Acceptable Use Policy

1. Purpose and Scope

This Acceptable Use Policy ("Policy") sets out the terms under which Maestra Tech Ltd ("Maestra Tech", "we", "us", or "our") provides email deliverability and security consultancy services, and governs the conduct of clients, contractors, and employees who access those services or any Maestra Tech systems, tools, or infrastructure.

Maestra Tech provides services including, but not limited to:

• Email authentication configuration and enforcement (SPF, DKIM, DMARC)
• DNS record review, creation, and management
• Email deliverability auditing and remediation
• DMARC reporting analysis and policy progression (none → quarantine → reject)
• Email infrastructure health assessments, including MTA-STS and TLS-RPT configuration
• Identity and Access Management (IAM) consultancy

This Policy applies to all clients engaging Maestra Tech under a signed Statement of Work (SOW) or service agreement, all employees, contractors, and subcontractors of Maestra Tech, and any third party granted access to Maestra Tech systems, portals, or client environments.

This Policy is governed by the laws of England and Wales. Nothing in this Policy limits any rights or obligations arising under applicable legislation including the Computer Misuse Act 1990, the UK GDPR, the Data Protection Act 2018, PECR 2003, and the Investigatory Powers Act 2016.

2. Definitions

• Client Domain — any domain or subdomain in respect of which Maestra Tech has been engaged to perform services, including primary sending domains, parked domains, and subdomain infrastructure where email authentication records are deployed or managed.
• Authorised Access — access to systems, DNS records, mail infrastructure, or data that has been explicitly granted in writing under the relevant engagement agreement.
• Authentication Records — DNS TXT records including SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and related records such as BIMI.
• Client Environment — the totality of a client's email-sending infrastructure, DNS hosting, domain registrar accounts, mail servers, third-party email service providers (ESPs), and associated tooling.
• Background IP — all intellectual property owned by Maestra Tech prior to or independently of any client engagement, including methodologies, templates, tooling, processes, and know-how.
• Force Majeure Event — any event beyond a party's reasonable control, including acts of God, natural disasters, war, terrorism, pandemics, regulatory or government action, or failure of third-party infrastructure.

3. Permitted Use

Clients and authorised users may use Maestra Tech services and systems solely for legitimate business purposes consistent with the scope of the engagement.

3.1 DNS and Authentication Record Management

• Requesting creation, modification, or deletion of SPF, DKIM, and DMARC records for domains owned and operated by the client
• Providing Maestra Tech with registrar or DNS hosting credentials solely to the extent necessary to perform agreed work
• Configuring DMARC reporting URIs to direct aggregate (rua) and forensic (ruf) reports to designated mailboxes or third-party analysis platforms
• Progressing DMARC policy from monitoring (p=none) through quarantine (p=quarantine) to enforcement (p=reject) in accordance with the agreed implementation roadmap
• Configuring MTA-STS policies and TLS-RPT records to enforce encrypted mail transport

3.2 Email Deliverability and Infrastructure

• Sharing email sending logs, bounce data, spam complaint data, and DMARC aggregate reports with Maestra Tech for analysis
• Granting read access to third-party ESP dashboards (e.g. Mailchimp, HubSpot, SendGrid) for the purpose of deliverability auditing
• Providing details of all authorised email sending sources to enable complete and accurate SPF and DKIM configuration

3.3 Reporting and Monitoring

• Accessing DMARC aggregate reports and deliverability analysis reports produced by Maestra Tech
• Using Maestra Tech-provided dashboards or summary reports for internal compliance and security monitoring purposes

4. Prohibited Use

The following activities are strictly prohibited. Maestra Tech reserves the right to suspend or terminate services immediately and without liability upon discovery of any prohibited use.

4.1 Misuse of Email Infrastructure

• Configuring or directing email authentication records to facilitate the sending of unsolicited commercial email (spam) in violation of PECR 2003
• Using Maestra Tech-configured infrastructure to conduct phishing attacks, email spoofing, domain impersonation, or business email compromise (BEC) campaigns
• Using Maestra Tech services to send bulk email in violation of the applicable requirements of major inbox providers, including failure to maintain spam complaint rates below the relevant threshold
• Sending email that impersonates a third party's domain or brand without authorisation from the domain owner

4.2 Unauthorised Access and System Abuse

• Attempting to gain unauthorised access to Maestra Tech systems, client environments, DNS hosting accounts, or any third-party systems beyond the scope of the engagement — this constitutes an offence under Section 1 of the Computer Misuse Act 1990
• Sharing, transferring, or reselling access to Maestra Tech systems, reports, or proprietary methodologies without prior written consent
• Introducing malware, ransomware, or any malicious code into any system, including client environments
• Attempting to reverse-engineer, decompile, or extract proprietary configuration templates, tooling, or methodologies

4.3 Misuse of DNS Access

• Making changes to DNS records in a client environment beyond those agreed under the engagement scope
• Using registrar or DNS hosting credentials provided for engagement purposes to access or alter any records not covered by the agreed scope of work
• Retaining registrar or DNS credentials after the conclusion of an engagement without explicit written authorisation

4.4 Prohibited Email Content

Maestra Tech will not configure or support infrastructure used to send content that is unlawful, defamatory, harassing, discriminatory, or obscene under applicable English law; content promoting illegal activity; content designed to deceive recipients; or content targeting minors with age-inappropriate or exploitative material.

4.5 Data and Privacy Violations

• Sharing with Maestra Tech any personal data not required for the provision of services, or personal data whose collection or processing is unlawful under UK GDPR or DPA 2018
• Using Maestra Tech deliverability services to send marketing communications to individuals who have not provided valid consent under PECR 2003
• Failing to maintain an accessible and functional unsubscribe mechanism in bulk marketing email, as required by PECR and major inbox provider policies

5. DNS and Technical Access Obligations

Where Maestra Tech is granted access to DNS hosting accounts, domain registrar panels, or email platform dashboards, the following obligations apply:

• The client must ensure that any credentials shared with Maestra Tech are limited in scope (e.g. using sub-accounts, role-based access, or API tokens with the minimum permissions required)
• Maestra Tech will only access systems to the extent necessary to complete the agreed scope of work
• Maestra Tech will record all DNS changes made in a client environment and provide a change log upon request
• Clients must revoke any credentials or access granted to Maestra Tech promptly upon conclusion of the engagement, and within no more than five (5) business days
• Where Maestra Tech is granted DNS write access, it shall notify the client before making any material record change and shall maintain a timestamped audit log of all changes made

6. DMARC Implementation and Reporting

DMARC configuration carries specific risks and obligations. Clients must:

• Provide accurate and complete information about all legitimate email-sending sources prior to Maestra Tech configuring or amending DMARC records
• Inform Maestra Tech promptly of any new email sending platforms, services, or IP addresses introduced during the engagement
• Acknowledge that premature progression of DMARC policy (e.g. moving to p=reject before all legitimate senders are authenticated) may result in legitimate email being rejected, and that Maestra Tech will not be liable for such outcomes where the client has not provided complete sender information
• Not modify DMARC, DKIM, or SPF records configured by Maestra Tech without prior notification and written agreement, unless in the case of a genuine operational emergency, in which case the client must notify Maestra Tech within 24 hours
• Note that the NCSC ceased providing DMARC aggregate report processing via Mail Check in March 2025; clients who previously relied on NCSC Mail Check for aggregate reporting should arrange alternative DMARC report processing

7. Data Protection and Confidentiality

7.1 UK GDPR and DPA 2018

Maestra Tech processes personal data only to the extent necessary for the performance of its services. Where Maestra Tech processes personal data on behalf of a client, it does so as a data processor and will enter into an appropriate Data Processing Agreement (DPA) with the client as required by Article 28 UK GDPR.

Both parties agree to process personal data only in accordance with documented instructions, implement appropriate technical and organisational security measures, and notify the other party within 72 hours of becoming aware of a personal data breach.

7.2 Confidentiality

All configuration data, DNS records, email infrastructure information, deliverability metrics, and DMARC reports shared with Maestra Tech are treated as confidential. Confidentiality obligations shall survive the termination or expiry of any engagement for a period of five (5) years.

7.3 Retention

Maestra Tech retains client data only for as long as is necessary for the provision of services and in accordance with applicable legal requirements. Upon conclusion of an engagement, clients may request deletion of their data held by Maestra Tech, subject to any statutory retention obligations.

8. Security Obligations

8.1 Acceptable Monitoring

Maestra Tech may monitor its own systems and any shared workspaces for security, performance, and compliance purposes. Where Maestra Tech personnel access client systems as part of the engagement, that access is limited to the scope of the agreed work. No monitoring of client employee communications, personal data, or systems outside the agreed scope will be conducted.

8.2 Client Security Obligations

• Implement multi-factor authentication (MFA) on any DNS hosting, registrar, or email platform account to which Maestra Tech is granted access
• Maintain up-to-date software and operating systems on devices used to access shared workspaces
• Report any suspected compromise of credentials shared with Maestra Tech immediately, and in any event within 24 hours of discovery

8.3 Maestra Tech Security Obligations

Maestra Tech will maintain and operate in accordance with cyber security best practices, including the NCSC Cyber Essentials framework, use secure encrypted channels for the transmission of sensitive configuration data, not retain client credentials beyond the active engagement period, and promptly notify clients of any security incident affecting their data, no later than 72 hours after becoming aware.

9. Intellectual Property

All Background IP — including Maestra Tech's methodologies, configuration templates, tooling, processes, diagnostic frameworks, and pre-existing know-how — remains the exclusive property of Maestra Tech. Deliverables produced specifically for a client (such as DNS configuration files, audit reports, and implementation roadmaps) are licensed to the client for use in connection with their own email infrastructure. The client does not acquire ownership of the underlying methodologies.

Clients must not copy, reproduce, or distribute Maestra Tech's proprietary documentation, templates, or tooling to third parties without prior written consent, use deliverables under one engagement as the basis for providing services to a third party, or remove or obscure any Maestra Tech proprietary notices from any materials provided.

10. Regulatory Compliance

Maestra Tech services are designed to assist clients in achieving and maintaining compliance with the following standards and regulations. However, clients remain solely responsible for their own regulatory compliance:

• UK GDPR and DPA 2018 — lawful email processing and data subject rights
• Privacy and Electronic Communications Regulations 2003 (PECR) — requirements for commercial email marketing consent and opt-out
• Google and Yahoo bulk sender requirements (effective February 2024) — mandatory SPF, DKIM, DMARC, and spam rate thresholds
• Microsoft Outlook.com sender requirements (effective May 2025) — authentication and sender reputation obligations
• PCI DSS v4.0 — DMARC enforcement is mandatory for organisations in scope as of March 2025
• NCSC DMARC guidance — note: NCSC ceased providing Mail Check aggregate reporting in March 2025
• NIS2 Directive (where applicable to clients operating essential or important entities)
• DORA (Digital Operational Resilience Act) — where applicable to clients in regulated financial services

Maestra Tech does not provide legal advice. Clients should seek independent legal counsel regarding their specific regulatory obligations.

11. Suspension and Termination

Maestra Tech reserves the right to suspend or terminate access to its services, with or without notice, in the following circumstances: breach or suspected breach of this Policy; receipt of a credible complaint that the client is using Maestra Tech-configured infrastructure for prohibited purposes; discovery that the client has provided false or materially misleading information; or where continued provision of services would expose Maestra Tech to legal, regulatory, or reputational risk.

Where suspension is due to suspected policy breach, Maestra Tech will notify the client in writing and allow a reasonable cure period of not less than five (5) business days, except where the nature of the breach requires immediate action.

12. Limitation of Liability

To the fullest extent permitted by law, Maestra Tech is not liable for any loss or damage arising from: the client's failure to provide accurate or complete information about its email-sending infrastructure; deliverability issues arising from changes made to DNS or email infrastructure by the client or any third party without Maestra Tech's involvement; or actions taken by inbox providers in response to spam complaints, authentication failures, or policy changes outside Maestra Tech's control.

Nothing in this Policy limits either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be excluded or limited under applicable law.

Maestra Tech's total aggregate liability under or in connection with any engagement shall not exceed the total fees paid by the client to Maestra Tech in the three (3) months preceding the event giving rise to the claim, unless otherwise agreed in writing.

13. Reporting Violations

Any person who becomes aware of a potential violation of this Policy is encouraged to report it promptly to:

Email: [email protected]

Maestra Tech will acknowledge reports within two (2) business days and will investigate all reports in good faith, treating reports confidentially where possible. Maestra Tech does not tolerate retaliation against anyone who raises a genuine concern in good faith.

14. Governing Law and Jurisdiction

This Policy and any disputes arising in connection with it are governed by the laws of England and Wales. Each party irrevocably submits to the exclusive jurisdiction of the courts of England and Wales in respect of any dispute or claim arising out of or in connection with this Policy.

15. Policy Review and Updates

This Policy will be reviewed at least annually, or sooner in response to significant changes in applicable law, regulatory guidance, inbox provider requirements, or Maestra Tech's service offerings. Continued use of Maestra Tech services following publication of an updated Policy constitutes acceptance of the updated terms. Where changes are material, Maestra Tech will provide not less than 30 days' prior written notice to active clients.

16. Force Majeure

Neither party shall be in breach of this Policy or any engagement agreement, nor liable for any failure or delay in performing its obligations, where such failure or delay is caused by a Force Majeure Event. If a Force Majeure Event continues for more than 30 consecutive days, either party may terminate the affected engagement upon 14 days' written notice, without liability other than for fees due for work completed prior to the event.

17. General Provisions

17.1 Entire Agreement

This Policy, together with any applicable Statement of Work, Data Processing Agreement, and engagement-specific terms, constitutes the entire agreement between the parties relating to its subject matter. No variation to this Policy shall be effective unless agreed in writing by an authorised representative of each party.

17.2 Severability

If any provision of this Policy is held by a court of competent jurisdiction to be invalid, illegal, or unenforceable, that provision shall be deemed deleted, but the remaining provisions shall continue in full force and effect.

17.3 Notices

All notices under this Policy must be in writing and delivered by email to [email protected] (for notices to Maestra Tech) or to the email address designated in the relevant engagement agreement (for notices to the client). Notices shall be deemed received on the next business day after sending.

18. Contact Details

© 2026 Maestra Tech Ltd. All rights reserved. This document is confidential and intended for client and internal use only.