2012 CPNI Certification Signed3

7/29/2019 2012 CPNI Certification Signed3

1/7

Annual 47 C.F.R. 64.2009(e) CPNI CertificationEB Docket 06-36

Annual 64 .2009(e) CPNI Certification for 2012Date filed: March 1, 2013Nam e of com pany covered by this certification: Toptel Link LLCForm 499 F iler ID: 829212Nam e of signatory: Vachara RiengTitle of signatory: CE OI, Vachara Rieng, certify that I am an o fficer of the comp any nam ed abov e, and acting as anagent of the company, that I have personal knowledge that the company has establishedoperating procedures that are adequate to ensure compliance with the Com mission's CustomerProprietary Network Information (CPNI) rules. See 47 C.F.R. 64.2001 et seq.Attached to this certification is an accompanying statement explaining how the company'sprocedures ensure that the comp any is in comp liance with the requirements (including thosemandating the ad option of CPN I procedures, training, recordkeeping and supervisory review)set forth in section 64.2001 et seq. of the Commission's rules.The company has not taken any actions (proceedings instituted or petitions filed by thecompany with either state commissions, the court system, or the Commission) against databrokers in the past year. I acknowledge that companies must report on any information thatthey have with respect to the processes pretexters are using to attempt to access CPNI, andwhat steps compan ies are taking to protect CPNI, and I have no such information to report atthis time.The company has not received any customer complaints in the past year concerning theunauthorized release of or access to CPN I and I hereby acknow ledge that if the com pany doesreceive any such complaints, it must provide that information to the Commission, including thenumber of customer complaints a company has received related to unauthorized access toCPNI, or unauthorized disclosure of CPNI, broken down by category or complaint, e.g.,instances of improper access by em ployees, instances of improper disclosure to individuals notauthorized to receive the information, or instances of improper access to online inform ation byindividuals not authorized to view the information.The co mp any represents and warrants that the above certification is consistent with 47 C FR 1.17, wh ich requires truthful and accurate statements to the Com mission. The com pany alsoacknowledges that false statements and m isrepresentations to the C omm ission are punishableunder Title 18 of the U.S. Code and m ay subject it to enforcement action.

Vachara Rieng, CEO


2/7

Statement Accompanying CPN I Certificate EB Docket N o. 06-36Toptel Link LLC (the "Company") does not use, disclose or permit access to Customer ProprietaryNetwork Information ("CPN I") except as permitted or required by law pursuant to 47 U.S.C. 222. T hesafeguards set forth in Sections I and J below are followed by the C om pany, and, to the extent that theCompany finds it necessary to use, disclose or permit access to CPNI, the operating procedures inSections A-H below are observed.A . Definitions. The terms used in this Statement have the same meaning as set forth in 4764.2003.B. Use of CPNI. It is the Company's policy that the Com pany m ay use, disclose, or permit accessto CPN I for the purpose of providing or marketing service offerings amo ng the categories of service(i.e., local, interexchange, and interconnected VOIP) to which the customer already subscribes from theCom pany, without customer approval.To the extent that the Com pany provides different categories of service, and a customer subscribes tomore than one category of service offered by the Company, the Com pany may share CPN I among theCompany's affiliated entities that provide a service offering to the customer. However, to the extent thatthe Com pany provides different categories of service, but a customer does not subscribe to more thanone offering, the Company does not share CPNI with its affiliates, except by following the requirementsdescribed herein.The Company does not use, disclose, or permit access to CPNI to market to a customer any serviceofferings that are within a category of service to which the subscriber does not already subscribe fromthe Com pany, unless the Company has customer approval to do so. The Com pany does not use, discloseor permit access to CP NI to identify or track customers that call competing service providers.Notwithstanding the forgoing, it is the Company's policy that the Company may use, disclose, or permitaccess to CPN I to protect the rights or property of the Com pany, or to protect users of those services andother carriers from fraudulent, abusive, or unlawful use of, or subscription to, such services.C. Customer Approvals.It is the Com pany's policy that the Com pany m ay obtain approval through written, oral or electronicmethods. The C ompany acknowledges that it bears the burden of dem onstrating that any oral approvalshave been given in compliance with the Commission's rules. The Company honors all approvals ordisapprovals to use, disclose, or permit access to a customer's CPNI until the customer revokes or limitssuch approval or disapproval. The C omp any m aintains records of approval, regardless of the form ofsuch approval, for at least one year.Opt-Out and Opt-In Approval Processes. It is the Company's policy that it may, subject to opt-outapproval or opt-in approval, use its customer's individually identifiable CPNI for the purpose ofmarketing communications-related services to that customer. It is the Company's policy that it may,subject to opt-out approval or opt-in approval, disclose its customer's individually identifiable CPNI, forthe purpose of marketing communications-related services to that customer, to its agents and itsaffiliates that provide communications-related services; and its joint venture partners and independentcontractors who do the same. It is the Com pany's policy that it may also perm it such persons or entitiesto obtain access to such C PNI for such purposes. Except as provided herein, or as otherwise provided inSection 222 of the Communications Act of 1934, as amended, the Company only uses, discloses, orpermits access to its custom ers' individually identifiable CPN I subject to opt-in approval.


3/7

D. Notice Required For Use Of Customer Proprietary Network Information. It is theCompany's policy that prior to any solicitation for customer approval, notification is provided to thecustomer o f the customer's right to restrict use of, disclosure of, and access to that customer's CPN I. TheCompany maintains such records of notification, whether oral, written or electronic, for at least oneyear. It is the Company's policy that individual notice to customers is provided when soliciting approvalto use, disclose, or perm it access to custome rs' CPNI.E. Notice Content Requirements. Com pany notices must com ply with the following requirements:1. Not ices must provide sufficient informat ion to enable the customer to m ake an informed decision asto whether to permit the Com pany to use, disclose, or permit access to, the customer's CPNI.2. Not ices must state that the customer has a r ight , and the Company has a duty, under federal law, toprotect the confidentiality of CPNI.3. Notices m ust specify the types of information that consti tute CPN I and the specific enti ties that willreceive the CPNI, describe the purposes for which CP NI will be used, and inform the customer ofhis or her right to disapprove those uses, and deny or w ithdraw access to CPN I at any t ime.4. Not ices must advise the customer of the precise steps the customer m ust take in order to grant ordeny access to CPN I, and mu st clearly state that a denial of approval will not affect the provision ofany services to which the custom er subscribes.5. Notices must be comp rehensible and must not be misleading.6. To the extent that writ ten N otices are provided, the N otices are clearly legible, use sufficiently largetype, and are placed in an area so as to be readily apparent to a customer.7. If any po rtion of a Notice is translated into another language, then all portions of the Notice m ust be

translated into that language.8. The N otice may state that the customer's approval to use CP NI m ay enhance the C omp any's abili tyto offer products and services tailored to the customer's needs. The Notice ma y also state that theCom pany m ay be com pelled to disclose CPNI to any person upon affirmative written request by the

customer.9. Notices m ay not include in the n otification any statemen t attemp ting to encou rage a custom er tofreeze third-party access to CPNI.10. Notices must state that any approval, or denial of approval for the use of CP NI ou tside of the service

to which the custome r already subscribes from the C omp any is valid unti l the customer affirmativelyrevokes or l imits such approval or denial .11. The C omp any's solicitation for approval must be proximate to the Notice of a customer's CPNIrights.


4/7

F .pt-Out Notice Requirements. It is the Company's policy that Notices to obtain opt-outapproval be given only through electronic or written methods, and not by oral com mun ication (except asprovided with respect to one-time use of CPN I below).The contents of any such notification must comply with the Notice Content Requirements describedabove.It is the Company's policy to wait a 30-day m inimum period of time after giving customers notice andan opportunity to opt-out before assuming customer approval to use, disclose, or permit access to C PNI.This 30-day minimum period is calculated as follows: (1) In the case of an electronic form ofnotification, the waiting period shall begin to run from the date on w hich the No tice was sent; and (2) Inthe case of N otice by m ail, the waiting period shall begin to run on the third day following the date thatthe notification was m ailed. It is the Com pany's policy to notify customers as to the applicable waitingperiod for a response before approval is assumed.For those instances in which the Com pany uses the opt-out mechanism , the Compan y provides noticesto applicable customers every two years.For those instances in which the C ompany uses e-mail to provide opt-out notices, the Comp any followsthe additional requirements in addition to the requirem ents generally applicable to notification:(1 ) The C omp any m ust obtain express, verifiable, prior approval from consum ers to send notices via e-mail regarding their service in general, or CPN I in particular;(2 ) The C omp any m ust allow customers to reply directly to e-mails containing CPNI notices in order toopt-out;(3 ) Opt-out e-mail notices that are returned to the Comp any as unde liverable must be sent to thecustomer in another form before the Co mpa ny considers the customer to have received notice;(4 ) The sub ject line of the message m ust clearly and accurately identify the subject matter of the e-mail;an d(5 ) The C omp any m akes available to every customer a method to opt-out that is of no additional cost tothe customer and that is available 24 hours a day, seven days a week.G .pt-In Notice Requirements. It is the Com pany's policy that Notices to obtain opt-in approvalbe given though oral, written, or electronic methods. The contents of any such no tification must com plywith the Notice Content Requirements described above.H .ne-Time Use of CP NI Notice Requirements. The C ompany may use oral notice to obtainlimited, one-time use of C PNI for inbound an d outbound cu stomer telephone contacts for the duration ofthe call. The C omp any requires that the contents of any such notification m ust comply w ith the NoticeContent Requirem ents described above, except that the Com pany m ay omit any of the following noticeprovisions if not relevant to the limited use for which the Com pany seeks CP NI:(1 ) The requiremen t that the Com pany advise custom ers that if they have opted-out previously, no actionis needed to m aintain the opt-out election;(2 ) The requiremen t that the Com pany advise custom ers that they ma y share CPN I with their affiliatesor third-parties and ne ed not nam e those entities, if the limited C PNI u sage will not result in use by, or


5/7

disclosure to, an affiliate or third-party;(3 ) The requirement that the Company disclose the means by which a customer can deny or withdrawfuture access to CPN I, so long as explanation is given to customers that the scope of the app roval theCom pany seeks is limited to one-time use; and(4 ) The C omp any m ay om it disclosure of the precise steps a customer mu st take in order to grant ordeny access to CPNI, as long as the Company clearly communicates that the customer can deny accessto his CPN I for the call.I. Safeguards Required for the Use of CPNI. It is the policy of the Com pany to train itspersonnel as to the circum stances under which CP NI m ay, and may no t, be used or disclosed. Inaddition, the Comp any has established a written disciplinary process in instances wh ere its personnel donot com ply with established policies. It is the Co mpan y's policy to require that a record be m aintainedof its own and its affiliates' sales and marketing campaigns that use their customers' CPNI. TheCom pany m aintains a record of all instances where CP NI was disclosed or provided to other third-parties, or where third-parties were allowed to access such C PNI. Th e record includes a description ofeach camp aign, the specific CPNI that was used in the camp aign, and what products and services wereoffered as a part of the campaign. Such records are retained for a minimum of one year.The Company has established a mandatory supervisory review process regarding compliance with CPNIrules for outbound marketing. Sales personnel must obtain supervisory approval of any proposedoutbound m arketing request for customer approval. The Co mp any's policies require that recordspertaining to such carrier compliance be retained for a minimum period of one year.In comp liance with Section 64.2009(e), the Com pany w ill prepare a "comp liance certificate" signed byan officer on an annual basis stating that the officer has personal knowledge that the Company hasestablished operating procedures that are adequate to ensure comp liance with 47C.F.R. 64.2001 et seq. The certificate is to be accom panied by this statement and will be filed in EBDocket N o. 06-36 annually on or before M arch 1, for data pertaining to the previous calendar year. Thisfiling will include an explanation of any actions taken against data brokers and a summary of allcustomer com plaints received in the past year concerning the unauthorized release of CPN I.It is the Com pany's policy to provide written notice to the FCC w ithin five business days of any instancewhere the opt-out mechanisms do not w ork properly, such that a consumer's inability to opt-out is morethan an anom aly. The written notice shall comply with 47 C .F.R. 64.2009(f).J. Safeguards on the Disclosure of CPN I. It is the Com pany's policy to take reasonable measuresto discover and protect against attempts to gain unauthorized access to CPNI. The Company willproperly authenticate a customer prior to disclosing CPN I based on custom er-initiated telephone contact,online access, or in-store visit, if applicable, as described herein.(1) Methods of Accessing CPNI.(a) Telephone A ccess to CPN I. It is the Compa ny's policy to only disclose Call detail information overthe telephone, based on custom er-initiated telephone contact, if the customer first provides the Co mpan ywith a password, as described in Section (2), that is not prompted by the C omp any asking for readilyavailable biographical information, or account information. If the customer does not provide a passw ord,the Com pany w ill only disclose Call detail information by sending it to the customer's address of record,or, by calling the custom er at the telephone num ber of record. If the customer is able to provide Calldetail information to the Com pany during a custom er-initiated call without the Compa ny's assistance,then the Company may discuss the Call detail information provided by the customer.


6/7

(b ) Online Access to CPN I. It is the Com pany's policy to authenticate a customer w ithout the use ofreadily available biographical information, or account information, prior to allowing the custom er onlineaccess to CPN I related to a telecommu nications service account. Once authen ticated, the customer m ayonly obtain online access to CPNI related to a telecomm unications service account through a passw ord,as described in Section (2), that is not prompted by the C omp any asking for readily availablebiographical information, or account information.(c) In Store Access to CPN I. It is the Compa ny's policy that it may disclose CPN I to a custom er who, atany retail location operated by the C omp any, first presents to the Com pany or its agent a valid photo IDmatching the custom er's account information.(2 ) Password Procedures. To establish a password, the Company will authenticate the customer withoutthe use of readily available biographical information, or account information. The Co mpan y may createa back-up custom er authentication method in the ev ent of lost or forgotten passwords, but such b ack-upcustomer authentication method will not prompt the customer for readily available biographicalinformation or account information. If the customer canno t provide the correct password or correctresponse for the back-up customer authentication method , the customer must establish a new passwordas described in this paragraph.(3 ) Notification of Account Chan ges. It is the Compan y's policy to notify customers imm ediatelywhen ever a password, custom er response to a back-up m eans of authentication for lost or forgottenpasswords, online accoun t, or address of record is created or changed. This notification may be throughCom pany-originated voicemail or text message to the telephone num ber of records, or by mail to theaddress of record, and w ill not reveal the changed information or be sent to the new acco untinformation.(4 ) Business Custom er Exemption. It is the Com pany's policy that it may contractually be bound toother authentication regimes other than those described h erein for services provided to businesscustomers that have b oth a ded icated account representative and a contract that specifically addresses theCompany's protection of CP NI.K .otification of CPNI Security Breaches.(1 ) It is the Com pany's policy to no tify law enforcement of a breach in its customers' CPNI as providedin this section. The C omp any will not notify its customers or disclose the breach p ublicly until it hascom pleted the process of notifying law enforcement pursuant to paragraph (2).(2 ) As soon as practicable, and in no event later than seven (7 ) business days after reasonabledetermination of the breach, the C omp any will electronically notify the United States Secret Services(USSS ) and the Fed eral Bureau of Investigation (FBI) through a central reporting facility.(a ) Notwithstanding state law to the contrary, the Com pany shall not notify customers or disclose thebreach to the public until 7 full business days have passed after notification to the U SSS an d the FB I,except as provided in paragraphs (b) and (c).(b) If the Com pany believes that there is an extraordinarily urgent need to notify any class of affectedcustomers sooner than otherw ise allowed u nder paragraph (a), in order to avoid imm ediate andirreparable harm, it will so indicate in its notification and m ay proceed to imm ediately notify its affectedcustomers only after consultation with the relevant investigation agency. The C omp any will cooperatewith the relevant investigating agency's request to minimize any adverse effects of such custome rnotification.


7/7

(c) If the relevant investigating agency determines that public disclosure or notice to custom er wouldimpede or comp romise an on going or potential criminal investigation or national security, such agencymay direct the carrier not to so disclose or notify for an initial period of up to 30 days. Such p eriod maybe extended by the agency as reasonably necessary in the judgm ent of the agency. If such direction isgiven, the agency shall notify the carrier when it appea rs that the public disclosure or notice to affectedcustomers w ill no longer impe de or com promise a criminal investigation or national security. Theagency shall prov ide in w riting its initial direction to the carrier, any sub sequent extension, and anynotification that notice will no longer impede or com promise a crim inal investigation or nationalsecurity and such writings shall be contemporan eously logged on the sam e reporting facility thatcontains records of notifications filed by the Co mpany.(3) Custom er Notification. After the Com pany has notified law enforcemen t pursuant to paragraph (2), itwill notify its customers of breach of those cu stomers' CPN I.(4) Recordkeeping. The C om pany will maintain a record, electronically or in some o ther manner, of anybreaches discovered, notifications mad e to the USSS and the FB I pursuant to paragraph (2), andnotifications m ade to custom ers. The record w ill include, if available, dates of discovery andnotification, a detailed description of the CP NI that was the subject of the breach, and the circum stancesof the breach. The Company will maintain the record for a minimum of 2 years.

Documents

2012 CPNI Certification Signed3