Acceptable use policy

Scope of the services and who is covered

This Acceptable Use Policy (the "policy") sets out how the services that New Mind s.r.o., company number 03579409 ("we", "us"), provides under the R2D2 Hosting name at r2d2hosting.com may and may not be used. The policy is an integral part of the the Terms of Service; an order cannot be sent without agreeing to both.

The policy covers all three plans (R2 10, R2 50 and R2 200), whatever the prepaid term, and everything they include: web hosting, databases, mailboxes and outgoing email, DNS, SSH and SFTP access, backups and the control panel.

The policy binds the customer (the person or company that ordered the service, whether a business or a consumer), anyone the customer lets into the account, the clients whose websites or email the customer runs on the service, visitors to hosted websites as far as the content they themselves post goes, and the scripts, cron jobs and applications running under the customer's account. Only persons aged 18 or over may order the service.

Changes to this policy are announced in the same way as changes to the Terms of Service (article 11 of the terms).

Permitted, prohibited and restricted use

Permitted

You may use the service to run lawful websites, online shops, blogs and web applications, and for email, for yourself and for your clients, within the limits of your plan. Anything this policy does not prohibit or restrict is permitted, as long as it is lawful and does not limit the other customers on the shared server.

Prohibited content

The following content must not be stored, displayed, offered or linked to on the service, regardless of who put it on the website:

• material depicting the sexual abuse of children, or any sexualised content involving minors; we disable access to it at once, block the account and report it to the Police of the Czech Republic;
• terrorist content and the promotion or glorification of terrorism;
• content inciting violence or hatred against groups of people because of race, ethnic origin, nationality, religion, sex, sexual orientation, disability or another protected characteristic;
• content infringing intellectual property rights: illegal copies of software, films, music, books and games, tools for breaking copy protection, counterfeit goods and misuse of other people's trade marks;
• pornographic and sexually explicit content, and offers of sexual services, including escort services;
• personal data published or processed unlawfully, in particular leaked databases and stolen login credentials;
• offers of goods whose sale is prohibited, in particular narcotic and psychotropic substances, stolen goods, and forged documents and payment cards;
• malicious code: viruses, ransomware, exploits, phishing pages and tools for attacking other people's systems;
• content that deceives consumers or serves a fraud: fake online shops, fake investment offers, imitations of the websites of banks, public authorities or well-known brands;
• any other content whose publication is criminal or otherwise unlawful in the Czech Republic or in the European Union, including defamation.

Prohibited activities

You must not use the service for any of the following, nor let anyone else do so:

• fraud of any kind: phishing, fraudulent investment and financial offers, pyramid schemes, fake competitions and misuse of other people's payment cards;
• spreading malicious code, running command and control servers for botnets, and any part in ransomware attacks;
• unsolicited commercial communications and bulk email to addresses whose owners have not agreed to it, mailing to bought address lists, and forging the sender;
• attacks on other systems: DoS and DDoS attacks, port and vulnerability scanning, password guessing and attempts at unauthorised access. Security testing is allowed only against your own systems or with the written consent of their owner;
• running open proxies, open mail relays, exit nodes of anonymising networks, or VPN services for third parties;
• cryptocurrency mining and other computing-heavy workloads that do not serve your website;
• unauthorised retransmission of television or audiovisual broadcasts (IPTV, unlicensed streaming);
• using the service as storage, a backup target or a file-sharing service for data unrelated to running a website, and running torrent trackers;
• operating or brokering gambling, betting and lotteries played for money, including promoting them for a commission;
• money laundering, terrorist financing and getting round international sanctions;
• impersonating another person, company or public authority;
• getting round the limits of a plan, and reselling the service as a hosting product of your own without our written consent. Hosting your own clients' websites is allowed; see article 05.

Restricted and high-risk fields

The following fields are not prohibited, but they carry a higher legal risk. You may run them only if you hold every authorisation the law requires for them and follow the rules of that field; you must show us the authorisation on request.

Compliance with the law and with international sanctions

The service may be used only in line with the law of the Czech Republic, of the European Union and of the country from which you use it or whose residents your website targets, in particular the rules on personal data (GDPR), on digital services (DSA), on consumer protection, on copyright and on commercial communications.

We do not provide services to persons and entities on the sanctions lists of the European Union, the UN Security Council or the Czech Republic, to entities they own or control, or into territories under comprehensive EU sanctions. By ordering the service you declare that you are not on any such list and that you will not use the service in breach of sanctions or to get round them; if that changes, you tell us without delay. Where there is reasonable suspicion of a sanctions breach we may refuse the order, suspend the service at once or end the contract, and we meet the reporting duties the law places on us.

The service must not be used for money laundering, terrorist financing or any other criminal activity.

Rules of use and the prevention of abuse, fraud and harmful content

Shared resources

You share the server with other customers. Stay within the limits of your plan as published on the plans page (PHP processes running at once, cron jobs, the size of the disk, the mailboxes and the databases) and do not work around them. If your website endangers the running of the server we may slow it down for the time being, even without warning, and we write to you straight away to say why.

Account security

Keep your content management system, plugins and libraries up to date, use strong, unique passwords and a key for SSH, never publish login details, remove access for people who no longer work with you, and report any suspected compromise to support@r2d2hosting.com straight away. A compromised account that harms others, for example by sending spam or spreading malware, may be isolated; we may stop its scripts, block its outgoing email or change its login details. Cleaning up the website is your responsibility; we help with restoring it from a backup.

Outgoing email

Send only mail that its recipients want. Commercial communications may be sent only with the recipient's consent, or to your own customers within the limits the law allows, always with a truthful sender and a working way to unsubscribe. Send larger newsletter volumes through a dedicated mailing service. Where spam is suspected we may stop outgoing email from the account.

Fraud prevention

Give truthful details when ordering. If an order shows signs of fraud, such as payer details that do not match, we may ask you to verify your identity and hold the service until you do, or refuse the order and return the payment.

Content posted by your users

If your website lets others post content, you must have your own rules, a way to report illegal content, and assess what is reported without undue delay and remove it where appropriate. If you run an online platform, you meet the obligations the DSA places on you.

Responsibility for third parties and sub-users

You are responsible for all use of your account as if it were your own conduct: for your employees, contractors and suppliers, for anyone you give login details to, for your clients, and for the scripts and applications running under your account.

You may run your clients' websites and email with us (web studios, agencies). Our contracting party remains you. You therefore bind your clients to rules no less strict than these, pass our notices on to them, make sure the problem is fixed within the time we set, and stay reachable. We contact your client directly only where the law requires it, or where serious harm is imminent and you cannot be reached.

For content posted by visitors to your website you answer to the extent of article 04: you assess reported illegal content without undue delay and remove it where appropriate.

Monitoring and enforcement: reports, restriction, suspension and termination

What we monitor

We do not monitor or read the content of your websites, databases or mailboxes as a matter of course, and we have no general obligation to do so. We do monitor the technical operation of the service: processor, memory and disk load, the number of processes, the volume and nature of network traffic and outgoing email, system and access logs, and the results of automated detection of known malicious code, spam and attacks, including reports from public blocklists. We look into the content of a particular account only when you ask us to, when we investigate a specific report or security incident, or when the law or a decision of a public authority requires it. Personal data is processed as article 09 of the Terms of Service describes.

Reporting abuse and illegal content

Anyone can report abuse of the service, or illegal content on a website we host, to abuse@r2d2hosting.com; the same address is our point of contact for public authorities under the DSA. We communicate in Czech and in English. Include the exact address (URL) of the content, why you consider it illegal or contrary to this policy, your name and email address (which you may leave out when reporting the sexual abuse of children), and a statement that you make the report in good faith. We confirm receipt, assess the report without undue delay and tell you what we decided. Manifestly unfounded reports are rejected.

Measures

We respond to a breach of this policy in proportion to how serious it is:

Normally we warn you first and give you time to put things right. We act at once, without prior warning, in the case of material depicting the sexual abuse of children or terrorist content, active phishing, malware distribution or an attack in progress from our server, a compromised account that is harming others, reasonable suspicion of a sanctions breach, a decision of a public authority, or an imminent threat to the server, to other customers or to third parties. We treat these cases, and a breach repeated after a warning, as serious. We inform you of every measure and its reasons, unless the law or a public authority forbids us to.

Challenging a measure, and what termination means

If you disagree with a measure, write to support@r2d2hosting.com and say why. We review the case again and answer you with reasons; if the measure was unjustified, we lift it. Your right to turn to a court or a competent authority is not affected.

If the contract ends because of a serious breach of this policy, the 30-day money-back guarantee under article 04 of the Terms of Service does not apply; we refund the unused part of the price for the period after the contract ends. The rights the law gives you as a consumer are not affected. Your data remains available for download for 30 days under article 08 of the Terms of Service, except illegal content, which we do not make available and may preserve for public authorities. You are liable under the law for damage that a breach of this policy causes to us or to third parties.

Public authorities

We comply with orders of competent authorities to act against illegal content and to provide information. We disclose customer data only where the law requires it, and we tell the customer unless the law or the authority forbids it.

Contact