These Terms of Service (“Terms”) govern your access to and use of the CyberLuka cybersecurity game platform at cyberluka.com(the “Service”). By creating an account, redeeming a voucher, paying for a game, or otherwise using the Service, you agree to these Terms.
CyberLuka is based in the Netherlands and operates under Dutch and EU law.
1. Parties
These Terms form an agreement between CyberLuka (“CyberLuka”, “we”, “our”) and the person or organisation creating the account (“you”, “Customer”). If you register on behalf of a company or other organisation, you warrant that you are authorised to bind that entity and “you” refers to that entity.
2. The Service
CyberLuka is a Software-as-a-Service platform that lets you configure and deploy Capture-the-Flag (CTF) cybersecurity games. When you create a paid game, we automatically provision the necessary cloud infrastructure, make the game available to your players for the duration of your tier, and destroy the infrastructure afterwards.
Development phase notice. The Service is currently in an active development phase. Features are added and improved frequently. While we take reasonable steps to ensure availability, we do not offer a specific uptime SLA at this stage. We recommend not relying on the Service for time-critical events without confirming availability with us in advance.
3. Accounts
- You must register with a genuine business email address. Personal free-mail domains (e.g. Gmail, Yahoo, Hotmail) are not accepted at registration.
- You may hold one account per person.
- You are responsible for the confidentiality of your credentials and for everything done under your account.
- You must verify your email address to activate your account.
Who the Service is for. The Service is designed for business and professional use (B2B). The business-email requirement reflects this. Where a consumer nevertheless enters into a contract with us, the consumer-specific rights set out in these Terms (in particular sections 6, 11, 12, and 15) apply, and any provision that conflicts with mandatory consumer-protection law is read down to the extent necessary to comply with that law.
4. Players invited by you (data processing)
When you create a game and invite players, you are the data controller for the personal data of those players and CyberLuka is your processor within the meaning of Article 4(8) GDPR. By using the Service you instruct CyberLuka to process player personal data on your behalf on the terms set out in this section, which together form the data processing agreement required by Article 28(3) GDPR.
4.1 Subject matter, duration, nature and purpose
- Subject matter: processing of player personal data to operate, maintain, and support the games you configure on the Service.
- Duration: for as long as your account is active, plus the retention periods set out in our Privacy Policy.
- Nature and purpose: hosting, authentication, progress tracking, leaderboard generation, anti-abuse, and security monitoring of CTF games.
4.2 Categories of data and data subjects
- Data subjects: the players you invite to your games.
- Categories of personal data: player username, hashed password, optional email, IP address, browser/device metadata, game activity (challenges attempted, flags submitted, scores, timestamps).
- No special-category data is processed by the Service. You undertake not to instruct or configure the Service to process special-category data within the meaning of Article 9 GDPR.
4.3 Our obligations as processor
CyberLuka will:
- process player personal data only on your documented instructions, including with regard to international transfers, except where required to do so by EU or Member State law (in which case we will inform you unless that law prohibits notification);
- ensure that personnel authorised to process the data are bound by appropriate confidentiality obligations;
- implement appropriate technical and organisational measures within the meaning of Article 32 GDPR, summarised in our security documentation available on request;
- assist you, taking the nature of processing into account, in fulfilling your obligations to respond to data-subject requests (Articles 12–23 GDPR);
- assist you in complying with Articles 32–36 GDPR (security, breach notification, DPIA, prior consultation), taking into account the nature of processing and the information available to us;
- notify you without undue delay after becoming aware of a personal data breach affecting player data;
- at your choice, delete or return all player personal data after the end of the provision of the Service, and delete existing copies unless EU or Member State law requires storage;
- make available all information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by you or another auditor mandated by you, on reasonable notice and subject to confidentiality.
4.4 Sub-processors
You give general written authorisation for CyberLuka to engage sub-processors to deliver the Service. Our current sub-processors (including Microsoft Azure for hosting, Stripe for payments, and our email provider) are listed at /sub-processors. We will notify you of intended changes to that list at least 30 days in advance and you may object on reasonable data-protection grounds; if we cannot accommodate your objection you may terminate the affected games and obtain a pro-rata refund of unused fees.
4.5 International transfers
Player personal data is processed in the European Union by default. Where a sub-processor processes data outside the EEA, transfers are carried out under an adequacy decision or the EU Standard Contractual Clauses, supplemented by the technical and organisational measures described in our security documentation.
4.6 Your responsibilities as controller
You are responsible for informing your players how their data is used, obtaining any consents your jurisdiction requires, and ensuring you have a lawful basis under Article 6 GDPR for inviting them to the Service. A separate signed Data Processing Agreement is available on request at privacy@cyberluka.com; in the event of conflict between this section and a signed DPA, the signed DPA prevails.
5. Plans and payment
- Prices, limits, and features for each plan are published at /pricing. Prices are exclusive of VAT where applicable; VAT is added at checkout based on your location.
- Payments are processed by Stripe. We do not store card numbers. By paying, you also accept Stripe’s terms.
- Prices may change from time to time. Any change takes effect only for games created after the change; games already paid for are unaffected.
- Launch pricing.Where we display a launch price alongside a regular price as a price reduction, the regular price shown is the lowest price applied by us in the 30 days before the reduction, in line with Article 6a of Directive 98/6/EC (as amended by Directive (EU) 2019/2161). The launch promotion is at CyberLuka’s discretion and may end at any time. Games already paid for keep the price charged at checkout.
- Vouchers, where issued, are redeemable for the specified plan, cannot be exchanged for cash, and expire as indicated when issued.
- The Custom Event plan is priced on request via the contact form and is not available through self-service checkout.
- Founding 10 Program. A limited launch program offers a permanent percentage discount to the first ten customers, identified by CyberLuka invoice number 001 to 010. The program is governed by separate Program Rules at /founding-10, which form part of these Terms once you become eligible.
6. Withdrawal, refunds, and digital content
Consumer right of withdrawal. Under the EU Consumer Rights Directive (Directive 2011/83/EU), consumers have a 14-day right to withdraw from contracts for digital services. The Service provides digital content that is performed immediately upon game deployment.
At checkout we ask you to (i) expressly consent to immediate performance and (ii) acknowledge that, in accordance with Article 16(m) of the Directive, you lose your right of withdrawal once the game has been deployed and accessed by any player. We confirm both on a durable medium (your order confirmation email). If you do not give these consents, deployment will not start and you will retain the full 14-day withdrawal right.
Refunds — failed deployment. You are entitled to a full refund if game deployment fails due to a fault on our side and the game was never accessed by any player. Requests must be made within 14 days of the failed deployment at billing@cyberluka.com.
Refunds — material defect during play. If a game is deployed and accessed but a defect attributable to us prevents normal use of the Service for a continuous period of more than 30 minutes during the active game window (for example, a country becomes unreachable, the leaderboard fails to update, or authentication is unavailable), we will, at our discretion and proportionate to the disruption, either: (a) extend the game window by an equivalent period; (b) issue a service credit redeemable against a future game; or (c) issue a partial refund. Requests must be made within 14 days of the affected game ending.
Outside the cases above, payments for deployed and accessed games are non-refundable. This does not affect your statutory rights as a consumer where those rights cannot be waived.
Business customers. If you are acting in the course of a business or profession (B2B), the consumer-specific 14-day withdrawal right does not apply. The refund and service-credit provisions in this section still apply.
7. Acceptable use
You agree that you will not, and will not allow anyone to:
- use the Service for any illegal purpose or in breach of applicable law;
- use the Service to attack, scan, or otherwise interact with any system, network, or person outside the CTF environment we provision for you;
- submit real credentials, personal data, or confidential company information as flag values or inside lab inputs — labs are educational simulations;
- attempt to reverse engineer, extract, redistribute, or sell the CTF lab source code or platform source code;
- share flag values or lab solutions publicly in a way that undermines the educational use of the Service;
- circumvent usage limits, rate limits, or access controls;
- upload or submit malware, or use the Service to develop or distribute malware outside a designated lab exercise;
- impersonate any person or entity, or misrepresent your affiliation.
8. Intellectual property
The Service, the CTF lab catalogue, and all associated content (code, designs, text, images, trademarks) are owned by CyberLuka or its licensors. These Terms grant you a limited, non-exclusive, non-transferable licence to use the Service and to run the lab content for the duration of the games you have paid for. No other rights are granted.
Content you submit (game names, team names, configuration) stays yours. You grant CyberLuka the rights needed to host, display, and operate that content as part of the Service.
9. Availability and support
We make reasonable efforts to keep the Service available but do not guarantee uninterrupted operation. We may perform maintenance, upgrades, or emergency interventions that temporarily affect availability. Support is provided by email at support@cyberluka.com with reasonable-effort response times during business hours (Europe/Amsterdam).
10. Suspension and termination
We may suspend or terminate your access to the Service if you materially breach these Terms, abuse the Service, or use it to harm others. Where possible we will give notice and a chance to cure. You may stop using the Service and request account deletion at any time.
On termination, the licence to use the Service ends and active games may be ended early. After a game ends, the underlying cloud infrastructure is destroyed within the timeframe set out in our product documentation; player accounts, leaderboard entries, and game-activity records are retained only for the periods described in our Privacy Policy. Personal data associated with your creator account is retained as set out in the same policy.
11. Warranties and disclaimers
The Service is provided on an “as is” and “as available” basis. To the fullest extent permitted by law, we disclaim all implied warranties including merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the Service will be error-free, uninterrupted, or meet any specific security objectives beyond those explicitly agreed in writing.
Consumers. If you are a consumer, nothing in this section limits your statutory conformity rights under Directive (EU) 2019/770 on digital content and digital services, or any equivalent rights under the law of your country of residence that cannot be waived by contract.
12. Limitation of liability
To the fullest extent permitted by law:
- our total aggregate liability to you in any 12-month period — across all claims, whether in contract, tort (including negligence), breach of statutory duty, or otherwise — is capped at the total amount you paid us for the Service in that period;
- if you are on the Free plan and have therefore paid nothing, our total aggregate liability to you across all claims arising from your use of the Free plan is capped at €1;
- we are not liable for indirect or consequential loss, including loss of profit, revenue, business, data, goodwill, or anticipated savings, even if we were advised of the possibility of such loss;
- nothing in these Terms excludes or limits liability for intent, gross negligence (opzet of bewuste roekeloosheid), death or personal injury caused by our negligence, fraudulent misrepresentation, or any other liability that cannot be excluded or limited under mandatory Dutch or EU law — including, where applicable, your statutory rights as a consumer and your rights under Article 82 GDPR.
13. Indemnity (business customers)
If you use the Service in the course of a business, you agree to indemnify CyberLuka against reasonable third-party claims and costs arising from your breach of these Terms or your unlawful use of the Service. This clause does not apply to consumer customers.
14. Changes to these Terms
We may update these Terms. Material changes will be notified by email at least 30 days before they take effect. If you do not agree to a material change, you may terminate your account before the effective date by emailing support@cyberluka.com; in that case any unused prepaid amounts will be refunded on a pro-rata basis. Continued use of the Service after the effective date constitutes acceptance of the updated Terms. Non-material changes (such as clarifications or updates to contact details) take effect on publication.
15. Governing law and jurisdiction
These Terms are governed by Dutch law. The courts of the Netherlands have exclusive jurisdiction over any dispute, except that consumers may also bring proceedings in the courts of their own country of residence, as required by EU consumer-protection rules.
EU consumers may also use the online dispute resolution platform at ec.europa.eu/consumers/odr. We are not obliged to, and generally do not, participate in alternative dispute resolution procedures.
16. About CyberLuka and contact
The Service is operated by:
- Tiago Madureira Teles, handelend onder de naam CyberLuka
- Jacob van Lennepkade 155 H, 1054 ZL Amsterdam
- The Netherlands
- Chamber of Commerce (KvK) number: 42047021
- VAT identification number: NL005455936B86
Questions about these Terms: info@cyberluka.com. Billing: billing@cyberluka.com. Privacy: privacy@cyberluka.com.