Terms of Use.

Effective date: 6 November 2026 · Version 2026-11-06-v2

These Terms govern access to and use of Ordna, including retailer accounts, shop workspaces, hosted online shops, ordering tools and related services. Please read them carefully before creating an account or subscribing.

1. Who operates Ordna and who these Terms apply to

Ordna is operated by Richard Agius, trading as ordna. ("the Operator", "we", "us" or "our"), an individual established in Malta. Ordna is currently operated by the Operator personally and is not a separate limited liability company. Business address: Bullara Court, Block B, Flat 1, Triq Guzeppi Bajada, Xaghra, Gozo, XRA 1661, Malta. VAT registration number: MT24705317. Contact: info@fortycreative.com.

These Terms apply to business customers who create or administer retailer accounts, and to other persons who access the platform. Retailers must use Ordna for a trade, business, craft or profession and must have authority to bind the business they represent. If you are acting as a consumer rather than for a business, contact us before subscribing so the applicable terms can be clarified.

2. What Ordna provides

Ordna is a software-as-a-service platform for fresh-food and other retailers. Subject to the plan and features made available, it provides retailer workspaces, product and category management, hosted shop pages, order-request tools, delivery and collection configuration, staff access, and connections to independent payment providers.

Ordna is a technology provider, not the retailer, seller, agent, distributor or merchant of record for products displayed in a retailer's shop. Each retailer independently offers and sells its own goods and is responsible for its dealings with customers.

3. Accounts, eligibility and security

• You must provide accurate, current registration and business information and keep it updated.
• You must verify the email address used for the account and keep your sign-in credentials confidential.
• You are responsible for activity carried out through your account and for the actions of people to whom you grant shop access, except to the extent caused by our own failure to meet a legal duty.
• Tell us promptly at info@fortycreative.com if you suspect account compromise, unauthorised access or misuse.
• Only the shop owner or an authorised representative may accept subscription terms, publish a shop, manage billing or grant owner access.

4. Free setup, private previews and publication

A retailer may register and create a private shop workspace without paying a subscription. The retailer is responsible for entering its own information and uploading its own logos, photographs, product details, prices, categories, opening hours, delivery areas, fees, payment settings and other content. Ordna does not promise that a new retailer's workspace will contain sample products, photographs or business information.

A draft shop and its preview are private and are not authorised for customer ordering. A retailer must select a monthly or annual plan, accept the applicable subscription terms and complete payment before the shop can be published. Publication is a separate, explicit action taken by the shop owner after payment confirmation.

The hosted customer URL and website embed code are provided for use only while the shop is published and its subscription remains active. A Facebook button, external link, iframe or other embed is only a reference to content hosted by Ordna; it is not a downloadable or permanent copy of the shop.

5. Subscriptions, billing and renewals

• The published standard plans are €20 per month or €200 per year, plus VAT if applicable. The price and any applicable tax will be shown before checkout is confirmed.
• The annual plan is billed in advance for the annual period. The monthly plan is billed in advance for each monthly period.
• Subscriptions renew automatically for the same period unless cancelled before the next renewal through the billing management facility or by contacting us.
• You authorise the subscription payment provider to charge the selected payment method for recurring subscription fees and applicable taxes.
• Payment processing fees imposed by Stripe, PayPal, banks or other payment providers are separate from Ordna's subscription fee and are governed by those providers' terms.
• Ordna does not charge a commission on customer orders under the standard plans. This does not remove third-party payment processing charges or any separately agreed service fees.
• Where a payment is declined, reversed, disputed or otherwise not confirmed, we may restrict publication or suspend access to paid features until the billing issue is resolved.

6. Cancellation, expiry and what happens to external links

You may cancel renewal at any time. Unless the law requires otherwise or we agree otherwise in writing, cancellation stops the next renewal; it does not ordinarily refund the current paid period. Your paid access continues until the end of that period.

When the paid period ends without a valid renewal, Ordna may automatically unpublish the shop and disable public access to its hosted catalogue, checkout and order-request functions. Any Facebook Start Order button, external URL or website embed may remain physically present on the third-party website, but it will lead to an unavailable shop and will not accept new orders. Ordna is not responsible for updating or removing links on websites, social networks or other services that the retailer controls.

The retailer's private workspace may remain available for account management, data export or reactivation, subject to security, retention and operational requirements. If the retailer later resubscribes, the same shop may be republished and the existing URL or embed may work again, provided the shop and its data have not been deleted and the URL remains assigned to it. We do not guarantee that a particular URL will be reserved indefinitely after account closure.

Refunds are handled in accordance with applicable law and the subscription terms presented at checkout. Except where required by law or expressly agreed by us, unused portions of a billing period are not refunded.

7. Customer orders, products and retailer responsibilities

Ordna provides order-request and order-management tools. Unless a specific payment flow clearly states otherwise, a customer's submission is an order request and is not by itself confirmation that a retailer has accepted the order, confirmed stock, final weight, delivery charge or final price.

The retailer is solely responsible for:

• the legality, safety, quality, availability, description, images, pricing, weights, units, taxes and suitability of products it lists;
• food safety, allergens, labelling, traceability, hygiene, licensing, trading standards, consumer information and all other legal duties applicable to its business and products;
• confirming actual weights, final order totals, delivery fees, collection arrangements, stock availability and order acceptance with the customer;
• fulfilling orders, delivering or handing over products, customer service, complaints, refunds, returns, cancellations, warranties and any consumer remedies;
• ensuring that every promotion, claim, photograph and statement on its shop is accurate, lawful and not misleading; and
• having a lawful basis and providing appropriate notices for the personal data it collects from customers.

Ordna does not inspect or certify retailer products and does not guarantee that a retailer will accept, prepare, deliver or fulfil any order.

8. Payments for customer orders and third-party providers

Where a retailer connects Stripe, PayPal or another payment provider, the retailer is responsible for its own merchant account, onboarding, verification, pricing, taxes, refunds, chargebacks and compliance with that provider's rules. Customer payments are processed by the selected provider for the retailer, and are not held as retailer sales funds by the Operator or Ordna unless a separate written arrangement expressly says otherwise.

Payment providers, banks, card schemes, email services, hosting companies, internet providers, mapping services and social networks are independent third parties. Their services may be unavailable, delayed, changed, suspended or declined for reasons outside Ordna's control. Their terms and privacy notices apply to their services. Ordna is not responsible for a third party's acts or omissions, but this does not exclude liability for a loss caused by our own breach of a duty that cannot lawfully be excluded.

Ordna is not a bank, payment institution, escrow provider or financial adviser. A payment link or payment status displayed in Ordna is subject to confirmation from the relevant payment provider.

9. Retailer content, ownership and licence

The retailer retains ownership of the text, images, logos, product information and other material it uploads ("Retailer Content"). The retailer grants the Operator a limited, non-exclusive, worldwide, royalty-free licence to host, store, reproduce, display, transmit, resize, format and technically adapt Retailer Content only as reasonably necessary to provide, secure, support and improve the retailer's use of Ordna and to display the retailer's shop as instructed.

The retailer warrants that it owns or has permission to use all Retailer Content and that its publication does not infringe intellectual property, privacy, publicity or other rights. The retailer must not upload confidential or personal information unless it is entitled to do so and the use is lawful.

Ordna's software, platform design, code, branding and documentation remain owned by the Operator or its licensors. We grant the retailer a limited, non-transferable, non-exclusive right to use the platform during the period in which the account is authorised and any required subscription is active.

10. Acceptable use and prohibited activity

You must not use Ordna to do anything unlawful, fraudulent, deceptive or harmful. In particular, you must not:

• upload illegal, infringing, defamatory, discriminatory, misleading or otherwise unlawful content or offer goods or services that you are not authorised to sell;
• misuse personal data, send unsolicited communications, scrape customer information or use customer data for purposes not disclosed to the customer;
• attempt to access another retailer's account, shop, files, images, orders, systems or data;
• probe, scan, test or bypass security or access controls without our written authorisation;
• introduce malware, malicious code, automated abuse, denial-of-service activity or any activity that disrupts the platform or its users;
• reverse engineer, copy, resell, rent, sublicense or commercially exploit the platform except as expressly permitted by law or by us in writing; or
• use the service in a way that could damage, overload or impair our systems or the availability of Ordna to other customers.

11. Content reports, moderation and legal requests

We may review, restrict, remove or disable content or access where reasonably necessary to comply with law, respond to a substantiated report, protect users, investigate suspected fraud or security incidents, enforce these Terms, or protect Ordna and third parties. Where required by applicable law, we will provide the affected user with reasons and information about available redress.

To report content or activity that you believe is illegal, infringes rights or creates a serious safety or security concern, email info@fortycreative.com with the shop URL, the specific content or location, an explanation of the concern and supporting information. We may request further details to assess the report. We will handle notices in accordance with applicable law, including the Digital Services Act where it applies.

We may preserve or disclose information where reasonably necessary to comply with a binding legal request, protect rights and safety, or investigate suspected unlawful activity, subject to applicable law.

12. Privacy and data processing

Our Privacy Policy explains how we process personal data. Retailers are generally independent controllers for personal data they collect from their customers through their shops. When the Operator processes customer order data on a retailer's behalf to host the shop, transmit order requests or provide dashboard functionality, the Operator acts as a processor and the retailer remains responsible as controller.

Where we act as processor, the retailer instructs us to process personal data only as needed to provide the service and in accordance with the retailer's documented lawful instructions. We will maintain appropriate technical and organisational safeguards, ensure authorised personnel are subject to confidentiality, use subprocessors under written terms, assist the retailer with relevant data-subject requests and security obligations where reasonably possible, notify the retailer of a personal-data breach without undue delay, and return or delete personal data at the end of the service subject to legal retention duties and backup cycles. We will provide reasonable information needed to demonstrate compliance and support proportionate audits in accordance with applicable law.

Retailers must not use Ordna to collect special-category personal data unless they have a lawful basis, a valid condition under data protection law and a clear need to do so. Retailers should not ask customers to enter payment-card numbers, passwords or unnecessary sensitive information in order notes.

13. Security, incidents and availability

We use reasonable technical and organisational measures designed to protect the platform and data. No online service, network, hosting environment or payment system can be guaranteed to be completely secure, uninterrupted or error-free. We cannot guarantee that unauthorised access, malware, service attacks, third-party failures or other incidents will never occur.

We may carry out maintenance, updates, security work, backups, migrations and changes to platform features. These may cause temporary interruptions or changes in functionality. We will take reasonable steps to limit disruption, but do not promise a specific uptime or service level unless a separate written service-level agreement says otherwise.

If we become aware of a security incident affecting personal data, we will assess it and take steps required by data protection law. Where we act as processor, we will notify the relevant retailer-controller without undue delay so that the retailer can assess its own notification duties. A controller may have to notify the Malta Information and Data Protection Commissioner within 72 hours of becoming aware of a reportable breach.

14. Data access, portability and switching

Retailer Content and business data remain the retailer's data. During an active account, the retailer may access available data and request a reasonable export of its data. We will provide data in the formats and through the procedures available for the service, and will support switching and data portability to the extent required by applicable law, including the EU Data Act where Ordna qualifies as a data-processing service.

Where the Data Act's switching rules apply, the contract and switching process will be interpreted in accordance with its mandatory requirements, including applicable notice periods, transition periods, assistance, security and machine-readable export obligations. Any switching charge will be limited to what applicable law permits at the time; from 12 January 2027, the Data Act provides for the removal of switching charges.

Before ending an account, retailers should request and securely store any data or content they need. Following termination, we may retain data for a limited operational, security, dispute-resolution or legal-compliance period and then delete or anonymise it in accordance with our retention practices and applicable law. Backups may persist until securely overwritten in the normal backup cycle.

15. Service changes and beta features

We may update, improve, replace or discontinue features where reasonably necessary for security, legal compliance, technology changes or product development. We will take reasonable steps to notify customers of material changes that significantly affect the service. Experimental or beta features may be incomplete, may change without notice and may be withdrawn at any time.

16. Disclaimers

To the fullest extent permitted by law, Ordna is provided on an "as available" basis. We do not warrant that the service will be uninterrupted, always available, completely secure, free from errors, compatible with every third-party website or platform, or suitable for every retailer's particular requirements. We do not guarantee sales, customer traffic, revenue, order volumes, search rankings, payment approval or uninterrupted access to third-party services.

Retailers are responsible for maintaining copies of important business information and for verifying product, order, customer, tax and payment information before acting on it. Nothing in these Terms excludes a warranty or statutory right that cannot lawfully be excluded.

17. Limitation of liability

Nothing in these Terms excludes or limits liability to the extent that such exclusion or limitation is prohibited by applicable law. In particular, nothing excludes liability for fraud or fraudulent misrepresentation, intentional misconduct, death or personal injury caused by negligence where such exclusion is unlawful, or liability and remedies that cannot lawfully be limited under data-protection, consumer-protection or other mandatory rules.

Subject to that rule, and to the maximum extent permitted by law, the Operator will not be liable for indirect, incidental, special, punitive or consequential loss, or for loss of profit, revenue, anticipated savings, business opportunity, goodwill, customers, reputation, or data, or for business interruption, arising from use of or inability to use Ordna. This does not exclude direct losses caused by our own breach of contract or negligence where those losses are legally recoverable.

Subject to the exceptions above, our total aggregate liability arising out of or in connection with the service and these Terms, whether in contract, tort (including negligence) or otherwise, will not exceed the subscription fees actually paid by the affected retailer to the Operator for the 12 months immediately preceding the event giving rise to the claim. If no subscription fees were paid in that period, the cap will be €100. This cap applies only to the extent enforceable under applicable law.

We are not responsible for losses caused by a retailer's products, content, staff, account credentials, business practices or customer relationship; by a bank, payment provider, social network, web-hosting company, internet carrier or other third party; or by circumstances outside our reasonable control. This does not excuse the Operator from liability for its own acts, omissions or legal obligations.

18. Indemnity

To the extent permitted by law, the retailer will defend and indemnify the Operator and its personnel against third-party claims, losses, liabilities and reasonable legal costs arising from the retailer's products, Retailer Content, dealings with customers, breach of these Terms, infringement of third-party rights, or violation of law. This obligation does not apply to the extent a claim was caused by the Operator’s own breach, negligence or unlawful conduct. We will give the retailer reasonable notice of a claim and cooperate in its defence.

19. Suspension and termination

We may suspend or restrict access where reasonably necessary because of non-payment, suspected fraud, security risk, unlawful activity, serious breach of these Terms, a legal requirement or a risk to other users or the platform. Where practical and lawful, we will give notice and an opportunity to remedy the issue. We may terminate an account for a serious or repeated breach, or where we are legally required to do so.

You may stop using Ordna and cancel your subscription as described above. Termination does not remove fees already due, rights or liabilities that accrued before termination, or provisions which by their nature should continue, including intellectual property, payment obligations, liability, indemnity, dispute and data-retention provisions.

20. Changes to these Terms

We may revise these Terms to reflect changes in the service, law, security or business operations. We will publish the updated version with a new effective date and, where required or appropriate, give account holders advance notice of material changes. If a change requires renewed agreement, we will request acceptance before the relevant new use or renewal. Continued use after the effective date may constitute acceptance only where permitted by law and after appropriate notice.

21. Governing law and disputes

These Terms are governed by the laws of Malta, subject to any mandatory law that applies regardless of this choice. The courts of Malta will have jurisdiction, unless mandatory law gives a party the right to bring proceedings elsewhere. We encourage retailers to contact us first so that a concern can be resolved informally.

22. General provisions

If a provision is found unenforceable, it will be modified only to the minimum extent necessary and the remaining provisions will continue in effect. A failure to enforce a right is not a waiver. You may not transfer your account or these Terms without our consent, except as part of a lawful business transfer. We may transfer these Terms as part of a reorganisation or transfer of the Ordna business, provided the transfer does not reduce mandatory rights.

22A. Digital accessibility

Retailers are responsible for assessing and meeting accessibility requirements that apply to their own online sales activities and customer-facing services, including applicable requirements under the European Accessibility Act and Malta's implementing legislation. Ordna is a software tool and does not certify a retailer's products, website content or overall legal compliance. We will address accessibility requirements that apply to the Operator in its capacity as a service provider, taking account of any statutory exemption that may lawfully apply to a microenterprise providing services.

Schedule 1 — Data Processing Agreement

This Schedule forms part of these Terms when a retailer uses Ordna to process personal data on its behalf. For the processing described below, the retailer is the controller and the Operator is the processor. This Schedule does not apply where the Operator processes personal data for its own independent purposes as described in the Privacy Policy.

1. Subject matter, duration, nature and purpose

the Operator processes personal data for the duration of the retailer's use of Ordna and for the limited period needed to complete return, export, deletion, backup and legal-retention activities after the service ends. The subject matter is the hosting and operation of the retailer's online shop and order-management workspace. Processing includes collecting, recording, organising, storing, retrieving, viewing, using, transmitting, restricting, exporting and deleting data as technically necessary to provide the service.

2. Categories of data subjects and personal data

Data subjects may include the retailer's customers, prospective customers who submit an enquiry or order request, retailer staff and authorised users. Personal data may include names, contact details, delivery and collection addresses, order contents, order notes, delivery-location information, account identifiers, and technical logs. Retailers must not intentionally submit special-category data or unnecessary identity or payment credentials through free-text fields.

3. Documented instructions and confidentiality

the Operator will process customer personal data only on the retailer's documented instructions, including instructions given through the retailer's normal use and configuration of Ordna, unless Union or Member State law requires otherwise. If legally required to process data beyond those instructions, the Operator will inform the retailer before processing unless the law prohibits that notice. the Operator will ensure that persons authorised to process personal data are bound by appropriate confidentiality obligations.

4. Security measures

the Operator will implement appropriate technical and organisational measures taking account of the state of the art, implementation costs, nature and purposes of processing and risks to individuals. Measures are designed to preserve confidentiality, integrity, availability and resilience, and may include access controls, authentication, role-based permissions, secure transmission, infrastructure safeguards, operational logging, backup and recovery processes, and incident-response procedures. No measure makes an internet service completely secure or eliminates all risk.

5. Sub-processors

The retailer gives general authorisation for the Operator to use sub-processors needed to provide Ordna. Current categories and examples are described in the Privacy Policy and may include hosting, database, authentication, file storage, application delivery, payment and communications providers. the Operator will impose written data-protection obligations on each sub-processor that are no less protective in substance than the applicable processor obligations in this Schedule, to the extent required by GDPR Article 28.

the Operator will make information about material sub-processor changes available to the retailer and, where practicable, give at least 30 days' notice before adding or replacing a material sub-processor. The retailer may object on reasonable data-protection grounds within that notice period. The parties will work in good faith to resolve the objection. If no reasonable solution is available, the retailer may stop using the affected processing feature and terminate the affected service in accordance with applicable law and these Terms.

6. Assistance to the retailer

Taking account of the nature of the processing and information available to the Operator, we will provide reasonable assistance with requests from data subjects, security obligations, personal-data breach assessments, data-protection impact assessments and prior consultation with a supervisory authority where the retailer is required to undertake those activities. Any assistance will be proportionate to the service and may be subject to reasonable charges where permitted by law and where the work is outside normal support.

7. Personal-data breaches

the Operator will notify the retailer without undue delay after becoming aware of a personal-data breach affecting personal data processed on the retailer's behalf. The notice will include information reasonably available to help the retailer assess the incident, its likely consequences and mitigation. the Operator will investigate, take appropriate steps to contain and address the breach, and provide reasonable updates as material information becomes available. The retailer remains responsible for deciding whether to notify a supervisory authority or affected individuals as controller.

8. Return, export and deletion

At the retailer's choice, and subject to applicable law, the Operator will make personal data available for export or delete it after the end of the processing service. the Operator may retain information where required by law or reasonably necessary for security, fraud prevention, legal claims or accounting, and may retain residual copies in protected backups until those backups are overwritten in the normal cycle. Retained data remains protected under this Schedule for as long as it is held.

9. Compliance information and audits

the Operator will make available information reasonably necessary to demonstrate compliance with the processor obligations in this Schedule and will allow for and contribute to proportionate audits or inspections by the retailer or an independent auditor mandated by it, on reasonable advance notice, during normal business hours, subject to confidentiality, security, other customers' rights and reasonable safeguards against disruption. The retailer must provide the scope and purpose of an audit in advance.

10. International transfers

the Operator will not transfer personal data outside the European Economic Area except in accordance with GDPR Chapter V. Where required, the transfer will be supported by an adequacy decision, appropriate safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism. Information about relevant transfer safeguards may be requested from the Operator.

11. Controller responsibilities

The retailer confirms that it has a lawful basis for collecting and instructing the processing of customer data, has provided the notices required by law, has configured its shop and order fields appropriately, and will respond to data-subject requests and fulfil its controller obligations. The retailer must not instruct the Operator to process data unlawfully.

23. Contact

For questions about these Terms, subscription billing, content reports, legal notices or security concerns, contact info@fortycreative.com and include your shop name and relevant details.