Aller au contenu
Fabriqué dans l'UE
Legal

Terms of Sale and Service

Effective 17 July 2026 · Version 2.0 · Contract language: English

These terms cover custom candy orders, QRCandy accounts, hosted QR codes, scan analytics, and the partner programme. Mandatory rights that cannot lawfully be limited always take priority.

Checkout is not legally ready until this is fixed

The seller identity is incomplete. Replace the bracketed values in src/lib/legal.ts with the contracting company's legal name, organisation number, VAT number, and registered address. A trading name alone is not enough.

1. Parties and Scope

These Terms of Sale and Service (the Terms) are an agreement between the person or organisation using QRCandy (the Customer or you) and:

[Legal entity name], trading as QRCandy
Swedish organisation number: [Swedish organisation number]
VAT number: [VAT number]
Registered address: [Registered postal address, Sweden]
Email: hello@qrcandy.co
Website: qrcandy.co

QRCandy sells made-to-order branded confectionery and provides associated hosted QR routing, campaign management, and scan analytics (together, the Service). These Terms apply when you create an account, place an order, use the Service, join the partner programme, or otherwise expressly accept them.

A Consumer is a natural person acting mainly for purposes outside their trade, business, craft, or profession. All other Customers are business customers. If you act for an organisation, you confirm that you have authority to bind it. Consumer provisions apply only to Consumers; business provisions apply only to business customers.

The storefront displays net prices exclusive of VAT and is aimed at business purchasing. Applicable VAT is calculated and added at the checkout payment step from the delivery country and any validated business VAT number, so the exact total price is always shown before payment. Consumers may also contact us at any time for a VAT-inclusive quotation and the pre-contract information they need.

2. Products and Food Information

Each product is manufactured to the configuration you approve, which may include a logo, colours, wrapper text, QR code, destination URL, quantity, and flavour. The product page and the final order summary form part of the contract for that order.

On-screen previews are a design aid, not a colour-accurate print proof. Reasonable differences caused by screens, printing, cutting, wrapping, and confectionery production may occur. A stated tolerance never removes a Consumer's mandatory rights or excuses a material failure to match the agreed specification.

Food information required before a distance purchase, including ingredients, highlighted allergens, nutrition, net quantity, and storage information, is provided on the relevant product page before ordering. The durability date may be provided on delivery where the law permits. Required particulars also accompany the delivered product. Review them before ordering, particularly if products will be distributed to people with allergies. If required food information is marked pending or unavailable, that product is not offered for sale and any apparent ability to order it is an error; please tell us.

Do not alter or obscure food labels. If you redistribute the products in a way that creates additional legal duties for you, you are responsible for those duties. We remain responsible for obligations that the law places on us as seller or food business operator.

3. Orders and Contract Formation

You place an order by configuring the product, reviewing the cart and delivery details, accepting these Terms, and completing the payment step on Stripe's hosted checkout. Check the design, destination URL, quantity, contact details, and delivery address carefully before payment.

Your submitted order is an offer to buy. We accept the offer, and a contract is formed, when we send the order confirmation email after successful payment. The version of these Terms presented when you ordered governs that order.

We may cancel an order for a genuine reason, including an unavailable product, failed or unverifiable payment, an obvious price or technical error, unsupported delivery destination, failure to meet a stated minimum, or content that breaches Section 9. If money was captured, we will promptly refund the canceled amount to the original payment method.

You must give accurate information and a monitored email address. Contact us immediately if the confirmation is wrong. We will try to correct an error, but changes may be impossible or chargeable once artwork, ingredients, or production have been committed.

4. Prices, Tax, and Payment

Prices are shown in the currency selected on the site (currently EUR, SEK, DKK, or NOK). The cart identifies product, setup, discount, and shipping amounts. Unless a price is expressly stated to include VAT, storefront prices are exclusive of VAT.

The checkout is designed for business orders but calculates VAT for every order: the Stripe payment page adds any VAT applicable to the delivery country and shows the exact total that will be charged before you pay. Business customers in another EU country can enter their VAT number at checkout; the EU reverse charge or zero rating is then applied automatically where legally available. Deliveries outside the EU are normally sold without Swedish VAT as exports and may attract the import charges described in Section 5.

Payment is due at checkout and is processed on Stripe's hosted page. Stripe, not QRCandy, receives your full card or payment credentials. We receive the payment status, amount, currency, transaction references, and information needed for reconciliation, refunds, and fraud handling. There is no recurring subscription for the QR functionality included with an order unless we separately agree one in writing.

If an obvious pricing or calculation error affected an order, we may cancel and refund it or ask whether you want to proceed at the correct price. We will not increase an accepted order's price without your agreement.

5. Production and Delivery

Products are made to order. The product page shows an estimated production lead time, and checkout shows the available destination, shipping charge, and estimated carrier time. An estimate is not a guaranteed date unless we expressly confirm it as such. Production begins after acceptance and may depend on artwork approval or other information from you.

We will deliver to the address in the accepted order using the stated method or a reasonably equivalent carrier. Tell us promptly about a likely delay. Consumers retain all statutory rights for late delivery, including the right in applicable cases to set a reasonable additional period, withhold payment, or cancel. A delay outside our reasonable control does not remove rights that cannot lawfully be excluded.

Risk of loss or damage passes when the goods are physically delivered to you or a person you nominate, except that if you independently appoint a carrier we did not offer, risk may pass when the goods are handed to that carrier as permitted by law. Title passes when we have received full payment.

You are responsible for correct delivery details and, for deliveries outside the EU, any disclosed import formalities, duties, and taxes. We remain responsible for information and costs that the law requires us to state before the order.

6. Changes, Cancellation, and Withdrawal

Made-to-order goods and withdrawal

Consumers normally have a 14-day right to withdraw from a distance purchase. That right does not apply to goods made to the Consumer's specifications or clearly personalised. QRCandy products configured with your artwork, colours, text, destination, or campaign QR code normally fall within that personalised-goods exception. We do not rely on a general claim that shelf-stable candy is “perishable”.

If we ever sell a non-personalised product for which withdrawal does apply, we will provide the required instructions and withdrawal function before you are bound. Nothing here limits a right that applies despite the personalised-goods exception.

Cancellation before delivery

A Swedish Consumer may cancel a goods order before delivery even where the 14-day withdrawal right is excluded. Contact us immediately. We will stop work where reasonably possible and refund sums not lawfully retained. We may claim the specific costs and reasonable loss caused by cancellation only to the extent permitted by mandatory consumer law; the amount can increase once artwork, materials, or production are committed.

Business customers have no automatic cancellation right. We may agree to a change or cancellation in writing, subject to work completed, non-cancellable supplier commitments, and reasonable administration costs.

7. Defects and Complaints

Email us as soon as practical if goods are damaged, unsafe, missing, late, or do not match the accepted specification. Include the order number, a clear description, and useful photographs where reasonably available. Do not discard affected goods or packaging until we have had a reasonable opportunity to investigate, unless keeping them would be unsafe.

Swedish Consumers may complain about an original defect for three years after delivery. A complaint made within two months after noticing the defect is always in time. For defects appearing during the first two years, the statutory presumption applies unless its application would be incompatible with the goods or defect.

Consumer remedies follow mandatory law and may include repair or replacement, proportionate price reduction, reimbursement of reasonable costs, withholding payment, or cancellation where the statutory conditions are met. We may choose a lawful remedy only where that choice does not cause unreasonable cost or inconvenience to the Consumer.

Business customers must inspect deliveries promptly and notify visible defects without undue delay, normally within ten business days, and hidden defects promptly after discovery. Subject to Section 14, our first remedy may be re-performance, replacement, or credit. This business notice period does not apply to Consumers.

8. QR Service

Each campaign QR code routes through QRCandy before redirecting the scanner to the destination selected in your dashboard. You can re-point or pause an active code, and the dashboard displays available scan analytics. A QR code identifies the campaign; it is not designed to identify an individual scanner.

No separate subscription or scheduled expiry is currently charged for QR routing included with an order. It remains available while QRCandy operates the hosted QR Service and your campaign is active, subject to these Terms. This is not a literal perpetual guarantee. If we plan to discontinue material QR functionality, we will give reasonable advance notice where practicable and explain available export or transition options.

We use reasonable care to keep redirects available, but cannot promise uninterrupted service or a particular scan rate. Scanning can be affected by device cameras, print damage, lighting, connectivity, third-party destinations, or events outside our reasonable control. We may perform maintenance and apply proportionate traffic limits or security controls.

You control the destination and must keep it lawful, safe, and suitable for the audience. You must give scanners the privacy information and other notices required for your campaign. Our processing of scanner metadata is described in the Privacy Policy, and our processor obligations are in Section 11.

9. Customer Content and Acceptable Use

You keep ownership of logos, artwork, text, URLs, and other material you submit (Customer Content). You grant us and our production and service providers a worldwide, non-exclusive, royalty-free licence to host, reproduce, resize, convert, print, and transmit Customer Content only as needed to provide, secure, support, and document the Service and fulfil your order.

You confirm that you have the rights and permissions needed for Customer Content and the campaign. You must not use the Service for content or destinations that:

  • infringe intellectual property, privacy, publicity, or other rights;
  • are unlawful, fraudulent, deceptive, defamatory, threatening, or hateful;
  • contain malware, phishing, credential theft, or unsafe redirects;
  • market age-restricted products unlawfully or target children inappropriately;
  • collect personal data without a valid legal basis and transparent notice; or
  • interfere with, probe, overload, scrape, reverse engineer, or bypass the Service.

We may reject artwork or block a destination where reasonably necessary to comply with law, protect scanners, or enforce these Terms. Where feasible, we will tell you why and allow a correction.

The QRCandy name, platform, software, templates, and original site content remain ours or our licensors'. Except for normal use of the Service, no rights are granted to copy, distribute, sell, or create derivative works from them.

Each party will use reasonable care to protect the other's clearly confidential non-public business or technical information and use it only for the agreement. This does not cover information already lawfully known, independently developed, received lawfully without restriction, or public through no breach. Required disclosure is permitted after advance notice where legally allowed. Customer Content may be shared with the production and service providers needed to fulfil the order.

10. Accounts and Security

You must be at least 18 and provide accurate account information. Keep credentials confidential, use a strong unique password, and promptly tell us about suspected compromise. You are responsible for authorised activity under your account and for managing access within your organisation.

You can request account deletion in settings. Deletion may be delayed while a paid order still needs delivery. Once deletion is completed, we deactivate and scrub QR campaigns, remove account and brand records, anonymise personal fields in retained order records, and neutralise the login. Records required by law, and data we must preserve for a live dispute, may remain as described in the Privacy Policy.

11. QR Data Processing Terms

This Section is the data-processing agreement under GDPR Article 28 for Scan Data that QRCandy processes on a Customer's behalf. It applies automatically when a Customer uses QR analytics as a controller. The rest of these Terms, including the liability provisions, also applies. If another part of the Terms conflicts with this Section about processing Customer Scan Data, this Section controls.

Roles, instructions, and processing details

The Customer is controller and QRCandy is processor for personal data generated when people scan the Customer's campaign QR codes (Scan Data), except where QRCandy acts as an independent controller for its own essential security, abuse prevention, legal compliance, or service-integrity purposes as explained in the Privacy Policy.

The subject matter is QR redirection and campaign analytics. Processing lasts while the QR Service is provided plus the deletion and backup period. Its nature is receiving an HTTP request, resolving and redirecting the code, recording and deduplicating an event, securing the Service, and making analytics available to authorised Customer users.

Scan Data may include timestamp, campaign and destination identifiers, user-agent and device/browser indicators, referring URL, country code, resolved URL, and a short-lived one-way request fingerprint derived from the code, IP address, and user-agent. The raw IP address is processed in transit but is not written to the QRCandy scan-event table. Data subjects are people who scan the Customer's codes.

The Customer instructs QRCandy to process Scan Data only to provide and secure the QR Service, as configured through the dashboard, these Terms, and documented support requests. QRCandy will process it only on documented instructions, including for international transfers, unless EU or Member State law requires otherwise. If so, we will inform the Customer before processing unless prohibited. We will promptly tell the Customer if we believe an instruction infringes data protection law.

QRCandy processor commitments

  • ensure authorised personnel are bound by confidentiality and access Scan Data only as needed;
  • maintain appropriate technical and organisational measures under GDPR Article 32, taking account of risk, including access controls, transport encryption, tenant-level database controls, deduplication hashing, monitoring, and tested recovery arrangements where appropriate;
  • notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Scan Data and provide available information reasonably needed for the Customer's notification duties;
  • taking account of the processing, reasonably assist with data-subject requests, security, breach assessments, DPIAs, and regulator consultation under GDPR Articles 32–36;
  • make information reasonably necessary to demonstrate compliance available and permit a proportionate audit by the Customer or an independent auditor bound by confidentiality, normally no more than once per year unless a breach, regulator, or credible compliance concern justifies more; and
  • at the end of the Service, at the Customer's written choice, return or delete Customer Scan Data and copies unless applicable law requires retention. During service, event rows are deleted after 24 months and deduplication fingerprints are removed after seven days. Backup copies are isolated until ordinary rotation.

Standard compliance information is provided without charge. The Customer pays reasonable costs of bespoke assistance or audits that go beyond QRCandy's normal materials, unless the audit identifies a material breach by QRCandy.

Subprocessors and transfers

The Customer gives general written authorisation for the current Scan Data subprocessors: Supabase for managed database/backend infrastructure and Lovable/hosting/CDN infrastructure providers for application delivery, routing, and request security. Their functions are described in the Privacy Policy. Other recipients listed there are not Scan Data subprocessors unless they receive Scan Data for the Customer's Service. QRCandy will impose data-protection obligations materially equivalent to this Section and remains responsible for subprocessor performance as required by GDPR.

We will give reasonable advance notice of an intended new or replacement subprocessor that processes Scan Data so the Customer can object on reasonable data-protection grounds. If no reasonable solution is available, the Customer may stop the affected QR Service.

QRCandy will use a valid Chapter V transfer mechanism for restricted transfers, such as an adequacy decision or the European Commission's Standard Contractual Clauses with supplementary measures where appropriate. The Customer authorises QRCandy to enter those clauses on its behalf where needed to appoint a subprocessor.

Customer controller duties

The Customer is responsible for a lawful basis, transparent scanner notice, handling data-subject requests, and ensuring its destinations and instructions comply with law. Do not instruct us to infer identity, use Scan Data for unlawful tracking, or process special-category, criminal-offence, or children's data through the QR analytics unless we have expressly agreed appropriate safeguards in writing. The Customer must promptly tell us if Scan Data was submitted unlawfully or must be restricted or deleted.

12. Partner and Referral Terms

These additional terms apply to anyone given a partner account or referral code. Programme-specific rates, eligible products, attribution window, commission basis, and status shown in the invitation or partner dashboard form part of the agreement.

  • Promote QRCandy accurately and transparently. Disclose the commercial relationship wherever endorsement or advertising law requires it.
  • Do not use spam, misleading claims, cookie stuffing, paid search on QRCandy marks, impersonation, self-referrals, fabricated orders, or other manipulation.
  • A commission is provisional until the qualifying order is paid, delivered, and no longer subject to cancellation, refund, chargeback, fraud, or exclusion under the programme settings. Reversed orders do not earn commission.
  • Approved commission is paid using the method and schedule agreed with the partner. The partner is responsible for invoices, tax, and payment details. The relationship does not create employment, agency, exclusivity, or authority to bind QRCandy.
  • We may reject abusive referrals, correct calculation errors, withhold disputed amounts while investigating, and suspend or end participation for breach. Accrued undisputed commission remains payable, subject to the programme rules.

Customer discount codes are personal to the promotion, have no cash value, cannot be combined unless stated, and may be limited or withdrawn prospectively. The Privacy Policy explains referral attribution and partner records.

13. Suspension and Termination

You may stop using the Service or close your account, subject to active orders and lawful retention. We may suspend only the affected account, campaign, destination, or feature where reasonably necessary for security, non-payment, legal compliance, material breach, danger to scanners, or serious disruption. Where appropriate, we will give notice and a reasonable opportunity to cure.

We may terminate an account for an uncured material breach, repeated breach, insolvency affecting performance, or unlawful use. Immediate action is permitted for fraud, malware, credible danger, or where law requires it. Termination does not cancel accepted goods orders or accrued rights unless the relevant breach makes performance unlawful or impossible.

Sections intended by their nature to survive do so, including payment, intellectual property, data protection, liability, disputes, and obligations concerning retained records.

14. Liability

Consumers

Nothing in these Terms excludes or restricts a Consumer remedy, burden of proof, product-safety right, data-protection right, or other liability that mandatory law does not allow us to exclude. We are responsible for foreseeable loss caused by our breach to the extent required by law, but not loss caused by the Consumer's misuse or failure to take reasonable steps to limit avoidable damage.

Business customers

To the fullest extent permitted by law, neither party is liable to the other for indirect or consequential loss, loss of profit, revenue, anticipated savings, goodwill, or business opportunity. QRCandy's aggregate liability arising from an order and its associated QR campaign is capped at the amount paid for that order. For a claim unrelated to an order, the cap is the amount paid to QRCandy in the twelve months before the event giving rise to the claim.

Those exclusions and caps do not apply to payment obligations, fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence, breach of confidentiality or data-processing duties to the extent a cap is unlawful, infringement by a party's own materials, or any liability that cannot lawfully be limited.

A business customer will indemnify QRCandy against third-party claims and reasonable direct losses to the extent caused by Customer Content, a customer-set destination, or that customer's material breach of Section 9 or applicable law. We will give prompt notice, allow reasonable control of the defence, and cooperate; no settlement may admit fault or impose a non-monetary obligation on QRCandy without our consent. This indemnity does not apply to the extent QRCandy caused the claim.

We do not guarantee a particular marketing result, number of scans, conversion rate, or commercial outcome. You remain responsible for campaign strategy, destination content, and decisions made using analytics.

A party is not liable for a failure caused by an event beyond its reasonable control while it uses reasonable efforts to mitigate and resume performance. This does not remove a Consumer's statutory rights for delay, refund, or cancellation.

15. Law and Disputes

Contact us first at hello@qrcandy.co so we can try to resolve a complaint promptly. These Terms are governed by Swedish law. A Consumer also keeps the protection of mandatory law in the country where they habitually reside and may bring proceedings in any court available under mandatory jurisdiction rules.

A Consumer may submit an eligible unresolved dispute to the Swedish National Board for Consumer Disputes (Allmänna reklamationsnämnden, ARN). We participate in the process where required and consider ARN recommendations.

Allmänna reklamationsnämnden (ARN)
Box 174, 101 23 Stockholm, Sweden
arn.se

The former European Commission Online Dispute Resolution platform closed in July 2025 and is therefore not offered as a dispute route. Business disputes are subject to the courts of Sweden, with Stockholm District Court as the first instance unless the parties agree otherwise.

16. Changes and Contact

We may update these Terms for future orders and future use of the Service. Changes do not retroactively alter an accepted order. For a material change to an ongoing account or QR Service, we will give reasonable notice by email, dashboard notice, or another durable method where practicable, explain the effective date, and state any right to object or stop the affected Service.

If a provision is unenforceable, it is limited only as much as necessary and the remainder continues. A failure to enforce a provision is not a waiver. You may not transfer the agreement without our consent; we may transfer it with the business or Service if this does not reduce a Consumer's mandatory rights.

Questions, complaints, cancellation requests, and legal notices can be sent to:

[Legal entity name], trading as QRCandy
Swedish organisation number: [Swedish organisation number]
VAT number: [VAT number]
Registered address: [Registered postal address, Sweden]
Email: hello@qrcandy.co
Website: qrcandy.co

See our Privacy Policy for how personal data is handled. Keep a copy of the Terms and order confirmation applicable to your purchase.