Terms and Conditions of the HUGO Honeynet Community Project

1. Introduction
   1. The Honeynet Hugo (hereinafter the “Project”) aims to collect information on cyber-attacks through a network of honeypots installed in the infrastructures of participating organizations (hereinafter the “User”). The Project Operator provides a ready-made honeypot software solution (“Honeypot Hugo”), which each User deploys within its own infrastructure. Data on attacks detected by these honeypots are mutually shared through the Project Operator's systems. These data provide the community's security teams with useful information necessary for ensuring the security and health monitoring of the CESNET e-infrastructure and other community networks.
   2. The Project Operator is CESNET, an interest association of legal persons, with its registered office at Generála Píky 430/26, Dejvice, 160 00 Prague 6, ID No. (IČO) 63839172, VAT No. (DIČ) CZ63839172, registered in the Register of Associations maintained by the Municipal Court in Prague under File No. L 58848 (hereinafter the “CESNET Association”).
   3. The User of the Project may be a natural person, a legal person or an organization that expresses interest in participating in the Project, i.e. in deploying the Honeypot Hugo and sharing data. Access is subject to manual approval in accordance with the internal procedures of the CESNET Association, and the User shall accept the decision.
   4. A detailed specification of the Project and the procedure for joining it are set out on the Website at https://hugo.cesnet.cz/.
   5. The User shall provide the cooperation necessary for the proper commissioning of the Project.
      
      
2. Rights and Obligations Associated with the Use of the Project
   1. In the area of administrative security measures, the User shall in particular:
      1. Protect access to its accounts by using a strong password meeting current security standards, and ensure the security of its access credentials against unauthorized access and misuse;
      2. Deploy the Honeypot in its network environment in such a manner that the operation of the Honeypot cannot affect the availability, integrity or security of the network or of production systems;
      3. Inform other affected participants of the planned deployment of the Honeypot or of any changes to its configuration;
      4. Suspend the operation of the Honeypot without delay if its operation causes, or threatens to cause, disruption to the operations of other participants
   2. The User shall notify the Project Administrator without undue delay of:
      1. The discovery of a defect in the Honeypot or in any other component of the Project;
      2. Any misuse of the infrastructure; or
      3. Any other circumstance that may indicate a security incident.
   3. The data obtained from the operation of the Project carry risks inherent in their nature. The User acknowledges that the data obtained are of an informative nature only. All information from the Project must be independently verified before any corrective or other measures or decisions are taken on the basis thereof.
   4. Participation in the Project shall be terminated at any time upon the User's request, by a decision of the CESNET Association, or as of the date of the CESNET Association's decision to terminate the Project.
   5. The Organization acknowledges and agrees that the data obtained from the Honeypot Hugo will be collected, processed and transferred to the community's security teams and used to ensure and enhance the security and health monitoring of the networks of the community members.
   6. The CESNET Association, acting as the processor, undertakes to process personal data in the operation of the Project exclusively in compliance with the General Data Protection Regulation (GDPR), in accordance with the instructions of the User as the controller, and within the scope set out below, as required for the operation of the Project:
      
      

      Categories of personal data	Categories of data subjects	Method, purpose and duration of processing
      name and surname, e-mail address, affiliation with the Organization, IP addresses, unique identifier, records of activities performed, scope of administrative rights	employees of the Organization – Honeypot administrators / technical contacts	personal data are processed for the purpose of configuring the Honeypot Hugo and for technical communication with the administrator, for as long as the Honeypot Hugo is deployed and functional

3. Warranties and Liability
   1. The User shall be responsible for the manner of technical deployment of the Honeypot within its infrastructure, including its network separation from production systems. The CESNET Association shall not be liable for any damage or other negative impact on the User's production systems arising from the deployment of the Honeypot in a manner deviating from the recommended procedure referred to in Section 2.1, due to the absence of network isolation.
   2. The security services and projects provided by the CESNET Association are designed as a significant support in ensuring the cyber security of the connected organizations. Although the CESNET Association strives to provide high-quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities in the provision of this Project. This Project, and the services of the CESNET Association generally, should be perceived as a complement to the User's own security activities, not as a substitute for them. The User bears the ultimate responsibility for securing its own environment.
   3. The User acknowledges and agrees that all data provided within this Project are supplied without any warranty as to their accuracy, completeness or fitness for any purpose. The User shall use the data from the Project at its own risk and is aware of the risks arising from their nature.
   4. Participation in the Project is provided free of charge. In view of the gratuitous nature of the Project, the CESNET Association shall not be liable for damage incurred by the User or by third parties in connection with the use of, or the inability to use, the Project, unless this Article provides otherwise. In particular, CESNET shall not be liable for: a) the loss, damage or unavailability of the User's data, b) the interruption or restriction of the User's research or other activities, c) damage caused by third parties through the Project, d) damage arising as a result of a cyber-attack conducted through the Project's infrastructure. The limitation of liability under paragraph of this Article shall not apply if the User proves that the damage was caused by the willful misconduct or gross negligence of CESNET. In such a case, CESNET's liability shall be limited to the actual direct damage.
   5. The Project is operated on a “best effort” basis. The CESNET Association does not guarantee any specific level of availability, performance or functionality of the Project. The CESNET Association reserves the right to modify, suspend or discontinue the Project, or any part thereof, at any time without prior notice. The User acknowledges that outages, delays or other limitations of the Project may occur and agrees that the CESNET Association shall not be liable for any losses or damage arising because of such events.
      
      
4. Final Provisions
   1. The CESNET Association is entitled to amend these Terms and Conditions unilaterally. A new version shall always be notified to the User in advance of its effective date via the contact e-mail or published on the Project Website. If the User disagrees with the new version of the Terms and Conditions, the User shall cease using the Project and notify the Project Administrator thereof no later than on the effective date of the new version of the Project's Operating Terms and Conditions. By continuing to use the Project after the effective date of the new version of the Terms and Conditions, the User expresses its consent to the new version of the Terms and Conditions.

These Terms and Conditions were published on 2 September 2026.