Personal Information Protection Standard

Version 1.1  ·  Effective June 2026  ·  Review cycle: Annual  ·  Primary data region: Singapore

1. Purpose and scope

This Personal Information Protection Standard (“PIPS”) defines how SINGAPORE KINGKUNGMEDIA PTE. LTD. (“KingKung”, “we”, “our”) protects personal data and TikTok Shop merchant data processed through the KingKung Seller Center OMS and related integrations.

This standard applies to:

• All employees, contractors, and administrators with access to production systems
• All environments that store or process TikTok Shop OAuth tokens, order data, product data, or seller account metadata
• Third-party infrastructure providers engaged under written confidentiality obligations

Public privacy notice: https://apitt.douking.vip/privacy.php

2. Roles and responsibilities

DPO contact: privacy@kingkungmedia.com

3. Information security policy

KingKung maintains this PIPS and related procedures covering acceptable use, authentication, remote access, change management, and vendor management. Reviewed at least annually and after material incidents.

4. Network security and monitoring

• Production hosted on Alibaba Cloud (Singapore) with security groups: public HTTPS (443); admin SSH restricted by IP allowlist
• Individual admin accounts; shared root credentials prohibited
• Security group rules reviewed quarterly
• Cloud monitoring and log review for health, failed logins, application errors
• Antivirus on company endpoints used for production administration

5. Endpoint and workplace security baselines

• Screen lock with auto timeout (≤ 5 minutes)
• Strong passwords (≥ 12 characters) or password manager
• Updated OS and antivirus definitions
• Clean desk policy for credentials and exports
• MFA on cloud console, repository, and email where supported

6. Access control (least privilege)

• Production secrets limited to authorized engineers
• OAuth tokens in restricted paths; access logged
• Access revoked within 24 hours of role change or offboarding
• Quarterly access reviews documented

7. Data classification and encryption

• In transit: TLS 1.2+ for https://apitt.douking.vip
• At rest: Cloud disk encryption; secrets outside web root; config not in repository

8. Vulnerability and threat management

• Monthly OS/runtime patches or upon critical CVE
• Dependency review before production deploy
• No hardcoded secrets; config.php excluded from version control
• Annual external attack-surface review

9. Incident response

1. Detection — alerts, staff report, TikTok/merchant notification
2. Containment — isolate systems, revoke tokens, block IPs
3. Assessment — scope, data categories, affected merchants
4. Notification — TikTok Partner support and merchants within 72h if breach confirmed
5. Remediation — patch, rotate credentials, root cause
6. Post-incident review — update controls within 30 days

Incident reports retained ≥ 3 years.

10. Privacy, merchant rights, and data lifecycle

• Assist access, correction, deletion, export within 30 days where feasible
• Disconnect OAuth → stop API calls; delete tokens within 30 days
• Contract end → delete/return data within 90 days
• No sale of personal data

11. Training and awareness

Security orientation before production access; annual refresher; developer training on TikTok API credential handling.

12. Subprocessors

Primary: Alibaba Cloud (Singapore) — hosting and networking under provider confidentiality terms.

13. Compliance statements

• No reportable personal data breach in the past 3 years (as of document date)
• No unresolved regulatory complaints in the past 3 years
• ISO 27001 / SOC 2: not certified; controls aligned with this PIPS

14. Document control

Confidential — Internal use. Upload PDF to TikTok Shop Partner Center → Data Security & Privacy Questionnaire. Filename suggestion: Personal_Information_Protection_Standard_KingKung_2026.pdf