| Case number | CAC-ADREU-008928 |
|---|---|
| Time of filing | 2026-03-29 15:59:06 |
| Domain names | ksec.eu |
Case administrator
| Organization | Iveta Špiclová (Czech Arbitration Court) (Case admin) |
|---|
Complainant
| Organization | KSEC Worldwide LTD |
|---|
Respondent
| Name | Samuel Matos |
|---|
To the knowledge of the Panel, there are no other legal proceedings pending that relate to the disputed domain name. However, the Panel is aware that the disputed domain name has been the subject of previous ADR proceedings, namely CAC-ADREU-008744, which resulted in the dismissal of the complaint for lack of earlier rights on which the Complainant could rely.
The Complainant requests the transfer of the disputed domain name <KSEC.EU> to himself based on the prior rights the Complainant claims to have in the term KSEC. The disputed domain name <KSEC.EU> was registered by the Respondent on March 26, 2022. Before Brexit, the domain name had been registered in the name of the Complainant. The Complainant is the registered holder of UK Trade Mark No. UK00003456415 for KSEC registered on 8 August 2020 as well as European Union Trade Mark No. 019151947 for the word mark KSEC, filed on 5 March 2025 and registered on 22 June 2025 in Classes 9, 16, 35, 38, 41, 42 and 45. In addition, it appears from the evidence provided by the Complainant that the disputed domain name is currently offered for sale; it resolves to a simple parking webpage where it is valued EUR 4,999.
The Complainant, Mr. Kai Castledine, argues that this Complaint is materially different from the earlier proceedings. He puts forward that he has become the registered holder of EU Trade Mark No. 019151947 for the word mark KSEC, registered on 22 June 2025 following filing on 5 March 2025, and that he is now a citizen of the European Union and therefore eligible to hold and register a .eu domain name under Article 4(2)(b) of Regulation (EU) 2019/517. The Complainant contends that his claim is supported by additional documentary evidence of prior ownership and use of <ksec.eu>, historic transactional use of the domain in 2020, pre-registration EU commercial activity, and EU-targeted advertising. He therefore argues that the present case addresses the deficiencies identified in the earlier decision on an updated legal and evidential basis.
As the previous ADR proceedings concerning the same domain name were conducted in English, and the Respondent demonstrated an ability to communicate in English, he requests that English be the language of the present proceeding. The ADR Rules permit the language issue to be dealt with procedurally, and prior English-language participation is relevant to that request.
The Complainant, Mr. Kai Castledine, is the owner of the UK trademark no. 3456415 KSEC, European Union Trade Mark No. 019151947 for the word mark KSEC, filed on 5 March 2025 and registered on 22 June 2025 in Classes 9, 16, 35, 38, 41, 42 and 45, and the founder of KSEC LTD and KSEC Worldwide LTD, businesses that operate under the KSEC brand.
According to the Complainant, the disputed domain name <ksec.eu> was legitimately owned by the Complainant before Brexit and after Brexit (March 26, 2022) it was registered by the Respondent, Mr. Samuel Matos. The Respondent is not actively using the domain name in dispute but has just listed it for sale at EUR 4,999.
The Complainant's view is that the Respondent actions constitute bad faith registration under B(11)(e) ADR Rules, which prohibits speculative domain registrations intended for resale rather than legitimate use.
The Complainant bases its claims upon the following different rights on the term KSEC:
a) UK-registered KSEC trademark (UK00003456415), actively used by KSEC LTD and KSEC Worldwide, which operate in cybersecurity, security consulting, retail, and distribution industries;
b) European Union Trade Mark No. 019151947 for the word mark KSEC, filed on 5 March 2025 and registered on 22 June 2025 in Classes 9, 16, 35, 38, 41, 42 and 45 as well as Brand recognition in EU demonstrated by the previous ownership on the <ksec.eu> domain name (before Brexit);
c) Use of the name KSEC LTD and KSEC Worldwide LTD to serve a growing EU customer base, engaging in business transactions, sales, and educational training across multiple EU countries, as well as rights under the national laws of Cyprus in the business identifier KSEC;
d) The circumstance that the KSEC brand is widely recognized in security and security consulting, with ongoing expansion efforts within the EU market.
In particular, the Complainant outlines that the inability to use <KSEC.EU> disrupts business growth, causes brand confusion among EU customers, and prevents the Complainant from operating under its established brand name in the European Union.
Before the commencement of the present proceedings there was an exchange of correspondence between the parties in which, as stressed by the Complainant, the Respondent had admitted that he checked for trademarks before registering <KSEC.EU>. This means, according to the Complainant, that the Respondent was fully aware of the KSEC brand and its prior use.
The Complainant notes that the domain name <KSEC.EU> is currently listed for sale at the excessive price of EUR 4,999 and, in his view, this constitutes bad faith according to the relevant case-law. In particular, the Complainant observes that the Respondent’s behavior matches common cybersquatting tactics, where a domain is acquired not for personal or business use but to extract money from the rightful brand owner.
Furthermore, in the Complainant's view, the Respondent has no legitimate interest in the disputed domain since he is not known by the name KSEC and does not operate a business or brand under this name and considering that he has made no attempt to develop or use the domain for any legitimate purpose while it remains simply parked and listed for sale. The Complainant also notes that a simple search for KSEC online immediately shows results for the Complainant’s businesses, further proving the Respondent’s awareness of its commercial significance and value.
The Complainant again refers to two prior ADR cases where the Respondent was found to have registered domain names in bad faith. He also claims to have established a European customer base, a history of EU-targeted advertising, cross-border sales, and ongoing EU-facing operational planning. He puts forward that the inability to operate under the exact-match domain <ksec.eu> fragments the Complainant’s branding, impairs market clarity, and interferes with the Complainant’s legitimate European expansion.
According to the Complainant, transfer is the appropriate remedy.
The Respondent also acknowledges the previous proceedings CAC-ADREU-008744 concerning the disputed domain name and questions the propriety of the Complainant's attempt to relitigate the same dispute.
The Respondent also puts forward that the EUTM relied on by the Complainant does not constitute an earlier right within the meaning of Article 4 (4) of the Regulation and Paragraph B 11(d)(1) of the ADR Rules.
The Respondent states that he has been actively engaged in the legitimate business of domain name registration and resale since 2020 and that, over this period, he has conducted numerous legitimate transactions in the domain industry. The Respondent's view is that the commercial practice of registering and reselling domains is both recognized and permitted under the applicable legal framework. In particular, the Respondent observes that, according to the relevant case-law, the mere fact that the domain is for sale is not sufficient to prove bad faith on the part of the Respondent as well as that the mere lack of active use of a domain name cannot be interpreted as bad faith use.
The Respondent also outlines that, at the time of the registration of the domain name in dispute, it was available for registration and that the same Respondent had no prior knowledge of any existing trademark for KSEC. In this context, the Respondent points out that a search for earlier KSEC trademarks protected in the European Union did not reveal any earlier rights. The mere fact that the Complainant was at one time the registered holder of the domain name <KSEC.EU> does not per se give the Complainant a right to claim the contested domain name for himself.
Furthermore, the Respondent observes that the term KSEC is generic and descriptive. This, in the Respondent's view, is evidenced by the existence of other companies and domain names operating under the term KSEC across Europe. Such widespread usage, according to the Respondent, supports the conclusion that KSEC is not exclusively associated with any single entity and does not inherently create consumer confusion or harm the goodwill of another party.
The Respondent contests the relevance of the EUTM registration relied on by the Complainant and questions the alleged EU activity and the rights which may have accrued to the Complainant as a result as well as the validity of the documents provided by the Complainant to show commercial planning for the EU.
The Respondent, in consideration of the above arguments, denies the Complainant’s assumption that he had knowledge of the Complainant's UK trademark and argues that the Complainant’s UK trademark, registered post-Brexit, does not extend protection across the European Union. Neither does the later EUTM provide such protection vis-a-vis an earlier domain name registration.
The Respondent moves that the Complaint be denied in its entirety.
A. LANGUAGE OF PROCEEDINGS
The language of these proceedings is English as jointly agreed by the parties. Therefore, the decision shall be rendered in English.
B. PREVIOUS DECISION IN CASE CAC 008744 REGARDING THE DISPUTED DOMAIN NAME <KSEC.EU>
The previous decision in case CAC-ADREU-008744 between the same parties concerning the same disputed domain name <KSEC.EU> has been acknowledged by both parties. Neither party has contested the accuracy or correctness of said decision. Instead, the Complainant has argued that the current complaint is materially different from the original Complaint, and the Respondent has put forward that the decision issued in the previous proceedings should preclude the Complainant from filing another complaint in the identical case.
According to Paragraph B 12 (a) of the ADR Rules, the decision making in .eu ADR proceedings is subject to the following provisions:
The decisions of the panellists shall be final, not subject to appeal, and compulsory for the Parties, without detriment to the right of the Parties to initiate a court proceeding in a Mutual Jurisdiction with consequences for implementation of the decision as described in the Terms and Conditions. A Party initiating a court proceeding shall notify the Provider and the Registry thereof within thirty (30) days of the Parties being notified of the decision. In the absence of such notification, the Registry shall consider the decision to be final and shall implement the decision.
In the case at hand, neither party has questioned the previous decision. For that reason, the Panel had to examine whether the Complainant was entitled to refile the complaint rather than initiating a court proceeding as described in the above cited Paragraph B 12 (A) of the ADR Rules.
The Complainant argues that this is the case since he has in the meantime
(i) become an EU citizen,
(ii) acquired rights in an EUTM and
(iii) relies on the laws of Cyprus to establish earlier rights under the .eu ADR Rules and the Supplemental ADR Rules.
The Panel finds that the arguments put forward could establish a material difference between the two cases and allows the case to go forward. However, since neither party to these proceedings challenged the accuracy or correctness of the previous decision, the Panel has decided that the findings relating to the original case are valid and will be adopted in this case.
C. MERITS OF THE CASE
In order for the complaint to succeed, the Complainant must still demonstrate that the requirements of Article 4.4 of Regulation (EU) 2019/517 (the “Regulation”) and Paragraph B11(d)(1) of the ADR Rules are satisfied. In order for the complaint to succeed, the Complainant must therefore show that:
(a) the disputed domain name is identical with or confusingly similar to a name in respect of which a right is established by Union or national law; and either
(b) the disputed domain name has been registered by its holder without rights or legitimate interest in the name; or
(c) the disputed domain name has been registered or is being used in bad faith.
C.1. RIGHTS OF THE COMPLAINANT
According to Recital 17 Regulation (EU) 2019/517 of the European Parliament and of the Council of 19 March 2019 on the implementation and functioning of the .eu top-level domain name and amending and repealing Regulation (EC) No 733/2002 and repealing Commission Regulation (EC) No 874/2004 (“the Regulation”), an ADR procedure may be initiated by any party where the registration is speculative or abusive.
According to Article 4 (4) of the Regulation and Paragraph B 11(d)(1) of the ADR Rules, the Complainant bears the burden of proving the following circumstances:
- the disputed domain name is identical with or confusingly similar to a name in respect of which a right is established by the national law of a Member State and/or European Union law; and either
- the disputed domain name has been registered by the Respondent without rights or legitimate interest in the name; or
- the disputed domain name has been registered or is being used in bad faith.
The Complainant based the complaint upon the following previous rights:
-
UK-registered KSEC trademark (UK00003456415);
-
Brand recognition in EU demonstrated by the previous ownership on the <ksec.eu> domain name (before Brexit);
-
Use of the name KSEC LTD and KSEC Worldwide LTD to serve a growing EU customer base, engaging in business transactions, sales, and educational training across multiple EU countries, as well as rights under the national laws of Cyprus in the business identifier KSEC;
-
EUTM No. 019151947 for the word mark KSEC, filed on 5 March 2025 and registered on 22 June 2025 in Classes 9, 16, 35, 38, 41, 42 and 45.
The Panel comes to the following conclusions regarding these alleged rights:
a. As previously decided, UK registered trademark KSEC No. UK00003456415 is not a right established by the European Union or under a national law of the Member States.
b. With reference to the alleged brand recognition in the European Union, it must be carefully noted that the mere previous ownership of the domain name <ksec.eu> is insufficient in order to demonstrate brand recognition in the European Union.
c. With reference to the use of the term KSEC in the European Union invoked by the Complainant it must be considered Article 9 (2) of Regulation (EU) 2020/857 of 17 June 2020 ("the Implementing Regulation") since it lists the rights on which the complaint may be based as follow: "copyright, trademarks, and geographical indications provided in Union or national law, and, in as far as they are protected under national law in the Member States where they are held: unregistered trademarks, trade names, business identifiers, company names, family names, and distinctive titles of protected literary and artistic works".
Paragraph B 1(b)(9) of the ADR Rules states that: "the complaint shall specify the names in respect of which a right is recognized or established by the national law of a Member State and/or Community law. For each such name, describe exactly the type of right(s) claimed, specify the law or law(s) as well as the conditions under which the right is recognized and/or established".
Like in the previous case, the Complainant again failed to clearly indicate what earlier rights he is relying on in his complaint as filed. The Additional Submission filed by the Complainant after the Response to the complaint had already been received contains no facts or evidence which the Complainant could not have filed with the original complaint.
The Complainant has provided neither “good reason” nor has he proved “exceptional circumstances” justifying such a late submission, reasons for which Panels have admitted such submissions into proceedings in the past. Nor did the other party to the proceedings file a late response – another reason previously cited by Panels for admitting late submissions into the proceedings.
On the contrary, the Complainant, being fully aware of the reasons for the decision of the previous complaint, once again failed to provide the necessary information to establish the earlier rights he may have been relying on.
For that reason, there is no reason for the Panel to admit such additional submissions into the proceedings and concludes that such rights were not established.
For the sake of completeness, however, the Panel wishes to point out that the rights relied upon are business identifiers or company names as far as they are protected under the national law of the member state where they are held which, in this case, are claimed to have been established in the Republic of Cyprus. Having closely examined the evidence provided un the additional submission, the Panel comes to the conclusion that no such rights have been substantiated.
The Complainant provides no evidence of the applicable laws other than a very generic and cursory statement that these are to be construed in favor of the claim. What is even more striking is that there is no evidence of the actual use of such company names or business identifiers in the Republic of Cyprus in any relevant way. The documents provided to show that there was commercial activity in the EU prior to the registration of the disputed domain name show no orders, no targeted digital advertising between 2020 and 2025, no specific EU operational planning for Cyprus and no reference to Cyprus in the European Web Traffic and User Base for 2026.
The only reference to commercial activities the Republic of Cyprus are supposed sales amounting to less than GBP 200.00 during the five years from 2021 to 2025. These figures were not corroborated by invoices or similar documents and are deemed commercially insignificant. This is clearly not sufficient to establish an earlier right within the meaning of the ADR Rules. The fact that the Complainant engaged Cyprus based legal counsel in April 2025 to assist with citizenship matters is also no evidence of earlier business identifiers or company names protected under the laws of the Republic of Cyprus.
The fact that the Complainant has provided a document entitled “Evidence of EU Operational Planning and Expansion Strategy” which may or may not have been drafted making use of AI tools and which states that a “Cyprus holding company, with its registered office established at the Complainant’s Cyprus solicitors’ address in Nicosia” is supposedly in existence is neither evidence nor in any way compelling, in particular since the Complainant failed to provide any evidence of such registration or, even more importantly, of the name of the supposed holding company, which may or may not be the name provided as the address of the complainant.
The Complainant has therefore once again failed to (i) prove to have said relevant right and (ii) establish that said relevant right is protected under the law of a Member State although the onus to do so obviously rests with the complainant (see CAC Case No 07951 Philippe Dumas v. Naden Badalgogtapeh). As highlighted by other panels (see CAC Case No 03239 Euro Suisse International Ltd, Mr Disby Tang v. Lehigh Basin Ltd), paragraph B 11 (d) of the ADR Rules makes it clear that ultimately the burden of proving the requirements of Article 4 (4) of the Regulation rests upon the complainant. It is therefore the minimum expectation under the ADR Rules that the complainant puts forward a prima facie case to the effect that a domain name should be subject to revocation. It is not sufficient for a complainant merely to assert that the requirements of the above-mentioned Article 4 (4) have been satisfied and to leave it to the panel to investigate whether this is correct.
As stated in the previous decision concerning the disputed domain name, being in the process of starting a business in the European Union is different from having established rights in the European Union which implies the fact that, in some way, the right is recognizable by European Union consumers and in any case such recognizability must be demonstrated by the Complainant. The fact that the Complainant has failed to demonstrate the recognizability of his rights in the European Union means that he has not satisfied his onus probandi.
d. European Union Trademark No. 019151947 for the word mark KSEC had already been relied on during the previous proceedings as an application. It has since matured to registration on 22 June 2025 and is protected in Classes 9, 16, 35, 38, 41, 42 and 45. The trademark was applied for on March 5, 2025, almost three years after the registration of the domain name in dispute and immediately before the filing of original complaint filed by the Complainant in the previous proceedings.
However, the Complainant has once again failed to meet the burden of proof. While the complaint was filed with a copy of the registration certificate of the earlier UK trademark registration which is of no relevance to this case, no such evidence was filed concerning the registration of the EUTM on which the Complainant relies in these proceedings.
Therefore, the Panel finds that the Complainant has not provided evidence that he is the holder of a valid prior right in the European Union in the name KSEC through EUTM No. 019151947. KSEC.
Therefore, the Panel comes to the conclusion that the Complainant has not provided evidence of the existence of earlier rights and the Complaint must also be denied on these grounds.
For the sake of further clarity, the Panel will consider whether evidence of the registration of the EUTM would have given the Panel grounds to rule in the Complainant’s favor.
C.2. SIMILARITY
To do so, the Panel must next assess whether the disputed domain name <KSEC.EU> is identical or confusingly similar to the Complainant’s EUTM KSEC. It is common practice to discount the top level TLD .EU in this comparison, leading to the trademark KSEC and the remaining letters of the disputed domain name to be compared. These are identical and the disputed domain name and the earlier trademark are therefore identical.
C.3. RIGHTS OR LEGITIMATE INTEREST
The Complainant has put forward that the disputed domain name is being offered for sale and that the Respondent has neither rights nor legitimate interest in the name. However, acquiring domain names for the purpose of investment and resale is not inherently illegitimate under .eu case law, provided the domain name is selected for its intrinsic qualities and not to target a rights holder. The Respondent has stated that he carried out a search for earlier trademarks protected in the European Union for KSEC prior to the filing of the disputed domain name and found no relevant registrations. Additionally, he produced evidence of a broader portfolio of unrelated third-party KSEC domain name registrations which exist in various domain name registers.
In a case such as this, where the assessment of legitimate interest turns on whether a domain name was selected because of its association with a particular rights holder, that inquiry necessarily overlaps with the question of bad faith. In the present case, the Panel examines the question of legitimate interest to the extent that it forms its assessment of targeting and bad faith, rather than as a wholly separate inquiry.
C.4. REGISTRATION OR USE IN BAD FAITH
The central issue to be examined in this case is whether the Respondent registered or used the disputed domain name with knowledge of the Complainant’s use of the letter sequence KSEC or with the intention of exploiting its commercial identity.
The disputed domain name has always been a neutral parking page offering the domain name for sale. There is no evidence of impersonation, diversion, or solicitation of the Complainant. Although the price of a domain name and the absence of use may, in conjunction with other factors, support an inference of bad faith, those factors are not sufficient on their own.
The Respondent's submission confirms that he has not registered any additional "KSEC” variants, and that the disputed domain name sits within a broader portfolio of registrations. This is inconsistent with a strategy of targeting the Complainant's business identifier or company name specifically at the time or registration of the disputed domain name or of using the domain name in bad faith following the registration of the Complainant’s EUTM.
The Respondent argues that the disputed domain name has not been used to impersonate the Complainant, redirect internet users to competitors, display content referring to the Complainant, create confusion with the Complainant’s business, or interfere with the Complainant’s operations. This has not been contested by the Complainant.
The Complainant has not demonstrated EU-wide notoriety from which knowledge could properly be imputed to the Respondent. The Complainant's allegation of a pattern of abusive registrations has also not been sufficiently substantiated.
The Complainant may have held rights in the name “KSEC” prior to the United Kingdom’s departure from the European Union. It is apparent that the Complainant considers that these rights were extinguished along with the United Kingdom’s membership of the EU as a result of Brexit. However, other panels have held, e.g. in CAC Case 008734 Nicholas Robert Sutton v. Colin McCluskey (Sutton Services), that pre-Brexit holders rights are expressly saved by art. 19 of the Regulation (EU) 2019/517 of the European Parliament and of the Council of 19 March 2019 on the implementation and functioning of the .eu top-level domain name and amending and repealing Regulation (EC) No 733/2002 and repealing Commission Regulation (EC) No 874/2004: "Article 19 Transitional provisions” states expressly:
- Domain name holders that have domain names that were registered pursuant to point (b) of Article 4(2) of Regulation (EC) No 733/2002 shall
“retain their rights in relation to the existing registered domain names. "
Therefore, there was no reason to forgo the registration of the disputed domain name. It is now neither the purpose nor the intent of .eu ADR proceedings to rectify such situations and it cannot be the task of this Panel to allow the Complainant to repeatedly attempt to claim rights in a domain name which were lost at an earlier time, and which no longer exist.
Having reviewed all the evidence provided, the Panel is not satisfied that the Respondent registered or used the disputed domain name in bad faith. In those circumstances and having regard to the structure of Article 4(4) of the EU Regulation, the Panel is not required to reach a separate, standalone determination under Article 4(4) of the EU Regulation, beyond its analysis already undertaken in connection with targeting and bad faith.
The only decision which can be taken as a result of late filing of the additional submission, the lack of evidence of the existence of relevant rights, of national law and relevant commercial activity is to deny the Complaint on both procedural grounds and on its merits.
Complainant's Eligibility
The Complainant is a natural person who purports to be residing in what could be a company address in the Republic of Cyprus but corresponds from what appears to clearly be a residential address in the United Kingdom. The Complainant claims that he is now a citizen of the Republic of Cyprus.
However, the only documentation provided by the Complainant in that regard is a document drafted in the Greek language with neither a translation of that document, nor an explanation provided. This is not sufficient to prove that the Complainant now satisfies the general eligibility criteria for registration set out in Article 3 of the Regulation and the Complaint would need to be denied on these grounds as well. However, in view of the above findings, this is of no relevance for this decision.
For all the foregoing reasons, in accordance with Paragraphs B12 (b) and (c) of the Rules, the Panel orders that the Complaint is denied.
PANELISTS
| Name | Udo Pfleghar |
|---|