Register an item
Menu

Legal

CredCheck platform terms for business customers

Effective date: [[EFFECTIVE DATE]] · Version: [[VERSION]]

These terms ("Terms") form an agreement between [[LEGAL ENTITY NAME]], [[REGISTERED ADDRESS]], Lagos, Nigeria, RC [[RC NUMBER]] ("CredCheck"), and the organisation that signs up for or orders the CredCheck platform ("Customer").

The agreement consists of these Terms, any order form or online plan selection ("Order"), and the Data Processing Agreement ("DPA"). If they conflict, this is the order of priority: Order, DPA (for personal data), then Terms.

The person accepting these Terms confirms they have authority to bind the Customer. [[ENGINEERING: record acceptance with version and timestamp at signup, gap 9]]

1. Definitions

  • Platform: the CredCheck company portal, APIs, SDKs, webhooks, consumer verification channels (app, web, USSD, SMS, WhatsApp) and related services.
  • Customer Data: data the Customer or its users submit to the Platform, including products, batches, product media, recall information, distributor records, engagement content and integration configuration. It also includes personal data within those records.
  • Codes: authentication codes (QR, serial, scratch, DataMatrix and similar) generated by the Platform for the Customer's products.
  • Consumer Data: data about consumers' verifications, reports and rewards. CredCheck is the controller of this data, as described in the consumer privacy policy.
  • Users: people the Customer authorises to use the portal, including partner users at the Customer's distributors.
  • Plan: the subscription tier and entitlements the Customer selects (limits, features and pricing).

2. Access and accounts

  1. CredCheck grants the Customer a non-exclusive, non-transferable right, during the subscription term, to use the Platform for its internal business purposes under the Plan.
  2. New organisations may be reviewed before activation, including verification of manufacturer status. CredCheck may decline, suspend or reject an organisation that fails verification. A "verified manufacturer" badge is shown only after verification.
  3. The Customer is responsible for its Users, for their roles and permissions, and for keeping credentials, MFA devices and API keys secure. Company admins must use multi-factor authentication.
  4. Support access. CredCheck support and operations staff may enter the Customer's portal in a time-limited support session, with a recorded reason. Every action in that session is logged and visible in the Customer's audit log. [[COMMERCIAL: whether customer pre-approval is required]]

3. Subscriptions, fees and billing

  1. Fees, currencies and Plan entitlements are set out in the Order or the pricing page at [[PRICING URL]]. Prices are versioned. The Customer keeps the price version it subscribed on until renewal or a Plan change [[COMMERCIAL TO CONFIRM grandfathering policy]].
  2. Trials. A trial of [[14]] days may apply. At the end of a trial, a paid subscription starts only if the Customer has chosen a paid Plan and provided a payment method.
  3. Usage. Usage (for example verifications, codes generated, SMS, AI) is metered. Overage is charged per block as shown in the Plan. The Platform may pause usage-limited features, such as code generation, at Plan limits.
  4. Payment. Payments are processed by third-party payment providers (Paystack, Flutterwave or Stripe, depending on country and Customer choice). CredCheck does not receive or store full card numbers. The Customer authorises recurring charges to its saved payment method for renewals and overage.
  5. Late payment. If payment fails, the subscription becomes past due and CredCheck will retry and notify the Customer during a grace period of [[X]] days. After that, premium features are paused. Verification of Codes already in market continues, and Customer Data is not deleted because of non-payment [[COMMERCIAL TO CONFIRM that consumer verification stays on for lapsed tenants, matching `billing-mailer.ts` copy]].
  6. Taxes. Fees exclude taxes. Applicable VAT and similar taxes are added to invoices.
  7. Upgrades, downgrades and cancellation. Upgrades take effect on payment. Downgrades may create account credit applied to the next invoice. Cancellation takes effect at the end of the current period unless the Order says otherwise. [[COUNSEL: refunds]]

4. Customer obligations and acceptable use

4.1 Code integrity

Codes are the security of the whole system. The Customer must:

  1. Protect plaintext codes. Code files are delivered once, encrypted, through a time-limited download, and CredCheck keeps only hashes. The Customer must store, transmit and print code files securely, restrict access to people who need it, and destroy copies once printing is complete.
  2. Apply each Code to one genuine unit of the product and batch it was generated for. Don't reuse, resell, share or publish Codes. Don't apply them to products not made by or for the Customer.
  3. Control its supply chain. Contractually require printers, packagers and distributors to do the same, and promptly suspend Codes or batches it knows or suspects are compromised.
  4. Report suspected code leaks to CredCheck without undue delay, and in any case within [[48]] hours of becoming aware.
  5. Keep product, batch, expiry and distributor records accurate and current. Consumers rely on them.
  6. Not misrepresent verification. Don't claim CredCheck certifies product safety or quality. Use the CredCheck name and marks only as allowed in [[BRAND GUIDELINES URL]].

4.2 Recalls and safety

  1. The Customer is solely responsible for its products, for deciding on and running recalls, and for meeting its legal duties to regulators and consumers.
  2. The Platform lets the Customer mark batches as recalled, set a recall classification and consumer message, and notify consumers who have scanned the batch by push notification. These tools support the Customer's recall process but don't replace it. Delivery depends on consumers' devices, permissions and third-party push services.
  3. The Customer must keep recall messages accurate and must not use recall or safety channels for marketing. The Platform does not show engagement content on counterfeit or recalled results.

4.3 Consumer engagement content

Warranty, usage and promotional content, and reward programmes, must be lawful, accurate, not misleading, and compliant with consumer protection and advertising rules in each market. The Customer funds any reward programme it enables. CredCheck may pause programmes that are being abused.

4.4 Consumer reports

The Customer receives consumer reports about its products, including descriptions, photos and, where the consumer consented, location. The Customer must:

  • use report data only to investigate and respond to product concerns, and to support enforcement against counterfeiting
  • not try to identify, contact or retaliate against reporters except through the Platform's response tools
  • handle report data under applicable data protection law, as an independent controller for its own use [[COUNSEL TO CONFIRM role]]

4.5 General acceptable use

The Customer must not, and must ensure its Users do not:

  • break the law, or upload unlawful, infringing or malicious content
  • try to access other tenants' data or get around tenant isolation, rate limits, plan limits or security controls
  • test the security of the Platform without written permission under [[VULNERABILITY DISCLOSURE POLICY URL]]
  • resell or white-label the Platform without an Order that allows it
  • use the Platform to build a competing product
  • upload special category or sensitive personal data unless the Platform is designed for it

5. API, SDK and webhooks

  1. API access uses keys created in the portal. Each key is shown once, stored as a hash, limited to scopes and an environment (live or test), and can be revoked or rotated. The Customer is responsible for all activity under its keys.
  2. The Customer must follow the API documentation at [[DEVELOPER DOCS URL]], respect rate limits (429 responses with Retry-After), and handle 503 overloaded responses as documented (at most one retry after Retry-After).
  3. Webhooks are signed with HMAC-SHA256 and a timestamp. The Customer must verify signatures and reject stale requests. Failed deliveries are retried with backoff and then held for manual replay.
  4. CredCheck may change or version APIs. It will give [[90]] days' notice before removing or incompatibly changing a generally available endpoint, except where needed for security or legal reasons.

6. Service levels and support

  1. CredCheck runs the Platform against the service level objectives published in [[SLO/STATUS URL]] (based on docs/slo.md). For example: verification availability 99.9% and portal and admin availability 99.5%, each over a rolling 30 days, measured as described there.
  2. These are objectives, not guarantees, unless an Order includes a service level agreement with service credits [[COMMERCIAL: define SLA, credits and exclusions per plan]]. None of the following are service level objectives: USSD and SMS end-to-end delivery (which depend on carriers), AI features, and completion times for exports and code generation.
  3. Planned maintenance is scheduled for low-traffic windows where possible, with notice through in-portal broadcasts.
  4. When the Platform is overloaded, it protects consumer verification first. Portal traffic may be slowed or temporarily refused.
  5. Support channels and response targets: [[SUPPORT MATRIX PER PLAN]].

7. AI features

  1. Some features use third-party AI models: copilot, intelligence briefs, risk forecast narratives and packaging checks. AI outputs are labelled, can be wrong, and are advisory. They never change a verification verdict. The Customer is responsible for decisions it makes using them.
  2. Customer Data sent to AI providers is limited to what the feature needs. Emails and phone numbers are redacted from text before sending. AI providers are listed as sub-processors. AI features are plan-gated, budget-limited and can be switched off.
  3. [[COUNSEL/COMMERCIAL: confirm provider terms prohibit training on API data, and state that here]]

8. Data

  1. Customer Data. The Customer owns Customer Data. CredCheck processes personal data within it as a processor under the DPA.
  2. Consumer Data and platform intelligence. CredCheck is the controller of Consumer Data. The Customer receives analytics, alerts and reports about its own products. CredCheck may use scan and fraud data from across the Platform to detect counterfeits, operate and improve the Platform, and provide aggregated statistics to regulators and the public. Aggregates will not identify the Customer's confidential commercial information [[COUNSEL/COMMERCIAL: define confidentiality of tenant-level volumes in regulator views]].
  3. Export. The Customer can export its data through the portal and API during the term, and for [[30]] days after termination. [[ENGINEERING TO CONFIRM: a full tenant data export does not exist yet; today only specific exports exist, such as the audit CSV and analytics]]
  4. Deletion. After that period CredCheck deletes or anonymises Customer Data within [[90]] days, except data it must keep by law (for example invoices and audit logs) and backups, which expire on their normal cycle. Code hashes and scan history may be kept in pseudonymised form for as long as the Codes may remain in circulation, so consumers checking products still get accurate answers (for example "no longer supported"). [[COUNSEL/COMMERCIAL TO CONFIRM; ENGINEERING: tenant offboarding and deletion is not implemented yet]]

9. Confidentiality

Each party will protect the other's confidential information with at least reasonable care, and use it only for this agreement. Disclosure is allowed to advisers and as required by law, with notice where lawful. [[STANDARD CARVE-OUTS]]

10. Security

CredCheck maintains the technical and organisational measures in Annex 2 of the DPA. It may update them as long as it does not materially reduce overall security.

11. Suspension

CredCheck may suspend affected accounts, keys, Codes or features immediately if it reasonably believes:

  • there is a security threat
  • Codes are compromised
  • the Customer is misusing the Platform or consumer channels
  • the law requires it
  • fees are overdue as described in section 3.5

It will notify the Customer and restore access once the issue is resolved.

12. Warranties and disclaimers

  1. CredCheck warrants that the Platform will perform materially as described in its documentation. The Customer's remedy for breach of this warranty is correction or, failing that, termination and a pro-rata refund of prepaid fees for the affected period.
  2. The Customer warrants that it has the rights to its products, marks and content, and that its product, batch and recall information is accurate.
  3. Beyond that, and to the extent the law allows, the Platform is provided "as is". CredCheck does not warrant that it will detect every counterfeit, that fraud alerts or AI outputs are accurate, or that consumer channels will always be available.

13. Indemnities

[[COUNSEL TO DRAFT]]:

  • the Customer indemnifies CredCheck against claims arising from its products (including safety, recalls and product liability), its content, and its breach of section 4
  • CredCheck indemnifies the Customer against third-party claims that the Platform, as provided, infringes intellectual property rights

14. Limitation of liability

[[COUNSEL AND COMMERCIAL TO DRAFT]]. Placeholders:

  • Neither party is liable for indirect or consequential loss, or loss of profit, revenue or goodwill.
  • Each party's total liability is capped at [[the fees paid or payable in the 12 months before the claim]].
  • A super-cap of [[X]] applies for data protection and confidentiality breaches.
  • No cap applies to: fraud, death or personal injury caused by negligence, the Customer's payment obligations, indemnities under section 13, or anything that can't be limited by law.

15. Term and termination

  1. The subscription term and renewal are as stated in the Order. Plans renew automatically unless cancelled.
  2. Either party may terminate for a material breach not remedied within [[30]] days of notice, or if the other party becomes insolvent.
  3. On termination, access ends, section 8.3–8.4 apply, and sections that by nature survive (fees owed, confidentiality, liability, data) continue.
  4. [[COMMERCIAL/COUNSEL: what consumers see when a terminated customer's Codes are checked]]

16. General

  • Governing law: [[laws of the Federal Republic of Nigeria]].
  • Disputes: [[arbitration seat, e.g. Lagos Court of Arbitration, or courts of Lagos State]].
  • Notices: [[NOTICE ADDRESSES]].
  • Assignment: neither party may assign without consent, except to a successor of its business.
  • Force majeure: neither party is liable for delays caused by events beyond its reasonable control, including carrier and network outages.
  • Entire agreement: this agreement replaces earlier discussions on its subject.
  • Changes: CredCheck may update these Terms with [[30]] days' notice to account admins. Material adverse changes take effect at renewal for customers on a fixed term.
  • Anti-bribery, sanctions and export control: [[STANDARD CLAUSES]].
Terms of service for business · CredChek