Acceptable Use Policy (AUP)

This AUP covers website, webshop and application hosting, server management, storage, connected services and online environments made available or managed by TovoT under an agreement. Only the services actually agreed are included in the assignment; this policy does not extend its scope.

These rules are intended for clients and anyone granted access through them, including employees, contractors, customers, end users and subusers. Clients must ensure these people know and comply with the relevant rules. Services independently provided by a third party are also subject to the terms agreed with that party.

You may use the services for lawful business activities, communications, publication, storage and data processing within the agreed purpose and available capacity. You must hold the necessary rights, permissions, legal bases and any required licences.

TovoT and users must comply with laws applicable to their activities, including privacy, intellectual property, electronic communications, consumer protection and, where relevant, sanctions and export restrictions. Services must not be used for transactions, persons, organisations, destinations or purposes for which supply or support is legally prohibited, or to circumvent such restrictions. TovoT may request information reasonably needed to assess this.

You must not use or allow the services to be used for:

• Fraud, phishing, identity abuse, deceptive payment or sales activities, money laundering, or concealing the actual supplier or source of unlawful activities.
• Malware, ransomware, botnets, credential theft, unauthorised access, exploitation of vulnerabilities or attacks on systems, including DDoS attacks.
• Spam, unlawful commercial messages, open mail relays, or circumventing opt-outs, access restrictions, security measures or usage limits.
• Illegal content, including child sexual abuse material, terrorist content, criminal threats, incitement to violence or criminal discrimination.
• Infringing copyright or other third-party rights, publishing personal data or intimate images without a legal basis, stalking or targeted harassment.
• Offering illegal goods or services, counterfeits, or products and activities without required licences or permissions.
• Deliberately disrupting availability, excessively consuming shared resources, or continuing prohibited activity through other accounts after a restriction.

Discuss activities involving elevated legal, security or capacity risks with TovoT in advance. Written permission and suitable safeguards are required for regulated gambling or financial services, crypto services, sale of weapons or controlled substances, sexually explicit content, hosting for resale, public proxies, large email campaigns, cryptomining, heavy computing workloads and penetration or load testing.

Permission applies only to the agreed purpose, systems and limits. Security testing also requires permission from every affected system owner. TovoT permission does not replace a licence or permit prohibited or unlawful use. Appropriate security and processing agreements must be in place before processing special-category or highly sensitive personal data.

Clients manage access to their environments, grant only necessary privileges and protect accounts, keys and passwords. Use available multifactor authentication and keep software you manage up to date. Do not share personal administrator accounts. Tasks agreed to be performed by TovoT remain TovoT responsibilities.

Clients are the contact point for use through their accounts, employees and subusers and take reasonable steps to prevent their abuse. This includes communicating these rules, investigating reports and restricting access where needed. Using third parties to carry out prohibited activities is not allowed. TovoT and its suppliers retain their own statutory and contractual responsibilities.

Report suspected compromise or abuse as soon as possible and cooperate with investigation and recovery. Do not include passwords, secret keys or unnecessary personal data.

Where necessary and lawful, TovoT may perform technical checks on availability, traffic, capacity, security signals and relevant logs. Automated security tools, such as malicious traffic filters, may be used. Specific signals or reports may lead to targeted investigation of the relevant use and content.

We limit access and processing to what is necessary, respect confidentiality and privacy, and consider the rights and legitimate interests of everyone concerned. This policy does not grant unrestricted access to private content or promise that all content is screened in advance or monitored continuously. Personal data processing follows applicable law, the privacy statement and processing agreements.

Anyone can report abuse without a client account by emailing [email protected] with the subject ‘AUP / abuse report’. Include the exact URL, domain or other specific location, a substantiated description, relevant times and available evidence references. Include your name and email address for a response and a statement that the report is accurate and complete to the best of your knowledge. Where the law allows reporting without a name and email address, these details may be omitted. Do not send copies of illegal imagery; provide its location instead.

We assess sufficiently specific reports carefully and without undue delay and may request more information. Where contact details are available, we acknowledge receipt and inform the reporter of our decision and available review options where lawful. In an immediate threat to personal safety, also contact emergency services.

In response to a violation, a sufficiently substantiated suspicion or a binding order, TovoT may investigate, request remediation, limit traffic, disable access to affected content, temporarily suspend accounts or services, or terminate all or part of the agreement where permitted by law and contract. We consider severity, repetition, urgency and the impact on those affected, choosing a targeted measure where possible.

Where reasonably possible, we provide prior warning and an appropriate opportunity to remedy the issue. Acute security risks, serious illegality or legal obligations may require immediate action. We give the affected user a clear explanation of the relevant facts, grounds, scope and duration of the measure and any role of automation, except where and to the extent prohibited by law or a statutory exception applies.

When grounds for a temporary measure are resolved, we assess restoration of access. Suspension does not automatically delete data; retention, return and deletion follow law and contract. Where lawful and safe, we provide an opportunity for transfer on termination. We may disclose information to competent authorities where a legal basis exists and disclose what the law requires.

To challenge a decision, email [email protected] with the subject ‘AUP / review’, identifying the report or service, your objection and any additional relevant information. An authorised employee reviews the substance of your objection; review is not based solely on an automated decision. Where possible, a different employee reviews the original decision. We communicate the outcome and reasons without undue delay. Your statutory rights, including access to a competent court or regulator, remain unaffected.

This AUP supplements the agreed services and applicable general terms. Specific written agreements and mandatory law take precedence; processing agreements remain leading for personal data processing. Publication alone does not automatically amend existing agreements. TovoT makes this AUP available when entering relevant agreements and implements changes under the agreed change procedure and the law.

We publish the version and date on this page and notify affected clients of material changes before they take effect for them, allowing appropriate notice unless the law or an urgent security risk requires otherwise. Changes do not apply retroactively.