1. Roles
For the personal data a restaurant ("you") keeps in Tillmora about its guests and staff, you decide why and how it is used (controller) and Tillmora ("we") processes it for you (processor). These terms apply automatically as part of the Terms of service.
2. What we process
| Who | What | Why |
|---|---|---|
| Your guests | Names, mobile numbers, emails, delivery addresses and map pins, orders, bookings, meal bookings, allergies and notes, door photos, choices about news, payment outcomes and card's last four digits | Taking and serving orders, bookings and meals, delivery, receipts and messages, records you must keep |
| Your staff | Names, roles, PIN hashes, shifts, actions recorded in the audit, drivers' locations while delivering | Running tills and deliveries, permissions, your records |
For as long as you use Tillmora, and then as in section 10.
3. Your instructions
We process this data only to provide Tillmora as you use and set it up, and as the law requires (we tell you first where the law allows). If we think an instruction breaks data protection law, we tell you.
4. Confidentiality
Only people at Tillmora who need to, and who are bound to confidentiality, can access it, and support sees your back office only when you allow it (or in a recorded emergency).
5. Security
We protect it with encryption in transit and at rest, encrypted copies on tills, separation between restaurants, strong sign-in, least access for our team, an audit trail, and backups, as described on Security, and we keep these measures up to date.
6. Sub-processors
You allow us to use the providers on Sub-processors. We bind each to data protection duties at least as protective as these. We tell account owners by email at least 30 days before adding or replacing one; if you object on reasonable grounds and we can't resolve it, you can stop using the affected feature or end your subscription with a refund of any prepaid period not used.
7. Helping you
Tillmora gives you the tools to answer guests' requests yourself: find, export, correct and erase a guest (Guests › Erase guest), and download all your data (Settings › Your data). If a guest contacts us about your records, we pass them to you. We help with data protection assessments and regulators' questions where reasonable.
8. Breaches
If we become aware of a breach affecting your data, we tell you without undue delay, with what we know, what we're doing, and what you may need to do, so you can meet your own duties.
9. Transfers
Our database is in India and some providers process data elsewhere (see Sub-processors). Where data leaves your country, we use the safeguards the law asks for, such as standard contractual clauses.
10. At the end
You can download your data at any time. After your account is closed, we keep the data for 90 days so it can be downloaded or the account restored, then delete it, except what the law requires us to keep. Backups expire on their schedule.
11. Audits
We answer reasonable written questions about how we protect your data and share summaries of our providers' security reports where they allow it. An on-site audit needs reasonable notice and is at your cost, unless a regulator requires it.
12. Order of documents
If these terms and the Terms of service differ on personal data, these terms apply.