Rightlink USA, Inc.

Procedures concerning Compliance with CPNI Rules

Rightlink USA, Inc. has instituted the following protocol governing the use, disclosure and protection of
Customer Proprietary Network Information (CPNI) in compliance with the requirements of FCC rules, 47
C.F.R. 64.2001 et seq.
CPNI is (A) information that relates to the quantity, technical configuration, type, destination, location,
and amount of use of a telecommunications service subscribed to by any customer of a
telecommunications carrier, and that is made available to the carrier by the customer solely by virtue of
the carrier-customer relationship; and (B) information contained in the bills pertaining to telephone
exchange service or telephone toll service received by a customer of a carrier.

USE, DISCLOSURE OF, AND ACCESS TO CPNI

Rightlink USA, Inc. may use, disclose or permit access to CPNI without the customers approval in its
provision of the communications service from which such information is derived; for services necessary
to, or used in, the provision of such communications service; to initiate, render, bill and collect for
communications services; to protect the rights or property of Rightlink USA, Inc., or to protect users or
other carriers or service providers from fraudulent, abusive or unlawful use of, or subscription to, such
services; to market services within the category or categories of services to which the customer already
subscribes, including to market customer premises equipment (CPE), information services, call
answering, voice mail or messaging, voice storage and retrieval services; and to provide maintenance or
repair services; or as required by law.
Rightlink USA, Inc. does not use or disclose CPNI in any manner requiring customer approval, including
but not limited to the use of CPNI for the marketing or the provision of CPNI to a third party, except as
indicated in the above disclosure. Rightlink USA, Inc. does not use, disclose or permit access to CPNI for
the purpose of identifying or tracking customers who call competing local service providers. When
Rightlink USA, Inc. receives or obtains proprietary information from another carrier for purposes of
providing telecommunications service, it shall use such information only for such purpose and shall not
use such information for its own marketing.

SAFEGUARDS AGAINST DISCLOSURE OF CPNI TO UNAUTHORIZED PARTIES

Rightlink USA, Inc. does not provide Call Detail Information (CDI) to inbound callers. CDI includes any
information that pertains to the transmission of specific telephone calls. For outbound calls, this includes
the number called and the time, location, or duration of any call. For inbound calls, this includes the
number, from which the call was placed, and the time, location or duration of any call. The company may
instead provide CDI to a customer at their request by sending it to their address of record that has been
on file with Rightlink USA, Inc. for at least 30 days, or by calling back the customer at their telephone
number of record. Rightlink USA, Inc. may disclose CPNI other than CDI to inbound callers after
engaging in other reasonable authenticate measures to validate the identity of the customer.
Rightlink USA, Inc. authenticates the identity of users seeking access to account information online by
sending a randomly generated password to the email address of record at the time the account is
created. The password is not expected to consist of any readily available biographical information or
account information, nor will it include easily guessed units such as consecutive or repeated letters or
numbers.
Rightlink USA, Inc. does not have retail locations. Rightlink USA, Inc. would, if such an instance should
arise, require customers to show a valid, non-expired, government-issued photo ID, such as a drivers
license or passport, matching the customers account information.
Customers receive notification whenever a password, online account or address, phone number or email
address of record is created or amended. This notification may be through carrier originated voicemail to
the telephone number of record, or through the mail to the address of record. This notification does not
include any account information, including the changed information.

REPORTING CPNI BREACHES TO LAW ENFORCEMENT

Rightlink USA, Inc. will notify the appropriate government entities of any breach of CPNI. A breach has
occurred when a person, without authorization or exceeding authorization, has intentionally gained
access to, used, or disclosed CPNI. Customers are notified upon completion of law enforcement
procedures.

RECORD RETENTION

Rightlink USA, Inc. maintains records of any breaches and the resulting notifications to government
entities and customers for a minimum of 2 years. Records include, if applicable, date of discovery and
notification, detailed description of the CPNI that was the subject of the breach, and the circumstance of
the breach.
Rightlink USA, Inc. maintains records of all customer complaints related to the handling of CPNI, and to
Rightlink USA, Inc.s handling of the complaint, for a minimum of 2 years.
Rightlink USA, Inc. does not utilize CPNI for marketing purposes; however, to assure compliance, sales
personnel must get supervisory approval for outbound marketing promotions. Rightlink USA, Inc.
maintains records of such promotions for a minimum of one year. Records include a description of each
promotion and what products or services are offered as a part of the promotion.
Rightlink USA, Inc. will have an authorized corporate officer of the company sign a compliance certificate
on an annual basis stating that the officer has personal knowledge that Rightlink USA, Inc. has
established operating procedures that are adequate to ensure its compliance with FCCs CPNI rules. The
certificate will be filed with the FCC by March 1 of the subsequent year, and will be accompanied by a
summary or copy of this policy that explains how operating procedures ensure that Rightlink USA, Inc. is
in compliance with the FCCs CPNI rules. In addition, the filing must include an explanation of any
actions taken against data brokers and a summary of all customer complaints received in the past year
concerning the unauthorized release of CPNI. Confidential portions of these submissions shall be
redacted from the public version of the filing and provided only to the FCC.

TRAINING

Rightlink USA, Inc. employees are educated as to when they are authorized to release or use CPNI, and
understand that any violation of these rules will result in disciplinary action which could include dismissal
and possible criminal prosecution.