1.Introduction

2.Our Commerce Products and Services

3.Licenses and Permissions

4.Seller Eligibility and Commitments

5.Your Commercial Relationship with Creators and Other Third Parties

6.Your Use of TT Commerce & Global Services API

7.Payments and Payment Services to You

• Hyperwallet Agreements: Hyperwallet Terms and Conditions; Hyperwallet Privacy Policy

8.Purchase Price of Your Products

9.Commissions to Creators

10.Logistics Services

11.Fees for use of TikTok Shop

12.Taxes

13.Account Security, Restriction, Suspension, and Termination

14.Your Indemnification Obligations

15.Dispute Resolution

Appendix 1. Minimum Security Measures

1. Information Security Policies
   • Approved security policies aligned to the highest industry standardsa) a policy governing access to datab) a policy governing data sharing with third partiesc) process for reporting suspected violations of our policies
   • At a minimum annual review of information security policies
   • Appropriately detailed data map
2. Organization of Information Security
   • Dedicated information security function responsible for security initiatives and operations
   • Designated roles and responsibilities within the security function
   • Dedicated internal audit function
3. Human Resource Security
   • Contractually binding confidentiality obligations on all personnel handling confidential and/or personal data
   • Security awareness, education, and training upon onboarding and at regular intervals
   • Background checks for all employees to the extent permitted by the applicable laws
   • Disciplinary process for policy violations to the extent permitted by internal policy and local applicable law
   • Termination or change of employment controls
4. Asset Management
   • Management oversight of assets such as servers, databases, and user endpoints
   • Assigned ownership for all assets
   • Classification and handling of assets
5. Access Control
   • Remote access to the IT systems via VPN tunnels, where appropriate, or other state-of-the-art secure, encrypted connections
   • Least privilege, and need-to-know basis security concepts embedded into the access management process
   • Access authentication program
   • Periodic review of access rights (at least annually)
   • Access termination within 48 hours for separated users
   • Use of multi-factor authentication (MFA) and/or single signon (SSO) to access TT Commerce & Global Services systems
   • Password complexity and configuration requirements in accordance with TT Commerce & Global Services standards
6. Cryptography
   • Encryption of data at rest as instructed by TT Commerce & Global Services
   • Key management system with applicable security controls
7. Physical and Environmental Security
   • Physical entry controls
   • Security of equipment and assets off-premises
   • Secure disposal or reuse of equipment
   • Visitor access and authorization program
8. Operations Security
   • Approved change management process for changes to products and infrastructure
   • An appropriate backup methodology to ensure data integrity and timely restoration of core operational data
   • Secure event log preservation
   • Quarterly vulnerability scanning of systems and environment
   • Annual penetration testing of systems and environment
   • Endpoint Detection & Response (EDR) to protect endpoints
   • Annual audit of system configurations and controls
   • Server and infrastructure components hardening
9. Communications Security
   • Network protection including security intrusion-detection-system, anti-malware software, anti-distributed denial of service software, firewalls deployed across the environment, etc.
   • Segregation of networks into zones
   • Network monitoring services in place 24 x 7 x 365 to detect unauthorized activities
10. System acquisition, development, and maintenance
    • Secure software development process to enable the creation of software that incorporates security into every phase of the software development life cycle (SDLC)
    • Security baked into the code from inception rather than addressed after testing reveals critical product flaws
    • Separation of development and production environments
    • Periodicreview of open-source and third-party source code libraries
    • Static and dynamic scanning of source code:a) Static scans review the code for vulnerabilities before it is packaged into the front-facing application. These are performed annually to address vulnerabilities in sourced code and compiled applications.b) Dynamic scans are performed during code changes after the compilation of the code and is to identify run-time errors in the application.
11. Supplier relationships
    • Third party risk management program enables ongoing identification, assessment, monitoring and mitigation processes to manage the risks that occur with using vendors, establishing partnerships, and outsourcing services.
    • Process to respond to regulatory and user requests
    • Capability to respond to security and privacy questionnaires from TT Commerce & Global Services within 10 business days.
12. Information security incident management
    • Incident management program
    • Forensic capability for collecting incident data
    • Business Continuity program to ensure redundancy of products and infrastructure
    • Business Disaster program to ensure recovery of personnel and infrastructure in the event of a disaster
    • Business impact analysis to identify critical systems and processes
    • Logging of access and forensic capabilities to preserve logs and evidence for investigations where necessary

Appendix 2. Service Market and Partner Services Terms

1. Definitions

1. Service Market as Marketplace

Appendix 3. API Terms

1. Definitions

1. Audit

1. Security

1. Intellectual Property