Terms of service — IoneShop Enterprise

Does not apply to self-serve “For shops” (Start / Growth / Pro) — see /terms (*shop* version).

1. Provider and audience

1. The Service is provided by ABSGROUP INC. (Named Alberta Corporation, Canada), 347 Hudson Bend, Edmonton, Alberta T6V 1R5, Canada — Alberta Corporate Access Number 2025055126, Canada Business Number 724018148 (“Provider”).
2. Contact: Enterprise sales — [email protected]; GDPR — [email protected]; complaints / DSA — [email protected]. EU representative (GDPR Art. 27) — mandate formalisation in progress: QData, Spektrum Tower, Twarda 18, 00-105 Warsaw, Poland (https://qdata.pl). Until the mandate is formalised, the Provider remains the contact point for data subjects and authorities ([email protected]).
3. These Terms target operators above typical single-shop scale, including:

- large online stores and omnichannel brands, - retail chains / retail groups, - holdings and corporate groups (multi-company, multi-market), - organisations with procurement, SLA/DR and compliance requirements (including NIS2-oriented design — not a legal determination of the Customer’s NIS2 status).

1. The agreement is B2B only. We do not provide the Platform to consumers.

2. Definitions

3. Subject matter and distinction from Shop offer

1. The Provider delivers a multi-tenant Platform with store data isolation and features agreed for the Plan (multi-store, multi-company, API, OMS/ERP within SOW scope).
2. The Shop offer (Start/Growth/Pro) has separate terms, different liability caps, no contractual HA/DR SLA and no Enterprise Secure — unless the Order Form states otherwise.
3. The Customer remains the merchant of record toward Shoppers unless a separate MoR product is expressly contracted in writing.
4. Prohibited: bypassing tenant isolation, scanning other tenants, illegal activity, storing PAN/CVV outside the PSP.
5. We do not make ISO/SOC2/PCI certification claims in these Terms without current evidence. PAN/CVV are not stored by the Provider.

4. Contract formation (sales-led)

1. An Enterprise agreement is formed upon signature / acceptance of the Order Form (or MSA + Order Form) and DPA — typically after demo and scope alignment.
2. The signatory represents that they are authorised to bind the Customer.
3. In case of conflict: Order Form / MSA → these Terms → Enterprise Privacy Policy (informational). Secure/SLA annexes prevail within their scope.

5. Scaling, load balancing, Capacity Band

1. Platform and Enterprise Plans (and where the Order Form so provides) include, among other things:

- load balancing of the application / edge layer maintained by the Provider, - autoscaling within the Capacity Band, - continuity / DR procedures per the SLA.

1. Autoscaling responds to load metrics to maintain agreed availability targets — it does not mean unlimited capacity without charge.
2. Sustained breach of the Capacity Band (persistent or repeated peaks) may result in:

- a proposed Band / Plan upgrade, - overage fees per the Order Form price list, - temporary protective throttling to safeguard Platform stability and other tenants — with prompt notice.

1. The Customer is responsible for spikes caused by its own load tests, scrapers or misconfigured integrations — unless solely caused by the Provider.

6. Fees, VAT, renewal

1. Fees, promotional periods and list price — only as stated in the Order Form (promotions always show the price after the promo period).
2. VAT: B2B reverse charge with valid EU VAT (VIES); without a valid number the Provider may defer activation.
3. Renewal: per Order Form (default auto-renew with 60 days’ notice before period end for Enterprise / 30 days for Business — unless the Order Form differs).

7. Customer obligations

1. Accurate KYC/billing data; compliance with laws of sales markets.
2. Own consumer-facing legal texts in B2C stores; controller role for Shopper data + DPA.
3. Security of SSO/MFA accounts, API keys, ERP/WMS integrations on the Customer side.
4. Cooperation during Incidents (24/7 contact point when Secure/IR is active).
5. No false certification claims toward Shoppers or authorities.

8. Provider obligations

1. Professional enterprise SaaS standard of care.
2. Tenant isolation, TLS, TOM measures described in documentation / security annex.
3. Availability and support — per the SLA.
4. Data export on offboarding within the agreed window (not less than 30 days unless law requires otherwise).
5. Incident notifications per DPA / SLA / Secure.

9. Data protection

1. Accounts / billing / Platform security: Provider = controller.
2. Shopper data: Customer = controller, Provider = processor (DPA).
3. Privacy policy: /enterprise/privacy. Secure programs may require additional processing / instructions.

10. Enterprise Secure (highest scope)

1. Enterprise Secure modules (including Cyber Protection Program, Incident Response, Cyber Risk Assessment, Forensics Support, Incident Cover Assist) are optional and activated only via Order Form / annex. Catalogue: /enterprise/secure. Legal terms: Secure annex (below and in Order Form).
2. Secure does not make the Provider:

- an insurer (unless the Order Form expressly identifies a policy where the Provider is a party), - a court-appointed expert, - an MSSP for the Customer’s entire IT estate outside the Platform, - a guarantor of zero Incidents or zero loss.

1. Shared responsibility: the Customer is responsible for its own systems, vendors (PSP, ESP, ERP), configurations and business decisions after risk reports.

11. Incident Cover Assist — insurance-process support

1. Within Enterprise Secure the Provider may deliver Incident Cover Assist (ICA) — support around the insurance process and Incident documentation, including in particular:

- help preparing Incident documentation for the Customer’s cyber policy, - coordination with a broker / insurer designated by the Customer, - — if the Order Form so provides — access to a group facility or a partner’s recommended insurance product (then policy terms = insurer’s terms, not these Terms).

1. The Provider is not an insurer and does not pay policy indemnities unless expressly agreed in writing in the Order Form.
2. Any Provider Incident fund / service credit (if in the Order Form) is independent of insurance and subject to the limits in Section 14.

12. Acceptable Use and DSA

No spam/phishing/malware, DoS, isolation breaches or illegal content. Reports: [email protected]. Notice-and-action steps do not mean the Provider takes editorial control of Customer stores.

13. SLA, maintenance, Force Majeure

1. Availability targets, RPO/RTO, support hours — SLA annex (/enterprise/sla).
2. Planned work may be announced via agreed channels.
3. Force Majeure excludes liability for effects during the event where due care was observed.

14. Liability (Enterprise — different from Shop)

1. Parties are liable on B2B contract principles with the limitations below — to the extent permitted by applicable law.
2. Exclusions (where lawful): lost profits, indirect damages, Customer-side data loss without agreed backups, Customer disputes with Shoppers / tax authorities, PSP and Customer network actions, Force Majeure — except wilful misconduct, gross negligence and non-excludable claims.
3. Aggregate cap on Provider liability for the 12 months preceding the event:

- default 200% of net Platform fees actually paid in that period or the amount stated in the Order Form (whichever is higher if the Order Form sets a floor), - for Enterprise Secure modules a separate sub-cap: 100% of net fees for those modules in that period (unless the Order Form states otherwise).

1. Shop caps (typically 100% of annual subscription) do not apply to Enterprise contracts — and vice versa.
2. SLA penalties / service credits count toward the cap unless the Order Form states otherwise.
3. The Customer indemnifies the Provider against claims arising from store Content, Customer’s breach of law and AUP breach — to the extent permitted.

15. Suspension and termination

1. Termination: terms in Section 6 / Order Form.
2. Material breach, non-payment after notice, legal risk — immediate suspension / termination may apply.
3. After termination: export within the contractual window, then deletion/anonymisation per DPA.

16. Governing law and disputes

1. Default: Alberta / Canada law, Alberta courts (Edmonton), unless the Order Form selects otherwise (e.g. PL law for an EU group).
2. Choice of law does not exclude GDPR (Art. 3) or mandatory EU rules.
3. Parties seek mediation / amicable resolution before litigation (30-day period).

17. Related documents

18. Changes

Enterprise Terms changes: notice ≥ 30 days before effective date; for materially adverse changes the Customer may terminate effective on the change date.

*IoneShop Enterprise Terms 2.1-enterprise. Not legal advice.*