13A.1 Scope and Access Eligibility
This Section governs access to and use of any application programming interface, webhook, data feed, or integration endpoint made available by the Company in connection with the Platform ("API"). Access to the API is not available to all Users by default and is subject to a separate API access application and approval process.
To be eligible for API access, you must:
(a) hold an active, verified Platform Account in good standing;
(b) be acting in a professional, technical, or commercial capacity as expressly authorized in writing by the Company — consumer accounts are not eligible for API access unless expressly approved;
(c) agree to and comply with this Section 12A and any additional API documentation, developer guidelines, or usage policies published by the Company from time to time;
(d) not be a direct competitor of the Company, unless prior written approval has been granted.
API access credentials are personal and non-transferable. You may not grant, sublicense, resell, or share your API credentials with any third party. The Company reserves the right to approve, reject, or revoke API access at its sole discretion without providing a reason.
13A.2 Authentication and Security Requirements
All API requests must be authenticated using the credentials (API key, OAuth token, or equivalent mechanism) issued by the Company upon approval. You are solely responsible for:
(a) storing API credentials securely and preventing unauthorised access or disclosure;
(b) rotating credentials immediately if you suspect they have been compromised, and notifying the Company at legal@exactsolution.com without undue delay;
(c) implementing appropriate technical controls in your systems to prevent unauthorised use of the API through your credentials;
(d) ensuring that all API calls are transmitted over encrypted connections (TLS 1.2 or higher);
(e) not embedding API credentials directly in publicly accessible code repositories, client-side code, or any publicly visible environment.
You acknowledge that the Company may monitor API usage patterns for security and abuse detection purposes. Any activity that the Company reasonably believes constitutes a security risk or breach may result in immediate credential suspension without prior notice.
13A.3 Rate Limits and Usage Restrictions
API access is subject to rate limits as specified in the API documentation published in the Developer Portal. Current limits apply on a per-credential, per-endpoint, and per-time-window basis. The Company reserves the right to adjust rate limits at any time, with notice provided where reasonably practicable.
You must not:
(a) exceed the rate limits applicable to your access tier;
(b) use multiple credentials, rotating IPs, or other technical mechanisms to circumvent rate limits;
(c) make requests that impose a disproportionate or unreasonable load on the Platform's infrastructure;
(d) cache or store API responses beyond the duration permitted by the response headers or API documentation;
(e) use the API to access data in bulk quantities beyond what is necessary for your stated integration purpose.
Exceeding rate limits may result in temporary throttling, suspension of API access, or termination of your integration agreement without liability to the Company.
13A.4 Prohibited Uses
In addition to the prohibited conduct set out in Section 4.2 of these Terms, the following uses of the API are expressly prohibited:
(a) Scraping and unauthorised data extraction — using the API to systematically collect, harvest, or extract Product data, pricing, inventory levels, or any other Platform data for purposes beyond your approved integration use case, including building competing price aggregation tools or databases;
(b) Reverse engineering — attempting to reverse engineer, decompile, disassemble, or otherwise derive the source code, architecture, algorithms, or trade secrets of the Platform through API interactions or response analysis;
(c) Automated account actions — using the API to programmatically create accounts, place speculative orders, manipulate product availability signals, or otherwise automate actions that circumvent the Platform's normal user interaction flows;
(d) Resale of access — offering API-derived data or functionality as a service to third parties without the Company's prior written consent;
(e) Security testing without authorisation — conducting penetration testing, fuzzing, vulnerability scanning, or any other security assessment of the API or Platform without the Company's prior written authorisation;
(f) Inference attacks — using patterns of API responses to infer confidential business information, including but not limited to inventory volumes, sales velocity, supplier relationships, or pricing strategies.
13A.5 Data Usage Restrictions — GDPR Alignment
Where API responses include or involve personal data (including but not limited to Customer names, delivery addresses, contact details, or order-linked identifiers), the following obligations apply:
(a) Independent controller responsibility — where you receive personal data via the API and process it for your own purposes, you act as an independent data controller under Regulation (EU) 2016/679 (GDPR) and are solely responsible for maintaining a valid lawful basis, providing appropriate privacy notices to data subjects, and complying with all applicable data protection obligations;
(b) Purpose limitation — personal data received via the API may be used only for the specific, documented integration purpose approved by the Company. You must not use such data for direct marketing, profiling, data enrichment, or any purpose other than that for which it was shared;
(c) Retention limits — personal data received via the API must not be retained beyond the period strictly necessary for the approved integration purpose. Data that is no longer required must be securely deleted or anonymised;
(d) No onward transfer without safeguards — you must not transfer personal data received via the API to any third party or to a country outside the European Economic Area without ensuring that appropriate transfer safeguards are in place in accordance with Chapter V GDPR;
(e) Data Processing Agreement — where the Company determines that the nature of API data sharing constitutes a controller-to-processor relationship, you will be required to execute a Data Processing Agreement with the Company before API access is granted or continued;
(f) Breach notification — if you suffer a personal data breach involving data received via the API, you must notify the Company at legal@exactsolution.com within 24 hours of becoming aware of the breach, in advance of any statutory notification obligations.
13A.6 Suspension and Revocation of API Access
The Company may suspend or permanently revoke API access credentials, with or without prior notice, in the following circumstances:
(a) breach of any provision of this Section 12A or the API documentation;
(b) any use of the API that the Company reasonably considers harmful to the Platform, other Users, or third parties;
(c) a data protection breach or GDPR non-compliance event involving API-received data;
(d) the discovery that API access was obtained by misrepresentation;
(e) a change in the Company's API offering, including the retirement or restructuring of API endpoints;
(f) a court order, regulatory direction, or law enforcement request.
The Company shall endeavour to provide advance notice of revocation where circumstances permit, but is not obligated to do so where immediate revocation is necessary to protect the Platform or its Users. Revocation does not affect the Company's right to pursue other remedies for breach.
Section 13B — Beta Services and Trial Features
13B.1 Scope
From time to time, the Company may make available features, tools, functionality, or services that are in a pre-release, experimental, pilot, or trial phase ("Beta Services"). Beta Services may be offered under a limited-access programme, a time-limited free trial, or an invitation-only arrangement. Participation in any Beta Service is voluntary and subject to this Section 12B, which governs to the exclusion of any conflicting provision in these Terms to the extent of the conflict.
Access to Beta Services does not create any entitlement to continued access, general availability, or the commercial release of any feature or functionality encountered in the Beta Service.
13B.2 "As-Is" Basis — No Warranty
Beta Services are provided strictly on an "as is" and "as available" basis, without representation or warranty of any kind, express or implied, including without limitation any warranty of:
(a) merchantability or fitness for a particular purpose;
(b) accuracy, completeness, or reliability of outputs or data;
(c) uninterrupted, error-free, or secure operation;
{d) compatibility with your systems, devices, or existing workflows;
(e) conformity with the description or documentation provided.
The Company expressly disclaims all warranties in respect of Beta Services to the fullest extent permitted by applicable law. Nothing in this Section affects your mandatory statutory rights as a Consumer under applicable EU and Polish consumer protection law, which cannot be waived.
13B.3 Features May Change or Be Discontinued
Beta Services are subject to change at any time and without prior notice. The Company may, at its sole discretion and without liability:
(a) modify, limit, or alter the functionality, scope, or availability of any Beta Service;
(b) discontinue a Beta Service permanently, whether or not a commercially released equivalent is made available;
(c) transition a Beta Service to a paid offering with or without a conversion period;
(d) merge, split, or restructure Beta Services in connection with Platform development.
You acknowledge that reliance on Beta Services for critical business or personal functions is at your own risk, and the Company accepts no responsibility for losses arising from the modification or discontinuation of a Beta Service.
13B.4 Limitation of Liability — Enhanced Exclusion for Beta Services
In addition to and notwithstanding the general limitation of liability in Section 12, the following enhanced limitation applies specifically to Beta Services:
The Company's total aggregate liability in connection with any Beta Service — whether arising in contract, tort (including negligence), breach of statutory duty, or otherwise — shall not exceed EUR 100 (or the equivalent in your local currency), regardless of the nature or extent of the loss claimed.
The Company shall not be liable for any of the following losses arising from your use of or reliance on a Beta Service:
(a) loss, corruption, or inaccessibility of data entered into or processed by a Beta Service;
(b) business interruption, loss of revenue, or loss of anticipated savings;
(c) reputational harm arising from Beta Service output or failure;
(d) costs of substitute services or workarounds adopted following Beta Service disruption.
Nothing in this Section 12B.4 excludes liability that cannot be excluded under mandatory Polish or EU consumer protection law, including liability for death or personal injury caused by negligence or for fraud or fraudulent misrepresentation.
13B.5 No Guaranteed Uptime or Support
Beta Services are not subject to any service level commitment, uptime guarantee, or support obligation. In particular:
(a) the Company does not commit to any minimum availability percentage for Beta Services;
(b) scheduled or unscheduled downtime may occur without advance notice;
(c) support for Beta Services, where offered, is provided on a best-efforts basis only and does not carry any response time or resolution commitment;
(d) the Company may prioritise resources for generally available Platform services over Beta Service issues at its sole discretion.
Where support for a Beta Service is offered, it will be provided through the channel specified in the Beta Service documentation or invitation. The Company's standard support SLAs set out in these Terms do not apply to Beta Services.
13B.6 Feedback and Improvements — Licence to Use
If you provide comments, suggestions, ideas, improvement requests, bug reports, or other feedback in relation to any Beta Service ("Feedback"), you grant the Company a perpetual, irrevocable, worldwide, royalty-free, fully sublicensable licence to use, reproduce, adapt, modify, incorporate, and exploit such Feedback for any purpose, including the development, improvement, and commercialisation of the Platform and related products, without any obligation of confidentiality, attribution, or compensation to you.
You represent that any Feedback you provide is your own original input and does not infringe the intellectual property rights of any third party. You waive any moral rights in the Feedback to the fullest extent permitted by applicable law.
This Feedback licence survives termination of your access to the Beta Service and does not create any joint ownership, employment, or agency relationship between you and the Company.