TikTok Research Tools Terms of Service

These terms (the "Research Terms"), when accepted, form a legal agreement between you and TikTok (defined below), and govern your access to and use of the TikTok Research Tools (defined below), and our related websites (such as https://developers.tiktok.com ("TikTok Research Site")), services, applications, and products which are stated to be offered subject to these Research Terms (collectively, the "Services").

The company ("TikTok") that you are contracting with depends on where you are resident:

If you are resident in one of the countries that form the European Economic Area (“EEA”) or Switzerland, your contract is with TikTok Technology Limited, a company registered in the Republic of Ireland with its registered office at 10 Earlsfort Terrace, Dublin, D02 T380, Ireland and company number 635755 (“TikTok Ireland”).
If you are resident in the United Kingdom, your contract is with TikTok Information Technologies UK Limited, a company registered in England with its registered office at 4 Lindsey Street, Barbican, London, EC1A 9HP, United Kingdom and company number 10165711 (“TikTok UK”).
If you are resident outside of the EEA, United Kingdom or Switzerland, your contract is with TikTok Inc., a company registered in the United States with its registered office at 5800 Bristol Pkwy., Culver City, CA 90232.

Please read these Research Terms carefully. By using, installing, accessing or operating the TikTok Research Tools, you agree (on your own behalf and on behalf of any Eligible Researcher (as defined below) for whom you act) to be bound by these Research Terms. If you do not agree to these Research Terms, do not access or use the TikTok Research Tools.

I. Definitions

1. Applicable Data Protection Law: means any and all applicable privacy and data protection laws that apply to the Processing of the Personal Data in question.

2. Data Subject: means: (a) an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; and (b) any person who falls within the scope of a "data subject" (or any materially similar or analogous concept or definition) under Applicable Data Protection Laws.

3. Eligible Researcher(s): means and includes academic research institutions and other non-academic research bodies, organizations and associations that meet the following criteria:

(i) have demonstrable experience and expertise in the relevant research areas and in the processing and analysis of data; and

(ii) has as one of its principal aims the conduct of research on a not-for-profit basis pursuant to a public-interest mission;

is a person to whom TikTok has otherwise granted access to the TikTok Research Data and / or TikTok Research Tools, in accordance with TikTok's legal obligations.

4. Minimum Security Measures: means the technical and organizational security measures with which you as the Eligible Researcher must comply, as set out in Schedule C.

5. Personal Data: means any information relating to an individual; and any information which falls within the scope of "personal data", "personal information" or "personally identifiable information" (or any materially similar or analogous concept or definition) under applicable privacy and data protection local laws.

6. Processing (and “Process” and “Processed”): means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

7. Research: means any research, findings, studies, academic work products, and other materials that derive from utilizing TikTok Research Tools (as defined below) or in connection with the use of TikTok Research Tools.

8. Research Application: means the research application pursuant to which you were deemed to be an Eligible Researcher (whether by TikTok or in accordance with TikTok’s legal obligations).

9. Security Incident: means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.

10. TikTok Research Data: means data that is provided by TikTok to you and made available through the TikTok Research Tools or by any other means authorized by TikTok, and any copies and derivative works thereof.

11. TikTok Research Tools: means the technical solution that TikTok provides to you to facilitate your research, including TikTok's application programming interfaces, software development kits, specifications, sample code, data, metadata, technology, software, virtual compute environments and other associated information and materials and any other interfaces, services, applications, products and mechanisms made available by TikTok, as well as any updates thereto.

12. The Platform: means the TikTok apps, websites, software and related services, accessed via any platform or device platform and its related websites, services, applications, products, and content individually and collectively.

13. Principal Researher: means the Eligible Researcher whose account for the TikTok Research Tools identifies subordinate Eligible Researcher collaborators (“Lab Group Member(s)”).

II. Description of the Services and License

1. TikTok Research Data is provided through the TikTok Research Tools to facilitate Research. Eligibility to access the TikTok Research Tools is based on various criteria as determined by TikTok in its sole discretion or in accordance with TikTok’s legal obligations. These criteria include compliance with applicable laws, regulations, and the scope and nature of your proposed research. To qualify to access the TikTok Research Tools, you must either be an Eligible Researcher or be properly authorized to act on behalf of an Eligible Researcher or a Lab Group Member, and meet all of the requirements specified in these Research Terms and any applicable eligibility criteria specified in the TikTok Research Site.

2. Unless otherwise provided for, TikTok will require you to submit a Research Application for review and approval by TikTok prior to giving you access to the TikTok Research Tools. More information on the Research Application process is available on the TikTok Research Site. You are responsible for ensuring that the information you provided is and remains accurate and up-to-date. If you make any changes to the information you supplied in your original Research Application after approval by TikTok, you must resubmit the Research Application to TikTok for re-approval. You agree to abide by TikTok's submission process, provide all required information, and answer all questions reasonably required by TikTok regarding your Research Application. If there are any changes to the information you supplied to TikTok in your original Research Application, you must provide reasonably prompt notice to TikTok of such changes. Failure to do so will be deemed a breach of these Research Terms and may result in the termination of your access to the TikTok Research Tools.

3. You are responsible for ensuring the confidentiality of your login credentials and you are responsible for all acts or omissions that occur under your account.

4. Subject to these Research Terms, TikTok hereby grants you a personal, non-exclusive, non-transferable, non-sublicensable, limited, revocable license during the approved Research solely to access and use the TikTok Research Tools for the sole purpose of undertaking the approved Research.

5. TikTok or its licensors own and shall maintain ownership of all right, title and interest in and to the TikTok Research Tools. TikTok expressly reserves all rights to the foregoing. These Research Terms do not grant you any right, title, or interest in any intellectual property owned or licensed by TikTok. TikTok shall have an unlimited, irrevocable and worldwide right to use for any purpose any feedback, whether provided verbally or in written form, by you to TikTok regarding your use of and/or access to the TikTok Research Tools, without monetary or other compensation to you.

6. If applicable, any content created, uploaded, posted, sent, received, stored, or otherwise provided by TikTok users or by other third party licensors (“TikTok User Content”), may be subject to copyright or other intellectual property and proprietary rights. You may not distribute TikTok User Content unless you obtain all necessary rights, consents, and licenses by the owner of such content or as required by law.

7. Your use of the TikTok Research Tools and interaction with the TikTok Platform is subject to and governed by the policies, guidelines and other terms and conditions (as updated from time to time and as relevant to you depending on where you are based) applicable to such use or access by you (the “Incorporated Terms”), including without limitation the following:

a. the TikTok Terms of Service located at https://www.tiktok.com/legal/terms-of-use?lang=en;

b. the TikTok Privacy Policy located at https://www.tiktok.com/legal/privacy-policy?lang=en;

c. the TikTok Community Guidelines located at https://www.tiktok.com/community-guidelines?lang=en;

d. If you are a resident of the United States, the TikTok Developer Terms of Service located at https://www.tiktok.com/legal/tik-tok-developer-terms-of-service?lang=en.

8. You will not encourage or create a facility for third parties that violates these Research Terms or the above Incorporated Terms. In the event of a conflict between these Research Terms and any of the above Incorporated Terms, these Research Terms shall prevail.

III. Rules and Restrictions

There are various obligations relating to your use of the Service as follows:

1. Reasonable use restrictions. You must:

a. abide by all laws, rules and regulations applicable to your Research, the TikTok Research Tools and your access to TikTok Research Data;

b. comply at all times with these Research Terms and with TikTok’s requirements, requests, policies and applicable Incorporated Terms (or those of any network connected to the TikTok Research Tools or the Platform);

c. not access any data or TikTok content other than through the TikTok Research Tools (including without limitation, no use of scraping or other technical or manual techniques for extraction of content);

d. implement and maintain technical, physical, and administrative safeguards in accordance with these Research Terms and the highest industry standards; and

e. immediately disconnect with the TikTok Research Tools in the event of your becoming aware of any compromise or deficiency in relation to your computer systems, networks, web-browsers or routers and report any such compromise or deficiency to TikTok immediately upon becoming aware of it.

2. General Restrictions: When accessing TikTok Research Tools, you will not (or allow others to):

a. distribute, license, transfer, directly or indirectly sell, rent, syndicate, lend, copy, modify, reverse engineer, decompile, or otherwise alter, in whole or in part, the TikTok Research Tools;

b. sublicense to any third party or permit any third party, without TikTok’s express written authorization, to browse, access or use the TikTok Research Tools, or any derivatives thereof;

c. use the TikTok Research Tools, including any content on the Platform, for any commercial or unauthorized purpose, including beyond the scope of the approved Research, except for the limited purpose of publishing papers regarding the approved Research that may themselves be commercial in nature;

d. use the TikTok Research Tools in connection with or for any illegal, unauthorized or otherwise improper purposes, or in any manner which would violate any right of any person, including intellectual property rights, or breach any laws or regulations, or in any manner that is misleading, defamatory, infringing, libelous, disparaging, obscene or otherwise objectionable;

e. use or combine the TikTok Research Tools with software offered under an open source license in such a way that would cause the TikTok Research Tools to be subject to any obligations under any such open source license;

f. use the TikTok Research Tools in a manner that violates any mobile developer or app store terms, conditions, guidelines, or policies;

g. use the TikTok Research Tools in a manner that (as determined by TikTok) exceeds reasonable request volume, constitutes excessive or abusive usage, or otherwise fails to comply with or contradicts any documentation, policies, these Research Terms, or any Incorporated Terms;

h. use the TikTok Research Tools for fraudulent or otherwise unlawful or unauthorized purposes, including but not limited to the development or promotion of spyware, adware, or other malicious codes or programs or to defame or harass any person;

i. introduce viruses, malware, malicious code, or other content of a harmful or destructive nature through your access or use of the TikTok Research Tools, including, but not limited to, failure to ensure adequate protection is installed on your devices and servers in accordance with industry practices;

j. use any robot, spider, site search or retrieval application, or other device to collect information about users of the TikTok Research Tools for any unauthorized purposes;

k. act in any way which could reasonably be expected to adversely impact the stability of TikTok’s servers or the behavior of other applications using the TikTok Research Tools;

l. interfere with or attempt to interfere with the proper working of the TikTok Research Tools, disrupt the TikTok Research Site or any networks connected to the TikTok Research Tools, or bypass, circumvent or attempt to bypass or circumvent any measures we may use to prevent or restrict access to the TikTok Research Tools;

m. remove, obscure, or alter any legal, copyright, trademark or other proprietary notices in relation to the Platform, the TikTok Research Tools, or falsify or delete any author attributions, legal notices, or other labels of origins or source of material, or fail to abide by TikTok’s requirements in relation to the use of any proprietary materials;

n. create a false identity on the TikTok Research Site; or

o. use the TikTok Research Tools or the Platform in any manner that is not expressly authorized under these Research Terms.

3. Research API specific obligations: a. Quotas. As part of your Research, you will receive a certain quota assigned by TikTok for accessing TikTok Research Data during your Research. The quota is determined by TikTok at its sole discretion, and TikTok may adjust your quota, suspend, or revoke your access to the TikTok Research Tools at any time, including in the event that Researcher is in breach of the Research Terms, following the completion of your Research, in accordance with TikTok’s legal obligations. b. Use of TikTok Research Data. You may only use TikTok Research Data for Research on the topics approved (by TikTok or otherwise in accordance with TikTok’s legal obligations) as part of your Research Application. c. Publication of Research. Consistent with Open Science Principles, you agree to use reasonable efforts to publish any Research in Open Access journals or publications and/or as Open Access resources on other websites. d. Principles of Research Ethics. You agree not to use the TikTok Research Tools and/or perform your Research in a manner that is deceptive, unethical, false, or misleading, that compromises academic or professional integrity, or that violates principles of research ethics. You will notify us without undue delay upon becoming aware of any content that is, or you believe to be, illegal, fraudulent, or violates TikTok Community Guidelines, such notification to include all known details relating to the alleged illegal content. e. Data Refresh and Deletion. Where you are able to access or download Personal Data through the TikTok Research Tools, you agree to regularly refresh TikTok Research Data at least every thirty (30) days, and delete data that is not available from the TikTok Research Tools at the time of each refresh. TikTok Research Data shall not be kept by you for longer than is necessary for Research approved as part of your Research Application. You agree to provide TikTok with written certification of data deletion upon TikTok's request. f. Research Outputs and Publication. You may create derivative Research outputs that are not specifically and directly made available through the TikTok Research Tools. You may not publish your research outputs if your outputs violate these Research Terms. You and your partners must provide attribution to TikTok in your research outputs and publications that use data derived from your use of the TikTok Research Tools. You agree to provide TikTok with a copy of any publications pertaining to or containing the results and findings of the Research outputs, and any supporting information, at least seven (7) days before publication primarily to identify any user private Personal Data that may need to be removed prior to publication or disclosure. g. No Endorsement. You agree that TikTok's provision to you of the TikTok Research Tools does not imply any endorsement by TikTok of either you, your Research, or any opinion, conclusion, or publication in relation to your Research. You may only reference TikTok as the source of your Research and shall not make any representations contrary to the no endorsement requirement. You may not use the TikTok name, logo, trademarks, service marks, domain names, or other distinctive brand features of TikTok without TikTok's prior written approval. Nothing in these Research Terms shall be construed as constituting a partnership, joint venture or relationship of employer and employee between the parties. h. License to TikTok. After you publish any research outputs, you agree that TikTok will have free and unlimited access to and use of your publication and research outputs. Such use may include, without limitation, the right to: After you send us your advance copy as specified in sub-section 3(f), make, distribute, and use copies of your publication and research outputs, for internal review, presentation, and training purposes; and After you publish any Research outputs, for marketing, training, and presentation purposes, use and distribute reasonable excerpts from your publication and Research outputs.

4. Privacy Obligations:

a. To the extent that you receive TikTok Research Data that is also Personal Data, then you agree that the following privacy obligations shall apply to such data sharing.

b. [This Clause is entered into not only by the Eligible Researcher and TikTok but also by TikTok Pte. Ltd., 1 Raffles Quay, #26-10, South Tower, Singapore 048583 ("TikTok Singapore"). Together, TikTok Inc., TikTok Singapore, TikTok Ireland and TikTok UK are referred to as the "TikTok Group".]

c. Your role as Eligible Researcher is as follows: You are a Controller under GDPR You are a Third Party under The California Consumer Privacy Act (“CCPA”) (Cal. Civ. Code § 1798.100 et. seq.), You are a Controller under Colorado Privacy Act (“CPA”) (Colo. Rev. Stat. Ann. § 6-1-1201 et. seq.), Connecticut Data Privacy Act (“CTDPA”) (Conn. Public Act No. 22-15), Utah Consumer Privacy Act (“UCPA”) (Utah Code Ann.§ 13-61-101 et. seq.), Virginia Consumer Data Protection Act (“VCDPA”) (VA. Code Ann. § 59-1-571 et. seq.).

d. TikTok Group shall comply with Applicable Data Protection Law at all times when transferring Personal Data to you. This shall include, if and to the extent required by Applicable Data Protection Law, entering into such supplemental data transfer terms with you as may be required by Applicable Data Protection Law (and, in the event of any conflict between any such supplemental data transfer terms and the Research Terms, those supplemental data transfer terms shall prevail).

e. In accordance with the Research Terms, you shall: comply with Applicable Data Protection Law at all times when Processing the Personal Data that is transferred/ shared by the TikTok Group, including by providing the same level of privacy protection required of the TikTok Group under Applicable Data Protection Law; only process any Personal Data for the purposes for which the Personal Data is shared with you, unless required otherwise by Applicable Data Protection Law, and as part of your Research strictly where required for such Research, and apply data minimization, anonymization and pseudonymization techniques wherever possible; not use the TikTok Research Data to build profiles of individual users or individual devices nor will you combine the TikTok Research Data with any other information or data about individual users that you obtain from any other source nor associate the behavior of any individual or device with any profile, database or similar record; not circumvent (or try to circumvent) any privacy or security features contained in the TikTok Research Tools, including (where applicable) to download or create a copy of the TikTok Research Data; not make any direct contact with TikTok users other than strictly in accordance with any processes agreed with you as part of the Research application; not undertake any processing activities in respect of the TikTok Research Data which involve the processing of any data which would be considered to be sensitive or special category data (or any materially similar or analogous concept or definition) under Applicable Data Protection Law or to infer the same, without informing TikTok Group. If you believe that any TikTok Research Data provided to you does contain any such data, then you must promptly inform us and delete it; not undertake any processing activities (including access) in respect of any Personal Data in the TikTok Research Data which relates to an identified or identifiable individual user under the age of 18 outside of the TikTok dedicated environment. If you believe that any TikTok Research Data provided to you outside of the TikTok dedicated environment does contain any such data, then you must promptly inform TikTok Group and delete it; not publish your Research outputs if your outputs can be linked back to a specific TikTok user or other individual; strictly adhere to any time limits, rate limits and other restrictions in relation to your access and use of the TikTok Research Data and the scope of the Research confirmed to you on approval of your Research Application; provide information and documentation on request to TikTok Group regarding compliance with these Research Terms including in relation to these privacy restrictions and obligations and your compliance with Applicable Data Protection Laws (including without limitation in respect of your compliance with transparency, data subject/individual rights, privacy assessments and any reliance by you on exemptions in respect of research activities or otherwise under Applicable Data Protection Laws); confirm that your access is in accordance with Applicable Data Protection Law and these Research Terms for the purpose of your Research as approved (by TikTok or otherwise) to Eligible Researchers authorized to access the TikTok Research Tools, when required by TikTok Group to do so; delete any inadvertently generated Personal Data promptly and in any event within 30 days; if TikTok Group informs you of a TikTok user having required rectification, erasure or restriction of processing of Personal Data shared with you, you must comply with such requests.

5. Lab Group Requirements:

a. You agree that the Principal Researcher is responsible for ensuring that all Lab Group Members meet the requirements of the Research Terms, including but not limited to ensuring that all Lab Group Members are Eligible Researchers. TikTok reserves the right to approve or deny access for Lab Group Members added after the Principal Researcher's Research Application to access the TikTok Research Tools is approved.

b. All Lab Group Members must comply with the Research Terms. You agree that the Principal Researcher is responsible for the actions of all Lab Group Members, including but not limited to the failure of any Lab Group Member to comply with the Research Terms.

6. Compliance and Monitoring. TikTok may monitor your use of the TikTok Research Tools and the Research at any time and without notice or otherwise conduct an audit of your activities or ask you to confirm that your use of the TikTok Research Tools is compliant with these Research Terms) in order to ensure compliance with these Research Terms. You agree not to block or interfere with such efforts and to provide us with reasonable access to information related to your compliance with these Research Terms. You agree you will provide your full cooperation and assistance with such monitoring and audit and provide reasonable documentary evidence that you and your Research comply with your obligations under these Research Terms.

7. Survey Participation Agreement. By agreeing to these Research Terms of Service, you consent to periodically receiving surveys regarding your experience with the tools under these terms. These surveys may be sent from a third-party tool or be administered by a third-party service provider. Your participation in these follow-up surveys is voluntary, and the feedback collected will be used to improve the quality and effectiveness of our research tools.

IV. Confidentiality

You acknowledge that the ability to access and aggregate analysis of TikTok Research Data might not generally be available in the public domain at the time that data is made available or disclosed to you. All of the data to which you gain access or which is provided to you in connection with your use of the TikTok Research Tools, including aggregated, de-identified, or anonymized data, may be considered as "Confidential Information" of TikTok and proprietary to TikTok, and you agree not to disclose, copy, reproduce, share, sell, or otherwise transfer to any third party any TikTok Research Data-or any data derived or aggregated from TikTok Research Data, unless you can demonstrate that such information: (a) was already known to you, other than under an obligation of confidentiality, at the time of disclosure; (b) was generally available in the public domain at the time of disclosure to you; (c) became generally available in the public domain after disclosure other than through your act or omission; (d) was subsequently lawfully disclosed to you by a third party without any obligation of confidentiality; or (e) was independently developed by you without use of or reference to any information or materials disclosed by TikTok. You may use this Confidential Information only as expressly permitted hereunder and you may not share the Confidential Information with any third party other than as required by a court, a regulator or otherwise under applicable laws. You acknowledge and agree that nothing in these Research Terms will be construed as restricting or preventing TikTok from creating and fully exploiting its own applications, products, or services with any obligation to you.

V. Disclaimer

To the extent permissible under applicable law: (i) TikTok provides the TikTok Research Tools including the TikTok research tools on an ‘as is’ and ‘as available’ basis and makes no commitment that it will be available; (ii) disclaims all guarantees, conditions, warranties and representations, express, implied, statutory or otherwise concerning the TikTok Research Tools supplied by TikTok hereunder, including but not limited to, those implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, title and non-infringement; (iii) TikTok does not represent that the TikTok Research Tools will be uninterrupted or error free uninterrupted, virus-free or secure or meet your requirements; (iv) your use of the TikTok Research Tools is at your own discretion and risk, and you will be solely responsible for any damage that results from the use of the TikTok Research Tools including, but not limited to, any damage to your computer system, loss of data or any other damage or injury to you or any third party. The laws of certain jurisdictions do not allow the disclaimer of implied warranties, so the above disclaimer may not apply to you. With respect to TikTok User Content, TikTok is not responsible for the accuracy, completeness, usefulness, availability, safety, or legality of such data, including content that may be offensive, indecent, defamatory, objectionable, or that may violate third party rights or applicable laws or regulations.

VI. Indemnity

To the maximum extent permitted by applicable law, you agree to hold harmless and indemnify TikTok, its subsidiaries, affiliates, licensors, licensees, assigns and successors, and each of their officers, directors, employees, agents, advisors and shareholders from and against any third-party claim, suit or action including any liability, losses, damages (actual and/or consequential), expenses, litigation costs and reasonable attorney fees, of every kind and nature arising from or in any way related to your (a) actual or alleged breach of your obligations under these Research Terms; (b) your use of the TikTok Research Tools or data derived therefrom; or (c) the Research. TikTok shall use reasonable endeavors to provide you with written notice of any such claim, suit or action. Your liability for the indemnity provided in this Clause VI, shall not be limited or excluded (including by any provisions of these Research Terms).

VII. Limitation of Liability

To the maximum extent permitted by applicable law, in no event shall TikTok, its affiliates, assigns, successors, licensors or licensees, or each of their officers, directors, employees, agents, advisors, or shareholders, be liable to you or any third party for any direct, indirect, incidental, special, punitive or consequential damages (including but not limited to any loss of data, service interruption, computer failure, or pecuniary loss) arising out of or in connection with these Research Terms or the use of, or inability to use, the Platform, or the TikTok Research Tools, including any damages resulting therefrom, regardless of the form of the action or the basis of the claim, whether based on breach of contract, breach of warranty, tort (including negligence, product liability or otherwise), regardless of whether TikTok has been advised of the possibility of such damages. Your only right with respect to any problems or dissatisfaction with Platform or the TikTok Research Tools is to stop using the Platform or the TikTok Research Tools.

VIII. Anti-Corruption; Export Rules

You agree to comply with all applicable laws and regulations in relation to export control, including those administered or enforced by the Bureau of Industry and Security of the U.S. Department of Commerce. You agree that you will not transfer any information or software it receives from TikTok that constitutes an export or transfer of controlled items, data or services, to include transfer to non-US persons employed by or associated with, or under contract to that party, without the authority of an export license, agreement or applicable exemption or exception.

IX. Jurisdiction Specific Terms

a. You acknowledge and agree that additional Jurisdiction Specific Terms may apply to the provision and use of the TikTok Research Tools. Where applicable, such Jurisdiction Specific Terms are incorporated into these Research Terms by reference.

b. Schedule A (EEA/UK Transfer Provisions) contains sub-schedules that set out specific local law requirements that may apply to transfers of Personal Data from the EEA and/ or the UK to an Eligible Researcher outside of the EEA and/ or the UK under these Research Terms.

c. Where and to the extent that any of the local law requirements set out in the sub-schedules to Schedule A apply, TikTok Group and/or Eligible Researcher (as applicable) must comply with them, and such local law requirements shall prevail over the provisions set out in the body of these Research Terms if and to the extent any conflict arises (unless the provisions set out in the body of these Research Terms are more protective of the Personal Data, in which event those provisions shall continue to apply).

X. Miscellaneous

1. Modification. We may modify these Research Terms at any time. Other than changes required by law, we will provide you with thirty (30) days' notice of any material changes to these Research Terms (for example by email or to your TikTok developer account). However, it remains your sole responsibility to review these Research Terms from time to time to view any such changes. The updated Research Terms will be effective as of the time of posting, or such later date as may be specified in the updated terms. Your continued access or use of the TikTok Research Tools after the modifications have become effective will be deemed your acceptance of the modified terms. You may discontinue your use of the TikTok Research Tools at any time.

2. Termination. We may modify, suspend or terminate your access to, or discontinue the availability of, any parts of the TikTok Research Tools at any time subject to our legal obligations, including, without limitation, where we determine that you have breached these Research Terms. Upon termination of these Research Terms, you must immediately cease use of any and all the TikTok Research Tools and permanently delete all TikTok Research Data.

3. Conflicts. These Research Terms apply in addition to the Incorporated Terms (as defined above). In the event of any conflict between these Research Terms and those other terms, these Research Terms shall take precedence solely with respect to your use of the TikTok Research Tools, and solely to the extent of the conflict. In the event of any conflict between these Research Terms and the Jurisdiction Specific Terms, the Jurisdiction Specific Terms shall take precedence, and solely to the extent of the conflict.

4. Governing Law. These Research Terms, its subject matter and formation, are governed by the laws of the State of California. Any disputes or proceedings (including tort claims) arising out of or relating to these Research Terms will be litigated exclusively in the United States District Court for the Central District of California. If, however, that court would lack original jurisdiction over the litigation, then the dispute will be litigated exclusively in the Superior Court of California, County of Los Angeles. The parties consent to personal jurisdiction in both courts. Each party expressly waives any right to a trial by jury in an action or proceeding brought by or against either party.

If you reside in the EEA or UK or Switzerland, these Research Terms are governed by the law of the jurisdiction in which you are a resident. If we have a dispute, we will first try and resolve it with you amicably. If we cannot resolve our dispute, you or we can go to your local courts. You can also go to the following courts: the courts of the Republic of Ireland will have non-exclusive jurisdiction over disputes with TikTok Ireland; and the courts of England & Wales will have non-exclusive jurisdiction over disputes with TikTok UK.

5. Notice. Any notice given under these Research Terms (a “Notice”) shall be in writing. TikTok may give Notices to you by email. A Notice may be sent by first class post (and air mail if overseas) or by email. Unless there is evidence that it was received earlier, a Notice is deemed given: (a) if sent by post (except airmail) two business days after posting it; (b) if sent by airmail, six business days after posting it; and (c) if sent by email, one business day after sending it (regardless of any out of office receipt notice that may be received from the recipient). All notices to TikTok shall be sent to https://www.tiktok.com/legal/report/feedback.

SCHEDULE A

EEA/UK TRANSFER PROVISIONS

This Schedule A (EEA/UK Transfer Provisions) sets out specific local law requirements that may apply to TikTok Group in respect of any transfer of Personal Data from the EEA and/ or the UK to an Eligible Researcher outside of the EEA and/ or the UK. If there is any conflict between the provisions of this Schedule A and the body of these Research Terms, Clause [IX(3)] Jurisdiction Specific Terms of this shall apply to resolve such conflict.

SCHEDULE A–1: EEA /UK

PART A–1.1: EEA/UK – DEFINITIONS

1. In this Schedule A-1, the following terms shall have the followings:

“Controller” means a natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data;

“Europe” means (i) the EEA as constituted at the time of a relevant transfer and which, as at the date on which the Research Terms take effect, being the date of the Research Terms (“Effective Date”), is comprised of the 27 Member States of the European Union, together with the three countries within the European Free Trade Association, namely Norway, Iceland and Liechtenstein and (ii) the UK;

“EU GDPR” means the General Data Protection Regulation of the European Union (Regulation 2016/679 of 27 April 2016);

“European Data Protection Legislation” means: (i) the EU GDPR; (ii) any applicable national/federal or state/provincial legislation implementing the GDPR in a member state of the EEA; (iii) the GDPR as incorporated into UK law pursuant to s.3 of the European Union (Withdrawal Act) 2018 (as amended, the "UK GDPR"); and (iv) any other applicable data protection or national/federal or state/provincial privacy legislation in force in a member state of the EEA or the UK, including where applicable, statues, decisions, guidelines, guidance notes, codes of practice, codes of conduct and data protection certification mechanisms issued from time to time by any supervisory authority or any other applicable authorities in a member state of the EEA or the UK;

"Restricted Transfer" means: (i) where the EU GDPR applies, a transfer of Personal Data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission; and (ii) where the UK GDPR applies, a transfer of Personal Data from the UK to any other country which is not based on adequacy regulations pursuant to Section 17A of the United Kingdom Data Protection Act 2018;

"Standard Contractual Clauses" means (i) where the EU GDPR applies, the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council ("EU SCCs"); and (ii) where the UK GDPR applies, standard data protection clauses adopted pursuant to or permitted under Article 46 of the UK GDPR ("UK SCCs").

2. If TikTok Ireland and/or TikTok UK are parties to the Research Terms then, to the extent that Personal Data relating to users of TikTok's products and services are transferred to Eligible Researcher pursuant to the Research Terms, the term "TikTok Group" as used in this Schedule A-1 shall refer only to TikTok Ireland and/or TikTok UK.

3. Any other capitalized terms used but not defined in this Schedule A-1 shall have the meaning given to them in Clause I (Definitions) of the Research Terms.

PART A-1.2: EEA/UK CONTROLLER TO CONTROLLER

1. This Part A-1.2 applies whenever TikTok Group or the Eligible Researcher is established in the EEA or the UK, or otherwise subject to either GDPR (under Article 3.2 of EU GDPR) or the UK GDPR (under Article 3.2 of the UK GDPR), or the Personal Data that will be Processed relates to Data Subjects in Europe or is otherwise protected under the EU/UK GDPR.

2. Each of TikTok Group and Eligible Researcher is a Controller of Personal Data transferred by TikTok Group to Eligible Researcher for Processing under the Research Terms. Each shall in relation to such Personal Data comply with European Data Protection Legislation in full, including (i) by providing transparency to Data Subjects about such transfer and Processing; (ii) having a lawful basis for such transfer or (as the case may be) Processing; and (iii) responding in accordance with European Data Protection Legislation to any assertion of Data Subject rights made against it.

3. If Eligible Researcher wishes to appoint a third party to Process Personal Data received from TikTok Group for the purposes of the Agreement, Eligible Researcher shall ensure that the third party complies with European Data Protection Legislation and the requirements of the Research Terms (including this Schedule A-1).

4. The parties agree that when the transfer of the Personal Data from TikTok Group to Eligible Researcher is a Restricted Transfer it shall be subject to the appropriate Standard Contractual Clauses as follows:

4.1. In relation to Personal Data that is protected by the EU GDPR, the EU SCCs will apply completed as follows: Module One will apply; in Clause 7, the optional docking Clause will apply; in Clause 11, the optional language will not apply; in Clause 17 (Option 1), the EU SCCs will be governed by the law of Ireland; in Clause 18(b), disputes shall be resolved before the courts of Ireland; in Annex I: with the information set out in Schedule B to these Research Terms; Annex II: with the technical and organizational security measures as set out in Schedule C to these Research Terms.

4.2 In relation to Personal Data that is protected by the UK GDPR, the UK SCCs will apply completed as follows: For so long as it is lawfully permitted to rely on the Standard Contractual Clauses for the transfer of Personal Data to Controllers set out in the European Commission's Decision 2004/915/EC of 27 December 2004 (“Prior C2C SCCs”) for transfers of Personal Data from the United Kingdom, the Prior C2C SCCs shall apply between the transferring Data Exporter and the Data Importer on the following basis: TikTok Group shall be the “Data Exporter” and Eligible Researcher shall be the “Data Importer”; Annex B: with the information set out in Schedule B to these Research Terms; in Clause II(h)(iii) of the Prior C2C SCCs, the words “option (iii)” to be inserted after the words “Data importer to indicate which option it selects:”, and the words “initials deemed inserted” to be inserted after the words “Initials of data importer:”, at Clause II(h)(iii) of the Prior C2C SCCs; and the optional illustrative indemnification Clause will not apply. Where sub-clause 4.2(a) above does not apply, but TikTok Group and Eligible Researcher are lawfully permitted to rely on the EU SCCs for transfers of Personal Data from the UK subject to completion of a “UK Addendum to the EU Standard Contractual Clauses” (“UK Addendum”) issued by the Information Commissioner’s Office under s.119A(1) of the Data Protection Act 2018, then: The EU SCCs, completed as set out above in clause 4.2(a) of this Agreement shall also apply to transfers of such Personal Data, subject to sub-clause (B) below; The UK Addendum shall be deemed executed between TikTok Group and Eligible Researcher, and the EU SCCs shall be deemed amended as specified by the UK Addendum in respect of the transfer of such Personal Data. If neither sub-clause 4.2(a) nor sub-clause 4.2(b) applies, then TikTok Group and Eligible Researcher shall cooperate in good faith to implement appropriate safeguards for transfers of such Personal Data as required or permitted by the UK GDPR without undue delay.

PART A-1.3: EEA/UK SUPPLEMENTARY PROVISIONS

1. Scope of this Part of this Schedule A-1: this Part A-1.3 applies whenever Part A-1.2 applies.

2. In the event that any provision of the Research Terms contradicts, directly or indirectly, the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

3. If the parties' compliance with their European Data Protection Legislation requirements relating to international transfers of Personal Data is affected by circumstances outside of the parties' control, including if the Standard Contractual Clauses or any other legal instrument for international transfers of Personal Data is invalidated, amended or replaced, then the parties will work together in good faith to reasonably resolve such non-compliance.

4. Subject to paragraph 5, if Eligible Researcher becomes aware that any law enforcement, regulatory, judicial or governmental authority (an "Authority") wishes to obtain access to or a copy of some or all of the Personal Data, whether on a voluntary or a mandatory basis, then Eligible Researcher shall: (i) immediately notify TikTok Group of such Authority's request; (ii) inform the Authority that such requests should be made to TikTok Group (or to the relevant Controller (as applicable)) in writing; and (iii) not provide the Authority with such Personal Data unless and until authorized by TikTok Group.

5. In the event Eligible Researcher is legally prohibited from complying with paragraph 4, Eligible Researcher shall use reasonable efforts to challenge such prohibition.

6. If Eligible Researcher makes a disclosure of Personal Data to an Authority (whether with TikTok Group's authorisation or due to a mandatory legal compulsion) it shall do so only to the extent legally required.

7. Paragraphs 4 and 5 shall not apply in the event that Eligible Researcher has a reasonable and good-faith belief that urgent access is necessary to prevent an imminent risk of serious harm to any individual. In such event, Eligible Researcher shall notify TikTok Group as soon as possible following such Authority's access and provide TikTok Group with full details of the same, unless and to the extent legally prohibited from doing so.

8. Eligible Researcher shall not knowingly disclose Personal Data in a massive, disproportionate and indiscriminate manner that goes beyond what is necessary in a democratic society.

SCHEDULE B

Data Processing Description

A. LIST OF PARTIES

Data exporter(s):Name:[TikTok Group]Address:See the relevant address(es) provided in these Research TermsContact person’s name, position and contact details:Kathryn Grant, Outreach Partnership Management, <[email protected]>Activities relevant to the data transferred under these Clauses:Research of the Eligible Researcher within the scope set out in their approved Research ApplicationSignature and Date:
Data importer(s)Name:See Research ApplicationAddress: See Research ApplicationContact person’s name, position and contact details:See Research ApplicationActivities relevant to the data transferred under these Clauses:Research of the Eligible Researcher within the scope set out in their approved Research ApplicationSignature and Date:The date the Research Terms are entered into

B. DESCRIPTION OF THE TRANSFER

Categories of Data Subjects whose Personal Data is transferred:TikTok users
Categories of Personal Data transferred:The data sets detailed in the Research Application
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures:None.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis):As set out in the Research Application.
Nature and purpose(s) of the Processing:Processing for the purpose of research conducted by the Eligible Researcher within the scope of their approved Research Application
The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period:As set out in the Research Application.

C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance (e.g. in accordance with Clause 13 SCCs)Ireland's Data Protection Commission

SCHEDULE C

MINIMUM SECURITY MEASURES

These Minimum Security Measures may be changed from time to time by TikTok Group (acting reasonably) providing you with a replacement. They are to be implemented by you in relation to any Personal Data transferred under the Research Terms and supplement any other security measures and commitments required of you under the Research Terms. You will document, implement and maintain an information security program that meets the standards of best industry practice to protect such Personal Data, which will include:

I. System Entry Control

Establishing, maintaining, monitoring, and using appropriate technical, physical, administrative, and organizational safeguards consistent with the highest industry standards to secure against a Security Incident including, at a minimum:

(a) Secure user authentication protocols and system access control;

(b) Use of mature and appropriate physical security, current malware, antivirus, and security software that includes e-mail filtering and malware detection;

(d) During idle times, Eligible Researcher-issued equipment (e.g., Eligible Researcher-issued laptops) are automatically locked;

(e) Encourage use of complex passwords;

(f) Concept of least privilege, allowing only the necessary access for users to accomplish their job function. Access above requires appropriate authorisation;

(g) IT access privileges are reviewed regularly by appropriate personnel;

(h) Network monitoring services in place 24 x 7 x 365 to detect unauthorized activities;

(i) Vulnerability scanning and remediation in place;

(j) Penetration testing as appropriate;

(k) Encryption protocols applied as necessary under various circumstances.

II. Physical Access Controls

You shall take, among others, the appropriate security measures in order to establish the identity of the authorized persons and prevent unauthorized access to the premises and facilities in which the TikTok Research Data are Processed.

III. Data Access Control

You shall take technical and organizational measures in order to prevent unauthorized activities in the data Processing systems outside the scope of any granted authorisations including, at a minimum:

(a) User and administrator access to the network a role-based access rights model. Authorization model grants access rights to data only on a “need to know” basis;

(b) Administration of user rights through system administrators;

(d) Perform internal audits as required to assess high risk processes, technologies, and people;

(e) Prohibit each employee from disclosing the Personal Data to any unauthorized third party or using the Personal Data in an unauthorized manner.

(f) Where encryption of data is used, proper key lifecycle management practices are in place.

IV. Data Transfer Control

You shall take technical and organizational measures in order to ensure that Personal Data cannot be read, copied, altered, or removed by unauthorized persons under their electronic transmission or during their transport or recording on data carriers and to guarantee that it is possible to examine and establish where Personal Data are or have been transmitted by data transmission equipment including, at a minimum:

(a) Remote access (including during remote maintenance or service procedures) to the IT systems are to be via VPN tunnels, where appropriate, or other secure, encrypted connections;

(b) Encryption protocols applied as necessary under various circumstances;

(d) Appropriate destruction and disposal of documents;

(e) Physical destruction processes in place to industry standards;

(f) Secure communication session established via TLS or similar protocols across core applications/services;

(g) Encrypted certificates utilized for authentication between core web client and core web server.

V. Input Control

You shall take appropriate technical and organizational measures in order to ensure that it is subsequently possible to verify and establish via log files whether and by whom Personal Data have been entered into data Processing systems, altered, or removed.

VI. Framework Control

You shall take technical and organizational measures in order to ensure that any Personal Data transferred under the Research Terms can only be Processed for the purposes specified in the Research Terms including, at a minimum:

(a) Clear and binding internal policies contain formalized instructions for data Processing procedures;

(b) Clearly articulated contractual protections in place as appropriate in underlying contracts;

(c) Regular staff training on the proper use of the computer security system, the security backup and disaster recovery procedures, and the importance of security to ensure compliance with contractual arrangements and maintain awareness regarding data protection requirements;

(d) Secure destruction processes in place to industry standards;

(e) Periodic access reviews that monitor employee access controls;

(f) The Eligible Researcher's corporate network is separated from its user services network by means of complex segregation devices.

VII. Availability Control

You shall take technical and organizational measures in order to protect TikTok Research Data from accidental destruction or loss including, at a minimum:

(a) Appliances for the monitoring of temperature and humidity in data centers;

(b) Fire/smoke detectors and fire extinguishers or fire suppression system in data centers;

(d) Data recovery measures and emergency plan in place and regularly tested;

(e) Implementation of mature and appropriate backup methods including physical separation of the backup data and storage of data stored in a redundant archive;

(f) Use a combination of full, differential, and cumulative backups to ensure data integrity and timely restoration for core data, as appropriate;

(g) To ensure an uninterrupted supply of power to the system, redundant power supply units are built into the systems wherever possible;

(h) Integrity of stored data regularly verified using checksums;

(i) Processes in place to move data traffic away from affected area to uncompromised area in case of failure;

(j) Preventative maintenance is performed to ensure continued operability of equipment.

(k) Appropriate Denial of Service and Distributed Denial of Service technology in place to defend against network and systems based resource starvation attacks.