Snapshot 35160
Normalized text
Scripts and page chrome removed; this is what change detection compares.
English Data Processing Terms (European Economic Area, United Kingdom & Switzerland) These terms apply with effect from: 5 February 2026 1 Scope of these Data Processing Terms 1.1 These Data Processing Terms apply when they are expressly incorporated by reference into the terms for TikTok’s products and/or services, in connection with your TikTok for Business, TikTok Ads Manager or TikTok Business Center accounts (the "TikTok for Business Platform"), including in the Jurisdiction Specific Terms. 2 Definitions 2.1 The following terms shall have the following meanings in these Data Processing Terms: (a) "Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. (b) "Data Subject" means the natural person to whom the Personal Data relates. (c) "EU GDPR" means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (d) "GDPR" means, to the extent applicable to the relevant Processing of Personal Data under these Data Processing Terms: (i) the EU GDPR; (ii) the UK GDPR; or (iii) the Swiss DPA, together (in each case) with any applicable national data protection laws made under, pursuant to or that apply in conjunction with any of (i), (ii) or (iii) (as may be amended or superseded from time to time). (e) "Personal Data" means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. (f) "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed under the Data Processing Terms. (g) "Processor" means a natural or legal person, public authority, agency, or other body which Processes Personal Data on behalf of the Controller. (h) "Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms "Process" and "Processed" shall be construed accordingly. (i) "Subprocessors" means third party Processors appointed by TikTok under the Data Processing Terms to Process Personal Data in order to support the provision of the TikTok for Business Platform. (j) "UK GDPR" means the EU GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018. (k) "Swiss DPA" means Switzerland’s Federal Act on Data Protection. Where the Swiss DPA is applicable to Processing of Personal Data under these Data Processing Terms, references in these Data Processing Terms and in the Swiss SCCs to Articles of the GDPR are to the equivalent provisions of the Swiss DPA. 3 TikTok Obligations 3.1 When TikTok Processes Personal Data pursuant to these Data Processing Terms, you are the Controller of such Personal Data and TikTok is a Processor. Accordingly, TikTok shall: (a) only Process the Personal Data in accordance with the terms which have incorporated these Data Processing Terms (the "Applicable Product Terms"). TikTok shall not disclose the Personal Data to any third party except where such disclosure: (i) is in accordance with the Applicable Product Terms, (ii) is to a Subprocessor pursuant to Clause 4; or (iii) otherwise in accordance with your documented instructions including to any of your other Processors to whom you may instruct us to disclose the Personal Data; (b) ensure that any person it authorizes to Process the Personal Data is subject to a duty of confidentiality (whether contractual or statutory); (c) implement appropriate technical and organizational measures to protect the Personal Data from and against a Personal Data Breach; (d) assist you by appropriate technical and organizational measures insofar as this is possible (taking into account the nature of the Processing) to enable you to fulfil any obligations to respond to requests for the exercise of Data Subject rights by a Data Subject under the GDPR; (e) notify you without undue delay upon becoming aware of a Personal Data Breach, and provide details, at the time of notification or as soon as possible after notification, of the nature of the Personal Data Breach and number of records affected, the category and approximate number of affected Data Subjects, any anticipated consequences of the Personal Data Breach, and any actual or proposed remedies for mitigating the possible adverse effects of the Personal Data Breach; (f) at your request and expense, provide you with such assistance as is reasonable in respect of any data protection impact assessment and/or consultation with a supervisory authority that you are required to undertake in accordance with the GDPR, taking into account the nature of the Processing and the information available to TikTok; (g) on termination of the Applicable Product Terms, delete the Personal Data within the period set forth in the Applicable Product Terms provided, however, that TikTok may keep the Personal Data if necessary to provide other services set forth in the Applicable Product Terms. Where the EU GDPR applies, the requirement to delete Personal Data shall not apply to the extent that European Union or EU Member State law requires continued storage of the Personal Data, where the UK GDPR applies, the requirement to delete Personal Data shall not apply to the extent that UK law requires continued storage of the Personal Data and, where the Swiss DPA applies, the requirement to delete Personal Data shall not apply to the extent that Swiss law requires continued storage of the Personal Data; (h) make available to you all information that is reasonably necessary to demonstrate TikTok's compliance with its legal obligations as a Processor under Article 28 of the GDPR; and (i) upon request, TikTok shall make available to you copies of any applicable information security and/or data protection audit certifications it may hold in respect of the Processing that is the subject of these Data Processing Terms. 4 Subprocessors 4.1 You agree that TikTok may subcontract its data processing obligations under these Data Processing Terms to third party Subprocessors (including TikTok group companies) provided that: (a) any such Subprocessors are engaged on terms that impose obligations on the Subprocessor which are no less onerous than these Data Processing Terms; (b) where any Subprocessor fails to fulfil such obligations, TikTok shall remain fully liable to you for the performance of that Subprocessor’s obligations; and (c) TikTok provides at least 7 days' prior notice of the addition or removal of any Subprocessor by updating its list of subprocessors in the Applicable Product Terms. If you reasonably object to such additional Subprocessor(s), you may inform TikTok in writing of the reasons for your objections. If you object to such additional Subprocessor(s), you should stop using the services set forth in the Applicable Product Terms and providing Personal Data to TikTok. ©2026 TikTok for Business Help Terms & Policies TikTok for Business rangeDom