1What this is and when it applies
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Mamba Technologies LLC and the Customer. It governs Mamba’s processing of personal information contained in Shop Data — principally the consumer information carried on TikTok Shop order records.
You do not need to sign this
This DPA applies automatically to every Customer from the date they accept the Terms. There is no separate signature step, and no version of the Service in which it does not apply. If your procurement process requires a countersigned copy, email legal@mamba.app and we will provide one.
1.1 Roles
For personal information in Shop Data: the Customer is the controller (a “business” under the CCPA) and Mamba is the processor (a “service provider”). Where an Agency is the paying Customer and a Seller owns the shop, the Seller is the controller of its own Shop Data, the Agency acts on the Seller’s instructions, and Mamba processes on the instructions of whichever of them holds authority for the shop.
1.2 Order of precedence
If this DPA conflicts with the Terms on the processing of personal information, this DPA controls.
2Instructions, and the limits on what we do
Mamba will process personal information only on the Customer’s documented instructions. The instructions are: the Terms, this DPA, the configuration the Customer sets in the Service, and any further written instruction the Customer gives. Using a feature is an instruction to perform it.
Mamba will not:
- sell personal information, or share it for cross-context behavioral advertising, as those terms are defined under the CCPA and comparable state laws;
- retain, use or disclose personal information for any purpose other than performing the Service, or outside the direct business relationship with the Customer;
- combine personal information received from one Customer with personal information from another Customer or from any other source, except as permitted to perform the Service or as expressly permitted by law; or
- use personal information to train general-purpose machine learning models, its own or anyone else’s.
2.1 De-identified data
Nothing in this section prevents Mamba from creating aggregated, de-identified data and using it to operate, secure and improve the Service, including to train Mamba’s own forecasting and benchmark models, as described in Privacy Policy Section 8. Such data is not personal information within the meaning of the CCPA or comparable state laws. Mamba commits to maintain and use that data in de-identified form, to make no attempt to re-identify it, and to contractually oblige any recipient to do the same.
The following are excluded from that use entirely and are never included in any aggregate or training set: consumer personal information of any kind; the Customer’s cost of goods, unit and landed costs, margins, supplier names and supplier terms; SKUs, product names and listings; the Customer’s business name, shop name or shop identifier; and free-text the Customer has entered. A Customer may opt out of inclusion at no charge on any plan by emailing privacy@mamba.app.
Mamba certifies that it understands these restrictions and will comply with them. If Mamba determines it can no longer meet its obligations under applicable privacy law, it will notify the Customer promptly and stop processing or remediate.
If Mamba believes an instruction infringes applicable law, it will inform the Customer and may pause that processing until the instruction is confirmed or amended.
3Annex I — the nature of the processing
| Subject matter | Providing TikTok Shop analytics, profit and loss reporting, inventory forecasting and client reporting to the Customer. |
| Duration | For the term of the Terms, plus the retention and deletion periods in Section 7. |
| Nature and purpose | Collection from TikTok, storage, organization, calculation, aggregation, display, export and deletion — all for the purpose of producing reporting for the Customer. |
| Categories of data subject | The Customer’s Authorized Users; consumers who place orders on the Customer’s TikTok Shop; affiliate creators who promote the Customer’s products. |
| Categories of personal information | Consumers: recipient name, delivery address, contact details where TikTok includes them,
order contents, order value, order status, returns and refunds, delivery and tracking records. Creators: handle, profile information, videos and video performance, collaborations, commission rates and payments, samples. Authorized Users: name, work email, role, authentication and activity records. |
| Sensitive information | None is intentionally collected or requested. The Service is not designed to hold special categories of personal information. |
| Frequency | Continuous, on an automated sync schedule, for as long as the TikTok authorization is live. |
4Sub-processors
The Customer gives general authorization for Mamba to engage sub-processors, subject to this section. Each sub-processor is engaged under a written contract imposing data protection obligations no less protective than this DPA, and Mamba remains liable to the Customer for its sub-processors’ performance.
The current list is published in the Privacy Policy, Section 9.2. Mamba will give 30 days’ notice before adding or replacing a sub-processor that processes consumer personal information. To receive those notices, email privacy@mamba.app.
If the Customer reasonably objects to a new sub-processor on data protection grounds within 15 days of notice, the parties will discuss it in good faith. If Mamba cannot offer a reasonable alternative, the Customer may terminate the affected part of the Service and receive a refund of prepaid unused fees for it.
5Annex II — security measures
Mamba maintains technical and organizational measures appropriate to the risk, including:
| Area | Measure |
|---|---|
| Encryption | TLS in transit; encryption at rest for databases, backups and stored TikTok access tokens. |
| Access control | Role-based access for Customers; least-privilege, individually attributed and logged access for Mamba personnel; access reviewed on a quarterly basis and revoked on role change or departure. |
| Tenant isolation | Workspace scoping enforced in the data layer so one Customer’s data cannot be read by another. |
| Authentication | Passwords hashed with a modern algorithm; session management and anomaly detection on sign-in. Risk-based email verification is available today and is required for new-device, new-IP, inactive and other higher-risk sign-ins, and before sensitive administrative actions. Customer-configurable authenticator-app MFA is not currently available. |
| Logging and monitoring | Authentication, API, ingestion and export activity logged and monitored, with alerting on anomalies. |
| Resilience | Encrypted backups taken daily, with tested restoration. Target recovery point 24 hours; target recovery time 24 hours. |
| Personnel | Confidentiality obligations for everyone with access; security awareness training. Mamba is a three-person company; everyone with production access is a principal of the business. Formal background screening is not currently performed, and Mamba states this rather than implying a control it does not operate. |
| Development | Code review, dependency monitoring and separation of production from development environments. Real shop data from connected shops is used to verify the correctness of financial calculations, because a P&L that has never been checked against real settlement figures is not fit to publish; consumer personal information is excluded from development and testing, and such access is limited to principals and logged. |
| Vendor management | Sub-processors assessed before engagement and bound by written terms. |
| Platform review | Mamba passed TikTok’s US data security review and its data security and privacy review as a condition of publication as a partner app. |
Mamba may update these measures, provided the level of protection is not reduced.
6Helping you meet your own obligations
6.1 Consumer rights requests
Consumers exercise their rights against the Customer, not against Mamba. If a consumer contacts Mamba directly, we will not respond substantively; we will tell them to contact the seller and, where we can identify the relevant Customer, forward the request and notify the Customer.
When the Customer instructs us, Mamba will access, correct, export or delete a consumer’s personal information within 10 business days, and will pass the instruction to any sub-processor holding a copy. Reasonable assistance is included in the subscription at no extra charge.
6.2 Breach notification
Mamba will notify the Customer without undue delay and in any case within 72 hours of confirming a personal data breach affecting the Customer’s data, and will provide: the nature of the breach and categories and approximate volume of data affected; the likely consequences; the measures taken or proposed; and a contact point. Mamba will not notify consumers or regulators on the Customer’s behalf unless the Customer asks in writing — that decision is the controller’s.
6.3 Assessments and consultations
Mamba will provide information reasonably necessary for the Customer to complete a data protection assessment or risk assessment required by law.
6.4 Government and legal demands
If Mamba receives a legally binding demand for Customer personal information, it will notify the Customer before responding unless legally prohibited, will disclose only what is legally required, and will challenge demands that appear overbroad or unlawful.
7Return and deletion
The Customer may export its data at any time during the term and for 30 days afterwards. On written request, or on expiry of that window, Mamba will delete or de-identify the personal information it processes for the Customer within 90 days, and will instruct sub-processors to do the same.
Backups are purged on their ordinary cycle, up to 90 days later, and remain encrypted and access-controlled until they are. Mamba may retain personal information where law requires, in which case it will keep processing it only to meet that requirement and will continue to protect it under this DPA.
8Audit and evidence
On reasonable written request, and no more than once a year unless there has been a breach or a regulator requires it, Mamba will provide the information reasonably necessary to demonstrate compliance with this DPA — including a completed security questionnaire and any current third-party assessments or certifications.
Where that is insufficient for the Customer’s legal obligations, the Customer may request an audit, on 30 days’ notice, during business hours, without unreasonable disruption, under confidentiality, and at the Customer’s expense unless the audit reveals material non-compliance. Mamba may require the auditor not to be a competitor.
9State-law specifics
9.1 California
Mamba is a service provider under the CCPA. The business purposes for which personal information is disclosed to Mamba are those in the Privacy Policy, Section 6. Mamba is prohibited from selling or sharing that information, from retaining, using or disclosing it for any purpose other than performing the Service, from retaining, using or disclosing it outside the direct business relationship, and from combining it with information from other sources except as permitted. Mamba grants the Customer the right to take reasonable steps to stop and remediate unauthorized use.
9.2 Other states
Where the Customer is subject to a comprehensive privacy law in another state, Mamba acts as its processor and this DPA constitutes the contract that law requires between controller and processor. The obligations here are intended to satisfy the required contractual terms in each such law; where a specific state requires a term this DPA does not contain, that term is incorporated to the extent required.
9.3 TikTok platform terms
Mamba’s processing is additionally governed by its agreements with TikTok, which restrict use of platform data to the authorized purpose, limit retention, require appropriate security, and permit TikTok to verify compliance. Where those requirements are stricter, they apply.
9.4 Europe
Mamba is offered to sellers operating in the United States and does not currently offer the Service to controllers established in the EEA, UK or Switzerland. If that changes, Mamba will publish an updated DPA with the appropriate transfer mechanism, including standard contractual clauses, before offering the Service in those markets.
10Liability and changes
Each party’s liability under this DPA is subject to the limitations in the Terms, Section 13, and those limitations apply in the aggregate across the Terms and this DPA.
Mamba may update this DPA on 30 days’ notice where required by law, by a change in sub-processors, or by a change in the Service, provided the update does not materially reduce the protection given to personal information.
Questions: privacy@mamba.app. Countersigned copies: legal@mamba.app.