Data Privacy

At Tiller Technologies, we are deeply committed to protecting the privacy of your clients Personal Identifiable Information (PII) as they use our Verify platform. We understand the sensitive nature of the data entrusted to us, and our data privacy practices are built on principles of transparency, accountability, and user control, aligning with stringent global regulations such as the UK General Data Protection Regulation (UK GDPR), UK Data Protection Acts 2018 and Jersey's Data Protection Law 2018.

This section of our Trust Portal details how we collect, use, store, and safeguard all data including PII data.

Is Tiller's position on data privacy clearly stated?

Tiller Technologies is deeply committed to safeguarding user privacy and personal data, a commitment detailed in our Privacy Policy, available at 'Tiller Technologies Privacy Policy'. This policy transparently outlines how Tiller collects, uses, shares, retains, and secures personal data across various interactions, whether users are Browse marketing websites, engaging directly, or utilizing the 'Verify by Tiller' service. Data collection in relation to our website is limited to basic usage information (via IP addresses analysis and cookies) Within our Verify by Tiller platform more extensive information may be captured including, identity verification details, such as full names, addresses, identity documents, facial images, and financial information, but only collected after explicit user consent is obtained. This data is primarily utilized for identity verification, fraud prevention, and financial crime prevention as part of our clients onboarding regulatory obligations.

Tiller makes a clear distinction between its roles as a data processor (for data collected via 'Verify by Tiller' service, where the requesting organization is the controller) and as data controller (for employees of clients, website visitors, and direct contacts). Personal data is shared only with selected, trusted third parties necessary for service delivery, such as identity processing service providers and sanction screening agencies, and may be shared with government bodies or law enforcement when legally required. The company enforces robust security controls and policies, requiring appropriate measures from all third-party contractors. Data is only retained for the legitimate or lawful needs of its own operation and that of its clients. Tiller upholds all user rights under GDPR, including the rights to access, rectification, erasure, restriction of processing, data portability, and objection to processing, ensuring individuals maintain control over their personal information.

How does Tiller ensure data is processed in accordance with expectations?

Tiller Technologies formalizes its commitment to data protection through a comprehensive Data Processor Agreement (DPA) that governs the processing of personal data on behalf of its clients. This DPA is included in all contracts with Tiller and in summary sets out the following. As the designated "Processor," Tiller adheres strictly to applicable data protection and privacy legislation, notably the Data Protection (Jersey) Law 2018, ensuring that all processing activities are conducted lawfully and responsibly. The primary purpose of this processing is to deliver Tiller Technologies' services, encompassing various categories of personal data as defined by the DPA, to facilitate the functionality and security of its platform. This agreement meticulously outlines Tiller's obligations, reinforcing that all personal data is handled under the strict written instructions of the client, who acts as the "Controller". Finally, Tiller also includes GDPR Standard Contractual Clauses (SCC) in its applicable contracts.

The DPA also establishes clear protocols for managing data subject rights and breach notifications. Tiller is mandated to promptly notify its clients (Controllers) of any complaints, notices, or communications related to data processing, as well as any requests received from data subjects regarding their personal data or other rights. Furthermore, Tiller provides full cooperation and assistance to clients in responding to such inquiries. To support its service delivery, Tiller utilizes a limited number of approved sub-processors, including reputable entities like Azure Services (Microsoft Ireland Operations Limited), GB Group plc, Experian Limited and IDMerit LLC, all operating under the stringent terms set forth in the DPA to maintain the highest standards of data security and privacy.

Is data transferred cross borders and is that transfer compliant with regulations?

Verify by Tiller processing and hosting is performed from a Dublin, Ireland based data centre with georedundant DR hosting from a centre in Amsterdam, Netherlands and therefore falls under EU commission regulations. Some aspects of our operations do require some limited PII data related to the individuals to be transferred to that person’s country of residency for the purposes of residential address verification. In all instances Transfer Impact Assessments (TIA) have been performed to assess any risk and ensure all parties meet EU GDPR standards and enforced by its Standard Contractual Clauses (SCC).

Some industries and jurisdictions may enforce additional restrictions such as those required by the Commission de Surveillance du Secteur Financier (CSSF), Luxembourg’s financial regulator requiring Binding Corporate Rules (BCRs) be pre-approved by the CSSF. In those situations, the client will need to determine if their operation and the services they are taking from Tiller meet the regulations they operate under. However, Tiller will always collaborate with its clients to help them meet and evidence their compliance wherever possible.

Available Supporting Data Privacy Documents

The following data privacy related supporting documentation is available via the request form below

Verify by Tiller - Data Processor Agreement - June 2024 - v1.2
TTL - ISMS-DOC-A08-2 Information Classification Procedure
TTL - ISMS-DOC-A08-9 Procedure for the Disposal of Media
TTL - ISMS-DOC-A16-1 Information Security Event Assessment Procedure
TTL - ISMS-DOC-A16-2 Information Security Incident Response Procedure
TTL - ISMS-DOC-A16-6 Incident Response Plan Data Breach
TTL - ISMS-DOC-A18-5 Privacy and Personal Data Protection Policy

Data Privacy Documentation Request Form

PreviousSecurity NextInfrastructure

Last updated 4 days ago