Acceptable Use Policy

1.1 Purpose. This Acceptable Use Policy (the "AUP") states what the Customer and its Users may and may not do with the Services, how DCXPS handles notices of allegedly illegal content, and what follows from a breach of this AUP. Capitalized terms have the meaning given in the Agreement or, for Platform accounts, in the Platform Terms of Service (Annex 07). Regulation (EU) 2022/2065 is referred to as the "DSA" and Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, as the "AI Act".

1.2 Nature of the Services. DCXPS provides computing infrastructure and platform services on dedicated bare-metal servers on which the Customer runs its own AI workloads. DCXPS provides the Services as a hosting service to which Article 6 of the DSA applies. DCXPS does not monitor Customer Data and has no general obligation to monitor it or to seek facts or circumstances indicating illegal activity (Article 8 of the DSA). The Customer is responsible for the content it and its Users store, process, generate or make available through the Services.

2.1 Customers. The Services are provided for AI and high-performance computing workloads of entrepreneurs, research institutions and public sector bodies established in the EEA or in another jurisdiction under clause 3.3 of the Agreement. The Services are not offered to consumers.

2.2 Users and resale. The Customer may permit individuals acting for it, for its Affiliates that satisfy clause 3.1 of the Agreement or for contractors acting on its behalf to use the Services as Users. The Customer remains responsible for the conduct of its Users (clause 7.1 of the Agreement). The Customer shall not resell, sublicense, sublet or otherwise make the Services, the capacity or the Units available to third parties as a service, except through the Platform under an agreement with DCXPS that expressly permits it.

3.1 Illegal content. The Customer shall not store, process, generate, transmit or make available through the Services any content that is illegal under Union law or under the law of the Czech Republic or of the Member State in which the Customer is established, including child sexual abuse material, terrorist content, content infringing intellectual property rights, unlawful hate speech and content whose processing breaches data protection law.

3.2 Harmful technical conduct. The Customer shall not use the Services to:

(a) gain or attempt to gain unauthorized access to any system, network or data;

(b) distribute malware, or conduct denial-of-service attacks or the scanning or probing of third-party systems without authorization;

(c) send unsolicited bulk communications;

(d) circumvent, test or probe the isolation, security controls or metering of the Services, except under rules of engagement agreed under section 5; or

(e) tamper with the Units, their sensors or DCXPS's facility and operations systems.

3.3 AI Act prohibited practices. The Customer shall not develop, train, place on the market, put into service, deploy or use through the Services any AI system for a practice prohibited by Article 5 of the AI Act, including:

(a) subliminal, purposefully manipulative or deceptive techniques that materially distort the behavior of a person and cause or are reasonably likely to cause significant harm (Article 5(1)(a));

(b) the exploitation of vulnerabilities of a person or a group of persons due to age, disability or a specific social or economic situation, with the objective or effect of materially distorting their behavior in a manner that causes or is reasonably likely to cause significant harm (Article 5(1)(b));

(c) the generation or manipulation of non-consensual intimate imagery or of child sexual abuse material (Article 5(1)(ba) and (bb), as inserted by Regulation (EU) 2026/1744);

(d) social scoring, that is the evaluation or classification of natural persons or groups of persons over a period of time based on their social behavior or on known, inferred or predicted personal or personality characteristics, leading to detrimental or unfavorable treatment in unrelated social contexts or that is unjustified or disproportionate (Article 5(1)(c));

(e) risk assessments of natural persons to assess or predict the risk of their committing a criminal offense based solely on profiling or on the assessment of their personality traits and characteristics (Article 5(1)(d));

(f) the untargeted scraping of facial images from the internet or from closed-circuit television footage to create or expand facial recognition databases (Article 5(1)(e));

(g) the inference of emotions of a natural person in the workplace or in education institutions, outside the medical and safety exceptions (Article 5(1)(f));

(h) biometric categorization that deduces or infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation, outside the permitted exceptions (Article 5(1)(g)); and

(i) real-time remote biometric identification in publicly accessible spaces for the purposes of law enforcement, outside the permitted exceptions (Article 5(1)(h)).

Where the Customer relies on an exception in Article 5 of the AI Act, it shall document the basis and provide the documentation to DCXPS on request.

3.4 Weapons, export control and sanctions. The Customer shall not use the Services:

(a) for the design, development, production, use, maintenance or storage of nuclear, chemical or biological weapons or of missiles or unmanned aerial vehicles capable of delivering them;

(b) for a military end use in a destination subject to an arms embargo; or

(c) for any other end use for which the export, brokering, technical assistance, transit or transfer of dual-use items, including the advanced computing integrated circuits and electronic assemblies listed in Annex I of Regulation (EU) 2021/821 as replaced by Commission Delegated Regulation (EU) 2025/2003, is prohibited or requires an authorization that has not been obtained.

The Customer shall not provide access to the Services to any person or destination to which such access is prohibited under Regulation (EU) 2021/821 or other applicable export-control law, or to any person listed on, or owned or controlled by a person listed on, a sanctions list referred to in clause 19.1 of the Agreement.

3.5 Workload mix. The Services are provided for AI workloads. Cryptocurrency mining, proof-of-work computation and similar activities are prohibited.

3.6 Third-party rights and models. The Customer shall use third-party models, datasets and software through the Services only under licenses that permit such use, and shall comply with the model license terms identified in the Order.

3.7 Shared infrastructure. The Customer shall not use the Services in a manner that degrades the Services for other customers of DCXPS, including by exceeding the resources allocated in the Order or by overloading the shared network or storage infrastructure.

4.1 Obligations. The Customer shall:

(a) maintain policies and controls so that its Users comply with this AUP;

(b) respond within two (2) Business Days to a request by DCXPS for information about a notice under section 6;

(c) remove or disable access to content that it determines, or that a competent authority or court orders, to be illegal;

(d) notify DCXPS without undue delay of any security incident affecting the Services; and

(e) designate in the Platform a contact for notices under sections 6 and 7.

5.1 Customer tests. The Customer may conduct penetration tests of its own servers and of its own tenant environment on prior notice through the Platform and under rules of engagement agreed with DCXPS in writing (scope, timing, contacts and prohibited techniques), as provided in clause 13.4 of the Agreement.

5.2 Prohibited targets. Testing of the shared infrastructure, of the environments of other customers, of the DCXPS Facility, of DCXPS's facility and operations systems, of the Platform outside the Customer's tenant and of DCXPS corporate systems is prohibited.

5.3 Regulated Customers. Where the Customer is a financial entity within Article 2 of Regulation (EU) 2022/2554, the participation of DCXPS in threat-led penetration testing under Article 26 of that Regulation is governed by Annex 08, Part E.

6.1 Submission. Any individual or entity may notify DCXPS of the presence on the Services of specific items of information that it considers to be illegal content, through the web form at chapek.io/legal/notice or by e-mail to support@chapek.io. DCXPS maintains the mechanism so that it is easy to access and user-friendly and allows the submission of notices exclusively by electronic means.

6.2 Contents of a notice. The mechanism enables and facilitates the submission of notices containing:

(a) a sufficiently substantiated explanation of the reasons why the notifier alleges the information to be illegal content;

(b) a clear indication of the exact electronic location of the information, such as the exact URL, and, where necessary, additional information enabling the identification of the illegal content;

(c) the name and e-mail address of the notifier, except in the case of information considered to involve one of the offenses referred to in Articles 3 to 7 of Directive 2011/93/EU; and

(d) a statement confirming the notifier's bona fide belief that the information and allegations contained in the notice are accurate and complete.

6.3 Handling. Where a notice contains the notifier's electronic contact details, DCXPS sends the notifier a confirmation of receipt without undue delay. DCXPS processes notices and takes its decisions in a timely, diligent, non-arbitrary and objective manner. DCXPS notifies the notifier of its decision without undue delay, with information on the available redress and, where DCXPS used automated means for the processing or the decision, information on that use. Where a notice concerns Customer Data stored on the Customer's servers, DCXPS forwards the notice without undue delay to the contact designated under section 4.1(e). The Customer shall then act under section 4.1(c) and report to DCXPS within five (5) Business Days.

6.4 Action. Where a notice or other information gives DCXPS actual knowledge or awareness of illegal content, DCXPS acts expeditiously to remove or to disable access to that content, choosing the proportionate measure:

(a) a request to the Customer to remove the item within a stated period;

(b) disabling access to the specific item, where technically possible; or

(c) in serious cases, suspension of the affected Services under clause 9.7 of the Agreement.

DCXPS does not decrypt Customer Data and does not inspect Customer Data beyond the item identified in the notice.

6.5 Orders from authorities. Orders to act against illegal content and orders to provide information issued by national judicial or administrative authorities (Articles 9 and 10 of the DSA) are handled under Annex 08, Part C (Government Access Protocol). DCXPS informs the issuing authority of the effect given to the order and informs the Customer as provided there.

7.1 Measures. On a breach of this AUP, DCXPS may take the following measures, in proportion to the breach:

(a) a warning;

(b) a request for removal or correction within a stated period;

(c) restriction of the visibility of, or disabling of access to, specific content;

(d) suspension of the affected Services under clause 9.7 of the Agreement; or

(e) withdrawal from the affected Order or from the Agreement under clause 9.4 of the Agreement, where the breach is a substantial breach within the meaning of that clause.

DCXPS gives prior notice where practicable, except where immediate action is required by law, by an order of an authority or to prevent serious harm.

7.2 Statement of reasons. Where DCXPS restricts the visibility of or removes content, suspends or terminates the Services, or suspends or terminates a Platform account on the ground that the content is illegal or incompatible with this AUP, DCXPS provides the Customer, at the latest when the measure is imposed, with a clear and specific statement of reasons stating:

(a) the measure taken and, where relevant, its territorial scope and duration;

(b) the facts and circumstances relied on, including whether the measure follows a notice under section 6 or an own-initiative investigation and, where strictly necessary, the identity of the notifier;

(c) where applicable, information on the use made of automated means in taking the decision, including whether the content was detected or identified using automated means;

(d) where applicable, the legal ground relied on and why the content is considered illegal, or the contractual ground relied on and why the content is considered incompatible with this AUP; and

(e) the redress available to the Customer, being the review under section 7.3, the dispute resolution procedure in clause 25 of the Agreement and judicial redress.

No statement of reasons is given for a measure taken under an order referred to in Article 9 of the DSA or where the information is deceptive high-volume commercial content (Article 17 of the DSA).

7.3 Review. The Customer may request a review of a measure under section 7.1 within six (6) months of the measure, through the Platform or by e-mail to support@chapek.io. DCXPS reviews the request in a timely, diligent and non-arbitrary manner, under the supervision of appropriately qualified personnel and not solely by automated means, and reverses the measure where the request is justified. The review is a contractual procedure and does not limit the Customer's right to judicial redress.

7.4 Misuse. DCXPS may, after a prior warning, suspend for a reasonable period the processing of review requests under section 7.3 submitted by a Customer that frequently submits review requests that are manifestly unfounded.

8.1 Notification. Where DCXPS becomes aware of any information giving rise to a suspicion that a criminal offense involving a threat to the life or safety of a person or persons has taken place, is taking place or is likely to take place, DCXPS promptly informs the law enforcement or judicial authorities of the Member State concerned of its suspicion and provides all relevant information available to it. Where DCXPS cannot identify with reasonable certainty the Member State concerned, it informs the law enforcement authorities of the Czech Republic, Europol, or both.

9.1 Authorities. The single point of contact of DCXPS for the authorities of the Member States, the Commission and the European Board for Digital Services (Article 11 of the DSA) is legal@chapek.io; postal address: the registered seat of DCXPS. Communication is in English and Czech.

9.2 Recipients. The single point of contact of DCXPS for recipients of the Services (Article 12 of the DSA) is support@chapek.io and the support function of the Platform; it allows direct and rapid communication by electronic means and is not limited to automated tools. Communication is in English and Czech.

9.3 Other contacts. Reports of security incidents or vulnerabilities are sent to security@chapek.io.

9.4 Terms and conditions. This AUP, the Agreement and the Platform Terms of Service contain the information on the restrictions that DCXPS imposes on the use of the Services in relation to information provided by the Customer, including the measures and tools used for content moderation and the rules of the review under section 7.3. DCXPS publishes this AUP at chapek.io/legal/aup in clear, plain, intelligible, user-friendly and unambiguous language and in a machine-readable format, informs the Customer of any significant change under section 10, and applies the restrictions in this AUP in a diligent, objective and proportionate manner, with due regard to the rights and legitimate interests of all parties involved (Article 14 of the DSA).

9.5 Transparency reporting. DCXPS publishes the reports on content moderation required by Article 15 of the DSA for each year in which it does not qualify as a micro or small enterprise within the meaning of Commission Recommendation 2003/361/EC (Article 15(2) of the DSA).

10.1 Updates. DCXPS may change this AUP on the grounds and with the notice stated in clause 26.4 of the Agreement, and the Customer may reject a change as provided in that clause. DCXPS publishes the current version of this AUP at chapek.io/legal/aup with its effective date.