Privacy Policy 

VKNG Group («VKNG«, «we«, «us«) 

Scope 

This Privacy Policy applies to: 

  • VKNG websites, contact forms, and communication channels. 
  • Professional services provided by VKNG to TikTok Shop clients (e.g., agencies, brands, creators, and sellers), and to applications/integrations that connect with TikTok Shop Partner Center/Open Platform. 
  • Interactions with job applicants and business prospects. 

When we act on behalf of TikTok Shop clients, we generally act as a data processor in relation to their buyers’/stores’ data. 

When we collect data through our own websites and forms, we act as a data controller. 

 

Data We Process 

  1. a) Website, forms, and recruitment

We may process: 

  • Name, company, email address, phone number. 
  • CVs and any files or information submitted by candidates or contacts. 
  • Technical data: IP address, session/device identifiers. 
  • Cookies that are strictly necessary and, where applicable, analytics/measurement cookies. 
  1. b) TikTok Shop integrations and services (on behalf of clients)

On behalf of our clients, we may process data originating from TikTok Shop and/or their systems, such as: 

  • Account / merchant data: shop ID, shop name, country, roles. 
  • Catalog and orders: products, prices, quantities, order status, amounts and currency; shipping and logistics information. 
  • Buyer data for order management: name, email, phone number, shipping/billing address (as applicable). 
  • Technical logs: timestamps, IP address, user agent, API logs, application identifiers, and encrypted tokens. 
  • Support & operations: tickets, messages, screenshots, and other materials shared by the client. 

We do not sell personal data. 

We do not use TikTok Shop data for our own advertising nor to build profiles beyond what is necessary to provide the contracted services. 

 

Purposes and Legal Bases 

  1. a) Main purposes

We use personal data to: 

  • Configure, operate, and improve our services and integrations with TikTok Shop. 
  • Provide support and respond to requests from clients and users of our solutions. 
  • Manage commercial inquiries, proposals, and recruitment processes. 
  • Ensure security, prevent fraud and abuse, maintain service continuity, and comply with legal obligations. 
  1. b) Legal bases (as applicable byjurisdiction)

Depending on the context, we rely on: 

  • Performance of a contract with our client. 
  • Consent, for example for direct marketing or non-essential cookies. 
  • Legitimate interest in securing and improving our services, subject to appropriate balancing. 
  • Compliance with legal obligations, such as invoicing, tax, and responding to lawful requests from authorities. 

 

Cookies and Similar Technologies 

We use: 

  • Strictly necessary cookies required for site operation. 
  • Analytics/measurement cookies, only where consent is provided, to understand usage and improve our content and services. 

If a client deploys TikTok tools (such as TikTok Pixel) or similar technologies on its own properties, those tools are governed by the client’s own privacy notices and consent mechanisms and by TikTok’s policies, not by this Privacy Policy. 

 

Security Measures 

We implement technical and organizational measures appropriate to the risk, including: 

  • Encryption in transit (TLS) and, where applicable, encryption at rest. 
  • Access controls based on least privilege and need-to-know, with multi-factor authentication (MFA) for administrative accounts and audit logging. 
  • Secret management, including secure storage and rotation of keys and tokens. 
  • System hardening and timely security updates. 
  • A secure SDLC: code review, change management, testing, and vulnerability remediation. 
  • Monitoring and logging of security and availability events. 
  • Confidentiality obligations and regular training for staff with access to personal data. 

When we use third-party service providers (e.g., cloud infrastructure, email, CRM, ticketing, storage), we require appropriate data protection commitments. 

An updated description of provider categories is available on request at [email protected]. 

 

Retention and Deletion 

  • TikTok Shop operational data (on behalf of clients): retained for as long as necessary to provide the services and up to 24 months after the last relevant interaction, unless a different period is required by law or instructed by the client. 
  • Access and security logs: retained for up to 12 months, unless needed longer for security investigations. 
  • Recruitment data: retained for up to 12 months from the last update, or as required by applicable law. 

Upon termination of services, and where requested by the client, we will delete or anonymize processed personal data without undue delay and, in any event, within 30 days, unless a longer retention period is legally required. 

 

International Data Transfers 

Where data is transferred outside its country of origin, we implement appropriate safeguards, such as: 

  • Standard Contractual Clauses, 
  • transfer risk assessments, and 
  • technical measures (e.g., encryption). 

When acting as a processor, we follow the client’s documented instructions and any applicable TikTok Shop requirements. 

 

Children 

Our services are not directed at minors. 

We do not knowingly process personal data of individuals under 18 (or the relevant local minimum age). TikTok Shop clients must not share minors’ data with VKNG unless there is a valid legal basis and properly documented consent or authorization. 

 

Data Subject Rights (ARCO / GDPR / CPRA) 

Data subjects may exercise, as applicable: 

  • Rights of access, rectification, erasure/cancellation, and objection. 
  • Where provided by law, rights to restriction of processing, data portability, and not to be subject to certain automated decisions. 

Requests may be submitted to: [email protected] 

  • In Mexico, VKNG follows LFPDPPP deadlines: response within 20 business days, and implementation, where applicable, within 15 business days thereafter. 
  • In the EU/EEA, UK, US, and other relevant jurisdictions, VKNG will respond in accordance with local data protection laws (e.g., GDPR, UK GDPR, CPRA). Data subjects may also contact the competent supervisory authority. 

 

Security Incidents 

If a security incident involving personal data occurs, we will act without undue delay to: 

  • Contain and assess the incident. 
  • Implement corrective and mitigating measures. 
  • Notify affected clients, TikTok Shop (where applicable), authorities, and/or data subjects when required by law or contract. 

 

How We Share Data 

We may share personal data: 

  • With TikTok Shop, only where necessary to operate approved integrations under the client’s instructions and TikTok Shop’s terms. 
  • With service providers (infrastructure, communications, support, billing, etc.) bound by confidentiality and data protection obligations. 
  • With authorities or third parties where required by law, legal process, or to protect our rights. 

We do not sell personal data. 

 

Controller and Contact 

VKNG Group 

Email: [email protected] 

 

Changes to This Policy 

We may update this Privacy Policy to reflect legal, technical, or operational changes. 

The current version will be published on our websites, indicating the last updated date. 

Last updated: 30 October 2025.