Privacy policy — IoneShop Enterprise

Does not replace the Shop privacy notice (/privacy, *shop* version). Applies in the EEA and for services directed at organisations in the EU/EEA/UK (to the extent permitted by law).

1. Controller and contact

Controller of personal data in the scope below:

ABSGROUP INC. (Named Alberta Corporation, Canada) Registered office: 347 Hudson Bend, Edmonton, Alberta T6V 1R5, Canada Alberta Corporate Access Number: 2025055126 · Canada Business Number: 724018148 Registration date (Alberta): 2023-03-30 GDPR email: [email protected] Enterprise sales: [email protected] General / complaints / DSA: [email protected]

EU representative (GDPR Art. 27) — mandate formalisation in progress: QData, Spektrum Tower, Twarda 18, 00-105 Warsaw, Poland Website: https://qdata.pl Until the mandate is formalised, the Controller remains the contact point for supervisory authorities and data subjects ([email protected]). Once the mandate is formalised, QData acts as representative under Art. 27 — alongside the Controller.

Product: IoneShop Enterprise track (landing, demo, MSA/Order Form, multi-company admin, API, Secure programs).

A DPO is not currently appointed (Art. 37). Art. 27 representative ≠ DPO.

2. Scope and definitions

2.1. Scope

This policy describes processing in connection with:

1. Enterprise site (demo, procurement contact, Business / Platform / Enterprise pricing, Secure);
2. SaaS accounts of the Customer’s staff and partners (multi-store / multi-company, SSO/OIDC, RBAC);
3. B2B contracts (MSA, Order Form, SOW, SLA / Secure annexes), billing and collection;
4. Support, SLA, Incidents and Enterprise Secure programs (CPP, IR, CRA, FS, ICA);
5. Processor role for end-customer (Shopper) data in Customer stores — under the DPA.

2.2. Definitions

3. GDPR roles

We are not the merchant of record for Customer store sales and not the controller of Customer shopper marketing, unless a separate agreement says otherwise.

The Customer is responsible for its own B2C store privacy policies and processor instructions.

4. Categories of data subjects and data

4.1. Enterprise landing visitors

• Technical data: IP, user-agent, timestamps, referrer URL, session identifiers;
• Demo / contact forms: name, company, work email, phone, message, scope preferences (SKU, markets, Secure);
• Cookie / landing variant / UI theme preferences;
• Analytics / marketing — only after consent (if enabled).

4.2. Customer representatives (Enterprise SaaS users)

• Identity and contact: name, job title, email, phone;
• Company / group company details: name, address, VAT, billing data, multi-company structure;
• Account: login, OIDC/SSO identifiers, RBAC roles, access and audit logs;
• Billing: subscription history, payment status (no PAN/CVV — PSP tokens);
• Support, SLA / IR ticket correspondence;
• Incident contact points (when Secure/IR is active);
• Security metadata (login IP, MFA, authentication events).

4.3. Shoppers (processor)

We process only on the Customer’s behalf, including order and account data, marketing preferences set by the Customer, session data needed for checkout and returns. We do not store PAN/CVV.

4.4. Enterprise Secure data

• CPP / IR: Platform security logs, alerts, Incident timeline, PIR;
• CRA: questionnaire answers, workshop notes, recommendation report;
• FS: Platform logs/artefacts preserved for forensics (within retention window);
• ICA: data sent to broker or insurer on Customer instruction (Incident documentation, contact details).

5. Purposes and legal bases (Art. 6 GDPR)

5.1. As controller

5.2. As processor

Customer contract + DPA. Bases toward Shoppers are set by the Customer.

6. Provider information

We publish company details and contacts on the Platform. Complaints: [email protected]. Enterprise: [email protected].

7. Recipients and sub-processors

Data may be disclosed to:

1. EEA infrastructure providers (hosting, DNS, CDN, storage) — EEA preferred;
2. ESP, monitoring, IdP (OIDC);
3. PSP (subscription and Shopper payments per Customer choice);
4. Legal / accounting / audit advisers under confidentiality;
5. Forensic firms designated by the Customer (FS) — on instruction;
6. Broker / insurer (ICA) — on Customer instruction and Order Form variant;
7. Public authorities — where legally required;
8. Business successor — in a transfer (with notice where required).

The sub-processor list is provided only in the DPA annex or Order Form — we do not publish a separate marketing page with the full list. Sub-processor changes: notice per DPA (usually 14–30 days).

This policy is not a SOC 2, ISO 27001, PCI DSS or “GDPR certificate” claim.

8. Transfers outside the EEA

We aim to process in the EEA by default. Transfers outside the EEA use Art. 44–49 mechanisms (adequacy, SCCs, TIA where required), as stated in the DPA / Order Form annex.

9. Retention (indicative)

10. Data subject rights

Including access, rectification, erasure, restriction, portability, objection, withdraw consent, lodge a complaint with a supervisory authority (UODO, CNIL, AEPD, Garante, AP, IMY, DPC, etc. — EDPB list: https://edpb.europa.eu/).

Platform / Enterprise account requests: [email protected] (and QData once the mandate is formalised). Shopper requests: to the Customer (controller). We support DSR tooling under the DPA — we do not replace the Customer toward shoppers.

11. Cookies

Details: /enterprise/cookies. Essential cookies without marketing consent. Analytics/marketing after consent. Reject as easy as accept.

12. Security

Measures appropriate to multi-tenant enterprise SaaS risk, including tenant schema/DB isolation (within the model), TLS, secrets at rest, SSO/MFA, RBAC, admin audit, LB/autoscaling/HA within Capacity Band and SLA, Secure programs when active, no PAN/CVV. No absolute security warranty; no certificate claims without evidence.

13. Personal data breaches

As controller: notify the authority without undue delay, where feasible within 72 hours (Art. 33); data subjects when Art. 34 applies. As processor: notify the Customer without undue delay (DPA / Art. 33(2)). With IR active: channels and times per SLA / Order Form.

14. Profiling and automated decisions

No Art. 22 solely automated decisions producing legal effects for Customers, except fraud/abuse controls (e.g. suspension) with a contact path. AI features (if any) are assistive; Customer accepts outputs.

15. Children

Enterprise is for businesses only. Store age policies are the Customer’s responsibility.

16. EU member-state notes

GDPR applies directly; national ePrivacy and DPAs add detail. DSA reports: [email protected]. Cross-border B2C legal texts remain the Customer’s duty.

17. Related documents

Order Form and Secure/SLA annexes prevail for those modules if they conflict.

18. Changes

Material changes: publish a new version and email Customers when the contract or law requires. Effective date is in the header.

19. Contact

Privacy: [email protected] Enterprise: [email protected] General / DSA: [email protected] EU representative (mandate formalisation in progress): QData, Spektrum Tower, Twarda 18, 00-105 Warsaw, Poland

*IoneShop Enterprise Privacy Policy 2.2-enterprise. Not legal advice.*