeure Event means an event beyond the affected party's reasonable control whose effects on the relevant obligation could not reasonably have been prevented, avoided, or overcome through appropriate precautions, reasonable care, and reasonable mitigation. Subject to that test, Force Majeure Events include:

• go