Company Terms of Service

Applies to: Companies and their Owners, Staff and other authorized users who use Company features
Summary of changes: Initial Company service draft. Ratings and Promotions are future/conditional and do not form part of the currently audited service. Feature-specific terms remain conditional on the feature being enabled.
Contact: [SUPPORT EMAIL] · Privacy: [DPO EMAIL]

Draft for review. This text is not an effective agreement. A qualified lawyer must adapt it to [COUNTRY/LAW] and review eligibility, KYC, data roles, fees, liability, indemnity, dispute resolution and any consumer-facing claims before publication.

In plain words

Companies must provide accurate business information, complete the required review and secure their accounts. Company access depends on account status, permissions and enabled features. Companies are responsible for their Products, claims, Labels, regulatory permissions and Codes. A Shogram Result reports Code registration/use status; it does not certify a Product. Codes must not be copied, shared or reused. Ratings and Promotions are not live in the audited app and are not offered by these draft Terms.

1. Agreement and definitions

These draft Terms govern Company access to the Shogram Platform when accepted through a valid, documented process. “Company” means the business identified in its account. “Owner” means a user authorized to administer that Company account. “Staff” means a person with permissions assigned by an Owner. “Code,” “Product Unit,” “Label,” “Verification,” “Result,” “KYC,” “Print Job” and “Label Vault” have the meanings in the shared glossary, subject to the feature limitations below.

The current public legal text is a draft. It becomes effective only after operator details, legal review, approval, publication, an effective date and a reliable acceptance process are in place. The audited application stores versioned Company Code of Practice acceptance; it does not currently provide general versioned Company Terms acceptance. Until that is implemented and the effective text is published, this draft is not evidence of an accepted contract.

2. Eligibility, registration and authority

The Company must be a lawfully formed business or an entity permitted to use the Platform in [COUNTRY/LAW]. The person registering it must have authority to provide the information and act for it. The Company must identify its legal name, trading name, jurisdiction, registration details and authorized contacts using the fields requested by the live registration flow.

The Company must provide true, complete and current information and promptly correct material errors. Required update deadlines, proof of authority and permitted business types must be confirmed by product and counsel before publication: [LAWYER REVIEW: eligibility and update deadlines]. Do not upload information or documents belonging to another business without authority.

3. Email verification, account setup and KYC

The account may require email verification, account setup, multi-factor authentication and review of business documents before Company modules are available. The exact required documents and review steps are those shown in the live application. The Company must keep submitted documents readable, genuine and current, and must respond to reasonable requests for clarification or replacement.

An application may be pending, under review, returned for information, rejected, approved, restricted or suspended according to the status actually supported by the Platform. A KYC decision concerns the Company information reviewed for Platform access; it is not government approval, Product certification or confirmation that every Company claim is true. Decision reasons, resubmission, re-verification and appeal routes must be documented before effective publication: [PRODUCT DECISION: review and appeal process].

4. Accounts, Owners, Staff and security

The Company is responsible for choosing authorized users, assigning only the permissions each user needs, reviewing access and promptly removing access when a person leaves or changes role. Each user must protect their credentials and must not share authentication factors.

Where the Platform requires MFA for privileged Company access, the user must complete it. The Company must report suspected account compromise, unauthorized access or exposure of Codes or Label files through [SECURITY CONTACT]. The response channel and service expectations must be verified before publication.

5. Code of Practice

The Company must comply with the effective version of the [Company Code of Practice] when one has been reviewed, published and made effective. The currently displayed Company Code of Practice is marked as a draft pending legal review. Its acknowledgement during registration must not be represented as acceptance of a legally effective Code until the final version and acceptance process are approved.

The effective Code may contain operational requirements for Code custody, Labels, printing, reconciliation, incident reporting, consumer Reports and enforcement. It must identify its version and effective date. If these Terms and the Code conflict, the precedence rule must be settled by qualified counsel before publication: [LAWYER REVIEW: document hierarchy].

6. Company features and eligibility

Products, Batches, Codes, Label design/upload, a Label Vault, Print Jobs, print/export tools, Staff roles, Billing, API keys and Webhooks may be available only to an approved Company and only where the relevant module is enabled for its account and plan. Some screens in the application are previews; a preview does not create a production service, permission or obligation. The current interface and account status control which feature is available.

The Company must use each feature only for its intended, authorized purpose. Any feature-specific limits, technical requirements, fees, service levels or retention terms must be stated in an effective product notice or schedule before the Company relies on them.

7. Products, Codes and Labels

The Company may register only Products it manufactures, owns, or is authorized to represent. It is responsible for the accuracy of its Product, Batch, manufacturing, expiry, regulatory, origin, ingredient and packaging information. The Company must not misrepresent a Result or claim that Shogram certifies a Product.

Each Product Unit must use its own unique Code where the enabled workflow provides unit-level Codes. A Code may not be reused, duplicated, guessed, transferred to another item or applied to an unrelated Product Unit. Codes must not be extracted, sold, shared or distributed as standalone tokens. They are to be handled only through enabled Platform workflows and approved Label/print outputs.

Where Label design or upload is enabled, the Company must provide a Label with a clear, scannable area and accurate product context. A Label may be rejected or returned for correction if it fails the checks shown by the Platform. A preview or automated check is not regulatory approval or a guarantee that every physical print will scan.

8. Printing, Print Jobs, downloads and incident response

Where Print Jobs and controlled outputs are enabled, the Company must follow the on-screen preflight, authorization and custody requirements. The design intent is that Codes appear only within approved, watermarked, traceable print files, with MFA, limited downloads and audit logging; each such control must be verified in the production module before this clause is presented as an active Platform guarantee.

The Company is responsible for printers, contractors and other recipients it authorizes. It must bind them to appropriate confidentiality, security and handling obligations and maintain records necessary to reconcile received, printed, applied, damaged, destroyed and unused materials where the applicable workflow requires it.

The Company must notify [SECURITY CONTACT] within 24 hours after discovering a suspected lost, stolen or exposed Code-bearing file, unauthorized print run or other Code compromise. This proposed deadline requires legal and operational approval before it becomes binding. The Company must preserve relevant records, identify affected batches and cooperate with containment, invalidation, consumer notice or recall steps where applicable.

Standalone Code downloads or exports are prohibited. The Company may access Code-bearing output only through an authorized workflow permitted by the effective product rules. Any restrictions, MFA checks, download limits, watermarking and audit events must match what the live Platform actually enforces.

9. Subscription, fees and payments

Plans, prices, currencies, billing intervals, taxes, renewal, grace periods, failed-payment handling, cancellation and refunds must be set out in an approved [Billing, Subscription and Refund Policy — route pending] and the selected plan before checkout. The Company owes only the fees clearly displayed and accepted through the effective checkout flow, subject to [COUNTRY/LAW].

Payment processing may be provided by the provider selected in the live checkout flow. Shogram may store payment references, plan and subscription identifiers, amount, currency, status and provider response information needed to reconcile a transaction. Card or bank credentials are handled according to the provider’s process; the exact data flow and provider list must be confirmed in the Privacy Policy.

When a subscription expires or is cancelled, prospective access to paid Company modules may change under the plan rules. Subject to legal, security, recall and suspension requirements, previously printed Codes are intended to remain verifiable; this does not mean that all Company workspace features or information remain available. A Company suspension may result in a status notice in a Result where the verification service supports it.

10. Ratings and Promotions

Company Ratings, reviews and consumer Promotions are not currently available in the audited application. These draft Terms do not activate or promise those features.

If introduced, Ratings will require an effective policy covering eligibility, moderation, replies, disputes and privacy. A Promotion will require separate rules identifying the actual promoter, funding, dates, market, eligibility, Points, Prizes, fulfillment and disputes. A Company must not advertise a Shogram Promotion or Rating feature until it has been enabled and the applicable terms have been published and approved.

11. APIs, Webhooks and integrations

API keys and Webhooks may be used only where enabled for the Company and subject to the technical documentation and plan rules then in force. The Company must secure credentials, rotate or revoke exposed keys, validate incoming events and avoid sending personal or sensitive data unless expressly authorized. Rate limits, event retention, delivery guarantees and support commitments must be published only after they are confirmed for the relevant integration.

12. Data, privacy and Company instructions

The Company must provide required notices and have a lawful basis for the personal information it submits. The parties’ respective roles as controller, processor or independent controllers depend on the processing purpose and applicable law and must be determined in a separate data-processing schedule: [LAWYER REVIEW: data roles and processor terms].

The Company may access only data made available to its authenticated users under their assigned permissions. It must not try to identify consumers from scan insights or use Platform data outside the permitted purpose. The Platform’s exact disclosures, service providers, international transfers, retention and consumer rights process are described in the effective Privacy Policy and any data-processing agreement.

13. Intellectual property and Company content

Each party keeps its pre-existing rights. The Company grants [COMPANY LEGAL NAME] only the limited permission needed to host, process, display and secure its Company content for the enabled service and to perform documented legal or security duties. The duration, sublicensing to providers, removal and post-termination handling of this permission require counsel review.

The Company confirms it has the rights and authority needed for the brands, Product images, Label artwork and documents it submits. It must not upload malicious files, infringing material, false claims or personal information without a lawful purpose.

14. Monitoring, suspension and termination

The Platform may review activity for security, compliance, service operation and enforcement of effective rules. Any access to Company records must be limited to authorized purposes and logged according to the Platform’s policies.

Access may be restricted or suspended where reasonably necessary to address a security risk, suspected misuse, inaccurate KYC information, legal requirement, overdue account issue under the published plan rules or serious violation of the Code of Practice. The process must provide notice and an opportunity to respond where safe and lawful. Grounds, timelines, appeal rights, termination effects and treatment of existing Product Codes must be completed before publication: [LAWYER/PRODUCT REVIEW].

15. Warranties, indemnity and liability

The Company remains responsible for the Products it makes or represents, their claims, labels, legal approvals, manufacturing quality and Code custody. The Platform is a verification tool and is not the manufacturer, distributor, seller or guarantor of a Product.

Any Company warranties, indemnity, liability limits, exclusions, remedies and non-excludable rights must be drafted for [COUNTRY/LAW] by qualified counsel. No uncapped or one-sided indemnity is included in this draft. [LAWYER REVIEW: allocate liability for Company content, product claims, privacy incidents, Code compromise, third-party claims and Platform negligence.]

16. Changes, governing law and contact

Versioning, material-change notice and renewed acceptance must follow an approved publishing process. Governing law and dispute forum: [COUNTRY/LAWYER REVIEW].

Operator: [COMPANY LEGAL NAME]
Address: [ADDRESS]
Company support: [SUPPORT EMAIL]
Security incidents: [SECURITY CONTACT]
Privacy: [DPO EMAIL]

How to complain

For a Company service or KYC complaint, contact [SUPPORT EMAIL] or use [COMPANY COMPLAINTS ROUTE — pending]. For a privacy matter, contact [DPO EMAIL]. For a suspected Code or account compromise, use [SECURITY CONTACT]. Appeal rights, regulator details and response times must be completed for [COUNTRY] before publication.

Change log

Version	Date	Summary
[VERSION]	[DATE]	Initial draft; feature status, commercial terms and legal terms require review.