IoneShop SaaS Terms of Service — Shop track

Does not apply to Business / Platform / Enterprise or Enterprise Secure — separate terms: /enterprise/terms (version *2.1-enterprise*).

Governing law: the laws of the Province of Alberta and federal law of Canada (to the extent applicable) Courts: courts of the Province of Alberta (Edmonton), unless mandatory law provides otherwise Binding language: Polish (language versions are informative translations unless otherwise agreed)

§ 1. General provisions

1. These Terms govern provision of the IoneShop service (“Service”, “Platform”) by:

ABSGROUP INC. (Named Alberta Corporation, Canada), registered office: 347 Hudson Bend, Edmonton, Alberta T6V 1R5, Canada; Alberta Corporate Access Number 2025055126; Canada Business Number 724018148 (“Provider”, “Operator”).

1. Contact: general / complaints / DSA — [email protected]; GDPR — [email protected]. EU representative (GDPR Art. 27) — mandate formalisation in progress: QData, Spektrum Tower, Twarda 18, 00-105 Warsaw, Poland (https://qdata.pl). Until the mandate is fully formalised, the Controller/Provider remains the contact point: [email protected] / [email protected].

1. The Service is intended exclusively for entrepreneurs (B2B) within the meaning of applicable law — natural persons conducting business activity, companies and other organisational units conducting economic or professional activity. We do not conclude consumer contracts for the Platform within the meaning of consumer protection rules, unless mandatory law provides otherwise.

1. Use of the Service requires acceptance of these Terms and — for processing of store customer data — the Data Processing Agreement (DPA) forming an annex to the order / order form (not published as a separate marketing page).

1. Related documents: Privacy Policy, Cookie Policy, DPA (order annex), pricing / plan description. Enterprise offer: /enterprise/terms.

§ 2. Definitions

§ 3. Subject of the Service

1. The Provider delivers an electronic SaaS service enabling, among other things:

- operation of an online store (storefront), - catalogue, order and configuration management in the panel, - integrations indicated in the Plan description, - hosting of Store applications in a multi-tenant model with store data isolation, - tools supporting data export / deletion (DSR) and offboarding.

1. The Provider is not a party to sales contracts between the Merchant and Shoppers, is not merchant of record vis-à-vis Shoppers and does not assume consumer seller obligations (pre-contractual information, withdrawal, statutory warranty/guarantee, retail VAT), unless a separate “marketplace / MoR” product is expressly agreed in writing.

1. Features marked as beta / preview may be unstable; the Provider will indicate status in product documentation.

1. The Provider does not represent possession of SOC 2, ISO 27001, PCI DSS or “certified GDPR/NIS2 compliance” certificates unless current evidence is provided. Marketing phrases such as “platform designed for NIS2 requirements” indicate design direction, not a legal status guarantee for the Merchant.

§ 4. Conclusion of contract

1. The contract is concluded when:

- these Terms and the DPA are accepted at registration / order and - the Provider confirms activation of the Account / Store (or automatic activation, if provided), - and in the paid model — also upon effective submission of a Plan order and (where required) payment authorisation.

1. The Provider may condition activation on identity / KYC verification, correctness of company data, absence of sanctions and fraud risk assessment.

1. The Merchant represents that registration data are accurate and that the person accepting these Terms is authorised to bind the Merchant.

1. The contract is concluded for an indefinite term with Plan billing periods or for a fixed term — according to the order.

§ 5. Technical requirements

1. Current browser supporting TLS, Internet access, active e-mail address.
2. The Merchant is responsible for password security, MFA (when available), employee accounts and API / webhook integrations.
3. The Provider may require DNS configuration updates for the Merchant’s custom domain.

§ 6. Plans, limits, payments, VAT

1. Plan descriptions, limits (products, domains, webhooks, storage, etc.) and prices are published on the Service website or in an individual offer.
2. Promo prices (e.g. first year) must be presented together with the price after the promo period — in line with fair TCO practice.
3. Payments are processed through a PSP; the Provider does not store PAN/CVV.
4. Invoices are issued according to Merchant data; the Merchant updates company details and EU VAT number (where held).
5. SaaS subscription VAT (B2B only): the Service is offered exclusively to entrepreneurs. For electronic services supplied by a non-EU provider to an EU VAT taxpayer, reverse charge usually applies — the Provider does not add EU VAT on the invoice and the Merchant accounts for VAT in its own country (Art. 196 Directive 2006/112/EC — accounting verification). Operational conditions:

- the Merchant provides a valid EU VAT number; the Provider may verify it in VIES; - on the invoice: reverse charge / Art. 196 notation; - lack of valid EU VAT → transaction may be treated as B2C (VAT / OSS obligation) — the Provider may refuse activation or require completion of data; - the Provider does not register for EU VAT as a rule solely for such B2B reverse charge sales — this does not mean “no VAT at all”, only the settlement model on the buyer’s side.

1. VAT on sales to Shoppers in Merchant stores — exclusively the Merchant.
2. Late payment: the Provider may suspend the Service after prior notice (e.g. 7–14 days), with proportionality.
3. Renewals: the Plan renews automatically for the next period unless the Merchant terminates with effect at period end (notice period: 30 days before period end, unless the Plan provides otherwise).

§ 7. Merchant obligations

1. Use the Service in compliance with EU law and laws of countries where sales are offered.
2. Hold and publish in the Store documents required by law (store terms, privacy policy, withdrawal information, complaints, seller details, prices with taxes, etc.).
3. Be controller of Shopper data and conclude a DPA with the Provider; do not instruct processing purposes contrary to law.
4. Do not upload Content violating law (including third-party IP, illegal content, phishing, malware).
5. Do not circumvent tenant isolation, scan other Stores, or conduct penetration tests without written consent.
6. Do not resell the Service as white-label without consent, unless the Plan allows it.
7. Keep access credentials confidential and promptly report suspected compromise.
8. Ensure legality of external integrations (marketplaces, ERP, marketing) and API keys.
9. Do not make false certification claims in the Store.

§ 8. Provider obligations

1. Provide the Service with professional due care.
2. Maintain Store data isolation and security measures described in documentation / Privacy Policy.
3. Provide target availability in line with published SLA (if no separate SLA — due care without 100% uptime guarantee).
4. Notify of planned work that may cause unavailability, with reasonable advance notice (incidents — without undue delay).
5. Enable export of Merchant data on offboarding in a reasonable format.
6. Process Shopper data solely as processor — in accordance with the DPA.

§ 9. Availability, support, Service changes

1. The Service is provided as-is within due care limits; maintenance includes security updates and product evolution.
2. The Provider may change Service features provided this does not deprive the Merchant of material Plan deliverables without proportional compensation / termination option.
3. Support channels and response times — according to the Plan (e.g. e-mail on business days).
4. Force majeure excludes liability for inability to perform during the event.

§ 10. Intellectual property

1. The Platform, code, IoneShop trademarks, Provider documentation — rights belong to the Provider or licensors.
2. The Merchant receives a limited, non-exclusive, non-transferable licence to use the Service during the contract — solely to operate its own Store.
3. Merchant Content remains property of the Merchant / entitled third parties. The Merchant grants the Provider a licence to host, cache, back up and process Content to provide the Service.
4. Reverse engineering beyond permitted statutory use is prohibited.
5. Open-source software used in the Platform is subject to its own licences (NOTICE / attribution).

§ 11. Personal data

1. Rules: Privacy Policy + DPA.
2. Merchant = controller of Shopper data; Provider = processor.
3. Provider = controller of Account, billing and Platform security data.
4. Sub-processor list — according to the DPA.

§ 12. Prohibited uses (Acceptable Use)

The following is prohibited in particular:

1. Illegal activity (including trade in prohibited goods/services in target jurisdictions);
2. Spam, phishing, malware distribution;
3. Multi-tenant isolation breaches / attempts to access others’ data;
4. Deliberate infrastructure overload (DoS);
5. Storing or processing card data outside the PSP;
6. Extremist content, child sexual abuse material, incitement to violence;
7. Circumventing Plan limits or billing systems.

Violation may result in immediate suspension and termination and notification of authorities.

§ 13. Moderation, DSA, reports

1. The Provider may remove or restrict clearly illegal Content after a credible report or upon authority request — following procedures under the DSA (Regulation (EU) 2022/2065) to the extent applicable to the Provider’s role.
2. Report contact point: [email protected].
3. The Merchant remains responsible for Content; Provider actions do not imply editorial control over the Store.

§ 14. Liability

1. The parties are liable on general principles with the limitations below — within limits permitted by applicable law.
2. Exclusions (B2B): to the fullest extent permitted, the Provider is not liable for:

- lost profits, data loss on the Merchant’s side due to lack of its own backups, indirect damages; - Merchant business decisions, Store content, disputes with Shoppers, Merchant tax authorities; - PSP actions, DNS registrars, Merchant connectivity providers; - effects of force majeure.

1. Cap: the Provider’s aggregate contractual liability for the 12 calendar months preceding the event giving rise to liability is limited to net subscription fees actually paid to the Provider for that period, excluding damages caused intentionally or by gross negligence, liability for death/personal injury and other non-excludable claims.
2. The Merchant is liable for damages from breach of § 7 and § 12 and for Shopper / third-party claims related to Content and sales.

§ 15. Suspension and termination

1. The Merchant may terminate with effect at the end of the billing period, observing the notice in § 6.
2. The Provider may terminate with 30 days notice or immediately for material breach (including AUP, non-payment after notice, legal risk).
3. After termination: the Merchant receives an export window (e.g. 30 days); Store data are then deleted/anonymised per the DPA, except legal retention (invoices, security logs).
4. Suspension does not release payment obligation for the period until termination where breach is on the Merchant’s side.

§ 16. Complaints (SaaS Service)

1. Service complaints: [email protected], stating company name, VAT/tax ID (if applicable), description and date of issue.
2. Response: within 14 business days (or longer if complex — with notice of extension).
3. Shopper complaints regarding Merchant goods/services — exclusively to the Merchant.

§ 17. Confidentiality

The parties keep non-public technical and commercial information obtained in connection with the contract confidential during the contract + 3 years, except public information, independently held information or information required by law.

§ 18. Changes to these Terms

1. The Provider may amend these Terms for important reasons (law, security, product development, sub-processors).
2. The Merchant is notified by e-mail / in-panel at least 14 days before effective date (longer if law requires).
3. Failure to terminate before the effective date constitutes acceptance where law permits; for materially adverse changes the Merchant may terminate with effect on the change date.

§ 19. Governing law and disputes

1. Governing law is the law of the Province of Alberta and federal law of Canada (to the extent applicable), excluding conflict rules leading to another state’s law, unless mandatory EU/EEA rules (including GDPR) provide otherwise.
2. Courts of the Province of Alberta (preferably Edmonton) have jurisdiction for B2B disputes unless law provides exclusive jurisdiction elsewhere.
3. The parties seek amicable resolution before litigation.
4. Choice of Canadian law does not exclude application of GDPR to processing of data of persons in the EU (Art. 3). If despite § 1(3) the contract were deemed consumer — the consumer retains mandatory rights of their place of residence.

§ 20. Annex — EU and Member State law framework

20.1. EU instruments (orientation)

20.2. Selected countries (Merchant B2C obligations — summary)

Merchants selling to consumers in a country should consider local transposition and practice, including:

The Platform does not replace the Merchant’s local advice for cross-border expansion.

20.3. Store language

When targeting consumers in a given country, the Merchant should provide required information in an understandable / locally required language.

§ 21. Final provisions

1. If any provision is invalid, the remainder stays in force; the parties replace it with a provision closest to the economic purpose.
2. Assignment of Merchant rights requires Provider consent; the Provider may transfer the contract to a legal successor on business sale / reorganisation, notifying the Merchant.
3. Full agreement: these Terms + order/Plan + DPA + Privacy Policy (informational scope) + any SLA annexes.
4. The electronic version at https://ioneshop.eu/terms (or successor) is the current text.

Annexes

• Annex A — Data Processing Agreement (DPA)
• Annex B — Sub-processor list
• Annex C — Order form / Plan (dynamic)
• Annex D — Acceptable Use Policy (if separated; currently § 12)

*IoneShop — Shop terms. Not legal advice.*