The application is an internal, non-public application and processes TikTok Shop data only after the relevant seller grants authorization.
1. Scope
This Privacy Policy applies to the internal TikTok Shop order management application developed and operated by Shenzhen Penni Technology Co., Ltd. (深圳市盆尼科技有限公司) ("we", "us", or "our"). The application is used only by authorized company personnel for specifically authorized TikTok Shop stores. It is not offered as a public application and does not provide public user registration.
The application is currently under development and will process TikTok Shop production data only after the relevant seller has granted authorization and the required security and privacy controls have been enabled.
This policy covers personal data that we access, collect, process, store, transmit, or delete through the application, including TikTok Shop order, buyer, recipient, fulfillment, logistics, product, authorization, and technical data.
2. Our role and seller authorization
For TikTok Shop order data, the relevant authorized seller generally determines the business purpose for processing, and we process the data only for authorized order and fulfillment operations. We do not access a seller's TikTok Shop data until the seller has granted the application the required permissions through TikTok Shop.
The seller may revoke authorization through the available TikTok Shop controls. After revocation, we stop new API access and handle previously collected data in accordance with Section 9 of this policy.
3. Personal data we process
Seller and authorization information
- Seller, shop, account, region, authorization status, and permitted API scope identifiers.
- Protected authorization credentials required to connect the authorized shop to the application.
Order and transaction information
- Order identifiers, order status, item and SKU details, quantities, pricing summaries, timestamps, cancellation or return status, and fulfillment records.
- We do not intentionally collect full payment-card numbers or card security codes.
Buyer, recipient, and delivery information
- Buyer or recipient name, masked or permitted contact information, shipping address, delivery instructions, and other information required to fulfill an authorized order.
Logistics and technical information
- Carrier, package, shipment, tracking number, dispatch status, delivery status, and related timestamps.
- Application user, access, security, error, and audit logs, including time, action, outcome, and relevant technical identifiers.
4. How we obtain data
We obtain data from TikTok Shop through authorized APIs, from the authorized seller or its designated personnel, and from operational actions performed by authorized users of the application. We collect only the data reasonably necessary for the purposes described below.
5. How and why we use data
We process personal data only for the following authorized purposes:
- Retrieve, display, organize, and manage authorized TikTok Shop orders.
- Support internal consolidation of eligible order and fulfillment records.
- Prepare shipments and upload carrier and shipment tracking information.
- Monitor order, fulfillment, dispatch, and delivery status.
- Perform reconciliation, troubleshooting, security auditing, fraud prevention, and service maintenance.
- Comply with applicable legal, regulatory, contractual, and dispute-resolution requirements.
6. How we disclose or share data
Access is limited to authorized employees who require the data for order fulfillment, logistics operations, system administration, maintenance, security, or troubleshooting. We do not use external developers, subprocessors, or third-party cloud storage providers for this application.
We may disclose limited data to the authorized seller, TikTok Shop, a carrier selected for fulfillment, or a competent authority when necessary to complete an authorized transaction, comply with law, protect security and legal rights, or respond to a valid legal request. We do not disclose data to unrelated third parties.
7. Processing location and international transfers
The application server and database are hosted on a company-owned NAS located at our office in Shenzhen, Guangdong, China. Authorized personnel accessing the application are located in China. The application is accessible only through the company's internal local area network and is not exposed to public inbound Internet access. Controlled outbound connections are used to communicate with authorized TikTok Shop API endpoints.
TikTok Shop data handled by this application is accessed, processed, and stored in China. After authorized receipt by the application, we do not onward-transfer or store it in another country or with an external cloud provider. If this arrangement changes, we will assess the change, update this policy, and implement any required safeguards before the new processing begins.
8. How we protect data
We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction. These safeguards include role-based and least-privilege access, individually assigned accounts, administrator multi-factor authentication where supported, endpoint protection, host and network firewalls, security logging, timely updates, restricted internal network access, and personnel security responsibilities.
Our approved security requirements call for TLS 1.2 or higher when sensitive data is transmitted over public or untrusted networks, and AES-128 or stronger protection for sensitive personal data at rest. Authorization credentials, passwords, and cryptographic secrets must be stored using approved protected mechanisms and must not be embedded in public source code.
No security control can eliminate every risk. We review relevant security events and update safeguards when material risks, system changes, or legal requirements arise.
9. Data retention and deletion
We retain personal data only for as long as reasonably necessary to complete authorized order and fulfillment activities, maintain security and auditability, resolve disputes, and meet applicable legal or contractual requirements.
- Authorization credentials are disabled or deleted promptly after seller authorization is revoked or no longer required.
- Unless a longer period is required by applicable law, contract, security investigation, or dispute, TikTok Shop personal data is deleted or irreversibly anonymized within 30 days after both seller authorization and the applicable service relationship end.
- Security and audit logs may be retained for up to 180 days unless a longer period is required for an active security investigation or applicable legal obligation.
Deletion includes active application records under our control. If protected residual copies exist in system recovery media, they remain access-restricted and expire through the applicable recovery-media lifecycle rather than being restored for ordinary use.
10. Privacy rights and requests
Subject to applicable law and the role of the relevant TikTok Shop seller, an individual may request access, correction, deletion, restriction, or other applicable action concerning personal data. A request may be submitted to the seller that collected the order information or to us using the contact details below.
We may need to verify the requester's identity and authority before acting on a request. When we process data on behalf of a seller, we may refer the request to or coordinate with that seller. We will respond within the period required by applicable law.
12. Changes to this policy
We review this policy at least annually and after material changes to applicable law, our organization, security controls, data-processing activities, or service scope. We will publish the updated policy on this page and change the "Last updated" date. Material changes will be communicated through an appropriate channel when required.
13. Contact us
For privacy questions, requests, or concerns relating to this application, contact:
- Organization
- Shenzhen Penni Technology Co., Ltd.
- Privacy contact
- SUHAN
- suhan7220487@163.com
- Location
- Shenzhen, Guangdong, China