Personal Data Protection Policy
1. Purpose and scope
This is the Company's internal policy for handling personal data. It sets the rules that every member, employee, and contractor of Moore & Taylor LLC must follow when personal data is collected, stored, transferred, shared, or deleted.
It applies to all Company work, on every Company device and account, including data accessed through the TikTok Shop Partner APIs. It sits alongside the Company's Privacy Notice, which describes the same practices to the public, and the Company's Information Security Policy, which describes how data is technically protected.
Where this policy and an external obligation conflict, the stricter requirement applies.
2. Roles and responsibility
Lindsay Taylor, Member, is the Company's appointed data protection contact. She is accountable for this policy, handles all requests from individuals, owns all breach notification decisions, and is the escalation point for any question about personal data. Contact: mooreandtaylor@gmail.com.
Every member is responsible for following this policy and for raising anything that looks wrong, immediately and without fear of blame.
3. What personal data we handle
The Company handles a deliberately narrow set of data:
- Creator profile information for TikTok accounts owned or operated by the Company or its members
- Affiliate collaboration records for those accounts
- Affiliate order identifiers and associated product identifiers
- Affiliate share link data
- Commission and performance figures for those accounts
- Business contact details of people who contact the Company directly
What we do not handle
- Buyer or consumer personal information
- Payment card, bank, or financial account details
- Government identifiers
- Data belonging to creators or sellers outside the Company and its members
- Special category data of any kind
If work would require any of the above, it does not proceed until the policy owner has assessed it and this policy has been updated.
4. Collection
- Purpose limitation. Personal data is collected only for consolidating performance reporting across TikTok accounts the Company and its members operate. It is not collected for any other purpose.
- Minimization. Only the minimum API permissions needed for that purpose are requested. Scopes that are not required are not enabled, and permissions are not requested speculatively.
- Authorization. Data is only accessed for an account whose holder has authorized that access, and only for as long as that authorization remains in place.
- No covert collection. The Company does not scrape, buy, or otherwise obtain personal data outside the authorized API.
5. Storage
- Personal data is stored on Company-controlled devices located in the United States, protected by full-disk encryption.
- Credentials and access tokens are stored in the Company password manager, never in plain text files, notes, messages, or screenshots.
- Access is limited to the members of the Company, on the principle of least privilege, with multi-factor authentication required.
- Personal data is not stored on personal devices, personal accounts, or any device not covered by the Information Security Policy.
- No unencrypted backup of personal data is kept.
6. Transfer and sharing
- We do not sell, rent, license, or trade personal data. Ever, to anyone.
- Personal data is not shared with third parties. The Company uses no subcontractors or third-party data processors for this data.
- All transmission of personal data uses TLS 1.2 or above.
- Personal data is never sent over unencrypted channels, posted in shared documents, or included in support tickets.
- Before engaging any vendor who would have access to personal data, the policy owner confirms their security protections and puts a data processing agreement in place where required, and this policy is updated.
- Personal data stays in the United States. Any future transfer to another country would be assessed by the policy owner first, with an appropriate transfer mechanism in place.
7. Retention and deletion
- Affiliate performance data is retained for 24 months, to allow year-over-year comparison, and is then deleted.
- Access tokens are deleted immediately when an authorization is revoked.
- At the end of any contractual relationship, all data collected under that relationship is deleted from Company systems.
- Deletion means removal from active systems and from any copy or backup under Company control.
- Data is not retained "just in case." If there is no current purpose for holding it, it is deleted.
8. Requests from individuals
Anyone may ask what personal data the Company holds about them, ask for it to be corrected, or ask for it to be deleted, by writing to mooreandtaylor@gmail.com.
- Requests go to the policy owner immediately, whoever receives them.
- The Company responds within 30 days.
- Requests are honored regardless of where the person is located, including rights arising under the California Privacy Rights Act and other privacy laws.
- A request is never ignored, delayed for convenience, or answered with a demand for unnecessary identifying information.
9. Assisting sellers and TikTok Shop
Where a user exercises their rights through TikTok Shop or through a seller, the Company will assist in giving effect to that request. On request from TikTok Shop or a seller, the Company will provide, correct, or delete data in its possession relating to that user, and will confirm back what action was taken.
The Company will act on such requests promptly and will not require the request to be made in any particular form.
10. Breaches
Any suspected exposure of personal data is an incident and is handled under Section 13 of the Information Security Policy: reported to the policy owner immediately, contained, investigated, and notified to affected individuals, TikTok Shop, affected sellers, and relevant authorities as required by law, without undue delay.
A written record of every incident is retained.
11. Training and awareness
Every member reviews this policy when they are granted access to Company systems and at least annually. Anyone unsure whether something is permitted asks the policy owner before acting, not after.
12. Review
This policy is reviewed at least annually, and immediately whenever the Company changes what data it handles, which services it uses, or which markets it operates in. The date at the top records the current version.
Adoption
Adopted by Lindsay Taylor, Member
Moore & Taylor LLC
September 20, 2026