Data Processing Agreement

1. Definitions

"Personal Data", "Controller", "Processor", "Processing", "Data Subject", "Personal Data Breach" and "Supervisory Authority" have the meaning given in the GDPR.

"Customer Personal Data" means Personal Data that Toktik processes on behalf of the Customer in providing the service, as described in Annex A.

"Sub-processor" means a third party engaged by Toktik to process Customer Personal Data.

"SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

2. Roles and scope

2.1 For Customer Personal Data, the Customer is the Controller and Toktik is the Processor.

2.2 What this DPA does not cover. Toktik acts as an independent controller, not as the Customer's processor, for:

(a) persisted observations of public TikTok LIVE activity (public creator and gifter handles, display names, avatars, rankings, gift totals, public agency catalogue fields) that it collects and publishes for its own analytics purposes, as set out in its Privacy Policy; and

(b) its own account administration, billing, security, fraud-prevention and support records.

The Customer does not instruct Toktik on these. Requests from Data Subjects about public activity are handled through the data removal page at toktikhq.com/data-removal or privacy@toktikhq.com.

2.3 The Customer's own data in the product. Handles, notes, marks, tags and alert destinations that the Customer saves in its workspace are Customer Personal Data only to the extent they relate to identifiable individuals. The Customer is responsible for having a lawful basis for saving them and must not enter special-category data (GDPR Article 9) in notes.

2.4 Each party complies with the data-protection laws that apply to it.

3. Processing on documented instructions

3.1 Toktik processes Customer Personal Data only on the Customer's documented instructions, which are: this DPA, the Agreement, and the Customer's use of the service's features (for example saving watchlist entries or notes, requesting an export, configuring alerts, issuing API keys). If law requires Toktik to process data otherwise, Toktik will inform the Customer before doing so unless the law forbids it.

3.2 Toktik will tell the Customer if it believes an instruction infringes data-protection law.

3.3 Toktik does not sell Customer Personal Data, does not use it for advertising, and does not combine it with data of other customers except as inherent in the service the Customer requests (for example public rankings, which contain no Customer Personal Data).

4. Confidentiality

Toktik ensures that people authorised to process Customer Personal Data are bound by confidentiality obligations and are given access only as needed to run, secure and support the service. Access to production systems and support records is limited to the operator.

5. Security

5.1 Toktik implements appropriate technical and organisational measures, described in Annex B, taking into account the state of the art, the costs, and the nature, scope and risks of the processing.

5.2 The Customer is responsible for the security of its own accounts, including keeping credentials and API keys confidential, removing members who should no longer have access, and the content it chooses to store.

5.3 Toktik may update the measures in Annex B provided the overall level of protection is not reduced.

6. Sub-processors

6.1 The Customer gives general authorisation for the Sub-processors listed in Annex C.

6.2 Toktik will give the Customer at least 30 days' notice, by email to the account owner or in the product, before adding or replacing a Sub-processor. The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection in good faith, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees for the unused period; this is the Customer's sole remedy for such an objection.

6.3 Toktik imposes on each Sub-processor data-protection obligations no less protective than those in this DPA and remains responsible to the Customer for their performance.

7. International transfers

7.1 Toktik is based in Singapore, its production servers are hosted in the European Union by OVHcloud, and some Sub-processors operate worldwide.

7.2 Where Customer Personal Data subject to the GDPR is transferred to Toktik in a country without an adequacy decision, the parties incorporate the SCCs, Module Two (controller to processor), which are completed as follows:

• clause 7 (docking clause): included;

• clause 9(a): Option 2, general written authorisation, with the notice period in section 6.2;

• clause 11(a): optional independent dispute-resolution language not included;

• clause 13: the competent Supervisory Authority is the one in the Member State where the Customer is established;

• clause 17: Option 1, the law of Ireland;

• clause 18(b): the courts of Ireland;

• Annex I of the SCCs is completed by Annex A of this DPA (parties, description of transfer, competent authority);

• Annex II of the SCCs is completed by Annex B of this DPA (technical and organisational measures);

• Annex III of the SCCs is completed by Annex C of this DPA (Sub-processors).

7.3 United Kingdom. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum (version B1.0, issued by the Information Commissioner under section 119A of the Data Protection Act 2018) is incorporated, completed by the information in this DPA, with neither party able to end it under its Section 19 for changes to the approved addendum.

7.4 Switzerland. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with references to the GDPR read as references to that Act, the Swiss Federal Data Protection and Information Commissioner as competent authority, and Swiss courts available to Data Subjects in Switzerland.

7.5 Transfers by Toktik to Sub-processors outside the EEA (including Backblaze, United States, for off-site backups) rely on appropriate safeguards, such as an adequacy decision or the standard contractual clauses that the Sub-processor offers.

7.6 If a transfer mechanism is invalidated or replaced, the parties will cooperate in good faith to put an alternative in place.

8. Assistance to the Controller

8.1 Taking into account the nature of the processing, Toktik will assist the Customer, by appropriate technical and organisational measures and as far as possible, to respond to Data Subject requests (access, rectification, erasure, restriction, portability, objection). If a Data Subject contacts Toktik directly about Customer Personal Data, Toktik will refer them to the Customer unless the law requires otherwise. Much of this the Customer can do itself in the product (edit or delete entries, export).

8.2 Toktik will provide reasonable assistance with the Customer's data-protection impact assessments and prior consultations with a Supervisory Authority, relating to the processing covered by this DPA. Assistance beyond what the product and Toktik's published documentation already provide may be charged at a reasonable rate agreed in advance.

9. Personal Data Breach

9.1 Toktik will notify the Customer without undue delay and in any case within 72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice goes to the account owner's email and to any security contact the Customer designates in writing.

9.2 The notice will describe, as far as then known: the nature of the breach; the categories and approximate number of Data Subjects and records concerned; the likely consequences; and the measures taken or proposed. Toktik will provide further information as it becomes available and cooperate with the Customer's reasonable steps to investigate and mitigate.

9.3 A notice is not an admission of fault or liability. Security reports may also be sent to security@toktikhq.com.

10. Deletion and return

10.1 During the term the Customer can export and delete Customer Personal Data in the product.

10.2 On closure of the account, Toktik deletes Customer Personal Data within 30 days, except where law requires longer retention (for example billing and tax records, which Toktik holds as controller and keeps for up to 7 years). Backups are rotated, and a deletion reaches backups on their next rotation. On request made before closure, Toktik will provide an export in a common format.

10.3 On request, Toktik will confirm the deletion in writing.

11. Audit and information

11.1 Toktik will make available the information reasonably necessary to demonstrate compliance with this DPA.

11.2 Toktik will allow for and contribute to audits, including inspections, by the Customer or an auditor it appoints, no more than once per twelve months (unless a Supervisory Authority requires otherwise or after a Personal Data Breach), on 30 days' written notice, during business hours, subject to confidentiality, without unreasonable disruption, and at the Customer's cost.

11.3 Toktik may satisfy an audit request first by providing written answers and relevant documentation. Toktik does not currently hold third-party security certifications and makes no claim to any.

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement. To the extent of any conflict with the SCCs, the SCCs prevail as between the parties, and nothing in this DPA limits liability to Data Subjects under the SCCs or liability that cannot be limited by law.

13. Term, governing law and order of precedence

13.1 This DPA applies from the date it is signed by both parties, or, if accepted online or by written confirmation, from that date, and lasts as long as Toktik processes Customer Personal Data.

13.2 In case of conflict: the SCCs prevail over this DPA; this DPA prevails over the Agreement on the subject of data protection.

13.3 Subject to section 7 and mandatory law, the governing law and forum of the Agreement (Singapore) apply to this DPA.

13.4 Toktik may update this DPA to reflect changes in law or in the service, with at least 30 days' notice; if a change materially reduces the Customer's protection, the Customer may terminate as in section 6.2.

Annex A — Details of processing

Data exporter (Controller): The Customer named in the signed copy of this DPA. Contact: the account owner's email.

Data importer (Processor): Toktik HQ, Singapore. Contact: privacy@toktikhq.com.

Subject matter: Providing the Toktik analytics service (rankings, watchlists, recruiting pool, exports, alerts, Developer API) to the Customer.

Duration: The term of the Agreement, plus up to 30 days after account closure.

Nature and purpose: Hosting, storing, displaying, exporting and transmitting data the Customer enters or generates, authenticating its users, metering usage, and sending the alerts and notices it has configured.

Categories of Data Subjects: (a) The Customer's users and team members; (b) public TikTok creators and gifters whose handles the Customer saves to watchlists, notes or exports.

Types of Personal Data: (a) Name or display name, email address, workspace role, authentication identifiers (including a Google or GitHub identifier if used), IP address and usage logs; (b) public TikTok handles, display names, avatars, and the Customer's own notes, tags and marks about them; alert destinations the Customer connects (email address, webhook URL, Telegram chat identifier). API keys are stored hashed.

Special-category data: None intended. The Customer must not enter special-category data in notes.

Frequency: Continuous, for the term.

Retention: While the account is active; deleted within 30 days of closure (section 10).

Competent Supervisory Authority (SCC clause 13): The authority in the Member State where the Customer is established.

Annex B — Technical and organisational measures

Measures in force on 3 October 2026, verified against the production system.

Transport and network

• Encryption in transit (TLS) for all customer traffic, fronted by Cloudflare.

• Cloudflare Turnstile and rate limits on public forms to block automated abuse.

Application security

• API keys are stored hashed; only a prefix is displayed. Session cookies are first-party and strictly necessary.

• Webhook signing secrets and stored third-party session credentials are encrypted at the application level (AES-256-GCM).

• Tenant isolation: data is scoped by workspace, with role-based access inside a workspace and scoped API keys.

Infrastructure and access

• Production runs on OVHcloud servers in France (European Union). Off-site backup copies are held in the United States (see Annex C).

• Administrative access to production is limited to the operator and uses SSH keys only; password login and direct root password login are disabled.

• Access to support records is limited to the operator.

Backups and resilience

• Regular database backups are taken, copied to off-site object storage with a separate provider (Backblaze, US East), and the two most recent are kept; a deletion reaches backups on their next rotation. Recovery has been tested; the documented recovery target is about one hour for restore and six hours for data currency.

Logging, monitoring and minimisation

• Service health and errors are logged and kept for a short rolling period; logs do not contain feedback message bodies or secrets.

• No advertising cookies or third-party trackers; first-party aggregate counters carry no personal identifiers.

Incident handling

• Breaches are handled per section 9; vulnerability reports to security@toktikhq.com are acknowledged within 2 business days.

Not claimed. Full-disk or database encryption at rest on production servers, application-level encryption of backup files, multi-factor authentication for operator access, and independent audits or certifications (ISO 27001, SOC 2) are not in place and are not claimed.

Annex C — Authorised Sub-processors

OVHcloud SAS — Production server hosting (application, database) — France, European Union

Backblaze, Inc. — Off-site storage of rotated database backups (the two most recent) — United States (Backblaze B2, region US East); transferred over TLS; transfer safeguards per section 7.5

Cloudflare, Inc. — Network, CDN, DDoS protection, Turnstile, email routing — Worldwide

Brevo (Sendinblue SAS) — Transactional email (sign-in links, notifications, digests) — European Union provider

Telegram — Alert and support messages, only if the Customer connects them — Worldwide

Google / GitHub — Sign-in, only if the Customer's users choose them — Worldwide

Independent controllers (not Sub-processors). Payment providers receive billing data under their own terms and determine their own purposes: Dodo Payments (merchant of record for card payments, invoices and VAT) and NOWPayments (crypto payments). Toktik does not send them Customer Personal Data beyond what is needed to complete a payment.

Last updated: 3 October 2026. Notice of changes under section 6.2.

How to enter into this DPA

To enter into this DPA, the Customer emails privacy@toktikhq.com from its account owner's address with the statement "We accept the Toktik HQ Data Processing Agreement v1.0" and its legal name, registered address and VAT or registration number. Toktik HQ confirms by reply email. The DPA, including the SCCs where section 7 applies, applies from the date of that confirmation, and the two emails together with this version of the DPA are the record of the agreement. Until then the Agreement and the Privacy Policy govern.