Lark Privacy White Paper

1Table of ContentsForeword......................................................................................................................... 3
1. Basic Principles for Personal Data Processing ................................................... 4
2. Lark’s Privacy Protection Management System .................................................. 5
2.1 Privacy Protection Organization and Personnel ........................................................ 5Compliance Team .................................................................................................................................... 5
Publicity and Training Programs on Compliance ........................................................................... 5

2.2 Life-cycle Management for Personal Data Processing ............................................. 5

Data Collection ......................................................................................................................................... 5
Data Use ..................................................................................................................................................... 5
Data Sharing ............................................................................................................................................. 6
Data Retention and Disposal ................................................................................................................ 6

2.3 Protection of Data Subject Rights ................................................................................ 62.4 Management of Data Residency and cross-border transfer..................................... 62.5 Privacy Risk Management.............................................................................................. 7Privacy Impact Assessment (PIA) ....................................................................................................... 7Risk Scanning for Security Compliance ............................................................................................ 7

2.6 Response to Data Leak Events ..................................................................................... 7
2.7 Data Security .................................................................................................................... 83. Lark’s Security and Privacy Compliance Certification ....................................... 9Conclusion ................................................................................................................... 11Version Change Record ............................................................................................. 122

Foreword
Lark Technologies Pte. Ltd (hereinafter referred to as “Lark”) provides the new generation of
corporate office services: Lark office platform, “mobile friendliness, real-time collaboration,and uniform access”, helping businesses improve work efficiency and reduce production andmanagement costs.
The Lark office platform provides powerful office collaboration services, including but notlimited to instant messaging, cloud documents, cloud storage, smart calendars, audio andvideo conferences, open platforms, mailboxes, OKR, approvals, etc., all boasting highextensibility and availability.
Lark attaches great importance to the data security of its customers and protecting theprivacy of customers' users. In the process of product design and development, Lark
adhered to the concepts of “Privacy by Design” and “Privacy by Default” and committed itself
to providing its customers with a transparent, trustworthy, secure, reliable, efficient andcollaborative office experience.
Note: For your convenience, the "customer" in this document refers to the legal person orother organization that has registered an account with Lark via an authorized natural person
to build an organizational structure and entitled management rights; the "user" refers to thenatural person who is authorized or invited by the customer to join the organizational
structure built by the customer in Lark and use the service, including the team creator andadministrator.
We would like to take this white paper as an opportunity to share with you Lark’s basic
principles and privacy management practices in this area.

31. Basic Principles for Personal Data Processing
Lark has determined its basic principles for personal data processing in accordance withapplicable laws and regulations and ensured that the following basic principles are followed
when processing personal data through appropriate management and technical measures:

§§

§
§

§
§

§

Lawfulness, Legitimacy and Transparency: Personal data should be processedlawfully, fairly and in a transparent manner.
Purpose Limitation: Personal data should be processed for a specified, clear
purpose and not further processed in a manner that is incompatible with thatpurpose.
Data Minimization: Personal data should be adequate, relevant and limited to whatis necessary in relation to the purpose for which it is processed.
Accuracy: Personal data should be accurate and kept up to date where necessary.
Reasonable measures will be taken to ensure that inaccurate personal data aredeleted or corrected in a timely manner based on the purpose of the data processing.
Storage Limitation: Personal data should not be stored for longer than necessary toachieve the purpose for which the personal data is processed.
Integrity and Confidentiality: Personal data should be processed in a manner thatensures appropriate security of the personal data, prevents unauthorized access toor modification of the personal data, and avoids damage or loss of the personal data,using appropriate technical and organizational measures.
Accountability: Records relating to data processing and privacy controls must be
maintained to demonstrate compliance with the above principles when necessary.

42. Lark’s Privacy Protection Management System
2.1 Privacy Protection Organization and Personnel
Compliance Team
Lark has a dedicated compliance team in place, which works together with multiple legal,
security and other teams in the countries and regions with its business presence, to provide
professional support for various compliance practices including privacy protection. Its
responsibilities include but are not limited to the establishment, operation and optimization ofdata compliance management systems, and the development of product-based data
compliance capabilities and solutions, etc. Lark will ensure that our product itself meets therequirements of global laws and regulations on data compliance, and provide customers with
better compliance functions and services.

Publicity and Training Programs on Compliance
Lark conducts regular training and publicity programs on compliance for all personnelthrough various forms, including general knowledge training programs based on therequirements of global laws and regulations on data compliance and special training
programs for employees in key positions, so as to enhance the awareness of all personnel
for data protection and reduce compliance risks.

2.2 Life-cycle Management for Personal Data Processing
Data Collection
Lark strictly follows the principles of lawfulness, legitimacy, transparency and data
minimization, and collects personal data necessary to provide services in an appropriatemanner and frequency. Before collecting personal data, we will disclose the type of personal
data collected, the purpose and method of collection in the Privacy Policy, and obtain theuser's consent in accordance with applicable laws and regulations. At the same time, Lark
also provides a number of privacy setting functions. Users can withdraw the consent granted
at any time through the privacy setting or by contacting the Lark team.

Data Use
Lark strictly abides by the principle of purpose limitation and will only use the collected
personal data for the purpose of use authorized by the customers and users. By default,5

Lark’s employees do not have access to the personal data mentioned above, and all
employees’ operations are strictly restricted and audited.

Data Sharing
Personal data processed by Lark is only disclosed in accordance with our Privacy Policy. Incases where Lark needs to share personal data with third parties, Lark strictly reviews thirdparties’ capabilities and qualifications for data security compliance, and uses reasonable
efforts to require third parties to protect data in accordance with its high standards.

Data Retention and Disposal
We will retain your personal data for the length of time needed to fulfill the purposes outlinedin Privacy Policy unless a longer retention period is required, for example to comply withlegal obligations or requests or for the establishment, exercise or defense of legal claims, orfor legitimate business purposes, or as provided by law.

2.3 Protection of Data Subject Rights
Lark allows users to submit data subject rights requests to customers. If the situation
requires the coordination of Lark, the customers can contact Lark through the corresponding
Customer Success Manager for assistance.
Lark has a dedicated compliance team in place to be responsible for the management andoperation of the above-mentioned channel to respond to data subject rights requests and toensure that the response is in accordance with the relevant compliance requirements.

2.4 Management of Data Residency and cross-bordertransfer
Lark has established a number of data center nodes to support compliance requirements
related to the customer’s own data residency. The following table provides information aboutdata center locations and suppliers.

CountrySupplier

Singapore

Amazon Web Services6JapanAmazon Web Services

United States of America

Amazon Web Services

Circumstances involving the cross-border transfer of personal data for Lark itself shall be
subject to strict legal and security compliance assessments. We rely on permitted legal
bases and exceptions and will comply with requirements under applicable laws, in relation
to such transfers. At the same time, Lark will also take appropriate management andtechnical measures to ensure the security of data transmission.

2.5 Privacy Risk Management
Privacy Impact Assessment (PIA)
Lark has been extensively implementing the concepts of “Privacy by Design” and “Privacy byDefault”, embedding the basic principles of privacy protection throughout the design,development and operation process of product requirements. For business functions orscenarios related to personal data processing, a privacy impact assessment shall be
conducted to assess the types of involved personal data, the purpose and method ofprocessing, and the possible impact on the rights and interests of data subjects. For theidentified medium-and high-risk items, corresponding risk rectifications shall be carried out
according to the established risk mitigation measures to reduce the privacy risk.

Risk Scanning for Security Compliance
Before and after the release of each application version of Lark, strict risk scanning for
security compliance will be conducted to identify and dispose of relevant risk items in atimely manner to ensure the security of customers’ data and privacy.
Before the release of an application version, static code scanning will be conducted on theapplication. After the release of the version, each product module will be regularly tested for
security compliance risks. For the variously identified medium-and high-risk security
vulnerabilities, privacy compliance problems, etc., they will be fixed and rectified within alimited time frame.

2.6 Response to Data Leak Events
Lark has established robust information security management and internal control related
systems and processes, and employs identification and access management, dataencryption, de-identification, security compliance scanning, Penetration Testing, security

7

information and event management platform (SIEM) and other technical means and tools toguard against potential security events.
In case of data leakage events, the security and compliance team will immediately andproperly handle the events in accordance with the relevant event management process andcontingency plans, report them to the regulators in a timely manner in accordance withapplicable laws and regulations, and notify customers, users or relevant parties that may beaffected. In addition, the events will be reviewed and summarized after they have been dealt
with, and relevant improvement measures will be taken to prevent the recurrence of similar
events.

2.7 Data Security
Lark attaches great importance to the data security of its customers and always stays
committed to the compliance philosophy of “your data is under your control” and ensuresdata security through various management and technical means.
In terms of the control process, a high-standard hierarchical classification and encryption
system for data has been put into place, and a large-scale data marking has been carriedout to ensure the effective implementation of the above system. In terms of technical means,advanced encryption technologies have been adopted, which can be used for server-side
encryption and end-to-end encryption. In terms of key management, an independent BringYour Own Key (BYOK) service and a Third-Party Key Management Service (Third-PartyKMS) are readily available.
For more information about data security practices, refer to Lark Trust Center.

8

3. Lark’s Security and Privacy Compliance Certification
Lark has secured a number of internationally recognized certifications related to security andprivacy compliance, which represent full recognition of our long-term dedication to security
compliance and privacy protection.

ISO 27001 Information Security
Management System

ISO 27701 Privacy Information
Management SystemISO 27001 is widely recognized by theindustry in the field of information
security management as aninternationally authoritative certification.
This certification indicates that Lark has
already aligned itself with international
standards in this field and met thesecurity standards required by thiscertification.

ISO 27701 is an international
authoritative certification in the field ofprivacy protection. It has taken privacy
protection practices into consideration on
the basis of the information security
management system. This certification
indicates that Lark has met the privacy
protection standards required by thiscertification.

ISO 27018 Personal Information
Protection Management System forPublic CloudISO 27017 Cloud Security
Management System

ISO 27018 is an international certification
focused on the protection of personal
information in the cloud. This certification
indicates that Lark has reachedinternational standards in terms of cloudbased data security and personal
information protection.

ISO 27017 is an international certificationin the field of information security
management of cloud services. Thiscertification indicates that Lark hasreached international standards in termsof mechanism and implementation forcloud security control.

9SOC 2 (Type Ⅱ) & SOC 3

Data Protection Trustmark (DPTM)

The SOC (System and OrganizationControls) report is an assurance reporton the internal control of an organization
issued by an independent third party
after conducting an assessment basedon the assurance standards establishedby the American Institute of Certified
Public Accountants (AICPA). The SOC 2(Type II) and SOC 3 reports indicate that
Lark complies with the principles ofsecurity, availability, confidentiality andprivacy in terms of system and internalcontrol, which are required by SOC
standards.

DPTM is a data protection trustmark
granted by the Infocomm MediaDevelopment Authority (IMDA) in
Singapore to certify companies that havedata protection measures in place todemonstrate that their data compliancepractices comply with Singapore’s
Personal Data Protection Act (PDPA).
This certification indicates that Lark has
met the personal data protection
standards required by this certification.

APEC CBPRAPEC PRP

Formulated by the Asia-Pacific Economic
Cooperation (APEC), APEC CBPR
(Cross Border Privacy Rules) serve toregulate regional arrangements for thetransmission of personal data among
APEC member countries. Thiscertification indicates that Lark has met
the personal data protection standards
required by this certification.

APEC PRP (Privacy Recognition forProcessors) certification applies to dataprocessors who demonstrate theircapabilities to assist data controllers inmeeting relevant privacy complianceobligations. This certification indicatesthat Lark has met the privacy protection
standards required by this certification.

10Conclusion
Lark respects its customers’ global IT strategy and international development needs, iswilling to make long-term investments, and provides customers with relevant capabilities
through various security compliance solutions on the basis of fully understanding customers’
demands for data security and privacy protection, to help them cope with the security
challenges resulting from the open and complicated network environment, as well as theincreasingly stringent requirements for global data compliance and privacy protection, and isopen to more in-depth cooperation in the field of security compliance.

11Version Change Record
DateVersion

Remarks

January 1st, 2023

V1.0

Initial Release12