Terms of Service

Agreement & Parties

1.1 Parties

This Agreement is between Grandco Inc., a corporation incorporated under the laws of Ontario, Canada ("Grandco"), and the individual or business entity that has completed the Grandco merchant or reseller application ("Customer"). Where Customer is a Reseller, Section 12 also applies.

1.2 Scope of Agreement

This Agreement governs:

• Access to and use of the Grandco SaaS platform, including the Grandco marketing suite, CRM, SMS, email marketing, appointment booking, and funnel builder;
• Use of Grandco's POS software and associated hardware purchase or lease;
• Payment processing services facilitated through Elavon Canada Inc. / Converge ("Payment Processor"), governed jointly by this Agreement and the Elavon Merchant Agreement;
• Credit card surcharging where enabled by Customer in accordance with Section 4;
• Any reseller or white-label arrangements described in Section 12.

1.3 Order of Precedence

In the event of a conflict between documents, the following order of precedence applies:

1. Card Scheme Rules (Visa, Mastercard, Interac) — always prevail
2. Elavon Merchant Agreement and Operating Guide
3. These Grandco Terms of Service
4. The Grandco Merchant Application and Welcome Letter
5. Any supplemental schedules, addenda, or pricing agreements

1.4 Acceptance

Customer accepts these Terms by: (a) completing and submitting the Grandco application; (b) activating a Grandco account; (c) processing the first payment transaction; or (d) clicking an acceptance checkbox during account setup. If Customer does not agree, Customer must not use the platform or payment services.

Grandco SaaS Platform

Payment Processing Services

3.1 Merchant Account

Upon approval, Grandco facilitates the opening of a Canadian merchant account through Elavon Canada Inc. ("Merchant Account"), enabling Customer to accept Visa, Mastercard, Interac Debit, and other approved Cards. Approval is at Elavon's sole discretion based on underwriting criteria. Grandco does not guarantee approval.

3.2 Interchange-Plus Pricing

Grandco uses transparent interchange-plus pricing through Converge. Customer's monthly statement separately discloses: (a) interchange fees set by Visa/Mastercard/Interac, passed through at cost; (b) Grandco/Elavon markup in agreed basis points; and (c) card scheme assessments. Customer's specific rate is confirmed in the Welcome Letter. Grandco will provide at least sixty (60) days' written notice before increasing Customer's markup rate.

3.3 Settlement

Subject to Section 6 and the Elavon Merchant Agreement, Elavon will settle approved transactions to Customer's Merchant Bank Account per the funding frequency stated in the Merchant Application (typically next business day for qualifying merchants). All settlements are provisional and subject to chargeback, adjustment, and set-off rights.

3.4 Bank Account Requirements

Customer must maintain a Canadian dollar bank account at a Schedule I or Schedule II chartered bank throughout the term. Customer must provide thirty (30) days' written notice before changing the Merchant Bank Account and must obtain Grandco and Elavon's prior written consent before implementing changes. Customer must maintain sufficient funds to cover all fees, chargebacks, and adjustments at all times.

3.5 Direct Debit Authority

Customer authorises Elavon and Grandco to directly debit the Merchant Bank Account for all amounts due under this Agreement, including subscription fees, processing fees, chargebacks, and adjustments. This authority remains in effect throughout the term and for 390 days following termination, or until all obligations are fulfilled, whichever is later. Customer must not revoke this direct debit authority without Grandco and Elavon's prior written consent.

3.6 Card Scheme Rules Compliance

Customer must comply at all times with the operating rules and regulations of all applicable Card Schemes. Card Scheme Rules prevail over all other terms in the event of conflict. Failure to comply may result in fines, additional fees, suspension, or termination of processing privileges. Card Scheme Rules may change without notice; compliance is an ongoing obligation.

3.7 Acquiring Limits

Elavon may limit the volume of transactions it will acquire from Customer. Where Customer exceeds an established limit, Elavon may suspend transaction acquiring or withhold settlement funds in accordance with the Elavon Merchant Agreement and Section 7 of these Terms. Grandco will inform Customer of applicable acquiring limits as provided by Elavon.

3.8 Provisional Credit & Adjustments

All payments into the Merchant Bank Account are subject to: (a) audit and adjustment by Elavon for inaccuracies or errors; (b) chargebacks and representments; (c) all applicable fees and adjustments; and (d) any conditional credit Elavon may grant for individual or groups of transactions. Elavon provides monthly statements showing the value of all sale transactions acquired, Merchant Service Charges, refunds, chargebacks, interchange fees, and all other fees and adjustments.

3.9 Multi-Currency & DCC

Customer may only accept transactions in Canadian dollars (CAD) unless dynamic currency conversion (DCC) or multi-currency conversion is specifically approved by Elavon in writing and reflected in the Schedule of Fees. Where approved, Elavon will apply a conversion rate calculated and published daily via the Converge Reporting Tool. Additional fees apply to DCC transactions. Customer must comply with all disclosure requirements specified in the Elavon Operating Guide for DCC transactions.

3.10 Reporting Tool

Where Customer elects to have access to Elavon's Converge Reporting Tool, Customer and all authorised users are bound by the terms displayed within the Reporting Tool. Customer acknowledges that: (a) use of the Reporting Tool is at Customer's sole risk and is provided on an "as is" and "as available" basis; (b) Elavon makes no warranty that the Reporting Tool will be uninterrupted, timely, secure, or error-free; and (c) any data or information accessed through the Reporting Tool is used at Customer's own discretion and risk. Elavon shall have no liability for any loss suffered as a result of Customer's use of or inability to use the Reporting Tool.

Credit Card Surcharging

4.1 Eligibility & Enablement

Surcharging is available on all Grandco subscription plans and is enabled by default upon account activation unless Customer opts out in writing. Customer may disable surcharging at any time through the merchant dashboard or by contacting Grandco support with three (3) business days' notice.

4.2 Permitted Surcharge Rate

Where surcharging is enabled, Customer may apply a surcharge of up to 2.4% on credit card transactions. Customer may set a lower rate through the merchant dashboard. The surcharge must bear a reasonable relationship to Customer's actual cost of accepting the applicable card type and must not be used as a mechanism to profit beyond the cost of card acceptance.

4.3 Prohibited Surcharged Transactions

Customer must not apply a surcharge to:

• Interac Debit transactions (any amount);
• Prepaid card transactions of any kind;
• Cards issued in a jurisdiction where surcharging is prohibited by law;
• Any transaction type excluded by Visa or Mastercard Card Scheme Rules from time to time.

4.4 Mandatory Disclosure Requirements

Customer is solely responsible for compliance with all surcharge disclosure requirements under applicable Card Scheme Rules and provincial consumer protection legislation, including:

1. Posting clear notice at the point of entry to Customer's business location that credit card surcharges may apply, including the applicable percentage;
2. Disclosing the surcharge amount or calculation method to the cardholder before the transaction is completed;
3. Separately itemising the surcharge on the transaction receipt, showing the goods/services amount, surcharge amount, and total amount;
4. Displaying the total transaction amount including surcharge on the terminal screen before the cardholder approves the transaction.

Grandco's POS platform automates terminal-level disclosure. Customer remains solely responsible for in-store signage, website disclosures, and any other compliance requirements under provincial consumer protection laws, including Quebec's Consumer Protection Act where applicable.

4.5 Customer Liability for Surcharging

Customer is solely liable for all fines, penalties, chargebacks, complaints, and regulatory actions arising from improper surcharging practices, including: surcharging debit transactions; surcharging above the 2.4% maximum; failing to provide required disclosure; or violating applicable provincial consumer protection laws. Grandco and Elavon accept no liability for Customer's surcharging practices or any consequences thereof.

Card Acceptance Rules

The following rules apply to all transactions processed through Grandco and supplement the Elavon Merchant Agreement and applicable Card Scheme Rules. In the event of conflict, the Elavon Merchant Agreement and Card Scheme Rules prevail.

5.1 General Card Acceptance

Customer shall:

1. Only accept valid, current Cards as payment for legitimate goods or services sold and supplied to cardholders;
2. Accept all eligible card types — including Visa and Mastercard consumer and commercial cards — without discrimination as between card types within the same Card Scheme;
3. Not impose minimum or maximum transaction amounts on cardholders except as specifically permitted by applicable Card Scheme Rules;
4. Not use Customer's own personal or business cards to process transactions through Customer's merchant account;
5. Not accept transactions where an employee, director, or other member of Customer's business is the cardholder;
6. Only process transactions in Canadian dollars (CAD) unless alternative currencies are specifically approved in writing by Elavon.

5.9 Purchase with Cashback

Customer may not provide purchase with cashback services without Elavon's prior written consent. Where approved, Customer must display clearly the cashback amount separately on the transaction receipt and comply with all Card Scheme Rules and Elavon Operating Guide requirements relating to cashback transactions.

5.10 Pre-Authorisations & Deposits

Customer may not accept card payments representing a deposit or partial payment for goods or services to be delivered in the future, and may not place pre-authorisation holds, without Elavon's prior written consent. Where approved: Customer must execute one transaction receipt when accepting the deposit and a second upon accepting the balance; Customer must not present the balance transaction until goods have been delivered or services fully performed; and Customer must note the words "deposit" or "balance" on each applicable receipt.

5.11 Electronic Gift Cards

Customer may not accept or issue electronic gift cards (EGCs) without Elavon's prior written consent and must comply with Schedule 3 of the Elavon Merchant Agreement and all applicable Card Scheme EGC rules where such consent is granted.

Fees & Billing

6.1 Platform Subscription Fees

Customer's monthly platform subscription fee is determined by the plan selected and confirmed in the Merchant Application and Welcome Letter. Subscription fees are billed monthly in advance on the billing date established at account activation. Fees are non-refundable except as expressly provided in Section 11.

6.2 Processing Fees

Payment processing fees are charged separately from platform subscription fees and are debited from the Merchant Bank Account in arrears. Processing fees include interchange, Grandco/Elavon markup, and card scheme assessments as described in Section 3.2. Processing fees are not included in the monthly platform subscription price.

6.3 Hardware Fees

POS terminal hardware may be purchased outright or leased monthly. Hardware pricing is disclosed at the time of order and confirmed in the Merchant Application. Purchased hardware may be returned within thirty (30) days of delivery for a refund less shipping costs, provided it is undamaged and in original packaging. Leased hardware must be returned within ten (10) business days of account termination; failure to return leased hardware results in a replacement charge debited to the Merchant Bank Account.

6.4 Fee Changes

Grandco may adjust platform subscription fees with sixty (60) days' written notice. Processing markup rates may only be increased with sixty (60) days' written notice. Customer may terminate this Agreement without penalty if notified of a fee increase, provided termination notice is received before the effective date of the increase. Card Scheme fees set by Visa, Mastercard, or Interac may be adjusted at any time and are passed through at cost.

6.5 Past-Due Amounts & Interest

Amounts not paid when due will bear interest at the rate of 2% per month (24% per annum), calculated daily, from the due date until the date of actual payment. Grandco and Elavon may suspend payment processing services without prior notice if any amount is past due by more than fifteen (15) days.

6.6 Taxes

All fees are exclusive of applicable taxes including GST/HST and QST (Quebec). Customer is responsible for any applicable taxes on fees charged under this Agreement. Grandco will issue tax invoices as required by the Excise Tax Act (Canada) and applicable provincial legislation.

6.7 Set-Off

Elavon and Grandco may set off any amounts owed by Customer against any amounts owed to Customer — including settlement funds — without prior notice. This right of set-off survives termination of this Agreement and may be exercised for up to 390 days post-termination.

Terminals & Hardware

6B.1 Terminal Requirement

Unless alternative forms of accepting transactions are expressly approved by Elavon in writing, Customer must use an approved terminal for accepting all card transactions regardless of the transaction amount. Customer may use: (a) terminals supplied by Grandco or Elavon under a hire arrangement; (b) third-party terminals with Elavon's prior written consent; or (c) card readers purchased through the Grandco hardware store. Customer must enter into any additional hire agreement for terminals as required by Elavon.

6B.2 Terminal Use & Maintenance

For all terminals supplied by or through Grandco or Elavon (excluding third-party terminals), Customer must:

• Operate and keep all terminals clean, undamaged, and secure at all times;
• Notify Grandco immediately if any terminal requires repair or replacement;
• Not attempt to repair, disassemble, or reverse-engineer any terminal hardware;
• Replace or upgrade terminals as required by Elavon or the applicable Card Schemes from time to time;
• Provide, maintain, and pay for all power and telecommunications connections necessary to operate the terminals, including all related charges;
• Not use any SIM card from a GPRS terminal for any purpose other than transmission and receipt of payment data.

Where repair or replacement of a terminal is required due to damage, misuse, loss, or theft, Elavon has the right to recover the cost of such repair or replacement from Customer. Elavon's determination as to whether a terminal was damaged through misuse or is lost or stolen is final and binding on Customer.

6B.3 Rental Fees & Terminal Recovery

Rental fees and any repair or replacement charges for Elavon-supplied terminals are debited to the Merchant Bank Account monthly by direct debit. Upon termination of this Agreement, Customer must return all rented terminals to Grandco within ten (10) business days. A Terminal Recovery Fee (an administrative charge) is payable in addition upon termination. If a terminal is not returned within this period, Elavon may charge Customer the full replacement cost of the terminal, which will be refunded upon receipt of the terminal in satisfactory working condition. Customer bears the risk of terminals in transit — if a terminal is lost or returned damaged, Elavon may charge an appropriate amount for repair or replacement.

6B.4 Third-Party Terminals

Customer may use third-party terminals only with Elavon's prior written consent and provided that such terminals are in all respects compliant with the requirements of the applicable Card Schemes, including requirements for the protection of cardholder information. The burden of demonstrating such compliance rests with Customer. If third-party terminals are used:

1. Customer must purchase or ensure the continued availability of third-party terminals through lease or hire;
2. Customer assumes full responsibility and liability for any failure of the third-party terminal or its vendor to comply with Card Scheme Rules, applicable law, and these Terms;
3. Customer must provide Elavon with terminal serial numbers, locations, and details of terminal management systems upon request;
4. Customer must ensure third-party terminals are operated, maintained, and upgraded in compliance with Elavon's requirements and Card Scheme Rules;
5. Elavon shall not be responsible for any losses or expenses incurred by Customer as a result of any error by a third-party terminal vendor or malfunction of a third-party terminal.

6B.5 Wireless Terminals & Mobile POS

Where Customer uses a wireless terminal or mobile POS reader, Customer acknowledges that limitations of wireless technology may affect performance and reliability. If wireless connectivity is unavailable or interrupted, Customer must not complete transactions using the wireless terminal and must use alternative approved processing means. Customer must not complete transactions without a valid authorisation code simply because wireless coverage is unavailable — doing so is at Customer's sole risk and Customer bears full liability for any resulting losses or chargebacks.

6B.6 Terminal Insurance

Customer must comprehensively insure all Grandco-supplied and Elavon-supplied terminals and PIN pads against all injury, loss, damage, or destruction. Customer must have Elavon's interest noted on the relevant insurance policy unless waived in writing by Elavon. Elavon may at any time require Customer to produce a copy of the insurance policy and evidence of premium payment. Any insurance monies received in relation to a terminal claim must be applied towards repairing or replacing the terminal and compensating Elavon for any related loss.

6B.7 Card Recovery Obligations

Customer must use reasonable means to recover a card if: instructed to do so by the terminal, the issuer, or a voice authorisation centre; Customer has reasonable grounds to believe the card is lost, stolen, counterfeit, fraudulent, or otherwise invalid; or the printed digits on the card do not match the embossed account number. Customer must not suggest it is acting as an agent of Grandco or Elavon at any time, unless specifically retaining or recovering a card at Elavon's request.

Chargebacks & Disputes

7.1 Chargeback Liability

Customer is liable for the full amount of any chargeback plus applicable chargeback processing fees. Where Elavon has already paid Customer for a charged-back transaction, Customer must immediately repay that amount. Chargeback amounts represent a debt immediately due and payable without demand. Elavon may debit Customer's Merchant Bank Account for any chargeback amount at any time.

7.2 Disputing Chargebacks

Customer may dispute a chargeback by providing evidence that the transaction was authorised by the cardholder and that goods or services were delivered as described. Dispute evidence must be submitted within the timeframe specified in the chargeback notification — typically five (5) to ten (10) business days. Grandco will assist Customer in compiling dispute documentation through the merchant dashboard but cannot guarantee reversal of any chargeback. Customer must not resubmit a transaction that has been the subject of a chargeback.

7.3 Retrieval Requests

Customer must respond to any retrieval request from Elavon or a Card Scheme within the timeframe specified in the request, by providing a legible copy of the sale transaction receipt. Failure to respond within the required timeframe results in automatic chargeback liability for that transaction, which cannot be reversed.

7.4 Excessive Chargeback & Fraud Merchant Status

If Customer's chargeback ratio exceeds Card Scheme thresholds (currently 1% by count or value in any calendar month), Customer may be designated an "Excessive Chargeback Merchant" by the relevant Card Scheme. In this event, Grandco and Elavon may: require a chargeback reduction plan; impose additional per-transaction monitoring fees; withhold settlement funds as a reserve; or suspend or terminate payment processing services. Customer is liable for all Card Scheme fines arising from designation as an Excessive Chargeback Merchant or Excessive Fraud Merchant.

7.5 Reserves

Grandco and Elavon may require Customer to maintain a reserve account in any circumstances creating heightened financial risk, including excessive chargeback levels, suspected fraud, insolvency risk, processing volumes significantly exceeding Application estimates, or termination of this Agreement. Reserve amounts are held for a minimum of 390 days post-termination and applied against Customer's outstanding obligations.

Data & Privacy

8.1 Privacy Policy

Grandco's collection, use, and disclosure of personal information is governed by Grandco's Privacy Policy and by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. By using the Grandco platform, Customer consents to Grandco's collection and use of data as described in the Privacy Policy.

8.2 Canadian Data Residency

Grandco stores Customer Data in data centres located in Canada. Customer acknowledges that payment processing data handled by Elavon/Converge may be transferred to or accessed from the United States or other jurisdictions by Elavon or its affiliates for fraud prevention and regulatory compliance purposes, subject to appropriate contractual safeguards. Grandco does not store cardholder payment data on its own servers.

8.3 Customer Data Ownership

Customer retains ownership of all Customer Data — including CRM contacts, transaction history, and marketing data — stored in the Grandco platform. Grandco is granted a limited licence to process Customer Data solely for the purpose of providing platform services. Grandco will not sell Customer Data to third parties. Upon termination, Customer may export Customer Data within thirty (30) days; thereafter Grandco may delete Customer Data in accordance with its data retention schedule.

8.4 PCI DSS Compliance

Customer must comply with the Payment Card Industry Data Security Standard (PCI DSS) at all times. Customer's PCI level is determined by monthly transaction volume as specified by the applicable Card Schemes. Customer must complete annual self-assessment questionnaires (SAQs) or third-party audits as required for Customer's PCI level. The Grandco/Converge gateway is PCI DSS compliant; Customer remains responsible for the security of its own systems, networks, and hardware.

8.5 Cardholder Data Security

Customer must not store sensitive authentication data — including CVV2/CVC2, full magnetic stripe data, or PIN data — after transaction authorisation, for any purpose. Customer must store cardholder primary account numbers (PANs) only in encrypted form meeting PCI DSS requirements and only where operationally necessary. Customer must immediately notify Grandco and Elavon upon becoming aware of any actual or suspected cardholder data breach.

8.6 Data Breach Response

In the event of a cardholder data breach attributable to Customer's systems or actions, Customer must: immediately notify Grandco and Elavon; preserve all logs and evidence; cooperate fully with any forensic investigation commissioned by Grandco, Elavon, or the Card Schemes; and implement all remediation measures required. Customer is solely liable for all costs of breach notification, forensic investigation, card reissuance required by affected cardholders, and Card Scheme fines.

8.7 CASL & Marketing Compliance

All commercial electronic messages (email and SMS) sent through the Grandco platform must comply with CASL. Customer is responsible for obtaining, recording, and maintaining valid express consent for all contacts. Customer must honour all unsubscribe requests within ten (10) business days. Grandco provides CASL-compliant opt-out mechanisms in all platform-generated messages but cannot guarantee compliance with Customer-created message content or subject lines.

8.8 Data Processing by Elavon

With respect to payment processing activities, Elavon acts as a data processor on Customer's behalf for transaction-related personal data. Elavon will: process personal data only in connection with providing Merchant Services; implement appropriate technical and organisational security measures; maintain PCI DSS requirements for all cardholder data; ensure personnel with access to personal data are subject to confidentiality obligations; and promptly notify Customer of any data subject requests. Customer is the data controller and warrants that all instructions given to Elavon for processing personal data comply with applicable data protection laws. Elavon may appoint sub-processors (including its affiliates) provided equivalent data protection obligations are in place.

8.9 IT Security for Internet Payment Services

Where Customer accepts payments through an internet-facing system, Customer must implement and maintain:

• Segregation of duties — separate development, test, and production IT environments at all times;
• Network security — appropriate solutions to protect networks, websites, servers, and communication links against abuse and attacks; hardened servers with unnecessary functions removed;
• Access controls — processes to monitor, track, and restrict access to sensitive payment data and critical resources; log creation, storage, and regular analysis;
• Data minimisation — the gathering, routing, processing, storing, and visualisation of sensitive payment data kept to the absolute minimum necessary;
• Security testing — regular security testing of internet payment systems under risk management function supervision, including tests for known potential attack scenarios;
• Extended validation certificates — transactional websites must use EV SSL certificates or equivalent validation methods to restrict the use of fraudulent impersonation sites;
• Periodic audits — independent audits of security measures and the implementation of internet payment services by trusted internal or external experts who are not involved in development or operational management.

Representations, Warranties & Covenants

Customer represents, warrants, and covenants to Grandco and Elavon, continuously throughout the term of this Agreement, each of the following:

8B.1 Accuracy of Information

All information provided to Grandco and Elavon in the Merchant Application and any other document submitted in connection with this Agreement is true, accurate, and complete. The information properly reflects Customer's business, financial condition, and principal partners, owners, or officers. Customer will promptly notify Grandco and Elavon in writing of any changes to the information provided, including changes to:

1. Customer's business locations, including any additional locations at which Customer desires to accept card payments;
2. Customer's legal name or trading name;
3. The identity of Customer's principals, directors, officers, or beneficial owners;
4. Customer's ownership or corporate structure, including any sale of all or a material part of the business;
5. Customer's usual trading activities, including if Customer stops or plans to stop trading;
6. The nature of Customer's business, including the type of goods or services provided, trading terms, or how sales are completed (e.g. online, by telephone, mail, or in person).

Such notice must be provided to Grandco at least ten (10) business days prior to any planned change. Customer will provide any additional information requested by Grandco or Elavon within a reasonable time, including product information, copies of trading terms, and supplier invoices.

8B.2 Authority & Capacity

Customer and the individual executing this Agreement have full legal capacity and authority to execute and perform this Agreement. The person signing is duly authorised to bind Customer. Customer's execution and performance of this Agreement does not violate any law, regulation, or other agreement to which Customer is party.

8B.3 No Pending Litigation

There is no pending or threatened legal action, proceeding, or regulatory investigation that would: (a) impair Customer's ability to carry on its business substantially as presently conducted; (b) adversely affect Customer's financial condition or operations; or (c) otherwise affect Customer's ability to perform its obligations under this Agreement. Customer has never been placed on the Visa Merchant Alert Service (VMAS™) or Mastercard's MATCH™ system, or if Customer has been listed, Customer has disclosed this fact to Grandco in writing.

8B.4 Business Purpose

This Agreement is entered into for commercial or business purposes, not for personal, family, or household purposes. Customer is obtaining and using Merchant Services for legitimate business purposes only, to facilitate lawful transactions between Customer and its customers. Customer's business and manner of conducting it comply with all applicable laws. Customer's Merchant Bank Account is used for lawful business purposes only.

8B.5 No Prior Data Security Breach

As of the date this Agreement was entered into, no security breach in respect of data processed by Customer or on Customer's behalf has occurred that remains unresolved. In the event Customer is in breach of this representation, Grandco and Elavon may suspend Merchant Services and take any steps deemed necessary to remedy the breach.

8B.6 Insolvency Notification

Customer will immediately notify Grandco in writing of any Insolvency Event (as defined in the Glossary). Customer must maintain the Merchant Bank Account as required by Grandco and Elavon following any Insolvency Event.

8B.7 Insurance Obligations

Customer agrees to maintain, at its own expense throughout the term:

• Public liability insurance — in amounts customary for businesses of Customer's type and size, with evidence provided to Grandco or Elavon on request;
• Professional liability / errors and omissions insurance — including coverage on an indemnity basis for liability to Grandco and Elavon for negligent acts, omissions, and fraud by Customer's employees, and in respect of Customer's indemnification obligations under Section 9;
• Terminal insurance — comprehensive coverage for all Grandco-supplied terminals and PIN pads against all injury, loss, damage, or destruction, with Elavon's interest noted on the policy (unless waived in writing).

8B.8 Cardholder Marks & Branding

Customer must prominently display the most current versions of the Card Schemes' names, symbols, and service marks at or near Customer's point-of-sale terminals for all card types accepted. Customer's use of Card Scheme marks must comply with each Card Scheme's brand standards. Such use does not: (a) indicate that any Card Scheme endorses Customer's goods or services; or (b) grant Customer any ownership interest in the marks. Customer may not copy, reproduce, distribute, or create derivative works from any Card Scheme marks or from any Grandco or Elavon intellectual property.

8B.9 Audit Rights

Customer authorises Grandco and Elavon to perform on-site audits of Customer's business at any time, with reasonable prior notice, to verify compliance with this Agreement. As part of any such audit, Customer must: (a) provide access to all business locations, records, systems, equipment, and stock; (b) permit copies of relevant records to be made; (c) provide all reasonable assistance requested; and (d) submit, at Customer's expense, an audit report from a third-party certified by the applicable Card Schemes when reasonably requested. Customer must also procure authority from any third-party vendors for Grandco and Elavon to perform similar audits of those vendors. Card Schemes have the right to audit Customer's business directly to verify compliance with Card Scheme Rules.

Indemnification

9.1 Customer's Indemnification Obligations

Customer will defend, indemnify, and hold harmless Grandco, Elavon, and their respective affiliates, officers, directors, employees, agents, and successors ("Indemnified Parties") from and against all claims, losses, damages, liabilities, costs, and expenses (including reasonable legal fees) arising from or relating to:

1. Any transaction, chargeback, or refund processed through Customer's merchant account;
2. Customer's breach of these Terms or the Elavon Merchant Agreement;
3. Customer's violation of applicable Card Scheme Rules;
4. Customer's surcharging practices, including improper disclosure or exceeding the permitted rate;
5. Any cardholder data breach attributable to Customer's systems, employees, or contractors;
6. Customer's violation of CASL or any other applicable law in connection with use of the Grandco platform;
7. Any claim by a cardholder or third party arising from Customer's goods, services, or business practices;
8. Misuse of POS hardware or Grandco software by Customer or Customer's employees;
9. Customer's failure to comply with PCI DSS requirements;
10. Any Card Scheme fines levied against Grandco or Elavon as a result of Customer's actions or omissions.

9.2 Procedure

Indemnified Parties will provide reasonable notice of any claim for which indemnification is sought. Customer may not settle any such claim without the prior written consent of the applicable Indemnified Party. Grandco and Elavon reserve the right to assume control of the defence of any claim at Customer's expense where they determine this is necessary to protect their interests.

Limitation of Liability

10.1 Cap on Grandco's Liability

To the maximum extent permitted by applicable law, Grandco's total aggregate liability to Customer arising out of or relating to these Terms or the Grandco platform — whether in contract, tort, negligence, or otherwise — shall not exceed the total platform subscription fees paid by Customer in the twelve (12) months immediately preceding the event giving rise to the claim.

10.2 Exclusion of Consequential Damages

In no event shall Grandco or Elavon be liable — even if advised of the possibility of such damages — for any:

• Loss of profits, revenue, business, or goodwill;
• Loss of data, Customer Data, or marketing records;
• Indirect, incidental, special, punitive, or consequential damages;
• Losses arising from platform downtime or service unavailability;
• Losses arising from third-party service failures including Grandco or Converge outages.

10.3 Elavon Liability Cap

Elavon's liability under the Elavon Merchant Agreement is separately limited to an amount equal to the Merchant Service Charges (less Card Scheme fees) paid by Customer during the twelve (12) months preceding the first act or omission giving rise to the claim. This cap is separate from and in addition to Grandco's liability cap in Section 10.1.

10.4 Exceptions — No Limitation

Nothing in these Terms limits liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) losses suffered by Grandco or Elavon in relation to chargebacks, Card Scheme fines, or refunds under this Agreement; or (d) any other liability that cannot lawfully be excluded or limited under applicable Canadian law.

10.5 Force Majeure

Neither Grandco nor Elavon shall be liable for any delay or failure in performance resulting from causes beyond their reasonable control, including natural disasters, pandemics, telecommunications or power failures, government actions, Card Scheme system outages, cybersecurity attacks, or acts of war. The affected party must notify the other promptly and resume performance as soon as reasonably practicable.

Termination & Suspension

11.1 Term

This Agreement commences on the date Customer activates a Grandco account and continues on a month-to-month basis unless terminated under this Section. There is no minimum SaaS contract term. The Elavon payment processing arrangement commences upon Merchant Account approval and continues month-to-month as described in the Elavon Merchant Agreement.

11.2 Termination by Customer

Customer may terminate this Agreement at any time by providing written notice to Grandco (email to info@grandco.ca is acceptable). Termination of the SaaS subscription takes effect on the last day of the then-current billing month. Customer remains liable for all processing fees, chargebacks, and adjustments relating to transactions processed before the termination date. Customer should separately notify Elavon to close the Merchant Account.

11.3 Termination by Grandco

Grandco may terminate this Agreement:

1. Without cause, on thirty (30) days' written notice to Customer;
2. Immediately, upon Customer's material breach of these Terms that remains uncured ten (10) business days after written notice of breach;
3. Immediately, upon Customer becoming insolvent, making an assignment for the benefit of creditors, or becoming subject to bankruptcy or insolvency proceedings;
4. Immediately, if required by Elavon, any Card Scheme, or any regulatory authority with jurisdiction over Grandco or Elavon.

11.4 Suspension of Services

Grandco or Elavon may immediately suspend payment processing services — without prior notice — where:

• Customer fails to pay any amount due and the amount remains outstanding for more than fifteen (15) days;
• Grandco or Elavon reasonably suspects fraud or criminal activity;
• Customer's chargeback ratio exceeds Card Scheme thresholds;
• Customer's processing volume materially exceeds levels disclosed in the Application;
• Required by law, regulation, or Card Scheme rules;
• Customer experiences a confirmed cardholder data breach or PCI DSS violation.

Grandco will notify Customer of any suspension as soon as reasonably practicable after suspension is implemented. Suspension of processing services does not affect Customer's obligation to pay SaaS subscription fees.

11.5 Effect of Termination

Upon termination of this Agreement:

1. Customer's access to the Grandco platform is deactivated at the end of the final billing period;
2. Customer must immediately cease processing transactions;
3. All leased hardware must be returned within ten (10) business days;
4. Settlement funds may be withheld by Elavon for up to 390 days post-termination to cover potential chargebacks and obligations;
5. Customer may export Customer Data within thirty (30) days of termination; Customer Data may be deleted thereafter;
6. Provisions that by their nature survive termination — including Sections 7, 8, 9, 10, and 13 — remain in full force.

Reseller Program

12.1 Reseller Designation

Individuals or entities approved by Grandco as resellers ("Resellers") may purchase Grandco platform subscriptions at wholesale rates and resell them to their own merchant clients ("Sub-Merchants"). Reseller status requires a separate Reseller Application and written approval by Grandco. Reseller status is personal to the Reseller and is non-transferable without Grandco's prior written consent.

12.2 Reseller Obligations

Resellers must:

1. Enter into a written agreement with each Sub-Merchant that incorporates terms at least as protective of Grandco and Elavon as these Terms, including obligations relating to card acceptance, data security, and chargeback liability;
2. Not represent themselves as Grandco or Elavon or create the impression they are agents of Grandco or Elavon without prior written authorisation from Grandco;
3. Accurately and fairly represent the capabilities, fees, limitations, and terms of the Grandco platform to all Sub-Merchants;
4. Not onboard Sub-Merchants operating in prohibited industries or submit Merchant Applications containing materially false or misleading information;
5. Notify Grandco promptly of any Sub-Merchant dispute, data breach, fraud suspicion, excessive chargeback situation, or material change in Sub-Merchant's business;
6. Comply with all applicable laws governing the marketing and sale of financial services and payment processing services in Canada, including any applicable provincial regulations.

12.3 Wholesale Rates & Reseller Tiers

Resellers are billed at wholesale rates determined by their Reseller Tier (Silver, Gold, or Platinum) as published at grandco.ca/pricing and confirmed in the Reseller Agreement. Tier qualification is based on the number of active Sub-Merchant accounts and is reassessed quarterly. Grandco may adjust Reseller Tier qualification thresholds and wholesale rates with sixty (60) days' written notice.

12.4 Processing Residuals

Resellers earn processing residuals ("BPS Residuals") of 10–15 basis points on the net monthly processing volume of qualifying Sub-Merchant accounts, as determined by Reseller Tier. Residuals are calculated at the end of each calendar month and paid on the 15th of the following month, provided the minimum payout threshold of $50.00 CAD has been reached. Grandco may withhold residual payments where a Sub-Merchant account is subject to active dispute, chargeback recovery, fraud investigation, or reserve requirements.

12.5 Post-Termination Residual Continuation

Upon voluntary termination of the Reseller Agreement in good standing — with no outstanding material breaches, unresolved chargeback liabilities, or fraud investigations — Reseller will continue to receive BPS Residuals on existing Sub-Merchant accounts for twenty-four (24) months following the effective termination date, provided those Sub-Merchants remain active Grandco customers. This residual continuation right does not apply if the Reseller Agreement is terminated for cause.

12.6 Reseller Liability for Sub-Merchants

Resellers are jointly and severally liable with each Sub-Merchant they onboard for chargebacks, Card Scheme fines, and other obligations where: the Reseller had actual or constructive knowledge of circumstances giving rise to the liability; or the Reseller failed to comply with the onboarding obligations in Section 12.2. Grandco may set off amounts owed by a Reseller's Sub-Merchants against Reseller BPS Residuals, with reasonable prior written notice.

12.7 Reseller Termination

Either party may terminate the Reseller Agreement on sixty (60) days' written notice without cause. Grandco may terminate immediately for cause, including material misrepresentation in Sub-Merchant onboarding, fraud, sustained non-compliance with Section 12.2, or breach of these Terms. Upon termination, Resellers must immediately cease marketing Grandco services and remove all Grandco branding from their materials within thirty (30) days.

White Glove Service Limits

The White Glove plan ($999/mo) includes all features of the Scale subscription plus a dedicated marketing team executing a monthly strategy on the Merchant's behalf. To ensure consistent, high-quality delivery to every White Glove client, the following service limits apply. These limits form part of the Merchant's agreement with Grandco and apply in addition to all other terms in this Agreement.

13.1 Website Build

The White Glove plan includes the design, build, hosting, and maintenance of one (1) custom business website. The included website is limited to a maximum of eight (8) pages (for example: Home, About, Services, Gallery, Blog Index, and Contact). Additional pages beyond eight (8) will be quoted and billed separately at Grandco's then-current rates. The Merchant must supply all required brand assets — including logo files, brand colours, and any required photographs — at onboarding. The initial website build will be delivered within fifteen (15) business days of completed onboarding, subject to timely receipt of all required assets from the Merchant.

13.2 Monthly Website Updates

Grandco will complete up to two (2) content revision requests per calendar month (for example: updating text, photos, business hours, or promotional offers). Revision requests must be submitted to the Merchant's dedicated account manager by the 20th of each month to be actioned within that same month; requests submitted after that date will be carried forward to the following month. Structural redesigns, new page additions, or changes requiring significant development work are not included within monthly revision allowances and will be scoped and quoted separately.

13.3 Social Media Management

Grandco will create and publish up to twelve (12) branded social media posts per calendar month across Facebook and Instagram (the same content published to both platforms). Grandco will also produce and publish up to four (4) short-form video reels or stories per calendar month, with a maximum duration of sixty (60) seconds each. For reels, the Merchant must either supply raw video footage or provide written approval for the use of AI-generated or licensed stock visuals. Community management (responding to comments and direct messages) covers organic content only and does not include management of paid advertising comments. Response times are within twenty-four (24) business hours, Monday through Friday, 9:00 a.m. to 5:00 p.m. Eastern Time.

13.4 Content and Email Marketing

Grandco will produce one (1) SEO-optimized blog post per calendar month (600–900 words), to be published to the Merchant's website. The Merchant must submit their approved topic to the account manager by the 10th of each month. Each blog post is subject to a maximum of two (2) rounds of revisions. Grandco will write, design, and send one (1) email newsletter per calendar month to the Merchant's existing customer list. Grandco does not purchase, build, or source external contact lists; the newsletter is sent exclusively to the Merchant's own list as provided to Grandco. The monthly seasonal or promotional campaign includes up to two (2) SMS sends and one (1) email send per campaign.

13.5 Automation and CRM Management

Grandco will monitor and optimize the Merchant's existing review request automation, missed call text-back, and webchat flows on a monthly basis. This service covers optimization and tuning of existing automations — it does not include the build or creation of new automation workflows, which will be scoped and quoted separately. The quarterly win-back re-engagement campaign runs once per quarter (not monthly).

13.6 Google Business Profile and Directory Listings

Grandco will manage the Merchant's Google Business Profile, including up to four (4) posts per month and up to eight (8) photo uploads per month. Grandco will maintain accurate business directory listings across 40+ platforms (powered by Yext). Initial directory listing setup will be completed within ten (10) business days of the receipt of all required business information from the Merchant. The Merchant is responsible for the accuracy of all business information provided to Grandco at onboarding and must notify Grandco promptly of any changes.

13.7 Strategy Calls and Reporting

The Merchant's dedicated account manager will conduct one (1) monthly strategy call of thirty (30) minutes. Strategy calls must be scheduled a minimum of five (5) business days in advance. If the Merchant cancels or fails to attend a scheduled strategy call with less than twenty-four (24) hours' notice, that month's call is forfeited and will not be rescheduled within the same month. Monthly performance reports will be delivered within the first five (5) business days of each new month.

13.8 Onboarding

Grandco's commitment to onboard the Merchant within five (5) business days is contingent upon the Merchant completing the onboarding intake form within forty-eight (48) hours of signup. Delays resulting from the Merchant's failure to provide required assets, information, or approvals in a timely manner will extend the onboarding timeline accordingly, and Grandco shall bear no liability for such delays. A dedicated account manager will be assigned on the first day of onboarding.

13.9 Additional Services

Services requested by the Merchant that fall outside the limits described in this Section 13 — including but not limited to additional website pages, additional social posts, paid advertising management, and custom automation builds — may be arranged through the Merchant's account manager and will be billed separately at Grandco's then-current rates for such services.

General Provisions

13.1 Entire Agreement

These Terms, together with the Merchant Application, Reseller Agreement (if applicable), Elavon Merchant Agreement, and any supplemental schedules, constitute the entire agreement between the parties and supersede all prior negotiations, representations, and agreements, written or oral, relating to the subject matter hereof.

13.2 Amendments

Grandco may amend these Terms at any time on sixty (60) days' written notice via email to the primary account holder's registered address and by posting updated Terms at grandco.ca/terms. Continued use of the platform after the effective date of any amendment constitutes acceptance. Customer may terminate without penalty before the effective date if Customer objects to the amendments.

13.3 Assignment

Customer may not assign or transfer these Terms or any rights hereunder without Grandco's prior written consent. Grandco may assign these Terms to an affiliate or in connection with a merger, acquisition, or sale of substantially all of its business assets, on written notice to Customer.

13.4 Notices

Notices to Customer shall be delivered by email to the registered account email address. Notices are effective upon sending (unless Grandco receives a delivery failure notification). Notices to Grandco must be sent by email to info@grandco.ca or by registered mail to Grandco's registered Ontario address. Email notices to Grandco are effective upon actual receipt and written acknowledgement.

13.5 Independent Contractors

The parties are independent contractors. Nothing in these Terms creates any agency, joint venture, partnership, employment, or franchisor-franchisee relationship between Grandco and Customer or between Grandco and any Reseller.

13.6 Severability

If any provision of these Terms is found to be invalid or unenforceable by a court of competent jurisdiction, that provision shall be modified to the minimum extent necessary to make it enforceable, and the remaining provisions shall continue in full force and effect.

13.7 Waiver

Failure by Grandco to enforce any provision of these Terms shall not constitute a waiver of that provision or any other provision. No waiver shall be effective unless in writing signed by an authorised Grandco representative. Waiver of a breach does not constitute waiver of any subsequent or similar breach.

13.8 Governing Law & Jurisdiction

These Terms are governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict-of-law principles. The parties submit to the exclusive jurisdiction of the courts of Ontario for resolution of any disputes. Customer irrevocably waives any objection to the laying of venue in Ontario. Elavon retains the right to bring proceedings in any court of competent jurisdiction in connection with the Elavon Merchant Agreement.

13.9 Language

The parties confirm their wish that these Terms be drawn up in English. Les parties confirment leur désir que la présente convention soit rédigée en anglais. A French-language version of these Terms is available upon written request and at grandco.ca/conditions-utilisation.

13.10 Contact Addresses

Internet & E-Commerce Transactions

A.1 Security Requirements for Internet Transactions

Where Customer is approved to accept internet transactions, Customer must implement and maintain the following security measures:

• A secure, encrypted payment page using TLS 1.2 or higher for all pages where cardholders enter payment data;
• An Extended Validation (EV) SSL certificate or equivalent validation issued in Customer's legal name for all transactional pages;
• CVV2/CVC2 verification for all card-not-present transactions;
• 3D Secure (Verified by Visa / Mastercard Identity Check) where required by the applicable Card Scheme or Elavon;
• Clear and accurate display of Customer's merchant name, legal business address, and customer service contact information on the payment page;
• A clearly displayed privacy policy and refund/return policy accessible from the payment page;
• Fraud screening tools appropriate to Customer's transaction volumes and risk profile.

A.2 Strong Customer Authentication (SCA)

For all internet transactions, Customer must:

1. Electronically request the application of Strong Customer Authentication (SCA) before completing any internet sale transaction through the Converge gateway;
2. Enable and cooperate in the application of SCA to all applicable transactions;
3. Follow all instructions regarding SCA received from an issuer or Elavon, including instructions provided electronically through the Converge gateway;
4. Not apply SCA on Customer's own initiative where an issuer or Elavon has not instructed Customer to do so;
5. Not split the value of sales to circumvent SCA requirements.

An issuer or Elavon may determine that SCA is not required for certain low-value or low-risk transactions in accordance with applicable regulations. If Customer does not request or cooperate in the application of SCA where required, Customer must not complete the transaction and assumes full liability for any resulting chargebacks or losses.

A.3 Transaction Presentment for Internet Orders

Internet transactions for the sale of goods must not be presented for settlement until the goods ordered have been dispatched or arrangements confirmed for service delivery, except where:

• For Visa transactions: the goods or services may be presented before dispatch provided a written acknowledgement quoting the dispatch date (not later than 28 days from order receipt) is sent to the cardholder within seven (7) days of presentment;
• For Mastercard transactions: presentment before dispatch or performance requires the cardholder's agreement to a properly disclosed delayed delivery at the time of the transaction.

A.4 Website Requirements

Customer's e-commerce website must, at minimum, clearly display:

• Customer's full legal or trading name and registered Canadian business address;
• Customer service telephone number and/or email address;
• Complete description of goods or services offered;
• Total price of goods or services including all applicable taxes and any surcharge;
• Currency of the transaction (Canadian dollars unless DCC is approved);
• Return, refund, and cancellation policy;
• Delivery or fulfilment timeframes;
• Privacy policy describing how cardholder data will be used;
• The Card Scheme marks for all card types accepted.

A.5 Prohibited Internet Practices

Customer must not, in connection with internet transactions:

• Store full card numbers, security codes, or magnetic stripe data in any database or log file;
• Pass cardholder data through URLs or in non-encrypted form;
• Pre-tick any checkbox indicating consent to a recurring charge;
• Accept payments on behalf of a third party merchant not disclosed in the Merchant Application;
• Display transaction pages in a manner that obscures or misrepresents Grandco's or Elavon's identity as the payment processor.

Confidentiality

B.1 Grandco & Elavon Confidential Information

Customer must keep in strict confidence all Confidential Information of Grandco and Elavon, including: pricing and rate schedules; processing system specifications and technical documentation; the Elavon Operating Guide; fraud prevention methods and tools; and any other non-public information received in connection with this Agreement. "Confidential Information" means all trade secrets, proprietary, or other confidential information or items of Grandco or Elavon of which Customer obtains knowledge as a result of this Agreement, whether or not in written form, and whether or not designated as confidential.

B.2 Permitted Disclosures

Customer may disclose Confidential Information only:

1. To Customer's employees, officers, representatives, advisers, agents, or subcontractors who need to know such information for the purpose of carrying out Customer's obligations under this Agreement, provided those persons are bound by equivalent confidentiality obligations; and
2. As required by applicable law, court order, or governmental or regulatory authority — in which case Customer must, where legally permitted, provide Grandco and Elavon with prior written notice and cooperate with any steps taken to limit or contest the required disclosure.

B.3 Prohibition on Unauthorised Use

Customer must not use any Confidential Information for any purpose other than performing its obligations under this Agreement. Customer must not use Grandco's or Elavon's Confidential Information to develop competing products or services, to solicit Grandco's or Elavon's other customers, or for any commercial purpose not directly related to Customer's use of the Grandco platform.

B.4 Cardholder Information — Strict Prohibition on Sharing

Without the prior written consent of the cardholder, Customer must not sell, purchase, provide, disclose, remit, share, or exchange card information — including cardholder details, transaction data, or any information obtained through the processing relationship — to any third party, except to Customer's approved third-party vendors for the sole purpose of assisting Customer in its business and only upon those vendors agreeing in writing to hold such information confidentially and to comply with all applicable laws and Card Scheme Rules. Account and transaction information belongs to Elavon and, where applicable, the Card Schemes. Customer agrees to use such information only for the sole purpose of acquiring transactions and complying with this Agreement.

B.5 Survival

Customer's confidentiality obligations under this Schedule B survive termination of this Agreement for a period of five (5) years, except that obligations relating to cardholder data survive indefinitely.

B.6 Disclosure of Transaction Data by Elavon

Elavon and its affiliates may, as permitted by Card Scheme Rules and applicable law, disclose to the Card Schemes: (a) confidential information furnished by Customer; and (b) information that would enable the Card Schemes to determine an individual's identity, including card account numbers. Elavon may disclose Customer's transaction data to third parties through which Customer was introduced to Elavon (including Grandco) for the purpose of calculating and paying applicable commissions and fees, and to facilitate their services to Customer. Elavon may also disclose data as described in these Terms, the Merchant Application, and any data privacy notices provided to Customer from time to time.

Data Security Standards & PCI Compliance

C.1 PCI DSS Compliance Obligation

Customer must comply with the Payment Card Industry Data Security Standard (PCI DSS) at all times throughout the term. PCI DSS compliance is an ongoing requirement, not a one-time certification. Customer's PCI compliance level is determined by Visa and Mastercard based on Customer's annual transaction volumes:

Grandco provides a PCI Waiver Plan for eligible Level 3 and Level 4 merchants. See Section C.5 for eligibility and conditions.

C.2 Prohibited Data Storage

Customer must never store, after authorisation, any of the following sensitive authentication data, for any reason whatsoever:

• Full magnetic stripe data (track 1 or track 2) from the card's magnetic stripe or chip;
• Card verification codes or values: CVV, CVV2, CVC2, iCVV, or PVV;
• PIN data or encrypted PIN blocks;
• Full unmasked Primary Account Numbers (PANs) in plain text in any database, log, or file.

Where PANs are stored for operational reasons, all but the last four digits must be masked. Customer must destroy cardholder account information prior to disposal in a manner that renders it unreadable (e.g. cross-cut shredding of paper, secure wiping of electronic media).

C.3 Security Breach Obligations

In the event Customer becomes aware of or suspects any security breach or compromise of cardholder or transaction data — whether by Customer, its employees, or any third-party vendor — Customer must:

1. Immediately notify Grandco and Elavon, identifying the nature and scope of the breach or compromise;
2. Preserve all system logs, files, and evidence and refrain from making changes to compromised systems without Grandco and Elavon's consent;
3. Identify and resolve the cause of the breach, co-operate fully with Grandco, Elavon, and the Card Schemes in any investigation;
4. At Grandco's or Elavon's request and at Customer's cost, procure a forensic investigation report from a qualified third party approved by the Card Schemes within the timeframe specified;
5. Comply with all recommendations in any forensic investigation report;
6. Allow Grandco and Elavon to review, comment on, and approve any forensic report before submission to the Card Schemes;
7. Notify affected cardholders and regulatory authorities as required by applicable law (including PIPEDA breach notification obligations).

Customer is solely responsible for all costs of breach response, including forensic investigation, card reissuance costs, fraud losses, notification costs, credit monitoring services provided to affected cardholders, and all Card Scheme fines. Customer's obligations under this Section C.3 apply regardless of whether Customer was compliant with PCI DSS at the time of the breach.

C.4 Third-Party Vendor Security

Where Customer uses third-party vendors that store, process, or transmit cardholder or transaction data on Customer's behalf:

• Customer must ensure such vendors are registered with and listed on each applicable Card Scheme's list of approved vendors;
• Customer must contractually require such vendors to comply with PCI DSS and all applicable Card Scheme security requirements;
• Customer remains fully liable for any breach of PCI DSS or Card Scheme Rules by such vendors as if the breach were Customer's own;
• Customer must procure that such vendors cooperate with Grandco and Elavon in any security investigation.

C.5 PCI Waiver Plan

Grandco offers a PCI Waiver Plan for eligible merchants classified as PCI Level 3 or Level 4. To be eligible and to maintain eligibility, Customer must:

1. Maintain classification as a PCI Level 3 or Level 4 merchant throughout the subscription period;
2. Subscribe to and maintain one of Grandco's approved PCI compliance solutions (SAQ facilitation or automated scan service);
3. Complete the applicable Self-Assessment Questionnaire (SAQ) annually and submit it to Grandco by the due date;
4. Not experience a confirmed cardholder data breach attributable to Customer's systems during the subscription period.

Where Customer is eligible and enrolled in the PCI Waiver Plan, Grandco will waive the PCI Non-Compliance Fee. Eligibility may be revoked immediately if Customer fails to maintain any of the above conditions. Enrolment in the PCI Waiver Plan does not constitute a guarantee of PCI DSS compliance and does not limit Customer's liability for any data breach.

C.6 VMAS™ & MATCH™ Reporting

In the event this Agreement is terminated for cause pursuant to Section 11.3(b) or (d), or in the event of confirmed fraud or a significant data breach, Customer's name and merchant identification number may be listed on the Visa Merchant Alert Service (VMAS™) and/or Mastercard's Member Alert to Control High-Risk (MATCH™) system. Customer acknowledges and accepts this possibility. Such listing may affect Customer's ability to obtain merchant processing services from any payment processor in the future. Grandco and Elavon shall have no liability to Customer for any losses resulting from such listing where it is made in accordance with applicable Card Scheme Rules.

Prohibited Business Types

D.1 Absolutely Prohibited — No Exceptions

Grandco and Elavon will not provide Merchant Services to any entity operating, facilitating, or materially associated with any of the following business types or activities, regardless of jurisdiction, licensing, or regulatory status:

• Illegal goods and services — any product or service that is illegal in the jurisdiction where the sale occurs or the cardholder is located, including unlicensed pharmaceuticals, controlled substances, and counterfeit goods of any kind;
• Adult content and services — pornography, escort services, adult entertainment clubs, and sexually explicit material of any kind, whether digital or physical;
• Child exploitation material — any content, service, or product that sexually exploits minors or facilitates harm to children, in any form;
• Unlicensed financial services — unlicensed money transmission, unlicensed currency exchange, unlicensed investment or securities dealing, unlicensed loan brokering, or Ponzi, pyramid, or multi-level marketing schemes with no genuine product;
• Illegal gambling — online or offline gambling services that are not licensed under applicable Canadian provincial or federal law;
• Weapons trafficking — sale of illegal weapons, unlicensed firearms, ammunition, or explosive devices;
• Hate groups and extremism — businesses promoting hatred, violence, or discrimination on the basis of race, ethnicity, religion, gender, sexual orientation, or any other protected ground;
• Human trafficking and exploitation — any service or business that facilitates human trafficking, forced labour, or modern slavery;
• Sanctions and embargoes — transactions with persons, entities, or countries subject to Canadian, US, EU, or UN sanctions programmes.

D.2 High-Risk Categories Requiring Prior Written Approval

The following business types require Elavon's prior written approval and enhanced underwriting before a merchant account can be activated. Approval is at Elavon's sole discretion and may be subject to additional terms, processing limits, or reserves:

• Online pharmacies and nutraceuticals — businesses selling prescription or over-the-counter medications, health supplements, or nutraceuticals online, particularly where delivery is cross-border;
• Travel and ticketing — travel agencies, tour operators, airlines, event ticket resellers, and any business accepting significant advance deposits for future-dated services;
• Subscription and negative option billing — businesses where recurring charges are initiated after a free trial period, or where cancellation requires affirmative action by the cardholder;
• Telemarketing and outbound call centres — businesses that primarily acquire customers through outbound telephone solicitation;
• Credit repair and debt relief — businesses offering to repair credit scores, settle debts, or negotiate with creditors on behalf of cardholders;
• Timeshare and vacation ownership — businesses selling or reselling timeshare interests, travel clubs, or vacation ownership products;
• Cryptocurrency and digital assets — cryptocurrency exchanges, digital asset brokers, NFT marketplaces, and related financial products;
• Social media services and engagement — businesses selling social media followers, likes, views, or artificial engagement metrics;
• Multi-level marketing (MLM) — direct sales organisations structured around recruitment compensation, even where a genuine product exists;
• Fantasy sports and skill gaming — online daily fantasy sports platforms and skill-based gaming with real-money prizes, except where licensed under applicable provincial law;
• Firearms and regulated weapons — licensed firearms dealers, ammunition suppliers, and manufacturers of regulated weapons components;
• Cannabis and THC products — licensed cannabis retailers and producers operating under applicable Health Canada or provincial licences (subject to Elavon's separate cannabis merchant programme terms);
• Bail bond services — bail bond agencies and related judicial services;
• Pawn shops and buy/sell/trade — pawn brokers, second-hand goods dealers, and businesses with a significant volume of used goods resale;
• Surety bond companies — companies that act as surety for legal proceedings or contracts.

D.3 Ongoing Compliance Obligation

Customer must promptly notify Grandco in writing if Customer's business changes such that it would fall into a prohibited or high-risk category, or if Customer begins offering any products or services not previously disclosed in the Merchant Application. Failure to disclose such changes may result in immediate termination of Merchant Services and VMAS™/MATCH™ reporting. Grandco reserves the right to re-underwrite Customer's account at any time if it becomes aware of material changes to Customer's business.

D.4 Geographic Restrictions

The Grandco platform and payment processing services are available only to businesses with a primary place of business in Canada and that primarily sell to Canadian-resident cardholders. Cross-border e-commerce may be permitted with Elavon's prior written consent and subject to additional terms, including compliance with applicable foreign consumer protection and data privacy laws. Grandco does not support merchant accounts for businesses incorporated in jurisdictions subject to Canadian, US, or EU financial sanctions.

Defined Terms

Capitalised terms throughout these Terms have the meanings set out below. Terms defined in the Elavon Merchant Agreement that are not defined here have the meanings given to them in that agreement, which is incorporated by reference.