Buying an Online Business: What Were They Actually Getting?

The situation

Harpreet had spent eleven years as a professional engineer, most recently with a mid-sized infrastructure firm, since immigrating to Canada from India with his wife Manpreet, a physiotherapist, nine years earlier. Between them they had built a solid dual income and a healthy set of savings, but Harpreet wanted something of his own — a business he could eventually run full-time, rather than a salaried role he was good at but had not chosen for its own sake. Manpreet, whose physiotherapy practice gave her a flexible schedule, agreed to co-invest and to help with the books once the deal closed.

What they found was an online retail business based in Thunder Bay, built over twelve years by its founder, Paulo. The business sold outdoor and cold-weather gear direct to customers across the country through its own online store, with no physical retail location and no warehouse of its own — inventory sat with a third-party fulfillment provider, and the business itself consisted of a website, a loyal customer base, a set of social media accounts with a substantial following, and a small team of contractors who handled photography, customer service and paid advertising. Paulo, now in his late fifties, wanted to retire from day-to-day operations and had priced the business at roughly $3,400,000, based on its trailing revenue and profit. Harpreet and Manpreet came to Treadstone Law with a signed letter of intent, eager to move quickly, having never bought a business before in Canada or anywhere else.

What the deal revealed

The first question Treadstone Law asked was one Harpreet and Manpreet had not thought to ask themselves: what, exactly, were they buying? A business with a storefront and a lease has a fairly obvious list of things that change hands — the premises, the fixtures, the inventory, maybe the employees. A purely online business has almost none of that. Its value sits in a collection of digital assets that are easy to overlook precisely because none of them can be walked through or photographed.

Working through the business with Paulo's accountant, the list turned out to include: the domain name and website itself; the underlying source code and any custom-built software running the store; the social media accounts and the following attached to them; the customer database, including names, contact details and purchase history built up over twelve years; the trademark rights in the business's brand name and logo, which had never been formally registered; the login credentials and account history with the payment processor that handled customer transactions; the advertising accounts used to run paid marketing; and a set of ongoing contracts with the fulfillment provider and the contractors who kept the business running day to day.

Each of those items carried its own problem. Customer data cannot simply change hands the way a filing cabinet can — Canada's federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act, restricts how personal information collected for one purpose can be used once a business changes hands, and customers need to be told their information is moving to a new owner. Payment processor and advertising accounts are typically tied to the individual who opened them and are non-transferable under the platform's own terms of service — attempting to simply hand over a login can flag the account for review or suspension, taking down the store's ability to process payments at the worst possible moment. And an unregistered trademark is a real asset with real value, but proving it was actually being bought, rather than just a name Paulo happened to use, takes deliberate drafting.

None of this meant the business wasn't worth buying. It meant the purchase agreement had to do work that a standard template, built around inventory and equipment, was never designed to do.

What we did

1. Structured the deal as an asset purchase, not a share purchase. Buying the specific assets — rather than buying Paulo's corporation itself, with whatever unknown liabilities it might carry — let Harpreet and Manpreet acquire exactly the list of digital assets they wanted and none of Paulo's past business history, unpaid claims or tax exposure.
2. Built a complete, itemized schedule of digital assets. Rather than a general reference to "the business," the agreement listed the domain name, the source code and any related intellectual property, each social media account by name, the customer database, the unregistered trademark, and every third-party account and contract individually — so there was no ambiguity later about what had or had not been sold.
3. Addressed the customer database as a privacy matter, not just a business asset. The agreement required Paulo to have obtained the necessary consents when the data was originally collected and to notify existing customers, consistent with federal privacy law, that their information was transferring to a new owner as part of the sale — with Harpreet and Manpreet agreeing to use the data only for the purposes customers had already consented to, not for anything new.
4. Solved the non-transferable accounts problem with a transition period instead of a handover. Rather than transferring logins directly — which risked the payment processor and advertising accounts being frozen for a change in control it hadn't approved — the agreement set up a defined transition period during which Paulo remained the named account holder while Harpreet and Manpreet opened new accounts in their own names and migrated the store's transaction history and advertising data across, with Paulo's cooperation contractually required until the migration was verified complete.
5. Assigned the intellectual property formally, including the unregistered trademark. The agreement included a specific assignment of the brand name and logo along with a warranty from Paulo that he had used the name continuously and exclusively for twelve years, giving Harpreet and Manpreet the paperwork trail they needed to register the trademark themselves after closing.
6. Held back part of the purchase price pending verification. Of the roughly $3,400,000 asking price, we negotiated a base payment of about $2,800,000 at closing, with the remaining $600,000 held in escrow for ninety days while Harpreet and Manpreet confirmed that the customer list, revenue figures and account access matched what had been represented — protecting them against the specific risk that a digital business's numbers are harder to verify at a glance than a store full of physical inventory.
7. Included a non-compete covering Paulo personally. Because the entire value of the business was knowledge, relationships and an online following rather than physical assets, we included a non-compete and non-solicitation clause preventing Paulo from starting a competing online store or contacting the business's existing customers for a defined period after closing.

The outcome

The deal closed on schedule. Over the ninety-day escrow period, Harpreet and Manpreet's bookkeeper reconciled the transferred customer database against the revenue figures Paulo had provided and found them consistent, and the migration of the payment processor and advertising accounts to their own names went through without disruption to the store's ability to take orders — the transition period built into the agreement meant there was no gap where the business couldn't process a sale. The escrowed $600,000 was released to Paulo in full once verification was complete.

Six months after closing, the business was running under Harpreet's day-to-day management, with Manpreet handling the finances around her physiotherapy practice, much as they had planned. The trademark application Harpreet filed using Paulo's assignment and continuous-use warranty was accepted for registration, giving the business formal protection over its brand name for the first time in its history. What could have been the deal's biggest source of post-closing disputes — a payment account frozen mid-transition, a customer list that turned out to be smaller or staler than represented, a brand name Paulo could have kept using for a competing store — never materialized, because each of those risks had been identified and addressed in the agreement before closing rather than discovered afterward.

What you can learn from this