Developer Terms of Service

TIKTOK SHOP DEVELOPER TERMS OF SERVICE Last Updated: May 22, 2025 These TikTok Shop Developer Terms of Service (“Developer Terms”), govern your integration and connection with the TikTok Shop Partner Center platform (“TTSPC”) and/or any other TikTok Shop platform (whether via TikTok Shop API or otherwise) (together, the “TikTok Shop Developer Services”), which are made available to You solely for integrating and connecting with the TikTok Shop Services as part of the services You provide to an End User. Your access and use of the TikTok Shop Developer Services is subject to the TikTok Shop Partner Center Terms of Service. Where applicable, these Developer Terms also govern any other agreements or addenda (on such terms and conditions as provided by TikTok) made in connection with these Developer Terms. By accepting these Developer Terms or by otherwise downloading, installing, accessing, using or operating the TikTok Shop Developer Services, you agree that you have read, and that you agree to be bound by these Developer Terms. If you do not agree to these Developer Terms, please do not access or use the TikTok Shop Developer Services. TikTok reserves the right to update these Developer Terms at any time by posting the updated terms on our website and with prior notice to you (if required by applicable laws to do so). Your continued use of the TikTok Shop Developer Services after the effective date will constitute acceptance of such updates.

1. Definitions

1.1 Application: means the software applications, websites, channels, and other digital products that Developer creates which use the TikTok Shop Developer Services, together with their enhancements, upgrades, updates, new versions and other modifications and amendments. 1.2 End Users: means users who engage with You in connection with the Application, including without limitation, any subscribers on the TTSPC, such as seller(s), creator(s), host(s)or any other third party that receives your services in connection with TikTok Shop. 1.3 Intellectual Property Rights: means patents, utility models, rights to inventions, copyright and related rights, trademarks and service marks, trade names and domain names, rights in get-up, goodwill and the right to sue for passing off or unfair competition, rights in designs, industrial designs, rights in computer software, database rights, rights to preserve the confidentiality of information (including know-how and trade secrets) and any other intellectual property rights, including all applications for (and rights to apply for and be granted), renewals or extensions of, and rights to claim priority from, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist, now or in the future, in any part of the world. 1.4 Seller: means a seller on TikTok Shop who has entered into the Seller Terms of Service for TikTok Shop (Brazil, EU, Indonesia, Japan, Malaysia, Mexico, the Philippines, Singapore, Thailand, United Kingdom, United States, Vietnam, Global-Selling Sellers). 1.5 Creator: means a creator on TikTok Shop who has entered into the ** TikTok Shop Creator Terms of Use ( href="https://seller-br.tiktok.com/university/essay?knowledge_id=3275818982590224&identity=1" ++Brazil++, EU, Indonesia, Japan, Malaysia, Mexico, the Philippines, Singapore, Thailand, United Kingdom, United States, Vietnam). 1.6 TikTok Shop API: means TikTok Shop’s application programming interfaces, software development kits, specifications, sample code, data, metadata, technology, software and other associated information and materials as well as any updates thereto that TikTok provides to you for the purpose of these Developer Terms. 1.7 TikTok Shop Information: TikTok Shop Information means any data and information made available to you through the TikTok Shop API or by any other means authorized by TikTok, and any copies and derivative works thereof. 1.8 TikTok Shop Logo: means the TikTok Shop name, logo, trademarks, service marks, domain names, or other distinctive brand features of TikTok Shop, including any combined logo TikTok may develop with Developer. 1.9 TikTok Shop Services: means TikTok Shop’s products and services, including without limitation those offered via the TTSPC or any other TikTok website(s) and TikTok mobile application(s).

2. License to use the TikTok Shop Developer Services

2.1 License to Developer. Subject to these Developer Terms, TikTok hereby grants Developer a personal, non-exclusive, non-transferable, non-sublicensable, limited, revocable license during the Term solely to access and use the TikTok Shop Developer Services to develop, test, maintain, support and operate the Application for interacting with TikTok Shop Services according to these Developer Terms and any documentation and specifications applicable to the TikTok Shop Developer Services for the purpose of assisting Sellers to integrate their enterprise resource planning systems with, and use, the TikTok Shop Services, and assisting Creators to authorize third parties to manage Creators’ data and business operation with, and use of TikTok Shop Services. 2.2 TikTok’s Ownership. TikTok or its licensors own and shall maintain ownership of all right, title and interest (including any Intellectual Property Rights) in and to the TikTok Shop Developer Services and TikTok Shop Services. TikTok expressly reserves all rights to the foregoing. Except as explicitly set forth in clause 2.1, these Developer Terms grant you no right, title, or interest in any Intellectual Property Rights owned by or licensed to TikTok. TikTok shall have an unlimited, irrevocable and worldwide right to use for any purpose any feedback, whether provided verbally or in written form, by you to TikTok regarding your use of and/or access to TikTok Shop Developer Services, without monetary or other compensation to you. 2.3 TikTok Shop Logo. If the TikTok Shop Developer Services include or require the use or display of the TikTok Shop Logo, subject to TikTok’s prior written approval on a case-by-case basis, TikTok may grant you a personal, non-exclusive, non-transferable, non-sublicensable, limited, revocable license during the Term to display certain TikTok Shop Logo in or through your Application in accordance with TikTok’s brand guidelines, as provided to you, and as amended from time to time. 2.4 TikTok Shop User Content. If applicable, any content created, uploaded, posted, sent, received, stored, or otherwise provided by TikTok Shop users or by other third-party licensors (“TikTok Shop User Content”), may be subject to Intellectual Property Rights and other proprietary rights. You may not distribute TikTok Shop User Content unless you obtain all necessary rights, consents, and licenses by the owner of such content or as required by law. 2.5 Incorporated Developer Terms. Your use of the TikTok Shop Developer Services and interaction with TikTok Shop Services is subject to and governed by the policies, guidelines and other terms and conditions (as updated from time to time) applicable to such use or access by you including without limitation the TikTok Shop Developer Terms of Use and the TikTok Shop Partner Center Privacy Policy (the “Incorporated Developer Terms”). You and the Application will not encourage End Users or other third parties to violate (or create facility for your End Users or other third parties that violates) these Developer Terms or the above Incorporated Developer Terms. In the event of a conflict between these Developer Terms and any of the above Incorporated Developer Terms, these Developer Terms shall prevail. 2.6 Monitoring. You agree that TikTok may monitor the use of the TikTok Shop Developer Services to ensure the quality and verify whether you comply with your obligations under these Developer Terms. You agree that you will not interfere with such monitoring. 2.7 End Users. a) You further acknowledge and agree that you are an independent contractor of any End User who engages you in relation to the TikTok Shop Development Services. TikTok (and/or any of TikTok Affiliates) is not a party to such agreement, is not responsible for the provision of any services from you, and is not liable for the acts, omissions, errors, representations, warranties, negligence or breaches of any End User with whom you contract. b) You acknowledge and agree that any personal data You collect from TikTok is being collected on behalf of anEnd User, and that You serve as a service provider/contractor or processor to thatEnd User. As a service provider/contractor or processor of an End User, You shall comply with the data restrictions in your agreement with the End User and any restrictions implied under applicable law. TikTok (and/or TikTok Affiliates) may from time to time recommend developers to End Users generally. TikTok makes no representation or warranty in respect of such End Users. In the event that an End User contracts with you on the basis of such recommendation, subject to clause 10.2, TikTok accepts no liability for such End User and shall not be liable for the acts, omissions, errors, representations, warranties, negligence or breaches of such End User. c) You must obtain required permissions and consent before accessing or using End User data. You must also follow applicable laws and regulations when accessing or processing End User data. You should not store End User or TikTok content data for longer than you need to or are legally able to. d) You must obtain express permission from each End User before you access their TikTok accounts or customer data. You agree only to retrieve or access End User data to the extent authorized and consented to by such End User. e) You will ensure in designing your Application or delivering a service to any End User that all data is collected, processed, transmitted, maintained and used in accordance with: (i) your agreement(s) with such End User, (ii) a legally adequate privacy policy which covers what information you collect and how it will be used, stored, processed, protected, (iii) appropriate contextual notices to, and consents from, nd sers, (iv) all laws and regulations, including applicable personal data protection laws. f) You must obtain express permission from each End User before you share their data with any third parties. g) You agree not to aggregate or otherwise utilize End User data for your own purposes. h) You warrant and undertake that any information or materials you provide to TikTok to make available to End Users in connection with the TikTok Shop Developer Services (including, without limitation, any advertising materials and/or free or discounted service offerings connected to the Application or your delivery of a service) will be valid, true, accurate and up-to-date in all material respects (and that you shall promptly remedy and notify TikTok if you become aware of any non-compliance with the same).

3. Developer Application; Reasonable Use; Restrictions

3.1 Authentication. In order to gain access to TikTok Shop Developer Services, you must register with the TTSPC and provide the information requested by us. You are responsible for ensuring that the information you provide is and remains accurate and up-to-date. You are responsible for ensuring the confidentiality of your login credentials and responsible for all acts or omissions that occur under your account. 3.2 Application. You shall carry out tests to ensure the quality of the Application and that it meets the requirements of this agreement and your agreement with End Users. Following completion of such tests, upon TikTok’s request, TikTok may require you to submit the Application for review and approval by TikTok prior to distribution to End Users, in which case, if TikTok grant approval of the Application, you may publish the Application in accordance with any conditions TikTok set in relation to such publication. You shall not publish the Application without written approval from TikTok. If you make any changes to the Application after approval by TikTok, you must resubmit the Application to TikTok. You agree to cooperate with TikTok in the submission process, provide all required information, and answer all questions reasonably requested by TikTok regarding your Application. 3.3 Developer Content. If the TikTok Shop Developer Services allow you to submit or create content to submit text, graphics, photos, video, audio, music, or other content (“Developer Content”) to the TikTok Shop Services, you hereby grant TikTok a perpetual, irrevocable, worldwide, sublicensable, royalty-free, and non-exclusive license to use, host, store, archive, copy, modify, cache, encode, reproduce, distribute, transmit, synchronize, display, create derivative works from, and publicly perform such Developer Content. Before you submit Developer Content to the TikTok Shop Developer Services, you must have all the necessary rights (including but not limited to consents from End Users or other third-party licensors) to grant TikTok this license. All Developer Content is subject to these Developer Terms, Incorporated Developer Terms, and any other policies provided by TikTok applicable to Developer Content. TikTok does not acquire ownership in Developer Content or the Application. 3.4 Reasonable Use. You must: a) abide by all laws, rules and regulations applicable to your Application, the TikTok Shop Developer Services, and TikTok Shop Services; b) comply at all times with these Developer Terms and with TikTok’s requirements, requests, policies and applicable Incorporated Developer Terms (or those of any network connected to the TikTok Shop Developer Services or TikTok Shop Services); c) make a complete and accurate disclosure to your End Users of the privacy practices and policies (including the provisions of the TikTok Shop Privacy Policy) applicable to the Application that is compliant with applicable law, these Developer Terms, and Incorporated Developer Terms; d) ensure that the Application which you connect to the TikTok Shop Developer Services is stable and easily navigable; e) implement and maintain technical, physical, and administrative safeguards in accordance with these Developer Terms and the highest industry standards (including but not limited to the Minimum Security Standards set out in Annex A, to these Developer Terms); f) immediately disconnect with the TikTok Shop Developer Services and TikTok Shop Services in the event of your becoming aware of any compromise or deficiency in relation to your computer systems, networks, web-browsers or routers and report any such compromise or deficiency to TikTok immediately upon becoming aware of it; and g) if applicable, provide all necessary customer support for the Application to End Users. 3.5 General Restrictions. When accessing the TikTok Shop Developer Services, developing an Application, or providing related services, you will not (or will not allow others to): a) distribute, license, transfer, directly or indirectly sell, rent, syndicate, lend, copy, modify, reverse engineer, decompile, or otherwise alter, in whole or in part, the TikTok Shop Developer Services, or TikTok Shop Services or any derivative works thereof; b) sublicense to any third-party or permit any third-party, without TikTok’s express written authorization, to browse, access or use the TTSPC, or any derivatives thereof; c) use the TikTok Shop Developer Services or TikTok Shop Services, without TikTok’s express written consent, for any unauthorized purpose, including without limitation communicating or facilitating any commercial advertisement or solicitation or spamming; d) use the TikTok Shop Developer Services or TikTok Shop Services in connection with or for any illegal, unauthorized or otherwise improper purposes, or in any manner which would violate any right of any person, including intellectual property rights, or breach any laws or regulations, or in any manner that is misleading, defamatory, infringing, libelous, disparaging, obscene or otherwise objectionable to TikTok; e) access the TikTok Shop API using anything other than the API key that we provide to you; f) make or allow through the Application, API calls in excess of any limits that we may impose from time to time; g) use or combine the TikTok Shop Developer Services with software offered under an open source license in such a way that would cause the TikTok Shop Developer Services to be subject to any obligations under any such open source license; h) use the TikTok Shop Developer Services in a manner that violates any mobile developer or app store terms, conditions, guidelines, or policies; i) use the TikTok Shop Developer Services in a manner that (as determined by TikTok), exceeds reasonable request volume, constitutes excessive or abusive usage, or otherwise fails to comply with or is contradictory with any documentation, policies, these Developer Terms, or any Incorporated Developer Terms; j) collect or attempt to collect any personal data from TikTok Shop users for any unauthorized or unlawful purpose or build, help build, or supplement any profiles, databases, or similar records on any individual, device, content, or browser or associate the behavior of any individual, device, content, or browser with any profile, databases, or similar record; k) use the TikTok Shop Developer Services for fraudulent or otherwise unlawful or unauthorized purposes, including but not limited to the development or promotion of spyware, adware or other malicious codes or programs or to defame or harass any person; l) introduce viruses, malware, malicious code or other content of a harmful or destructive nature through the Application or your access or use of the TikTok Shop Developer Services, including, but not limited to, failure to ensure adequate protection is installed on your devices and servers in accordance with industry practices; m) use any robot, spider, site search or retrieval application, or other device to collect information about users of the TikTok Shop Developer Services for any unauthorized purposes; n) act in any way which could reasonably be expected to adversely impact the stability of TikTok’s servers or the behavior of other applications using the TikTok Shop Developer Services; o) interfere with or attempt to interfere with the proper working of the TikTok Shop Developer Services or TikTok Shop Services, disrupt our website or any networks connected to the TikTok Shop Developer Services or TikTok Shop Services, or bypass, circumvent or attempt to bypass or circumvent any measures we may use to prevent or restrict access to the TikTok Shop Developer Services or TikTok Shop Services; p) remove, obscure, or alter any legal, copyright, trademark or other proprietary notices in relation to the TikTok Shop Services, TikTok Shop Developer Services, and abide by TikTok’s requirements in relation to the use of any proprietary materials, or falsify or delete any author attributions, legal notices, or other labels of origins or source of material; q) imply any affiliation, sponsorship, or endorsement of you or the Application by TikTok, without TikTok’s prior written consent; r) use the TikTok Shop Developer Services to compete with or replicate any TikTok Shop Services; s) use the TikTok Shop Developer Services to recreate a core functionality of, or replace, any functionality of the TikTok Shop; t) use TikTok Shop Developer Services or TikTok Shop Services in any manner that causes any reputational damage to an End User or TikTok; u) create a false identity on the TTSPC; or v) use TikTok Shop Developer Services or TikTok Shop Services in any manner that is not expressly authorized under these Developer Terms. 3.6 Compliance. TikTok may physically or remotely audit you and the Application for compliance with these Developer Terms. You agree you will provide TikTok with proof that you and your Application comply with your obligations under these Developer Terms. You shall keep complete and accurate records to demonstrate your compliance with these Developer Terms. 3.7 Privacy. For information on how we collect, use, share and otherwise process information about you, please see our TikTok Partner Privacy Policy. We may use cookies or similar technologies to store certain types of information each time you use the TTSPC. You can find out more about how we use cookies and other similar technologies in our Cookie Policy (if applicable).3.8 Data Protection. In developing your Applications or providing services to End Users, you shall comply with all applicable data protection laws if you collect or process any personal data of such End Users.

4. Confidentiality

All authentication procedures, information and data to which you gain access or which is provided to you in connection with your use of the TikTok Shop Developer Services and TikTok Shop Services is the “Confidential Information” of TikTok and proprietary to TikTok, unless you can demonstrate that such information: (a) was already known to you, other than under an obligation of confidentiality, at the time of disclosure; (b) was generally available in the public domain at the time of disclosure to you; (c) became generally available in the public domain after disclosure other than through your act or omission; (d) was subsequently lawfully disclosed to you by a third-party without any obligation of confidentiality; or (e) was independently developed by you without use of or reference to any information or materials disclosed by TikTok. You may use this Confidential Information only as expressly permitted hereunder and you may not share the Confidential Information with any third-party other than as required by a court, a regulator or otherwise under applicable laws. You acknowledge and agree that TikTok may be independently creating applications and other products and services that may be similar or competitive with the Application and nothing in these Developer Terms will be construed as restricting or preventing TikTok from creating and fully exploiting such applications, products, or services with any obligation to you.

5. Modifications; Suspension; Support

TikTok may change, suspend, or discontinue any aspect of the TikTok Shop Developer Services at any time. TikTok may also impose limits on certain features and services or restrict your access to parts or all of the TikTok Shop Developer Services without notice or liability to you. TikTok will use commercially reasonable efforts to correct errors in the TikTok Shop Developer Services that cause the same not to perform in accordance with TikTok’s published user documentation for such site or materials that has been made available by TikTok. From time to time, TikTok may make your continued use of the TikTok Shop Developer Services subject to approval or re-approval of your Application. In such case, You will be required to go through the approval process as set out in clause 3.2.

6. Fees

TikTok does not currently charge for use of the TikTok Shop Developer Services; however, TikTok reserves the right to do so in the future, at its sole discretion. If TikTok decides to charge for the TikTok Shop Developer Services, unless otherwise permitted by applicable law, TikTok will give you reasonable advance notice of changes to such charges and the date that they will come into force . If you do not wish to pay such charges, your sole and exclusive remedy is to terminate your use of the TikTok Shop Developer Services at which point each party’s obligations under these Developer Terms will automatically terminate.

7. Term & Termination

The "Term" of these Developer Terms will commence on the earlier of your acceptance of these Developer Terms or your first use of any of the TikTok Shop Developer Services and shall continue until these Developer Terms are terminated by either party. Either party may terminate these Developer Terms upon notice to the other party. Upon termination of these Developer Terms, all licenses granted herein immediately expire, and you must immediately cease use of any and all TikTok Shop Developer Services, TikTok Shop Logo and permanently delete all Confidential Information, any TikTok Shop User Content in all forms in your possession and control (including from our servers). The following clauses will survive any expiration or termination of these Developer Terms: clauses 2.2, 2.7, 3.6, 4, and clauses 8 to 11, and any other provision of the Developer Terms that contemplates a continuing obligation.

8. Disclaimers

To the extent permissible under applicable law: (a) TikTok provides the TikTok Shop Developer Services on an ‘as is’ and ‘as available’ basis; (b) TikTok disclaims all guarantees, conditions, warranties and representations, express, implied, statutory or otherwise concerning the TikTok Shop Developer Services supplied by TikTok hereunder, including but not limited to, those implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, title and non-infringement; (c) TikTok does not warrant, undertake or represent that the TikTok Shop Developer Services will be uninterrupted or error free, virus-free or secure or meet your requirements; and (d) your use of the TikTok Shop Developer Services is at your own discretion and risk, and you will be solely responsible for any damage that results from the use of the TikTok Shop Developer Services including, but not limited to, any damage to your computer system, loss of data or any other damage or injury to you or any third-party. The laws of certain jurisdictions do not allow the disclaimer of implied warranties, so the above disclaimer may not apply to you. With respect to TikTok Shop User Content, TikTok is not responsible for the accuracy, completeness, usefulness, availability, safety, or legality of such data, including content that may be offensive, indecent, defamatory, objectionable, or that may violate third-party rights or applicable laws or regulations.

9. Indemnity

To the maximum extent permitted by applicable law, you agree to hold harmless and indemnify TikTok, TikTok Affiliates, licensors, licensees, assigns and successors, and each of their officers, directors, employee, agents, advisors and shareholders from and against any third-party claim or action including any liability, losses, damages (actual and/or consequential), expenses, litigation costs and reasonable legal fees, of every kind and nature arising from or in any way related to your: (a) actual or alleged breach of your obligations under these Developer Terms, including but not limited to any representations or warranties contained herein; (b) your use of TikTok Shop Developer Services and any Developer Content or data derived therefrom; (c) your willful misconduct or gross negligence; or (d) the performance, promotion, sale or distribution of the Application. TikTok shall use reasonable endeavors to provide you with written notice of any such claim or action.

10. Limitation of Liability

10.1 TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL TIKTOK OR TIKTOK AFFILIATES BE LIABLE TO YOU FOR ANY SPECIAL, INDIRECT, INCIDENTAL, STATUTORY, EXEMPLARY, PUNITIVE, CONSEQUENTIAL, OR OTHER SPECIAL DAMAGES EVEN IF TIKTOK HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 10.2 NOTHING IN THESE TERMS SHALL LIMIT OR EXCLUDE EITHER PARTY’S LIABILITY FOR DEATH OR PERSONAL INJURY RESULTING FROM NEGLIGENCE, FRAUD, OR FOR ANY OTHER LIABILITY WHICH CANNOT BE EXCLUDED BY APPLICABLE LAW (OR THE EQUIVALENT AMOUNT IN THE LOCAL CURRENCY). 10.3 SUBJECT TO CLAUSE 10.2, TIKTOK’S AGGREGATE LIABILITY FOR CLAIMS ARISING OUT OF OR IN CONNECTION WITH THESE TERMS, WHETHER UNDER CONTRACT, TORT (INCLUDING NEGLIGENCE), BREACH OF STATUTORY DUTY, MISREPRESENTATION OR OTHERWISE, SHALL NOT EXCEED AN AMOUNT EQUAL TO $100.

11. Miscellaneous

11.1 Insurance. You shall take out and maintain insurance cover at your own cost with a reputable insurance company to cover your potential liabilities arising under or in connection with these Developer Terms to such extent as would be reasonably expected to be taken out and maintained by an experienced, reasonable and prudent provider of developer services. 11.2 Publicity. You agree that TikTok may use your name, logo(s), or other identifying information or image for any legitimate business purpose without consent. You may not make any public statement regarding your relationship with TikTok or access to the TikTok Shop Developer Services without TikTok’s prior written consent. 11.3 Agency. Nothing in these Developer Terms will be construed to establish any agency, partnership, joint venture or employment relationship between you and TikTok. 11.4 Entire Agreement. These Developer Terms, together with applicable Incorporated Developer Terms, constitute the whole legal agreement between you and TikTok and govern your use of the TikTok Shop Developer Services and entirely replace any prior agreements between you and TikTok in relation to the TikTok Shop Developer Services. You acknowledge that you have entered into these Developer Terms in reliance only on the representations, warranties, promises and terms contained in these Developer Terms and, save as expressly set out in these Developer Terms, TikTok shall not have any liability in respect of any other representation, warranty or promise unless it was made fraudulently. 11.5 Assignment. You may not assign any of the rights or obligations granted hereunder, in whole or in part, whether voluntarily or by operation of law, without the prior written consent of TikTok. Any attempted assignment in violation of this clause is null and void, and TikTok may terminate these Developer Terms. TikTok may assign any or all of the rights or obligations granted hereunder, in whole or in part, whether voluntarily or by operation of law, without Your prior written consent. 11.6 No Waiver/Severability. Our failure to enforce any provision of these Developer Terms shall not be construed as a waiver of any provision or right. If any part of these Developer Terms is determined to be invalid or unenforceable by a court of competent jurisdiction, that part will only be enforced to the maximum extent permissible and the remaining provisions of these Developer Terms will remain in full force and effect. 11.7 Notice. TikTok may give notices to you by email. All notices to TikTok must be sent to e-commerce@tiktok.com.

ANNEX A

MINIMUM SECURITY MEASURES AND CONTROLS These Minimum Security Measures may be changed from time to time by Us (acting reasonably) providing Developer with a replacement. They are to be implemented by developers in relation to any personal data processed under these Developer Terms. Developer will document, implement and maintain an information security program that meets the standards of best industry practice to protect such personal data, which will include: I. System Entry Control Establishing, maintaining, monitoring, and using appropriate technical, physical, administrative, and organizational safeguards consistent with the highest industry standards to secure against a Security Incident, including, at a minimum: a. Secure user authentication protocols and system access control; b. Use of mature and appropriate physical security, current malware, antivirus, and security software that includes e-mail filtering and malware detection; c. Use of proper network protection measures; d. During idle times, company-issued equipment (e.g., company-issued laptops) are automatically locked; e. Encourage use of complex passwords; f. Concept of least privilege, allowing only the necessary access for users to accomplish their job function. Access above requires appropriate authorization; g. IT access privileges are reviewed regularly by appropriate personnel; h. Network monitoring services in place 24 x 7 x 365 to detect unauthorized activities; i. Vulnerability scanning and remediation in place; j. Penetration testing as appropriate; and k. Encryption protocols applied as necessary under various circumstances. II. Physical Access Controls Developer shall take, among others, the appropriate security measures in order to establish the identity of the authorized persons and prevent unauthorized access to Developer’s premises and facilities in which the data are processed. III. Data Access Control Developer shall take technical and organizational measures in order to prevent unauthorized activities in the data processing systems outside the scope of any granted authorizations including, at a minimum: (a) User and administrator access to the network a role-based access rights model. Authorization model grants access rights to data only on a “need to know” basis; (b) Administration of user rights through system administrators; (c) Number of administrators is reduced to the absolute minimum; (d) Perform internal audits as required to assess high risk processes, technologies, and people; (e) Prohibit each employee from disclosing the personal data to any unauthorized third-party or using the personal data in an unauthorized manner; and (f) Where encryption of data is used, proper key lifecycle management practices are in place. IV. Data Transfer Control Developer shall take technical and organizational measures in order to ensure that personal data cannot be read, copied, altered, or removed by unauthorized persons under their electronic transmission or during their transport or recording on data carriers and to guarantee that it is possible to examine and establish where personal data is or has been transmitted by data transmission equipment, including, at a minimum: (a) Remote access (including during remote maintenance or service procedures) to the IT systems is to be via VPN tunnels, where appropriate, or other secure, encrypted connections; (b) Encryption protocols applied as necessary under various circumstances; (c) Data storage devices and paper documents are locked away when not in use (e.g., clean desk policy); (d) Appropriate destruction and disposal of documents; (e) Physical destruction processes in place of industry standards; (f) Secure communication session established via TLS or similar protocols across core applications/services; and (g) Encrypted certificates utilized for authentication between core web client and core web server. V. Input Control Developer shall take appropriate technical and organizational measures in order to ensure that it is subsequently possible to verify and establish via log files whether and by whom personal data has been entered into data processing systems, altered, or removed. VI. Framework Control Developer shall take technical and organizational measures in order to ensure that any personal data transferred under these Developer Terms can only be processed for the purposes specified in the Developer Terms including, at a minimum: (a) Clear and binding internal policies contain formalized instructions for data processing procedures; (b) Clearly articulated contractual protections in place as appropriate in underlying contracts; (c) Regular staff training on the proper use of the computer security system, the security backup and disaster recovery procedures, and the importance of security to ensure compliance with contractual arrangements and maintain awareness regarding data protection requirements; (d) Secure destruction processes in place to industry standards; (e) Periodic access reviews that monitor employee access controls; and (f) Developer’s corporate network is separated from its user services network by means of complex segregation devices. VII. Availability Control Developer shall take technical and organizational measures in order to protect the data from accidental destruction or loss, including, at a minimum: (a) Appliances for the monitoring of temperature and humidity in data centers; (b) Fire/smoke detectors and fire extinguishers or fire suppression systems in data centers; (c) Use of mature and appropriate anti-virus software that includes e-mail filtering and malware detection; (d) Data recovery measures and emergency plan in place and regularly tested; (e) Implementation of mature and appropriate backup methods including physical separation of the backup data and storage of data stored in a redundant archive; (f) Use a combination of full, differential, and cumulative backups to ensure data integrity and timely restoration for core data, as appropriate; (g) To ensure an uninterrupted supply of power to the system, redundant power supply units are built into the systems wherever possible; (h) Integrity of stored data regularly verified using checksums; (i) Processes in place to move data traffic away from affected areas to uncompromised areas in case of failure; (j) Preventative maintenance is performed to ensure continued operability of equipment; and (k) Appropriate Denial of Service and Distributed Denial of Service technology in place to defend against network and systems-based resource starvation attacks. VIII. Minimum Security Standards You must document, implement and maintain an information security program that meets the standards of best industry practice, which will include: (a) Information Security Policies (i) Approved security policies aligned to industry standard-ISO27001 or NIST 800-53 (ii) Industry standard certification such as ISO27001 or SOC2 (iii) (At a minimum) annual review of information security policies (iv) High level conceptual data flow diagram (b) Organization of Information Security (i) Dedicated information security function responsible for security initiatives and operations (ii) High level description of roles and responsibilities within the security organization (iii) Dedicated information security risk management function (c) Human Resource Security (i) Signed non-disclosure agreements by all personnel handling confidential data (ii) Annual security awareness, education and training (iii) Background checks for corporate users (iv) Background checks for contractors (v) Disciplinary process for policy violations (vi) Documented management responsibilities for security (vii) Termination or change of employment controls (viii) Dedicated HR governance and technology systems (d) Asset Management (i) Management oversight of assets and data (ii) Assigned ownership for all assets (iii) Classification and handling of assets (iv) Process for management and disposal of removable media (e) Access Control (i) Least privilege, segregation of duty and need to know basis security concepts are embedded into the access management process (ii) Access assurance control program (iii) Periodic access review (at least annually) (iv) Access termination within 24-48 hours for separated users (v) Management of privileged access rights (vi) Use of multi-factor authentication (MFA) and/or single sign-on (SSO) (vii) SAML 2.0 or SCIM integration readily available to TikTok (viii) Password complexity/configuration requirements in accordance with TikTok standards (ix) Password management system with applicable security controls (where applicable)