Reseller Agreement — framework draft
Prepared for review by licensed counsel. Not legal advice. The knowledge base contains no facts about a reseller program (only a "Business" page without B2B terms — RSK-029). This is a framework. No reseller may be appointed until: (1) the business model in Part B §0 is chosen; (2) OFAC counsel has approved the sanctions procedure and any Sanctions Annex; (3) the intake questionnaire (Part D) has been completed under counsel's direction. A reseller program is an escalation area for sanctions (KB-002 A7; BRF-2026-001 P0-6, P1-1).
Part A — Drafting brief (internal)
| Item | Value |
|---|---|
| Question presented | On what terms may a third party resell HidzoVPN subscriptions, and how does HidzoVPN control sanctions, platform, consumer, tax, competition, brand and data risk? |
| Models | Model A — Reseller buys prepaid Activation Codes and resells them as merchant of record. Model B — HidzoVPN sells to End Users; Reseller acts as commission agent. White-label and affiliate/referral arrangements are out of scope and need separate agreements |
| Key point from review | HidzoVPN supplies the service when a code is activated, so HidzoVPN — a U.S. person — is the exporter of the service. The Reseller's promises do not transfer HidzoVPN's strict liability; HidzoVPN must screen at activation (§5.4) |
| Key risks | Sanctions facilitation (31 C.F.R. §560.208 — Reported); app-store rules on unlocking features with codes bought outside the app (Apple 3.1.1 — Reported); consumer law on prepaid codes; reseller marketing (16 C.F.R. §255.1(d) — Reported); anti-corruption (15 U.S.C. §78dd-2 — Reported); antitrust (resale prices, territory); tax (who is the supplier); data roles (POL-RPRIV-001) |
Part B — Proposed agreement text
HidzoVPN Reseller Agreement
This Reseller Agreement (the "Agreement") is between HidzoVPN, Inc., a Florida corporation, Florida Department of State document number P25000060442 ("HidzoVPN"), and the reseller identified in the Order Form (the "Reseller").
0. Business model
[OPEN — Part D Q4: choose Model A or Model B. Sections 3 and 4 are drafted for Model A; Model B requires a commission clause, HidzoVPN as seller of record, and HidzoVPN's consumer checkout and withdrawal process. Until chosen, this Agreement may not be signed.]
1. Definitions
"Activation Code" means a code issued by HidzoVPN that gives an End User HidzoVPN Premium for a stated fixed period and does not renew automatically. "End User" means a person who activates an Activation Code. "Order Form" means the signed document stating the Reseller's details, Territory, prices and quantities. "Territory" means the countries listed in the Order Form, excluding each Restricted Country and each country listed in Schedule 2 [OPEN: countries where resale or use of VPN services is restricted — COUNSEL and 07-Jurisdictions]. "Marks" means the HidzoVPN name and logo. "Blocked Person" means a person on the Specially Designated Nationals and Blocked Persons List or another list maintained by the U.S. Department of the Treasury's Office of Foreign Assets Control, and any entity owned 50 percent or more, directly or indirectly, by one or more such persons [VERIFY: OFAC 50 Percent Rule]. "Export-Restricted Party" means a person on the Entity List, Denied Persons List, Unverified List or Military End-User List of the U.S. Department of Commerce. "Other Listed Person" means a person subject to sanctions of the United Nations, the European Union, the United Kingdom or the Reseller's country of organization. "Restricted Country" means [COUNSEL: countries and regions subject to comprehensive U.S. sanctions, and any other country HidzoVPN designates in writing]. "Public Official" means an officer or employee of a government, a government-owned or controlled entity or a public international organization, or a candidate for political office.
2. Appointment
2.1 HidzoVPN appoints the Reseller, on a non-exclusive basis, to resell Activation Codes to End Users in the Territory during the term of this Agreement.
2.2 The Reseller is an independent contractor. It shall not bind HidzoVPN and shall not describe itself as HidzoVPN's agent, partner or representative.
2.3 The Reseller shall not appoint sub-resellers, and shall not sell Activation Codes through online marketplaces, to bulk buyers for resale, or to government bodies or government-owned entities, without HidzoVPN's prior written consent.
2.4 Conditions precedent. This Agreement takes effect only when HidzoVPN has completed its due diligence on the Reseller (Section 5.5), the Order Form and any Sanctions Annex have been signed by both parties, and HidzoVPN has confirmed the effective date in writing (the "Effective Date").
3. Ordering, prices and payment
3.1 The Reseller orders Activation Codes as stated in the Order Form. HidzoVPN invoices the Reseller in advance at the prices in the Order Form. The Reseller shall pay within [OPEN: 15] days of invoice. Late amounts bear interest at [OPEN].
3.2 The Reseller determines its resale prices independently. Any price HidzoVPN communicates is a non-binding recommendation [COUNSEL: U.S. state resale-price-maintenance rules; EU/UK vertical rules].
3.3 The Reseller shall pay in U.S. dollars by bank transfer from an account in its own name at a bank that is not a Blocked Person and is not located in a Restricted Country. HidzoVPN may refuse or return any payment from a third party, a money-service business, an exchange house or a cryptocurrency source [COUNSEL].
3.4 Each party is responsible for its own taxes. All payments shall be made without deduction or withholding unless the law requires it; if it does, the Reseller shall pay the additional amount needed so that HidzoVPN receives the full invoiced amount [COUNSEL and TAX ADVISER: VAT/GST supplier under the chosen model; withholding tax; U.S. resale certificates].
3.5 Code inventory. HidzoVPN delivers Activation Codes electronically. The Reseller shall keep unsold codes secure and shall notify HidzoVPN promptly of any loss or leak. HidzoVPN may cancel lost, leaked or fraudulently obtained codes; the Reseller bears the loss for codes lost or leaked while in its control.
3.6 HidzoVPN may change prices for future orders on [OPEN: 30] days' written notice.
4. End Users
4.1 Each End User accepts HidzoVPN's Terms of Service, including the Acceptable Use Policy and the Refund and Cancellation Policy, and is given HidzoVPN's Privacy Policy, when activating a code. The Reseller shall tell End Users this before sale and shall not offer any other terms on HidzoVPN's behalf.
4.2 HidzoVPN provides the service to End Users and technical support. The Reseller provides first-line sales support.
4.3 The Reseller shall honor any refund or withdrawal right that the law gives End Users against the seller of the code, and shall handle refunds for codes it has sold [OPEN: under Model A]. If HidzoVPN deactivates a code because of the Reseller's breach, the Reseller shall refund the End User or reimburse HidzoVPN for any refund HidzoVPN makes.
4.4 Redemption. Activation Codes may be redeemed only at [OPEN: hidzovpn.com/redeem]. A subscription obtained by redeeming a code is available in the mobile apps only as the applicable app-store rules permit. The Reseller shall not state or imply that codes can be redeemed inside the iOS or Android apps and shall not use HidzoVPN's app-store listings to sell codes. [ENGINEERING: no in-app code-entry field in store builds; Premium also offered as an Apple in-app purchase — Apple Guidelines 3.1.1, 3.1.3(b), Verified (EV-262); VERIFY: Google Play rule on access to subscriptions bought outside Play; do not use Apple or Google offer or promotional codes as resale inventory]
4.5 Unredeemed Activation Codes expire [OPEN] [COUNSEL: gift-card, gift-certificate and unclaimed-property laws per Territory; 12 C.F.R. §1005.20 applies to devices "in a specified amount" — application to fixed-period codes open]. An activated code is not transferable.
5. Sanctions, export controls and anti-corruption
[COUNSEL: OFAC counsel to approve this Section before any reseller is appointed]
5.1 The Reseller represents and undertakes that: (a) neither it nor any of its owners, directors or officers is a Blocked Person, an Export-Restricted Party or an Other Listed Person, and it is not located, organized or ordinarily resident in a Restricted Country; (b) it shall not sell, supply or transfer Activation Codes to, or for the benefit of, any such person or any person in a Restricted Country, except as expressly set out in a Sanctions Annex that HidzoVPN adopts on the written advice of sanctions counsel and attaches to the Order Form; (c) it shall screen its customers as HidzoVPN reasonably requires; and (d) it shall comply with the sanctions and export-control laws that apply to it. HidzoVPN gives no approval of individual transactions under this Section.
5.2 Anti-corruption. The Reseller shall comply with the U.S. Foreign Corrupt Practices Act and all other anti-bribery laws that apply to it. In particular, the Reseller shall not offer, pay or give anything of value, directly or through others, to a Public Official or any other person to obtain an improper advantage in connection with this Agreement; shall not pass any discount or margin to a Public Official; shall keep accurate books and invoices; and shall tell HidzoVPN promptly if any owner, director or key employee is or becomes a Public Official. [COUNSEL: 15 U.S.C. §78dd-2 ("knowing" standard); UK Bribery Act 2010 s.7 for UK resellers]
5.3 Remedies. If HidzoVPN reasonably believes that Section 5 has been or will be breached, HidzoVPN may immediately suspend deliveries, suspend or deactivate Activation Codes, and terminate this Agreement, and HidzoVPN shall block or report as sanctions law requires [COUNSEL: 31 C.F.R. §§501.603–501.604].
5.4 Redemption controls. HidzoVPN applies sanctions screening at activation in accordance with its sanctions compliance procedure and may refuse activation of any Activation Code [COUNSEL: OFAC] [ENGINEERING: activation-time controls and denial log].
5.5 Due diligence and change of control. Before the Effective Date and at least annually, the Reseller shall give HidzoVPN the information it reasonably requests about the Reseller's owners down to the 50 percent level, directors, banks and customers by country. The Reseller shall tell HidzoVPN within [OPEN: 5] business days of any change of control or of becoming aware that it or any owner is listed.
5.6 Records and audit. The Reseller shall keep complete records of each sale of Activation Codes, including the buyer's identity and country, for at least 10 years [31 C.F.R. §501.601 — Reported] and shall make them available to HidzoVPN on [OPEN: 10] business days' notice.
5.7 Cooperation. The Reseller shall tell HidzoVPN promptly of any suspected breach of this Section and shall cooperate with any inquiry by a government authority.
5.8 Nothing in this Section requires a party to act in breach of Council Regulation (EC) No 2271/96 or any similar anti-boycott law that applies to it [COUNSEL: EU sanctions — VERIFY].
6. Marketing and trademarks
6.1 HidzoVPN grants the Reseller a non-exclusive, non-transferable license to use the Marks during the term, only to promote Activation Codes in the Territory, in accordance with HidzoVPN's brand guidelines and with materials HidzoVPN has approved. All goodwill arising from the use of the Marks belongs to HidzoVPN. [COUNSEL: U.S. trademark — license only after chain of title for application 99461233 is resolved]
6.2 The Reseller shall use only the product statements listed as APPROVED in HidzoVPN's Approved Claims Schedule, as updated from time to time. The Reseller shall not describe the service as "anonymous", "untraceable", "no logs" or "government-proof", shall not promote it for unblocking streaming services, piracy, age-verification bypass or any use prohibited by the Acceptable Use Policy or local law, and shall not advertise VPN services where such advertising is unlawful.
6.3 The Reseller shall clearly disclose its commercial relationship with HidzoVPN in any endorsement or review it publishes or procures, shall flow these obligations down to its affiliates, influencers and promoters, and shall comply with anti-spam laws [16 C.F.R. §255.1(d) — Reported].
6.4 HidzoVPN may monitor the Reseller's marketing. The Reseller shall remove any material HidzoVPN objects to within [OPEN: 48] hours of notice.
6.5 The Reseller shall not register the Marks, any similar mark, domain name or social-media handle in any country, and shall transfer any such registration to HidzoVPN on request. The Reseller shall not bid on the Marks as search keywords without HidzoVPN's written consent [COUNSEL: antitrust limits on keyword restrictions].
6.6 The Reseller shall not publish HidzoVPN apps, or modified versions of them, in any app store or website.
6.7 The Reseller shall not actively market outside the Territory. Nothing in this Agreement restricts sales to customers who approach the Reseller unsolicited [COUNSEL: EU/UK vertical rules].
7. Data protection
Each party shall process personal data in accordance with the Reseller Data Protection Terms, which form part of this Agreement.
8. Confidentiality
Each party shall keep the other's non-public information confidential and use it only for this Agreement, during the term and for [OPEN: 3] years after it ends. Sales reports shall not contain other resellers' prices.
9. Warranties, liability and indemnity
9.1 HidzoVPN shall provide the service to End Users in accordance with its Terms of Service. EXCEPT AS STATED IN THIS AGREEMENT, AND TO THE EXTENT PERMITTED BY LAW, HIDZOVPN MAKES NO OTHER WARRANTY TO THE RESELLER, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.
9.2 Neither party is liable to the other for indirect or consequential loss. Fines, penalties and the costs of regulatory inquiries caused by a party's breach are direct losses. Each party's total liability under this Agreement is limited to the amounts paid or payable by the Reseller in the 12 months before the claim, except for breach of Section 5, breach of Section 8, breach of the Reseller Data Protection Terms, infringement of the other party's intellectual property, fraud, and the indemnities in Section 9.3.
9.3 The Reseller shall indemnify HidzoVPN against claims, losses, fines and reasonable legal costs arising from the Reseller's marketing, its breach of Section 5 or 6, or its dealings with End Users.
9.4 A party seeking indemnity shall notify the other promptly, allow it to control the defense (except that no settlement admitting fault by the indemnified party may be made without its consent), and cooperate reasonably.
10. Term and termination
10.1 This Agreement lasts [OPEN: 1] year from the Effective Date and renews for further [OPEN: 1]-year periods unless either party gives [OPEN: 60] days' written notice.
10.2 Either party may terminate for material breach not cured within 30 days after notice. HidzoVPN may terminate immediately under Section 5.3, on the Reseller's insolvency or change of control, or if a change in law or sanctions makes performance unlawful or impractical. Either party may terminate for convenience on [OPEN: 90] days' notice.
10.3 On termination, the Reseller shall stop using the Marks and stop selling Activation Codes, and shall return or destroy unsold codes, which HidzoVPN shall cancel [OPEN: credit for unsold codes]. Activated codes remain valid for their term unless deactivated under Section 4.3 or 5.3.
10.4 Sections 3.4, 4.3, 5, 8, 9 and 11 continue after termination.
11. General
11.1 Governing law. This Agreement is governed by the laws of the State of Florida. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
11.2 Disputes. Disputes with a Reseller organized in the United States shall be heard by the state courts in Pinellas County, Florida, or the federal court for the district that includes Pinellas County. Disputes with a Reseller organized outside the United States shall be finally resolved by arbitration under the [COUNSEL: ICDR / ICC] Rules, seated in [OPEN: Tampa / Miami], Florida, in English. Either party may seek interim relief in any court.
11.3 Notices. Notices shall be in writing and sent to the addresses in the Order Form and, for HidzoVPN, to [OPEN: [email protected]] with a copy by courier to 7901 4th Street North, Suite 9375, Saint Petersburg, FL 33702, United States. The Reseller appoints [OPEN: process agent] to receive service of process in the United States, or consents to service by courier and email.
11.4 Local law. The Reseller shall comply with the laws of the Territory that apply to it, including any licensing of VPN services and consumer-protection laws.
11.5 Assignment. Neither party may assign this Agreement without the other's consent, except HidzoVPN to a successor to its business.
11.6 Other terms. Order of precedence: the Standard Contractual Clauses in Schedule 1 to the Reseller Data Protection Terms, where they apply [SCC Clause 5 — Verified, EV-249]; then the Sanctions Annex; then this Agreement; then the rest of the Reseller Data Protection Terms; then the Order Form. Amendments must be in writing and signed by both parties. A failure to enforce is not a waiver. If a provision is unenforceable, the rest continues. There are no third-party beneficiaries. Neither party is liable for delays caused by events beyond its reasonable control, except for payment obligations. This Agreement may be signed electronically and in counterparts. English is the language of this Agreement. Neither party may publicize this Agreement without the other's consent. This Agreement, the Order Form, any Sanctions Annex and the Reseller Data Protection Terms are the entire agreement between the parties.
Part C — Drafting notes (internal)
C.1 Sources
| Element | Basis | Label |
|---|---|---|
| Facilitation by U.S. persons | 31 C.F.R. §560.208 | Reported (A) — eCFR read by research agent (EV-259) |
| Services to Iran and exclusions | 31 C.F.R. §560.540 | Verified (EV-223) |
| OFAC recordkeeping (10 years) | 31 C.F.R. §501.601 | Reported |
| 50 Percent Rule (incl. indirect ownership; some programs block persons without designation); compliance framework (intermediaries, counter-parties, geography; root causes III, IV, VII) | OFAC FAQs 398, 401; Framework for OFAC Compliance Commitments (2019) | FAQ 401 Verified first-hand in capture; others Reported (B) (EV-260) |
| Encryption export via resellers | 15 C.F.R. §740.17 intro and (c): resellers may use ENC only on its terms; ENC never covers Country Groups E:1/E:2 (Iran, North Korea, Syria; Cuba); for Iran an OFAC authorization also counts under the EAR (§746.7(a)(2)) | §740.17 Verified first-hand in capture; Supp. 1 and §746.7 Reported (A) (EV-261) |
| Code redemption in apps | Apple 3.1.1 (no license keys or QR codes to unlock features); 3.1.3(b) (access to items bought elsewhere only if also sold as in-app purchases) — so Premium must also be offered through Apple IAP; whether a third-party reseller code is "other platforms" [COUNSEL]; Google Play Payments policy §§2–4 silent on codes bought elsewhere [VERIFY: FAQ 10281818] | Apple Verified first-hand (EV-262); Google Reported (EV-262) |
| Advertiser liability for endorsers; intermediaries; affiliate disclosure; e-mail sent by resellers | 16 C.F.R. §§255.0(a), 255.1(d), (f), 255.5 Ex. 11; CAN-SPAM 15 U.S.C. §§7702(9), (12), 7704(a), 7705 (a person who procures an e-mail "initiates" it) | Reported (A) (EV-263) |
| Prepaid devices | 12 C.F.R. §1005.20(a), (e) | Reported |
| Anti-corruption | 15 U.S.C. §78dd-2(a)(3), (h)(1)(B), (h)(3) ("knowing" includes awareness of a high probability); E.O. 14209 (2025) changed enforcement policy, not the statute | Reported (A) (EV-264) |
| EU Blocking Statute | Council Reg. (EC) 2271/96 as amended by Delegated Reg. (EU) 2018/1100 | [VERIFY] |
| Antitrust | Leegin, 551 U.S. 877 (2007); state RPM laws; Reg. (EU) 2022/720; UK VABEO 2022 | [VERIFY] |
C.2 Limits of this analysis
No reseller facts exist. Not reviewed: laws of reseller countries (distribution/agency protection, VPN licensing, consumer law); EU/UK competition law in detail; tax; gift-card and unclaimed-property laws; local data-protection laws. Sources not opened: EUR-Lex (Blocking Statute; VBER). Counsel required: U.S. commercial; OFAC; tax; EU/UK competition; U.S. trademark.
C.3 Review log
| Date | Reviewer | Verdict | Notes |
|---|---|---|---|
| 2026-09-25 | Drafted | — | v0.1 framework |
| 2026-09-25 | hidzo-counsel-reviewer (AI) | REVISE (4 Blockers; 16 Majors) | v0.2: model choice gating (§0); HidzoVPN activation screening (§5.4); no individual transaction approvals, Sanctions Annex only (§5.1(b)); redemption on the website only (§4.4); refunds and deactivation remedies; list definitions split; due diligence, records (10 years), cooperation, Blocking Statute; anti-corruption expanded; antitrust wording; claims schedule, monitoring and takedown; trademark and keyword clauses; liability carve-outs and indemnity procedure; arbitration for foreign resellers; CISG exclusion; process agent; boilerplate; "shall" throughout |
| 2026-09-25 | hidzo-counsel-reviewer (AI) — cross-document final audit; research memos EV-232–235 | REVISE (set: 1 Blocker, 8 Majors) | v0.3: cross-document redlines X-01–X-31 applied where they concern this document; authority labels updated from first-hand and research-memo checks (EV-238–264) |
Part D — Reseller program intake questionnaire
**To be completed at the request of, and returned only to, [OPEN: OFAC counsel]. Do not circulate. Do not answer Questions 2, 3 and 9 in writing before counsel instructs.**
- Is there an existing or planned reseller program? Which model: prepaid codes, agency, white-label, affiliate/referral, API?
- Who are the proposed resellers, who owns them (beneficial owners), and where are they organized and located? Which countries will they sell into?
- How will resellers pay HidzoVPN (bank, card, crypto), from which countries and banks?
- Who is the seller of record to the End User — HidzoVPN or the reseller? Who issues invoices and who handles refunds?
- How are codes redeemed — website only, or in the iOS/Android apps?
- What End User data, if any, does the reseller collect, and would any of it be shared with HidzoVPN?
- Will resellers use the HidzoVPN name and logo? Will they run advertising, influencer or email campaigns?
- Will resellers provide customer support?
- Are there existing informal reseller arrangements, and on what terms have they operated so far?
- Expected volumes, prices and codes per buyer (tax registration and anti-money-laundering review).
- Will any reseller sell to government bodies or government-owned entities?
- Does the reseller hold any license required for VPN services in its country?