Framme Shop Service Terms

1.1 The Framme Shop Subscription Agreement accepted by Customer, these Service Terms (including Section 25, Products and fulfilment), the Data Processing Terms and the Acceptable Use Policy, each in the version identified in the Subscription Agreement (together, the "Agreement"), govern Customer’s subscription to and use of Framme Shop, including the Services, the Programs, Technical Support Services and any Additional Services (each as defined in Section 2).

1.2 Framme Shop is the only Framme product covered by this Agreement. References to "the Service", "the Platform" or similar refer to Framme Shop and its standard customer-facing integrations described in Section 13. No other Framme product, tool or internal system is licensed or made available under this Agreement. This Agreement governs Customer’s use of Framme Shop under the Professional or Enterprise Plan; free Solo accounts on framme.com (consumer accounts that do not include a Customer Shop, sourcing or Magic Link Orders) are governed separately by the Framme Shop Terms at framme.com/terms and are not subject to this Agreement.

1.3 Framme may make available to Customer certain value-added services ("Additional Services") which may be provided by Framme or by its affiliates or strategic partners. Where Additional Services are subject to separate fees they are governed by an additional Subscription Order or work order incorporating this Agreement.

1.4 This Agreement also governs the technical consultancy work needed for implementation, set-up of the Service and onboarding of Customer Materials, where such consultancy is identified in a Subscription Order.

Capitalised terms not otherwise defined have the meanings set out below.

Acceptable Use Policy means the policy published at framme.com/aup, in the version identified in the Subscription Agreement.

Affiliate means any entity that controls, is controlled by, or is under common control with a Party, where control means ownership of more than 50% of the voting securities or the equivalent power to direct management.

Collection means Framme’s standard catalogue of products offered through Framme Shop.

Confidential Information means any information disclosed by one Party to the other that is marked as confidential or that a reasonable person would understand to be confidential by its nature, including trade secrets, technical data, designs, business plans, customer lists, pricing, source code, security information, and the existence and terms of this Agreement.

Customer Data means data that Framme and its sub-processors process or store on behalf of Customer in connection with the Services, including Personal Data and Customer Materials.

Customer Credentials means usernames, passwords, API keys, magic-link tokens, signed URLs and other access credentials issued to Customer or generated for Customer’s Users.

Customer Materials means designs, artwork, fonts, typography, symbols, layouts, logos, prototypes, photography, copy, product specifications and other materials supplied by Customer to be reproduced, hosted, listed for sale, fulfilled or otherwise used through Framme Shop.

Data Controller, Data Processor, Personal Data, Processing, Data Subject and Sub-processor have the meanings given in the GDPR.

Data Protection Laws means all data-protection and privacy laws and regulations applicable to a Party’s processing of Personal Data under this Agreement, including the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), the e-Privacy Directive (2002/58/EC) and any successor or implementing legislation in the European Economic Area, the United Kingdom or any other applicable region.

Effective Date means the date on which Customer accepts this Agreement (including the Subscription Agreement) in accordance with Section 21.

Fees means the Subscription Fee and all other charges payable by Customer under the Subscription Agreement and this Agreement.

Force Majeure means events beyond the reasonable control of the affected Party including fire, earthquake, flood, embargo, war, riot, strike, lockout, pandemic, large-scale internet outage, denial-of-service attack, or act or omission of a governmental authority, in each case where the affected Party uses reasonable efforts to mitigate the event.

Framme Shop or the "Platform" means the customer-facing e-commerce platform owned and operated by Framme, including the Programs and the standard integrations described in Section 13.

Intellectual Property Rights means all patents, utility models, copyright and neighbouring rights, design rights, trademarks, service marks, domain names, database rights, rights in confidential information and know-how, and all other intellectual property rights worldwide, in each case whether registered or unregistered.

Magic Link Order means an Order placed by an invited recipient through a single-use (or reusable, where Customer marks the link as such) campaign invitation link issued by Framme Shop on Customer’s instruction. The technical characteristics of Magic Link Orders are described in Section 16.

Order means an order placed on Framme Shop for tangible items utilising Customer Materials, whether placed directly by a Shop User or via a Magic Link Order.

Personal Data Breach has the meaning given in Article 4(12) GDPR.

Programs means the software programs, modules and tools comprising Framme Shop, including the customer-facing Shop interface, the operator console, public APIs and webhooks, and the related program documentation. The general functional scope of the Programs is described in Framme’s then-current product documentation, published at framme.com or as otherwise made available by Framme.

Service Levels means the availability commitments and incident response targets set out in Section 5.

Services means Customer’s access to and use of Framme Shop and the Programs, the Technical Support Services, and any Additional Services purchased under a Subscription Order.

Shop means a Customer-configured instance of Framme Shop operated by Customer for its end-users. A Customer may operate one or more Shops under this Agreement.

Sourcing Services means Framme’s service of researching, sourcing and procuring items that are outside Framme’s standard Collection. Sourcing Services are subject to Section 18 and are made available only to Enterprise Plan customers.

Subscription Fee means the recurring charges payable by Customer for use of Framme Shop as set out in the Subscription Order.

Subscription Agreement means the signed or click-accepted Framme Shop Subscription Agreement document, which identifies the Parties, Plan, Subscription Fee, other fees, Region, term, contacts, Framme pre-existing Intellectual Property, any Custom Deliverables, any Special Terms and the versions of the documents incorporated into this Agreement. References to "the Subscription Order" or "Part A" are references to the Subscription Agreement.

Data Processing Terms means the Standard Contractual Clauses under Article 28(7) GDPR (Commission Implementing Decision (EU) 2021/915) and their Annexes published at framme.com/legal/dpa, in the version identified in the Subscription Agreement.

Sub-processor means any third party engaged by Framme that processes Personal Data on behalf of Customer in connection with the Services, as further described in the Data Processing Terms.

Technical Support Services means standard technical support and maintenance of the Programs as defined for the applicable Plan and Section 5.

Region means the region (or regions) in which Customer is licensed to use the Service, as set out in the Subscription Order. If no Region is specified, the Region is worldwide.

User means any individual authorised by Customer to access or use Framme Shop, including Customer’s employees, contractors, and end-users who interact with Customer’s Shop (each a "Shop User").

3.1 Licence. Subject to Customer’s compliance with this Agreement and payment of the applicable Fees, Framme grants Customer a non-exclusive, non-transferable, non-sublicensable right during the term to access and use the Programs in the Region for Customer’s internal business operations, including for the benefit of Customer’s Affiliates and their authorised contractors, provided Customer remains responsible for their compliance with this Agreement.

3.2 Framme ownership. Framme retains all Intellectual Property Rights in and to the Programs, Framme Shop, the Service, the documentation, any improvements, updates and configurations. Customer obtains no rights other than those expressly granted in this Agreement. Ownership of deliverables produced under Additional Services is addressed in Section 3.3.

3.3 Custom Deliverables under Additional Services. Customer owns all rights, title and interest in and to deliverables and related materials specifically produced for Customer under Additional Services (as defined in Section 1.3). Custom Deliverables are identified in the Subscription Agreement. Notwithstanding the above, Framme retains all pre-existing Intellectual Property Rights (including the items identified as Framme pre-existing Intellectual Property in the Subscription Agreement) and all Intellectual Property Rights in and to the Programs, Framme Shop, the Service, and Framme's methodologies, tools and reusable building blocks existing prior to the commencement of the Additional Services or developed independently of Customer Materials or Customer Confidential Information — even where used or referenced in producing Additional Services deliverables. Framme retains a perpetual, non-exclusive, royalty-free licence to use general know-how, ideas, techniques and skills acquired in the course of providing Additional Services, provided such use does not disclose Customer's Confidential Information or Personal Data.

3.4 Customer ownership. Customer retains all Intellectual Property Rights in Customer Materials. Customer grants Framme a non-exclusive, non-transferable, royalty-free, worldwide licence (or sub-licence) during the term and for so long as is necessary thereafter to fulfil outstanding Orders and post-termination obligations, to use, reproduce, host, transmit, store, modify (for technical formatting only) and distribute Customer Materials solely as necessary to provide the Services and to perform Customer’s instructions. Where Customer combines Customer Materials with a Framme Collection product through the Programs (including via the mockup tool) and adds the resulting branded variant or customised configuration to its Shop, that branded variant is owned by Customer to the extent of Customer’s creative contribution. Customer’s ownership of a branded variant does not extend to the underlying Collection product, including its physical design, photography or technical specifications, which remain with Framme or its third-party suppliers. The licence continues after termination to the extent Framme retains Customer Materials as part of the Shop Configuration under Section 14.3.

3.5 Restrictions. Customer shall not, and shall not permit any third party to: (a) reverse-engineer, decompile, disassemble or otherwise attempt to derive source code from the Programs (except to the limited extent permitted by mandatory law); (b) remove or modify any proprietary marking on the Programs; (c) use the Programs to build a competing product; or (d) circumvent any technical access control or rate limit.

3.6 Feedback. If Customer provides Framme with suggestions or feedback, Framme may use that feedback without restriction or obligation. No feedback creates Confidential Information unless explicitly identified as such.

4.1 Framme provides Framme Shop on a software-as-a-service (SaaS) basis. Framme will use commercially reasonable efforts to make available updates, configurations and consultancy needed to onboard Customer Materials and operate Customer’s Shop(s).

4.2 Customer will provide Framme with the User lists and contact information (email, name, phone, role) necessary to set up and maintain Customer’s User base. Customer warrants that it has the legal basis to share that information with Framme.

4.3 Framme may disclose User account information to its sub-processors only where strictly necessary to provide the Services, and only on terms consistent with Sections 8 and 12 and the Data Processing Terms.

4.4 An account is created for Customer for executing Order transactions, managing the Shop, configuring branding, viewing analytics and managing Users. Customer may create multiple Users with different roles. A Customer-appointed Store Manager may invite new Users and archive Users whose access is no longer required, including when an individual ends employment or changes role.

4.5 Customer is responsible for keeping Customer Credentials secret, ensuring they are used only by authorised Users, and notifying Framme without undue delay of any suspected unauthorised access. Framme may, without prior notice, suspend a User’s Credentials if Framme reasonably suspects misuse, compromise or breach of this Agreement; Framme will inform Customer as soon as reasonably practicable thereafter.

4.6 Upon Customer’s written request and subject to Customer identity verification, Framme will delete or anonymise the personal information of a specified User or Shop User in accordance with Section 14 and applicable Data Protection Laws.

4.7 Customer-Supplied Products and Customer-nominated suppliers. Customer may use Framme Shop to list and sell products that are not part of Framme’s Collection and that are sourced or fulfilled by Customer or by a supplier Customer has nominated in the Service ("Customer-Supplied Products"). For Customer-Supplied Products: (a) Customer is responsible for the description, quality, fitness for purpose, regulatory and consumer-protection compliance, intellectual-property clearance, pricing and availability of the products; (b) order confirmations and fulfilment instructions are routed by the Service to Customer or to Customer’s nominated supplier as Customer has configured; (c) Framme is not responsible for the production, shipping, delivery, defects, returns, refunds or any consumer-protection obligations arising in respect of those products; and (d) Customer’s representations and warranties under Section 5.8 and the indemnity in Section 6.4 apply to Customer-Supplied Products.

5.1 Service warranty. Framme will perform the implementation and the Technical Support Services in a professional and workmanlike manner consistent with prevailing industry standards. Framme warrants that the Programs will perform in all material respects in accordance with their then-current documentation.

5.2 Service Levels — availability. Framme will use commercially reasonable efforts to provide the Programs at a monthly availability of at least 99.5% ("Target Availability"), measured as the percentage of minutes in a calendar month during which the public Shop and the operator console are reachable and able to serve requests. Maintenance windows pre-notified at least 72 hours in advance, Force Majeure events, and failures attributable to Customer, Customer’s third parties or the public internet outside Framme’s control are excluded from the calculation.

5.3 Incident severity and response. Framme will use the following severity tiers and target response times. "Response" means an acknowledgement and assignment to a named engineer. "Workaround" means a manual or partial route around the issue. Business hours are 09:00–17:00 EET, Monday–Friday excluding Finnish public holidays.

5.4 Outage notification. Framme operates internal monitoring and alerting. Where Framme becomes aware of a P1 outage Framme will notify Customer’s administrative contact without undue delay; Customer is not required to give the 14-day deficiency notice in Section 5.7 for outages of which Framme is independently aware.

5.5 Remedy for missed Target Availability. If Framme fails to restore the Service to compliance with the Target Availability within five (5) business days of becoming aware of an incident causing such failure, Customer may submit a written request to support@framme.com for a credit equal to one (1) month of the Subscription Fee for the calendar month in which the failure occurred. Customer must submit any such request within thirty (30) days of the end of the relevant calendar month; requests submitted after that window are forfeit. Approved credits are applied to Customer’s next Subscription Fee invoice, are not payable in cash and do not extend the term. This credit is Customer’s sole and exclusive financial remedy for any failure to meet Target Availability and does not limit Customer’s right to terminate for material breach under Section 9.

5.6 Defect remedy. For any breach of the warranty in Section 5.1, Framme’s sole obligation and Customer’s sole and exclusive remedy is, at Framme’s option, to: (a) use commercially reasonable efforts to correct the defect; (b) rectify the error within five (5) business days; or (c) if neither (a) nor (b) is achieved within ten (10) business days, refund the portion of the Subscription Fee paid for the affected Programs for the month(s) in which the defect occurred.

5.7 Defect notification. Customer must notify Framme of a defect within fourteen (14) calendar days of becoming aware of it. The 14-day notice requirement does not apply to outages that Framme is independently aware of under Section 5.4, or to incidents that constitute a Personal Data Breach. Failure to notify within the 14-day window limits Customer’s remedy under Section 5.6 for the specific defect concerned but does not waive Customer’s other rights under this Agreement.

5.8 Customer warranties. Customer represents and warrants that it owns or has all necessary rights, licences and consents in respect of Customer Materials and other content uploaded to or transmitted through the Service, and that it will not upload content that violates third-party rights, Data Protection Laws or the Acceptable Use Policy.

5.9 Disclaimers. Except for the express warranties in this Section 5, the Service is provided on an "as available" basis and Framme disclaims all other warranties, express or implied, to the maximum extent permitted by law, including merchantability, fitness for a particular purpose, non-infringement and any warranty arising from course of dealing or trade usage.

6.1 By Framme. Framme will defend Customer and its directors, officers, employees and Affiliates (the "Customer Indemnitees") against any third-party claim alleging that Customer’s authorised use of the Programs infringes the third party’s Intellectual Property Rights, and will pay finally awarded damages and reasonable settlement amounts, provided Customer (a) gives Framme prompt written notice of the claim, in any event no later than 14 days after first becoming aware of the claim, (b) gives Framme sole control of defence and settlement (provided no settlement imposes any non-monetary obligation on Customer without Customer’s consent), and (c) reasonably cooperates with Framme at Framme’s cost.

6.2 Mitigation by Framme. If a claim under Section 6.1 is made or in Framme’s reasonable opinion is likely to be made, Framme may at its option: (a) modify or replace the Programs to be non-infringing while preserving substantially equivalent functionality; (b) procure for Customer the right to continue using the Programs; or (c) if neither (a) nor (b) is commercially reasonable, terminate this Agreement on written notice and refund any pre-paid Fees attributable to the period after termination.

6.3 Exclusions. Framme has no obligation under Section 6.1 to the extent the claim arises from (i) Customer Materials, (ii) Customer’s combination of the Programs with non-Framme products not authorised by Framme, (iii) Customer’s use outside the scope of the licence, or (iv) any modification of the Programs by anyone other than Framme.

6.4 By Customer. Customer will defend Framme and its directors, officers, employees, Affiliates and sub-processors against any third-party claim arising from (a) Customer Materials, (b) Customer’s breach of Section 5.8 or the Acceptable Use Policy, or (c) Customer’s instructions to Framme to process Personal Data in violation of Data Protection Laws; and Customer will pay finally awarded damages and reasonable settlement amounts, subject to the same procedural requirements set out in Section 6.1 for the benefit of Framme as the indemnified party.

6.5 Sole remedy. This Section 6 states each Party’s sole and exclusive remedy and the other Party’s entire liability for third-party Intellectual Property infringement claims.

6.6 Cap. Customer’s indemnification obligations under Section 6.4 are not subject to the aggregate cap in Section 7.2. Framme’s obligations under Section 6.1 are subject to the super-cap in Section 7.2(b).

7.1 Indirect damages. Neither Party will be liable to the other for any indirect, incidental, special, punitive or consequential damages, or for any loss of profits, revenue, business, goodwill or anticipated savings, whether arising in contract, tort (including negligence) or otherwise, even if the Party has been advised of the possibility of such damages.

7.2 Aggregate cap. (a) General cap. Subject to Section 7.3, each Party's aggregate liability arising out of or related to this Agreement, whether in contract, tort, indemnity or otherwise, will not exceed the total platform Fees (Subscription Fee, Magic Link Order fees, and one-off setup or implementation Fees) actually paid by Customer to Framme in the twelve (12) months preceding the event giving rise to the liability. For the avoidance of doubt, amounts invoiced for goods purchased through the Service, third-party logistics or carrier costs, and one-off project management or consultancy services are not included in the calculation of the cap.

(b) Super-cap for Data Protection and Confidentiality. Notwithstanding Section 7.2(a), each Party's aggregate liability for breach of Section 8 (Personal Data, Privacy and Data Protection), the Data Processing Terms or Section 12 (Confidentiality) shall not exceed the greater of (i) €50,000 or (ii) two (2) times the amount calculated under Section 7.2(a), subject in all cases to a maximum of €300,000.

(c) Excluded from the cap calculation. Service-level credits and other price reductions do not reduce the cap. Customer’s indemnification obligations under Section 6.4 remain uncapped as set out in Section 6.6.

7.3 Exceptions. No limitation in this Section 7 applies to (a) any liability that cannot be excluded or limited under applicable law (including liability for death or personal injury caused by negligence, or for fraud or fraudulent misrepresentation), or (b) Customer’s obligation to pay undisputed Fees under Section 10.

7.4 Force Majeure. Neither Party is liable for failure or delay in performance caused by a Force Majeure event, save that payment obligations are not excused.

8.1 Roles. Customer is the Data Controller of Customer Personal Data processed by Framme on Customer’s instruction under this Agreement. Framme acts as Data Processor and processes such Personal Data only on Customer’s documented instructions (including instructions embedded in this Agreement, the Subscription Order and Customer’s configuration of the Service), and as required by applicable law. Separately, Framme acts as Data Controller in respect of a limited set of operational processing activities carried out for Framme’s own purposes, including platform security and abuse prevention, records of Customer’s representatives kept for contract administration, statutory bookkeeping records, and aggregated or anonymised analytics used for service improvement. Framme’s processing as Controller is described in Framme’s Privacy Notice.

8.2 Compliance. Each Party will comply with its obligations under applicable Data Protection Laws. Framme will not use Personal Data for any purpose other than providing the Services, will not sell Personal Data, and will not use Personal Data for marketing.

8.3 Sub-processors. Customer authorises Framme to engage the Sub-processors identified in the Data Processing Terms (Annex IV) to provide hosting, payment processing, transactional email delivery, parcel tracking, third-party logistics (3PL), production and fulfilment by suppliers and branding partners that Framme engages to produce branded goods for Customer’s Shop, and similar operational services. Framme remains responsible for the acts and omissions of its Sub-processors. New Sub-processors will be added in accordance with the change-notification mechanism in the Data Processing Terms.

8.4 Personal Data location. Framme processes and stores Customer Personal Data within the European Union. Specifically, primary application data is stored in AWS region eu-central-1 (Frankfurt, Germany); transactional email delivery uses AWS Simple Email Service in region eu-west-1 (Ireland). Where a Sub-processor named in the Data Processing Terms (e.g. payment processor, parcel-tracking provider) may transfer Personal Data outside the European Economic Area, such transfers are made under European Commission Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Three, or another lawful transfer mechanism under Chapter V GDPR.

8.5 Security. Framme will implement and maintain appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Without limiting the Data Processing Terms (Annex III), these measures include: (a) encryption of Personal Data at rest in Framme’s primary databases, object storage, queueing and cache layers; (b) encryption in transit on all public network paths via TLS; (c) per-environment access control, IAM least-privilege and Secrets-Manager-managed credentials; (d) hashing of authentication passwords with bcrypt and a documented password complexity policy; (e) rate-limiting and IP-based lockout on authentication endpoints; (f) PII redaction in production application logs; and (g) regular backups of the primary database with point-in-time recovery within the configured backup retention window.

8.6 Personal Data Breach notification. Framme will notify Customer of a Personal Data Breach affecting Customer’s Personal Data without undue delay, and in any event within seventy-two (72) hours of becoming aware of the breach. The notification will contain the information required by Article 33(3) GDPR to the extent then available, and Framme will provide further information as it becomes available.

8.7 Data Subject Requests. Taking into account the nature of the processing, Framme will provide reasonable assistance to Customer in responding to Data Subject Requests under Articles 15–22 GDPR, and in complying with Customer’s obligations under Articles 32–36 GDPR. Material assistance beyond the routine information available to Framme may be subject to reasonable additional charges agreed in writing.

8.8 Retention. Framme will retain Personal Data for the duration of this Agreement and for the operational retention windows set out in the Data Processing Terms (Annex II), and will return or delete Personal Data on termination in accordance with Section 14.

8.9 Further details. Further details of Personal Data, privacy and data protection — including categories of Personal Data, processing purposes, retention windows, technical and organisational measures, and the list of Sub-processors — are set out in the Data Processing Terms (Standard Contractual Clauses under Article 28(7) GDPR).

9.1 Initial term. This Agreement becomes effective on the Effective Date and remains in force for an initial term of twelve (12) months from the Effective Date (the "Initial Term").

9.2 Auto-renewal. On expiry of the Initial Term this Agreement automatically renews for successive twelve-month periods (each a "Renewal Term"), unless either Party gives the other at least thirty (30) days’ prior written notice before the end of the then-current Initial Term or Renewal Term to prevent renewal. Renewal takes effect at the same Subscription Fee unless Framme has given Customer notice of a revised Subscription Fee or warehousing rate under Section 10.5.

9.3 Termination for convenience by Customer. Customer may terminate this Agreement for convenience at any time on written notice. Termination takes effect at the end of the then-current Initial Term or Renewal Term. Customer is not entitled to a refund of pre-paid Fees on a for-convenience termination.

9.4 Termination for convenience by Framme. Framme may terminate this Agreement for convenience on at least sixty (60) days’ prior written notice. If Framme terminates for convenience during a pre-paid period, Framme will refund Fees pro rata for the unused portion of that period.

9.5 Termination for cause. Either Party may terminate this Agreement on written notice with immediate effect if the other Party: (a) commits a material breach and fails to commence cure within thirty (30) days after written notice and to diligently pursue completion thereafter; (b) becomes insolvent, enters bankruptcy or reorganisation, or has a receiver, administrator or similar officer appointed; or (c) ceases or threatens to cease to carry on business. Where Customer terminates this Agreement for cause under this Section 9.5 in respect of Framme’s material breach, Framme will refund to Customer, on a pro-rata basis, any Fees pre-paid by Customer for the period after the effective date of termination.

9.6 Effects of termination. On termination or expiry: (i) all access rights granted to Customer cease, save as expressly preserved by Section 14 for the data return window; (ii) Customer remains liable for all Fees accrued through the effective date of termination; (iii) Sections 3, 6, 7, 8, 10, 12, 14, 15, 20, 22 and 23 survive together with any other provisions that by their nature should survive.

10.1 Fees. Customer will pay the Subscription Fee, the one-off setup or implementation Fee (if any), the Magic Link Order fee (if any), and any other charges set out in the Subscription Order. Time-and-material setup and integration work is invoiced after the Service has been set up and tested by the Parties.

10.2 Invoicing. Invoices are payable within thirty (30) days of invoice date in EUR by bank transfer to the account on the invoice, unless the Subscription Order specifies another currency or term.

10.3 Taxes. Fees are exclusive of value-added tax, sales tax and similar taxes. Framme is incorporated in Finland (Finnish VAT registered under FI-23820749). Where Customer is a VAT-registered business established in another EU Member State, Framme will invoice without Finnish VAT under the EU reverse-charge mechanism (Council Directive 2006/112/EC, Article 196), provided Customer supplies a valid VAT number. Where Customer is established outside the EU, Framme will invoice without VAT subject to applicable export rules. Where Customer does not supply a valid VAT number, Framme will charge VAT at the applicable Finnish rate or under the OSS / IOSS scheme as appropriate. Customer is responsible for accounting for tax in its own jurisdiction. Withholding taxes (if any) are Customer’s responsibility and must not reduce amounts payable to Framme.

10.4 Late payment. Undisputed invoices unpaid more than thirty (30) days after the due date accrue interest at the rate prescribed under section 4a of the Finnish Act on Interest (633/1982) for commercial agreements, from the due date until paid. Framme may suspend the Service on at least ten (10) business days’ written notice for non-payment of undisputed Fees.

10.5 Annual rate review. Framme may revise the Subscription Fee and its rate card for the warehousing and inventory-handling charges set out in Section 10.6 not more than once per calendar year. Framme will give Customer at least sixty (60) days’ prior written notice of any revised rates; revised rates take effect on the date stated in the notice, which date will not be earlier than 1 March of the relevant calendar year. Framme will not revise the Subscription Fee or its warehousing rate card at any other time in the calendar year. If Customer does not wish to accept the revised rates, Customer may terminate this Agreement on written notice given before the revised rates take effect, in which case Framme will refund any Fees pre-paid by Customer for the period after the effective date of termination on a pro-rata basis. This Section 10.5 does not apply to carrier shipment rates or Collection product prices, which are addressed in Section 10.6.

10.6 Logistics and warehousing charges. Charges for third-party logistics (3PL) warehouse services and carrier deliveries are not included in the Subscription Fee and are invoiced monthly based on actual usage, including (a) stored stock volume in the warehouse during the billing period (for example, by number of pallets or units), (b) inbound and outbound warehouse shipments, (c) pick-and-pack and other inventory-handling activities, and (d) carrier shipments dispatched on Framme’s account, unless otherwise agreed in the Subscription Order. Applicable rates and any minimum charges are set out in the Subscription Order or the relevant pricing schedule. Framme may, on at least thirty (30) days’ prior written notice to Customer, move some or all of these charges to alternative billing arrangements (for example, per-Order charging of a Customer-registered payment card). Carrier shipment rates reflect the carrier’s then-current published rates, and Collection product prices reflect Framme’s then-current catalogue pricing; both may change in line with the underlying rate card or pricing without prior notice to Customer.

11.1 Framme may amend this Agreement on at least thirty (30) days’ prior written notice to Customer. The amended terms take effect on the date stated in the notice.

11.2 If Customer does not accept the amended terms, Customer may terminate this Agreement by written notice given before the amendment takes effect. Framme will refund Customer, on a pro-rata basis, any Fees pre-paid for the period after the effective date of termination.

11.3 This Agreement may be amended only as set out in this Section 11. Terms inserted by Customer in a purchase order, supplier portal, vendor-onboarding form or other Customer document do not modify this Agreement and apply only where Framme has expressly accepted them in writing with reference to this Section 11.3. Framme’s acceptance of payment or performance of the Services does not by itself constitute acceptance of any such Customer-proposed terms.

12.1 Each Party will keep the other’s Confidential Information confidential during the term and for a period of five (5) years thereafter, and will use it only for purposes of this Agreement. Each Party will use at least the same degree of care to protect Confidential Information as it uses to protect its own, but in any event no less than reasonable care.

12.2 Permitted disclosures. A receiving Party may disclose Confidential Information to: (a) those of its personnel, professional advisers and sub-processors who need to know it for purposes of this Agreement and who are bound by confidentiality obligations consistent with this Section 12; and (b) as required by law, court order, regulator, stock exchange or competent authority, provided the receiving Party (where lawful and practicable) gives prompt notice to the disclosing Party to allow the disclosing Party to seek a protective order.

12.3 Publicity. Neither Party will issue a press release or other public statement about this Agreement without the other Party’s prior written consent (such consent not to be unreasonably withheld), save that Framme may reference Customer’s name and logo on its website client list and in routine sales materials upon Customer’s prior written consent.

12.4 Exclusions. The obligations in this Section 12 do not apply to information that: (a) is or becomes publicly known through no fault of the receiving Party; (b) was already known to the receiving Party without an obligation of confidence; (c) is independently developed by the receiving Party without reference to the Confidential Information; or (d) is rightly received from a third party without an obligation of confidence.

12.5 Sub-processors. Framme may disclose Confidential Information of Customer to its Sub-processors as set out in Annex IV (Sub-processors) of the Data Processing Terms, as updated from time to time in accordance with Section 8.3, and only to the extent each such Sub-processor needs to know the information for the performance of its duties under this Agreement. Framme shall ensure that each Sub-processor is bound by written confidentiality obligations no less protective than those in this Section 12, to the extent applicable to the subcontracted service. Framme shall on Customer's reasonable written request provide the relevant parts of each Sub-processor's confidentiality undertaking, where Framme is contractually able to do so, or otherwise written confirmation that the Sub-processor is bound by confidentiality obligations no less protective than those in this Section 12. For Sub-processors with publicly available standard terms, Framme may satisfy this obligation by directing Customer to the published terms. Framme remains liable for the breach of confidentiality obligations by its Sub-processors as if such breach were Framme's own, subject to the limitations of liability in Section 7.

12.6 Return and destruction. Upon expiration or termination of this Agreement, each Party shall return or destroy all electronic and physical records, files, designs and copies embodying the other Party's confidential information, save for information retained in routine encrypted backups that will age out in the ordinary course. Section 14 (Customer Data export, return and deletion on termination) governs the post-termination handling of Customer Materials, Personal Data and Shop Configuration and prevails to that extent.

13.1 Standard customer-facing integrations. Framme Shop’s standard customer-facing integrations, as of the Effective Date, include the third-party services listed below. The specific vendor identity for each integration may change from time to time; the authoritative current list of Sub-processors is maintained in the Data Processing Terms (Annex IV) and may be updated in accordance with Section 8.3, and any such change is not a material amendment requiring notice under Section 11. Framme integrates with each service as part of operating Framme Shop; Customer is not required to contract directly with these third parties.

• —Stripe (payment processing): Stripe Checkout for card payments, payment-intent webhooks, refunds and chargeback handling. Framme transmits the Order email address and Order metadata to Stripe at checkout; Stripe collects card details directly under its own PCI scope.
• —AfterShip (parcel tracking): registration of tracking numbers and inbound delivery-status webhooks. Framme transmits to AfterShip only the tracking number and the carrier slug; recipient personal data is not sent to AfterShip.
• —3PL warehouse and warehouse-management system (3PLogistiikka Group Oy and Ongoing Warehouse AB — for items stored on Customer’s behalf): Framme transmits to the 3PL the full delivery profile of each Order (recipient name, address, contact email and phone) and the line items, so the 3PL can pick, pack and ship; the 3PL transmits back shipment confirmations and tracking numbers.
• —Amazon Web Services (infrastructure, including Simple Email Service for transactional email delivery): hosting, storage, database, caching, queueing and email delivery in EU regions as described in Section 8.4.
• —Suppliers and branding partners (production of made-to-order and branded items): where an Order requires production by a supplier or branding partner nominated for Customer’s Shop, Framme transmits the recipient’s delivery profile (recipient name, address, contact email and phone) and the line items to that supplier or branding partner via a Production Order, so that the partner can produce and ship the goods to the recipient. The list of approved suppliers and branding partners and their roles is maintained per Customer Shop and is treated as a Sub-processor flow under Section 8.3 and the Data Processing Terms (Annex IV).

13.2 Customer-facing third-party terms. Customer acknowledges that Customer’s use of any third-party service through Framme Shop (whether listed above, or any optional integration Customer separately enables) is also governed by that third party’s own terms and privacy notice. Customer is responsible for accepting any such third-party terms that apply to Customer or its Shop Users at the point of use (e.g. Stripe’s acceptable-use policy at checkout).

13.3 Framme responsibility split. Framme is responsible for: (a) operating the integration on its side; (b) the security of the data flow from Framme Shop to and from the third-party service; (c) responding to security or service incidents on Framme’s side; and (d) maintaining contracts with each third-party service that, where the service processes Personal Data on Customer’s behalf, comply with Customer’s requirements in Section 8 and the Data Processing Terms.

13.4 Framme limitations. Framme is not responsible for: (i) the availability or performance of any third-party service itself; (ii) third-party platform pricing changes, deprecations or service withdrawals (Framme will use reasonable efforts to notify Customer of any change that materially affects the Service); (iii) Customer or Shop User compliance with any third party’s own terms; or (iv) acts, omissions or business decisions of the third party.

13.5 Personal data flows. Personal Data flows to the third-party services named in Section 13.1 are described at a high level in Section 8 and in detail in the Data Processing Terms (Annexes I, II and IV).

13.6 Customer-specified integrations. Where Customer requests Framme to integrate with a third-party system at Customer’s nomination (e.g. Customer’s CRM, identity provider, marketing automation), the scope, fees and responsibilities for that integration will be set out in a separate Subscription Order or work order incorporating this Agreement.

14.1 Export window. For thirty (30) days following the effective date of termination or expiry of this Agreement (the "Export Window"), Framme will, on Customer’s written request, make available to Customer an export of Customer Data in a structured, commonly-used machine-readable format (CSV and/or JSON). The export covers Customer’s Shop configuration, product and SKU catalogue, Order history with associated line items, Customer’s uploaded Customer Materials, and audit-log extracts attributable to Customer.

14.2 Deletion of personal data. Following the Export Window, Framme will delete or anonymise Customer Data within ninety (90) days, save that: (a) Customer may request, in writing before the end of the Export Window, that Framme instead retain Customer Data in an archived, read-only state for up to twelve (12) months following termination, in which case Customer remains the Data Controller and is responsible for ensuring it has a lawful basis under applicable Data Protection Laws for the continued retention; (b) retention is required by applicable law or by a Sub-processor’s independent legal obligation; (c) data is held in encrypted backups which will age out under Framme’s standard backup-retention windows; or (d) aggregated, anonymised data not capable of re-identifying any Data Subject is retained for service-improvement purposes (such data falls outside the scope of GDPR and is not Personal Data within the meaning of these Clauses).

14.3 Shop Configuration preservation. Framme may retain Customer’s Shop configuration, branding settings, uploaded Customer Materials, product-catalogue mapping, integration settings and other records that do not constitute Personal Data (collectively the "Shop Configuration") following termination, to enable potential re-onboarding. Customer may request deletion of the Shop Configuration at any time, and Framme will action such a request within ninety (90) days.

14.4 Certificate. On Customer’s written request following deletion, Framme will provide a written confirmation that the deletion has been completed in accordance with this Section 14.

14.5 Mid-term exports. Customer may request an export of Customer Data at any time during the term, subject to a reasonable cooperation fee for non-routine extracts. Routine Order and reporting exports available through the Service’s self-service tools are included in the Subscription Fee.

15.1 Information rights. On Customer’s reasonable written request, not more than once per calendar year (and in any event additionally following a Personal Data Breach affecting Customer or a material change in Sub-processors), Framme will provide:

• —a completed security questionnaire in a recognised industry format (e.g. CAIQ or equivalent);

• —an architecture overview of Framme Shop, a description of the technical and organisational measures (see the Data Processing Terms Annex III), the list of Sub-processors and their roles (the Data Processing Terms Annex IV);
• —if and when held by Framme, the executive summary of any third-party assurance report (e.g. SOC 2 Type II, ISO/IEC 27001 certificate). Framme will inform Customer if and when such a report or certification becomes available.

15.2 On-site audit. Subject to the Data Processing Terms, Clause 7.6, Customer may request an on-site audit of Framme’s data-protection compliance for cause (e.g. following a Personal Data Breach affecting Customer or material non-compliance), at Customer’s cost, on at least thirty (30) days’ prior written notice, during business hours, conducted by Customer’s personnel or by an independent auditor reasonably acceptable to Framme who is subject to confidentiality obligations consistent with Section 12. The audit will not interfere with Framme’s business operations and will not require Framme to disclose information about other customers.

15.3 Costs. Each Party bears its own costs of routine information requests under Section 15.1. On-site audits under Section 15.2 are at Customer’s cost; Framme may charge for material support of Customer’s audit beyond a reasonable baseline.

16.1 Purpose. Framme Shop supports invitation-based Orders ("Magic Link Orders") where Customer issues recipients a single-use (or reusable, where Customer marks the link as such) campaign invitation link that grants the recipient access to a configured Order experience.

16.2 Token issuance and security. Each Magic Link is bound to a cryptographically random invitation token of at least 256 bits of entropy, generated server-side at issuance.

16.3 Single-use by default. Invitation tokens are single-use by default: a token transitions to a "used" state upon successful Order creation and cannot be redeemed a second time. Token resolution and redemption are subject to row-level locking to prevent double-redemption from concurrent requests.

16.4 Reusable links. Customer may explicitly mark a campaign invitation link as reusable, in which case the link remains valid for multiple redemptions while the parent campaign is active. Reusable links may be distributed by Customer to the intended recipients via channels of Customer’s choosing. Customer acknowledges that reusable links carry an inherently higher risk of unauthorised redemption than single-use links. Customer is responsible for managing the distribution channel, monitoring redemption activity in Framme Shop and notifying Framme promptly of any suspected abuse so that affected tokens may be revoked. Framme is not responsible for losses or unauthorised Orders arising from a reusable link that has been shared, posted publicly or otherwise distributed beyond the intended audience or operated in a context (for example a shared device or a public event) chosen by Customer.

16.5 Token validity window. Invitation tokens are valid only while the parent campaign is active and within its configured start and end dates; tokens automatically cease to be redeemable on campaign expiry or when revoked by Customer or Framme.

16.6 Abuse prevention. Framme operates standard platform-level protections including high-threshold request rate limits at the platform tier and row-level locking on token redemption to prevent double-redemption from concurrent requests. Framme does not apply per-device or per-recipient controls (such as device fingerprinting) on Magic Link redemption. Where Customer chooses to use reusable links, Customer is responsible for managing abuse as set out in Section 16.4 and Section 16.7.

16.7 Customer obligations. Customer is responsible for the secure distribution of Magic Link invitations. Customer will not, and will not permit any User to, (a) publish Magic Link tokens on a publicly indexed page, social network or other unrestricted forum where the link is intended for a specific recipient, (b) distribute reusable links beyond the audience for which they were intended, or (c) circumvent or attempt to circumvent any rate limit or abuse-prevention control. Customer will notify Framme without undue delay of any suspected token leak or abuse so that Framme may revoke affected tokens.

16.8 Commercial terms. The per-Order Magic Link fee (if any) is set out in the Subscription Order.

17.1 Acceptable Use Policy. Customer and its Users will comply with the Acceptable Use Policy set out in the Acceptable Use Policy. Breach of the Acceptable Use Policy is a breach of this Agreement.

17.2 Enforcement. Framme may suspend access to Framme Shop, in whole or in part, to address an active or imminent violation of this Section 17, including suspension of a specific User, campaign or Shop. Framme will use commercially reasonable efforts to give Customer prior notice of suspension and to limit suspension to what is necessary to address the violation.

18.1 Eligibility. Sourcing Services — Framme’s service of researching, sourcing and procuring items outside Framme’s standard Collection — are made available only to Enterprise Plan customers as classified in the Subscription Order. Professional Plan customers are not entitled to Sourcing Services under this Agreement.

18.2 Scope and engagement. For eligible Enterprise Plan customers, Sourcing Services are provided on a project basis. Each engagement is described in a Sourcing brief and confirmed by Framme in writing (which may be by email or via the Service’s sourcing request tool), specifying the item description, target unit price range, target quantity, target delivery window, and any quality / compliance requirements. Sourcing Services do not constitute a binding commitment by Framme to procure any particular item; Framme will use commercially reasonable efforts to identify suitable suppliers and present options to Customer.

18.3 Fees and supplier terms. Sourcing Services are priced as an all-in quote per engagement. Framme sources from suppliers on its own account and supplies the items to Customer under this Agreement; Customer’s commercial relationship for sourced items is with Framme, not with the underlying supplier. Once Customer accepts a quote, the supplier’s commercial terms (lead time, returns, defect handling) are reflected in the quote and govern the supply.

18.4 Plan change. Framme may change Customer’s Plan on at least thirty (30) days’ prior written notice. Where Customer’s Plan changes, the eligibility for Sourcing Services under this Section 18 changes accordingly from the effective date of the change.

19.1 Notices under this Agreement must be in writing and sent to the receiving Party’s notice contact specified in the Subscription Order. Notices may be sent by email and are deemed received on the next business day after sending (absent a delivery failure). Notices of termination, breach or material amendments must also be sent by email to:

• —Framme: support@framme.com;
• —Customer: [notice address per Subscription Order].

20.1 Subcontractors. Framme may subcontract part of the Services to its Affiliates or to qualified third parties (including the Sub-processors named in the Data Processing Terms). Framme remains responsible for the acts and omissions of its subcontractors as if they were its own. [Enterprise option — delete if not agreed: Framme will give Customer at least thirty (30) days' prior written notice before engaging a new subcontractor that will perform a material part of the Services; Customer may object on reasonable grounds within that period, and the Parties will discuss in good faith; the notice-and-object mechanism in the Data Processing Terms, Annex IV applies to Sub-processors.]

20.2 Assignment. Neither Party may assign or transfer this Agreement without the other Party's prior written consent (not to be unreasonably withheld), save that either Party may assign this Agreement, together with the Subscription Order, to an Affiliate or, on written notice to the other Party, to a successor in interest in connection with a merger, acquisition, reorganisation or sale of substantially all of its assets, provided that the successor is not a Restricted Person. "Restricted Person" means an entity that (a) is a direct competitor of the non-assigning Party, (b) is subject to comprehensive EU, UK, US or UN sanctions, or (c) is in material insolvency proceedings. Where the proposed assignee is a Restricted Person, prior written consent applies (not to be unreasonably withheld); any refusal shall be given in writing with reasons stated within thirty (30) days of the request.

21.1 Click-accept. This Agreement is accepted, and becomes binding on Customer, when an authorised representative of Customer accepts the Subscription Order by clicking "I accept", checking the equivalent acceptance control, or otherwise indicating acceptance through the Service’s order-acceptance flow. Acceptance is an electronic signature under Regulation (EU) 910/2014 (eIDAS) and is binding to the same extent as a handwritten signature.

21.2 Acceptance log. Framme will record at minimum the following information for each Subscription Order acceptance: the version identifier of this Agreement and of the Subscription Order, the date and time of acceptance, the IP address from which acceptance occurred, the identity of the accepting User (email address and name), and a copy of the accepted documents in durable form. On Customer’s written request, Framme will provide Customer with a copy of the acceptance log entry and the accepted documents.

21.3 Optional countersignature. Where Customer or Framme prefers, the Parties may execute the Subscription Order by handwritten or qualified electronic signature in lieu of click-accept; in that case the date of the last Party’s signature is the Effective Date.

21.4 Authority. Each individual accepting on a Party’s behalf represents that they are duly authorised to bind that Party.

22.1 Entire agreement. This Agreement (comprising the Subscription Agreement, these Service Terms, the Data Processing Terms and the Acceptable Use Policy) constitutes the entire agreement between the Parties on its subject matter and supersedes any prior agreement, proposal or communication.

22.2 Order of precedence. In the event of conflict, the order of precedence is: (1) the Data Processing Terms for matters governed by them; (2) the Subscription Agreement, including any Special Terms; (3) Section 25 (Products and fulfilment) for matters concerning Products and their fulfilment; (4) the remainder of these Service Terms; (5) the Acceptable Use Policy. Each document is read consistently with the others to the extent possible.

22.3 Severability. If any provision of this Agreement is held to be unenforceable, the rest of the Agreement remains in force and the unenforceable provision is to be replaced by an enforceable provision that comes as close as possible to the Parties’ original intention.

22.4 No waiver. A Party’s failure to enforce any right is not a waiver of that right.

22.5 No third-party beneficiaries. This Agreement does not give rights to any third party, save that Customer’s Affiliates may benefit from the licence under Section 3.1 through Customer.

22.6 Relationship. The Parties are independent contractors. Nothing in this Agreement creates a joint venture, agency or employment relationship.

22.7 Injunctive Relief. The Parties acknowledge that a breach or threatened breach of Section 3 (Intellectual Property), Section 17 (Acceptable Use Policy), Section 8 (Personal Data, Privacy and Data Protection) or Section 12 (Confidentiality) may result in irreparable injury to the other Party for which monetary damages would be an inadequate remedy. In addition to its other remedies under this Agreement or any Subscription Order, each Party is entitled to seek interim or injunctive relief in respect of such a breach or threatened breach from any court of competent jurisdiction, in aid of and without prejudice to the dispute resolution provided for in Section 23.2 and the limitations of liability in Section 7.

23.1 This Agreement is governed by the laws of Finland, excluding its conflict-of-law principles and the UN Convention on Contracts for the International Sale of Goods.

23.2 The Parties will attempt in good faith to resolve any dispute by negotiation between senior representatives. Any unresolved dispute, controversy or claim arising out of or relating to this Agreement (including its formation, interpretation, performance, breach, termination or validity) is to be finally resolved in the District Court of Helsinki, Finland, as the court of first instance. Proceedings may be conducted in English by agreement of the Parties; otherwise the working language of the proceedings is Finnish.