1. Scope and agreement
This Data Processing Agreement forms part of the Lockbah Terms of Service when a customer uses Lockbah to process personal data on behalf of its business. By using the service for that purpose, the customer and Lockbah agree to these data processing terms.
This agreement applies only to Customer Personal Data processed by Lockbah as a processor or service provider. Lockbah remains an independent controller for account administration, billing, security, legal compliance, and its own business records as described in the Privacy Policy.
2. Roles and instructions
The customer is the controller or business responsible for deciding why and how Customer Personal Data is used. Lockbah is the processor or service provider acting on the customer’s documented instructions.
The customer instructs Lockbah to process Customer Personal Data as needed to provide, secure, maintain, and support the contracted service and as otherwise documented in the Terms, this agreement, or the customer’s use of product settings.
3. Processing details
Processing continues for the customer’s subscription and any limited period needed to return, delete, secure, or lawfully retain data after the service ends.
- Subject matter and purpose: TikTok LIVE comment intake, product matching, buyer locks, receipt generation, printing, fulfilment history, support, and service security.
- Data subjects: the customer’s sellers, staff, contractors, viewers, buyers, and other people whose data the customer submits or connects to Lockbah.
- Personal data: names, usernames, viewer comments, product claims, VIP codes, order or fulfilment context, account identifiers, printer settings, and related technical records.
- Processing operations: collection, organization, matching, storage, retrieval, display, transmission to configured printing services, support access, deletion, and backup handling.
4. Customer responsibilities
The customer must process personal data lawfully, provide required notices, obtain required permissions, issue lawful instructions, and avoid submitting data that the service does not need.
The customer is responsible for responding to its data subjects and for configuring retention, access, team, TikTok, and printer settings appropriately for its business.
5. Confidentiality and security
Lockbah will ensure that people authorized to process Customer Personal Data are subject to appropriate confidentiality duties and access it only where needed for their role.
Lockbah will maintain reasonable technical and organizational safeguards appropriate to the service and risk, including access controls, encrypted transport, protected credentials, backups, logging, dependency maintenance, and procedures for security incidents.
6. Subprocessors
The customer authorizes Lockbah to use subprocessors needed to provide the service. Lockbah will require subprocessors to protect Customer Personal Data through written terms appropriate to the processing they perform.
Current subprocessors may include hosting and infrastructure providers, Paddle for billing, PrintNode for customer-configured printing, Resend or another configured email provider, and monitoring or security providers. TikTok acts under its own terms for connected platform data and optional marketing services.
Lockbah will publish material changes to its subprocessor information through this agreement, the Privacy Policy, or another reasonable notice channel. A customer with a documented data protection concern may contact Lockbah before the change takes effect.
7. Data subject requests
Taking account of the nature of the processing, Lockbah will provide reasonable assistance so the customer can respond to lawful requests for access, correction, deletion, restriction, objection, or portability where applicable.
If Lockbah receives a request concerning Customer Personal Data, it may direct the requester to the customer unless law requires Lockbah to respond directly.
8. Security incidents
Lockbah will notify the affected customer without undue delay after confirming a personal data breach involving Customer Personal Data and will provide available information reasonably needed for the customer’s assessment and notifications.
Notification does not by itself mean Lockbah accepts fault or liability. The customer remains responsible for determining whether it must notify regulators or affected people.
9. Return, deletion, and retention
On termination or a verified request, Lockbah will delete or return Customer Personal Data within a reasonable period unless law, fraud prevention, dispute handling, security, backups, or accounting obligations require limited retention.
Data retained for those purposes will remain protected and will not be used for unrelated purposes. Backup copies will be removed through the normal backup lifecycle.
10. Compliance information and audits
Lockbah will provide information reasonably necessary to demonstrate compliance with this agreement. Where that information is insufficient, the parties may agree on a proportionate audit that protects other customers, confidential information, and service security.
The customer must give reasonable notice, avoid unnecessary disruption, and bear its audit costs unless a material Lockbah breach is identified.
11. International transfers
The customer authorizes processing in countries where Lockbah and its subprocessors operate, subject to applicable transfer requirements. Where required, the parties will use an applicable transfer mechanism or supplementary contractual safeguards.
If the European Union or United Kingdom data protection rules apply, the parties will cooperate in putting appropriate standard contractual clauses or equivalent safeguards in place for restricted transfers.
12. Order of terms and contact
If this agreement conflicts with the Terms of Service on the protection of Customer Personal Data, this agreement controls for that conflict. The remaining Terms, including liability and governing law provisions, continue to apply.
Customers may contact Lockbah using the email below for data processing questions, security information, subprocessor concerns, or a signed copy of this agreement.