Data Processing Addendum

The Customer is the controller and Tilligo is the processor. Each party will comply with the obligations that apply to it under applicable data-protection law, including the GDPR where applicable.

Tilligo acts as an independent controller for personal data it processes for its own account administration, billing, fraud prevention, security, legal compliance, and direct customer relationship purposes. That processing is governed by the Privacy Policy rather than this DPA.

Tilligo processes personal data only to provide, secure, support, and improve the dashboard and embeddable accessibility-preference widget; to administer accounts, subscriptions, and configured domains; and to meet the Customer’s documented instructions. Processing continues for the term of the service and the limited deletion period described below.

When the Customer enables consented widget analytics, Tilligo retains only bounded organization-level counters and estimates. Request domains and browser metadata may be examined transiently for authorization, security, rate limiting, and coarse device classification, but raw analytics events, IP addresses, user agents, page URLs, referrers, client session identifiers, and request domains are not retained in the widget analytics store. Daily and monthly temporary aggregates expire from Redis after 14 and 30 days; duplicate markers expire after 48 hours. Durable rollups remain for the service term and are deleted with the organization, subject to backups and applicable law.

• Data subjects may include the Customer’s authorized users, billing contacts, support contacts, and visitors to websites on which the Customer deploys the widget.
• Personal data may include account and contact details, organization and configuration data, billing identifiers, support correspondence, IP addresses, browser and device metadata, event, security, and diagnostic logs, and widget preference data where enabled by the Customer.
• The processing consists of collection, recording, organization, storage, retrieval, transmission, security monitoring, support, aggregation, and deletion as needed to operate the service.
• The service is not intended to process special-category personal data, payment-card details, website form contents, or information entered by visitors into customer websites. The Customer must not instruct Tilligo to process such data unless the parties first agree appropriate written safeguards.

Tilligo will process personal data only on the Customer’s documented instructions, including this DPA, the service agreement, the Customer’s configuration of the service, and reasonable written instructions consistent with the service. Tilligo may process personal data where required by applicable law and will inform the Customer of that requirement unless the law prohibits notice for important public-interest reasons.

Tilligo will notify the Customer if, in its opinion, an instruction infringes applicable data-protection law. The Customer is responsible for the lawfulness, accuracy, and means by which it collects and provides personal data, as well as for its notices, legal bases, and instructions.

Tilligo will ensure that personnel authorized to process personal data are bound by confidentiality obligations or are subject to an appropriate statutory duty of confidentiality.

Taking account of the nature of processing, the state of the art, implementation costs, and the risks to individuals, Tilligo will implement and maintain appropriate technical and organizational measures under Article 32 GDPR. These measures are designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The Customer remains responsible for the security of its accounts, authorized users, domains, and instructions.

• Encryption in transit and provider-managed encryption at rest where supported by the relevant hosting service.
• Authenticated, role-based access and least-privilege controls for production systems and customer organizations.
• Tenant, API-key, and approved-domain controls that limit access to customer configuration and widget delivery.
• Rate limiting, structured security and error logging with secret redaction, monitoring, and incident-response procedures.
• Managed backups and recovery controls, dependency and change review, and periodic testing of relevant safeguards.

The Customer gives Tilligo general written authorization to engage subprocessors. The current subprocessors and their processing roles are published on the Subprocessors page.

Tilligo will give at least 30 days’ prior notice of a new or replacement subprocessor by updating that page and, where practicable, by email or the dashboard. The Customer may object in writing on reasonable data-protection grounds within 14 days after notice. Tilligo and the Customer will work in good faith to resolve the objection. If no reasonable resolution is available, the Customer may terminate the affected service before the change takes effect, without penalty for that affected service.

Tilligo will impose written data-protection obligations on each subprocessor that are materially no less protective than those in this DPA and remains responsible for its subprocessors’ performance of those obligations.

Tilligo and its subprocessors may process personal data in the EEA, the United Kingdom, and other countries in which they or their service providers operate. Where a transfer requires a safeguard under applicable data-protection law, Tilligo will use a valid transfer mechanism, such as an adequacy decision or applicable standard contractual clauses, and supplementary measures where required. The Customer acknowledges that the service is not represented as EU-only hosting.

Taking account of the nature of processing, Tilligo will provide reasonable assistance through appropriate technical and organizational measures to help the Customer respond to requests from data subjects exercising their rights. Tilligo will promptly forward such a request to the Customer unless it is legally required to respond itself.

Tilligo will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer personal data, with a target of within 48 hours after confirmation. Tilligo will provide information reasonably available to help the Customer meet its notification obligations and will keep the Customer informed of material developments.

Taking account of the nature of processing and information available to Tilligo, Tilligo will provide reasonable assistance with data-protection impact assessments, prior consultations, and inquiries from a competent supervisory authority, to the extent required by Article 28(3) GDPR and at the Customer’s reasonable expense where the request goes beyond the ordinary service.

At the end of the service, and on the Customer’s written choice, Tilligo will return or delete Customer personal data within 30 days, unless applicable law requires retention. Data in routine backups may remain until overwritten under Tilligo’s backup cycle; it will be isolated from ordinary processing and deleted when the applicable backup is replaced, unless law requires a longer retention period.

Tilligo will make information reasonably necessary to demonstrate compliance with this DPA available to the Customer. Before requesting an audit, the Customer will use Tilligo’s written security and compliance information first. The Customer may conduct one audit in any 12-month period on reasonable prior written notice, during normal business hours, and in a manner that does not unreasonably disrupt Tilligo or expose other customers’ confidential information. More frequent or expedited audits may be permitted following a confirmed incident, a binding regulator request, or a reasonable substantiated compliance concern. Audits are at the Customer’s expense unless otherwise required by law.

If this DPA conflicts with the service agreement on the processing of personal data, this DPA controls to the extent of that conflict. Nothing in this DPA limits either party’s rights or obligations under applicable data-protection law.

Questions, instructions, objections, and requests under this DPA may be sent to legal@tilligo.app or by post to Ordinary Random Objects AB, Västermorvägen 73, 777 91 Smedjebacken, Sweden.