Acceptable Use Policy

1. Introduction and Purpose

Corpshore Solutions Corporation, trading as Corpshore Ghana ("Corpshore Ghana", "we", "us"), is committed to providing high-quality, ethical, and responsible outsourcing services from Ghana to clients worldwide. As a provider of IT outsourcing, artificial intelligence data services, BPO, finance, and HR outsourcing, we have both a commercial and ethical obligation to ensure that our services are used for lawful and responsible purposes.

This Acceptable Use Policy ("AUP" or "Policy") sets out the standards and rules that govern how clients, users, and website visitors may use Corpshore Ghana's services, systems, and website. It is designed to protect the integrity, security, and reputation of Corpshore Ghana's services; protect the rights and wellbeing of Corpshore Ghana's staff; protect third parties, including end customers and data subjects, from harm; and ensure compliance with applicable Ghanaian law and, where relevant, international legal standards including the EU AI Act.

This Policy is incorporated by reference into Corpshore Ghana's Terms of Service and Master Services Agreements. By using our website or engaging our services, you agree to comply with this Policy. This Policy should be read together with our Privacy Policy, our Terms of Service, and, where applicable, our Data Processing Agreement.

We reserve the right to take action against any use of our services that violates this Policy, up to and including suspension or termination of services and referral to relevant authorities.

2. Definitions

For the purposes of this Policy:

• "AI Services" means any of Corpshore Ghana's artificial intelligence and data services, including training data annotation, data labelling, content moderation, AI model evaluation, natural language processing data preparation, and AI quality assurance.
• "Client" means any business entity or individual that has engaged Corpshore Ghana's services through a formal agreement.
• "Client Data" means data provided by the Client to Corpshore Ghana for processing in connection with the delivery of Services.
• "IT Services" means Corpshore Ghana's IT outsourcing services, including managed IT, software development, testing, helpdesk, infrastructure management, and cybersecurity services.
• "Services" means all services provided by Corpshore Ghana, including BPO, AI Services, IT Services, finance, HR, and consulting.
• "Systems" means Corpshore Ghana's technology infrastructure, including its network, servers, workstations, software, cloud platforms, and communication tools, as well as systems to which Corpshore Ghana has access in the course of delivering IT Services.
• "User" means any individual who accesses Corpshore Ghana's website or uses Corpshore Ghana's Services, whether as a client representative, employee, contractor, or website visitor.
• "EU AI Act" means Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence.
• "Ghana Cybersecurity Act" means the Cybersecurity Act 2020 (Act 1038) of the Republic of Ghana.

3. Scope and Application

This Policy applies to:

• All clients of Corpshore Ghana and their authorised representatives who use or access Corpshore Ghana's Services;
• All visitors to the Corpshore Ghana website at corpshoreghana.com;
• Any person or entity that submits data, instructions, or requests to Corpshore Ghana in connection with the Services.

This Policy does not apply to Corpshore Ghana's own staff in the context of their internal employment. Staff are subject to separate internal acceptable use and information security policies, which are consistent with and at least as stringent as this external Policy.

Where a client's employees, contractors, or end users interact with Corpshore Ghana's Services or Systems, the client is responsible for ensuring that those individuals comply with this Policy. The client's acceptance of the Terms of Service constitutes an acceptance of responsibility for all users who access the Services through the client's account or instructions.

4. Permitted Uses

Corpshore Ghana's Services are intended for legitimate business purposes. The following uses are expressly permitted, subject to compliance with all applicable laws and the terms of the relevant engagement agreement:

• Business process outsourcing: Engaging Corpshore Ghana to perform customer support, back-office processing, complaint handling, order management, and other business process functions in connection with the client's legitimate commercial operations.
• IT outsourcing: Engaging Corpshore Ghana to manage IT infrastructure, develop software, perform testing, provide helpdesk support, and carry out other IT functions as specified in a Statement of Work.
• AI training data services: Providing datasets for annotation, labelling, evaluation, or moderation purposes, where those datasets have been collected lawfully and the client has the right to use and share them with Corpshore Ghana for the specified AI development purpose.
• AI quality assurance and red-teaming: Engaging Corpshore Ghana to evaluate AI models for quality, accuracy, safety, and fairness, including structured adversarial testing within defined ethical parameters agreed in advance.
• Content moderation for lawful platforms: Engaging Corpshore Ghana to moderate user-generated content on lawful digital platforms in accordance with documented moderation guidelines and applicable law.
• Finance and accounting outsourcing: Engaging Corpshore Ghana for bookkeeping, payroll, accounts preparation, and financial reporting in connection with the client's legitimate business.
• HR outsourcing: Engaging Corpshore Ghana for recruitment process outsourcing, HR administration, and other HR functions in accordance with applicable employment law.
• General website use: Visiting the Corpshore Ghana website to obtain information about our services, submit a legitimate business enquiry, apply for employment, or access published resources.

All permitted uses are subject to compliance with this Policy and applicable law. A use is not permitted simply because it is not explicitly listed as prohibited; uses that are not clearly within the scope of the Services or that raise ethical or legal concerns will be assessed on a case-by-case basis.

5. General Prohibited Uses

The following uses of Corpshore Ghana's Services and website are strictly prohibited:

5.2 Intellectual Property Violations

• Instructing Corpshore Ghana to reproduce, distribute, or process copyright-protected material without the rights holder's authorisation, unless a recognised exception (such as fair dealing or fair use) applies in the relevant jurisdiction.
• Providing datasets for AI training that include copyright-protected works for which the client does not hold an appropriate licence or legal basis for such use.
• Instructing Corpshore Ghana to create derivative works, summaries, translations, or transformations of third-party content in a manner that infringes the rights holder's exclusive rights without lawful authority.
• Using Corpshore Ghana's IT or AI Services to circumvent digital rights management (DRM) systems or technical protection measures.

5.3 Unauthorised Scraping and Data Collection

• Instructing Corpshore Ghana to scrape, crawl, or extract data from third-party websites or platforms without the authorisation of those platforms and in violation of their terms of service.
• Engaging Corpshore Ghana to collect personal data of individuals without their knowledge or consent, in violation of applicable data protection law.
• Using Corpshore Ghana's IT Services to operate automated bots on third-party platforms in violation of those platforms' terms of service.

5.4 Deepfakes and Non-Consensual Synthetic Media

• Engaging Corpshore Ghana's AI or IT Services to create, annotate, evaluate, or distribute synthetic media — including AI-generated audio, video, images, or text — that depicts a real, identifiable person without that person's freely given and informed consent.
• Using Corpshore Ghana's Services to produce non-consensual intimate imagery (NCII) or any other non-consensual synthetic media.
• Instructing Corpshore Ghana to assist in the creation of political disinformation, election interference content, or synthetic media designed to deceive the public as to the identity of a speaker or the authenticity of an event.

5.5 Security Violations

• Attempting to probe, scan, or test the vulnerability of Corpshore Ghana's systems or networks without prior written authorisation as part of a formal penetration testing engagement.
• Attempting to gain unauthorised access to Corpshore Ghana's systems, networks, accounts, or any systems to which Corpshore Ghana has access in the course of providing IT Services.
• Uploading, transmitting, or introducing malware, spyware, ransomware, trojans, or other malicious code to Corpshore Ghana's systems or to any system managed by Corpshore Ghana.
• Engaging in denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks against Corpshore Ghana's infrastructure or any third-party systems.

6. AI-Specific Restrictions

Given the significant potential for AI systems to cause harm when misused, Corpshore Ghana applies specific restrictions to its AI and data services. These restrictions reflect both ethical obligations and the requirements of the EU AI Act, which applies to certain uses of AI within the European Union and to systems that affect EU residents.

6.1 Prohibited AI Applications

Clients may not engage Corpshore Ghana's AI Services for the following purposes:

• Banned AI practices under the EU AI Act: Any use that falls within the prohibited practices listed in Article 5 of the EU AI Act, including: subliminal manipulation techniques that distort behaviour without the person's awareness; exploitation of vulnerabilities of specific groups; real-time remote biometric identification in publicly accessible spaces (outside narrow law enforcement exceptions); social scoring systems that evaluate or classify individuals based on social behaviour; and AI systems that predict criminal behaviour based solely on profiling or personality traits.
• Discriminatory systems: Building, training, or evaluating AI systems designed to make or assist in making decisions that discriminate against individuals or groups on the basis of race, ethnicity, gender, sexual orientation, religion, disability, national origin, or other protected characteristics under applicable law — unless the client can demonstrate a legitimate and legally compliant purpose (such as diversity monitoring).
• Bias amplification: Instructing Corpshore Ghana to annotate or curate training data in a manner that deliberately amplifies harmful biases — for example, by excluding or under-representing particular demographic groups in a way that would lead to discriminatory model outcomes.
• Mass surveillance systems: Building or training AI systems intended for mass surveillance of individuals without lawful basis, including systems that aggregate public data to build profiles of individuals without their knowledge or consent.
• Weapons and conflict AI: Training, annotating, or evaluating AI systems intended to identify, target, or attack individuals in armed conflict or law enforcement contexts, without the required authorisations from relevant governmental bodies and explicit written approval from Corpshore Ghana.
• Manipulation and deception: Training AI systems intended to manipulate users through deceptive interfaces (dark patterns), to impersonate humans without disclosure, or to generate disinformation at scale.

6.2 High-Risk AI System Requirements

Where a client engages Corpshore Ghana to support the development or evaluation of AI systems that fall within the "high-risk" category under Annex III of the EU AI Act — including systems used in employment decisions, credit scoring, education, critical infrastructure, and law enforcement — the client is responsible for ensuring that the engagement complies with the applicable requirements of the EU AI Act and any national implementing legislation. This includes:

• Ensuring that data governance requirements applicable to high-risk AI systems are met in relation to training, validation, and testing datasets provided to Corpshore Ghana;
• Ensuring that appropriate human oversight mechanisms are in place for AI systems that affect individuals' rights or interests;
• Providing Corpshore Ghana with any instructions or constraints required by applicable law for the handling of such datasets or evaluation tasks.

Corpshore Ghana does not accept any liability for the regulatory compliance of a client's AI system. Responsibility for ensuring that AI systems meet applicable regulatory requirements rests with the client as the developer or deployer of that system.

6.3 Ethical AI Data Principles

In addition to the restrictions above, clients using Corpshore Ghana's AI data services are expected to adhere to the following principles:

• Training data should be collected and used with appropriate legal basis and in compliance with applicable data protection law.
• Annotation tasks should not require Corpshore Ghana's staff to repeatedly view violent, disturbing, or psychologically harmful content without appropriate safeguards, informed consent of staff, and duty-of-care provisions. Corpshore Ghana reserves the right to refuse or limit tasks that are determined to pose a risk to staff wellbeing.
• Clients should disclose the intended use of annotated data to Corpshore Ghana at the time of engagement, to enable Corpshore Ghana to assess whether the task is consistent with this Policy.

7. IT Outsourcing Security Requirements

Clients who engage Corpshore Ghana's IT outsourcing services, and who grant Corpshore Ghana access to their systems, networks, or infrastructure, agree to the following security requirements:

• Access credentials provided to Corpshore Ghana staff must be dedicated access accounts created solely for Corpshore Ghana's use. Clients must not share existing employee accounts with Corpshore Ghana staff.
• Clients must maintain an up-to-date access log and review Corpshore Ghana's access privileges at least quarterly, removing access to any systems or data that is no longer required for the delivery of Services.
• Clients must promptly revoke Corpshore Ghana's access credentials upon expiry or termination of the relevant engagement.
• Clients must not provide Corpshore Ghana with access to systems or data that exceeds what is strictly necessary for the delivery of the agreed Services. The principle of least privilege applies.
• Clients must not instruct Corpshore Ghana to deploy, install, or run software or scripts from unverified or untrusted sources on client systems.
• Clients must not instruct Corpshore Ghana to carry out actions on client systems that the client does not have the lawful right to authorise — for example, accessing data belonging to third parties without those third parties' consent.

8. Client Data Responsibilities

Clients are responsible for all data they submit to Corpshore Ghana in connection with the Services. Specifically:

• Lawfulness: Clients warrant that all Client Data shared with Corpshore Ghana has been collected and is being shared lawfully, including in accordance with applicable data protection and privacy law.
• Special category data: Clients must not submit special category personal data (as defined under the GDPR and Ghana Data Protection Act 2012) — including health data, biometric data, racial or ethnic origin data, data concerning sexual orientation, or trade union membership data — without first executing a Data Processing Agreement with Corpshore Ghana and obtaining Corpshore Ghana's prior written consent for the specific processing task. See our Data Processing Agreement.
• Children's data: Clients must not submit personal data relating to children under the age of 18 for annotation or processing purposes without explicitly identifying this fact to Corpshore Ghana at the time of engagement, demonstrating the legal basis for such processing, and obtaining Corpshore Ghana's prior written approval for the specific task.
• Accurate classification: Clients must accurately describe the nature, sensitivity, and content of data submitted to Corpshore Ghana. Deliberate misclassification of data — for example, submitting sensitive data without identifying it as such — constitutes a material breach of this Policy and the Principal Agreement.
• Data accuracy: Clients are responsible for the accuracy and quality of the data they provide. Corpshore Ghana is not responsible for the downstream consequences of processing inaccurate or incomplete client data.
• Retention: Clients should not transmit data to Corpshore Ghana for retention beyond the processing task. All data should be shared under a documented data lifecycle, consistent with the Data Processing Agreement.

9. Client Security Obligations

To maintain the security of Corpshore Ghana's systems and staff, clients agree to the following security obligations:

• No social engineering: Clients and their representatives must not attempt to deceive, manipulate, or social engineer Corpshore Ghana staff into taking actions outside their authorised scope — for example, persuading staff to bypass access controls, disclose credentials, or process data without proper authorisation.
• No credential sharing beyond authorised use: Credentials provided to access Corpshore Ghana's client portal or other systems may only be used by the authorised user to whom they are issued. Sharing credentials with colleagues or third parties is prohibited.
• Prompt breach notification: Clients who become aware that their credentials for accessing Corpshore Ghana's systems have been compromised, or that their own systems accessed by Corpshore Ghana have been breached, must notify Corpshore Ghana immediately at info@corpshore.solutions.
• No introduction of malicious content: Clients must not knowingly submit data or instructions that contain malware, malicious scripts, or other harmful code that could compromise Corpshore Ghana's systems or the welfare of Corpshore Ghana's staff.
• Compliance with security protocols: Clients must comply with any security protocols, access management requirements, and data handling procedures specified by Corpshore Ghana for the relevant service engagement.

10. Monitoring and Detection

Corpshore Ghana reserves the right to monitor the use of its services and systems to detect violations of this Policy, security incidents, and unlawful activity. Such monitoring may include:

• Review of data submitted by clients where Corpshore Ghana has reasonable grounds to suspect a violation of this Policy;
• Technical monitoring of network traffic and system access logs;
• Review of content flagged by Corpshore Ghana staff during the delivery of services (for example, content moderation tasks);
• Analysis of anomalous patterns in data submission or service usage.

Monitoring activities are carried out in accordance with applicable law and our Privacy Policy. Where monitoring reveals evidence of a violation of this Policy, applicable law, or the rights of third parties, Corpshore Ghana may take the enforcement actions described in section 11 and may be required to disclose evidence to relevant law enforcement authorities.

11. Enforcement

Violations of this Policy may result in the following enforcement actions, applied at Corpshore Ghana's reasonable discretion based on the severity, frequency, and nature of the violation:

In all cases, Corpshore Ghana will conduct a proportionate investigation before determining the appropriate enforcement response, except where immediate suspension or termination is necessary to prevent harm. Where suspension or termination is implemented, Corpshore Ghana will notify the client of the reason as soon as reasonably practicable, subject to any legal constraints on disclosure.

Enforcement action under this Policy is without prejudice to any other rights or remedies that Corpshore Ghana may have under the Principal Agreement, applicable law, or at equity.

Clients who have been suspended or terminated may not attempt to re-engage Corpshore Ghana's services under a different name or through a different entity during the period of suspension or following termination for a serious violation without Corpshore Ghana's prior written consent.

12. Reporting Violations

We encourage anyone who becomes aware of a violation of this Policy — whether by a client, a user, or any other party — to report it to us promptly. Reports can be made by:

• Email: info@corpshore.solutions — please include "AUP Violation Report" in the subject line.
• Post: Compliance Team, Corpshore Ghana, Accra, Ghana.

Reports may be made anonymously. We will not disclose the identity of a person who reports a violation in good faith without their consent, except where required by law. We investigate all reports promptly and will provide feedback to the reporting party where legally and operationally possible.

Where a reported violation involves suspected criminal activity — including CSAM, fraud, cybercrime, or human trafficking — Corpshore Ghana will refer the matter to the relevant law enforcement authority. Clients should note that reporting suspected criminal activity may be a legal obligation under Ghanaian law, including the Cybersecurity Act 2020 (Act 1038).

13. Ghana Cybersecurity Act Alignment

This Policy is designed to be consistent with and to support compliance with the Ghana Cybersecurity Act 2020 (Act 1038), which establishes a legal framework for cybersecurity in Ghana. Key provisions of Act 1038 that are relevant to clients using Corpshore Ghana's services include:

• Prohibition on unauthorised access (Section 65): Accessing a computer system or network without authorisation, or exceeding authorised access, is a criminal offence under Act 1038. Clients must ensure that their instructions to Corpshore Ghana do not require Corpshore Ghana staff to commit this offence.
• Prohibition on cybercrime activities (Sections 66-80): Act 1038 prohibits a range of cybercrime activities including computer fraud, identity fraud, phishing, distribution of malware, and electronic forgery. None of these activities may be facilitated through Corpshore Ghana's services.
• Mandatory reporting of cybersecurity incidents (Section 39): Critical information infrastructure owners are required to report certain cybersecurity incidents to the Cyber Security Authority (CSA). Corpshore Ghana complies with these obligations in relation to its own infrastructure. Clients are responsible for their own reporting obligations under Act 1038.
• Child online protection (Sections 82-89): Act 1038 includes provisions protecting children from online exploitation, including prohibition on child pornography and online sexual grooming. These activities are absolutely prohibited in connection with Corpshore Ghana's services.
• Protection of critical information infrastructure: Clients must not use Corpshore Ghana's services in a manner that attacks, disrupts, or threatens critical information infrastructure, including financial systems, telecommunications networks, government systems, or healthcare systems.

Violations of Act 1038 are serious criminal offences carrying substantial penalties, including imprisonment. Corpshore Ghana will co-operate fully with the Cyber Security Authority and law enforcement authorities in relation to any suspected violation of Act 1038 involving the use of our services.

Corpshore Ghana is registered with the Cyber Security Authority of Ghana and complies with all applicable cybersecurity directives, regulations, and standards issued by the CSA.

14. Updates to This Policy

Corpshore Ghana may update this Acceptable Use Policy from time to time to reflect changes in our services, applicable law (including developments in AI regulation), and best practice. Changes will be posted on this page with an updated effective date.

Where changes are material — for example, where we add new prohibited uses or impose new client obligations — we will notify existing clients by email at least thirty (30) days before the changes take effect. Clients who do not accept material changes to this Policy may terminate their engagement in accordance with the termination provisions of the relevant Principal Agreement.

Your continued use of Corpshore Ghana's services after the effective date of a revised Policy constitutes your acceptance of the changes.

15. Governing Law and Contact

This Acceptable Use Policy is governed by the laws of the Republic of Ghana. Any disputes arising out of or in connection with this Policy shall be resolved in accordance with the dispute resolution provisions of the relevant Principal Agreement or, in the absence of a Principal Agreement, by the courts of Ghana.

For questions about this Policy, to report a violation, or to seek clarification about whether a particular use of our services is permitted, please contact us:

• Email: info@corpshore.solutions
• Post: Compliance Team, Corpshore Ghana, Accra, Ghana

We aim to respond to all compliance enquiries within five (5) business days. For urgent matters involving suspected criminal activity or imminent harm, please use the emergency contact channels described in section 12.