We take your privacy very seriously and we are committed to complying with applicable data protection laws in the jurisdictions where we operate. Your personal information may be processed in accordance with local legal requirements, including but not limited to data protection regulations such as the UK GDPR in the United Kingdom, the EU GDPR in the European Union, and the Privacy Act 1988 in Australia, and other relevant laws in your region.
Please read this privacy policy carefully as it contains important information about who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint.
We keep our privacy policy under regular review. This version was last updated in April 2025.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
Third-party links
This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.
Third-party apps, websites and services
If you use any third party apps, websites or services to access our services, your usage is subject to the relevant third party's terms and conditions, cookies policy, and privacy policy. For example, if you interact with us on social media, your use is subject to the terms and conditions and privacy policies of the relevant social media platform.
When we say ‘Tillo’ ‘we’ or ‘us’ in this policy, we are referring to one or some of the companies that make up the Tillo Group. The companies that currently make up the group are:
Tillo is the data controller and is responsible for certain personal data about you that we collect and use as a consequence of:
We may also act as processor of some consumers’ or end users’ (i.e. our Clients’ customers) personal data that we receive from or collect on behalf of our Clients, which are acting as controllers in this case. This is so that we can provide our services to our Clients, and our legal obligations as a processor are instead set out in the contract between us and the relevant controller and the relevant privacy obligations applied.
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
Job applicants
Representatives of our Clients
Representatives of our Suppliers and Buyers
Website users
If you apply for a job vacancy via our Careers website, you can optionally choose to fill out a survey form by answering some questions about yourself, including your gender identification, ethnicity, and sexual orientation. This information is stored separately from your application and anonymised at the point of collection by Ashby, Inc. As such, Tillo is unable to link your survey answers to you as an individual; consequently, such data does not qualify as personal data.
We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data is derived from your personal data but is not considered personal data under the law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.
We do not collect any “Special Categories” of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
We collect and use this personal data for the purposes described in the section ‘how and why we use your personal data’ below. If you do not provide personal data we ask for, it may delay or prevent us from providing products to you or your organisation.
We collect some of this personal data directly from you in person (for example, by telephone, email and/or via our forms hosted on the Tillo website). However, we may also collect information from:
Under data protection law, we can only use your personal data if we have a lawful basis, such as for our legitimate interests or those of a third party, where you have given consent, or to comply with our legal and regulatory obligations.
A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests.
The table below explains how and why we use your personal data.
What we use your personal data for |
Lawful basis/bases |
Types of data |
To register your organisation as a new Customer, Buyer or Brand. |
Necessary for our legitimate interests (to operate our business). |
Identity Data |
To process your organisation’s order as a Customer, Buyer or Brand and deliver our service, which may include providing a demo, or a report or various workshops and events organised by us. |
Necessary for our legitimate interests (operate our business). |
Identity Data |
To engage your organisation as a Supplier to provide services to us. |
Necessary for our legitimate interests (operate our business). |
Identity Data |
To manage our relationship with you and with your organisation (for Clients, Buyers and Suppliers) and to develop, enhance and improve our business. |
Necessary for our legitimate interests (to keep our records updated and to study how customers use our products). |
Identity Data |
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance,support, reporting and hosting of data). |
Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise). |
Identity Data |
If you’ve applied for a role with Tillo that’s advertised on our Careers website, to progress your application throughout the recruitment process and liaise with you on the progress of your application. |
For our legitimate interests, i.e. to recruit staff for our business. |
Identity Data |
To deliver relevant website content to your organisation and to carry out marketing to your organisation and to make recommendations about goods or services that may be of interest to your organisation. |
For our legitimate interest, i.e. to develop and grow our business. |
Identity Data |
To use data analytics to improve our website, products, marketing, customer relationships and experiences. |
Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy). |
Technical Data |
Preventing and detecting fraud against you or us. |
For our legitimate interest, i.e. to minimise fraud that could be damaging for you and/or us, and to comply with our legal and regulatory obligations. |
Identity Data |
To enforce legal rights or defend or undertake legal proceedings, or to provide information required relating to audits, enquiries or investigations by regulatory bodies. |
To comply with our legal and regulatory obligations; |
Identity Data |
Operational reasons, such as improving efficiency, training quality control and security of our website. |
For our legitimate interests, ie to be as efficient as we can so we can deliver the best service to you at the best price. |
Identity Data |
Statistical analysis to help us manage our business. |
For our legitimate interests, i.e. to be as efficient as we can so we can deliver the best service to you at the best price. |
Technical Data |
Marketing
We may use your personal data to send you marketing communications and updates about our products.
You have the right to opt out of receiving marketing communications at any time by clicking on the unsubscribe link within our emails.
We will always treat your personal data with the utmost respect and never sell it to other organisations for marketing purposes.
Cookies policy
A cookie is a small file placed on your device when you access a website. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.
Below is a list of cookies that we collect in line with the website permissions that you select.
Cookie |
Purpose |
Duration |
AnalyticsSyncHistory |
Used to store information about the time a sync with the lms_analytics cookie took place for users in the Designated Countries |
1 month |
bcookie |
LinkedIn: This is a Microsoft MSN 1st party cookie for sharing the content of the website via social media. |
1 year |
bscookie |
Used by the social networking service, LinkedIn, for tracking the use of embedded services. |
1 year |
_fbp |
Used by Meta/Facebook to deliver a series of advertisement products such as real time bidding from third party advertisers |
3 months |
_ga |
Google Analytics |
24 months |
_gid |
This cookie is set by Google Analytics. It stores and update a unique value for each page visited and is used to count and track pageviews. |
1 day |
__hstc & hubspotuk |
Marketing/Tracking |
13 months |
__hssrc & __cfruid |
Session tracking |
session |
_hp2_id.APP_ID |
Heap - User cookie (stores user_id, identity, other ids) |
13 months |
_hp2_ses_props.APP_ID |
Session properties cookie (stores timestamp and cookie domain/path) |
30 minutes |
_hp2_props.APP_ID |
Event properties cookie (stores properties set by addEventProperties API) |
13 months |
_hp2_hld.* |
Used to determine which domain a cookie can be set on (since public suffix domains block setting cookies on the top level) |
Should not persist |
_hjSessionUser_{site_id} |
User attribution |
365 days |
_hjid |
User attribution - ensures data from subsequent visits are attributed to same user ID |
365 days |
_hjFirstSeen |
Session tracking - identifies a new user’s first session |
Session |
_hjUserAttributesHash |
User attributes sent through to Hotjar Identify API that are cached |
Session |
_hjCachedUserAttributes |
Stores user attributes sent through to Hotjar Identify API whenever not in the sample - collected attributes saved following interaction with Hotjar feedback tool |
Session |
_hjViewportId |
Stores user viewport details such as size and dimensions |
Session |
_hjSession_{site_id} |
Session data |
30 minutes |
_hjSessionTooLarge |
Session data - stops collecting if session becomes too large |
Session |
_hjSessionRejected |
Session data - rejected sessions due to server overload |
Session |
_hjSessionResumed |
Session data - set when a session is reconnected to Hotjar servers after a break in connection |
Session |
_hjLocalStorageTest |
Session data - checks if Hotjar Tracking Code can use local storage, which is deleted almost immediately after it is created |
Under 100ms |
_hjIncludedInPageviewSample, _hjIncludedInSessionSample |
Session data - set to determine if a user is included in data sampling defined by pageview limit or daily session limit |
30 minutes |
_hjAbsoluteSessionInProgress |
Session data - pageview |
30 minutes |
_hjTLDTest |
Session - determines most generic cookie path to use to share cookies across subdomains where applicable |
Session |
_hjRecordingEnabled |
Session recordings |
Session |
_hjRecordingLastActivity |
Session recordings - set in session storage as opposed to cookies |
Session |
_hjClosedSurveyInvites |
Feedback tool - Set when a user interacts with a link survey invitation modal |
365 days |
_hjDonePolls |
Feedback tool - set when a user completes an on-site survey |
365 days |
_hjMinimizedPolls |
Feedback tool - set when a user minimises an on-site survey and ensures the survey stays minimised when navigating through the site |
365 days |
_hjShownFeedbackMessage |
Feedback tool - set when a user minimises a feedback widget and ensures the widget loads as minimised when navigating to another page |
365 days |
lidc |
LinkedIn: This is a Microsoft MSN 1st party cookie that ensures the proper functioning of this website. |
1 day |
li_gc |
LinkedIn: Used to store guest consent to the use of cookies for non-essential purposes |
6 months |
li_sugr |
LinkedIn: This is a Microsoft MSN 1st party cookie that ensures the proper functioning of this website. |
1 day |
__zlcmid |
Customer support widget - stores visitor ID for widget authentication |
365 days |
__zlcprivacy |
Customer support widget - store’s visitor’s decision on CookieLaw Javascript API |
365 days |
tuuid |
Marketing/Tracking |
24 months |
tuuid_lu |
Marketing/Tracking |
24 months |
Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
We routinely share personal data with:
We only allow those organisations to handle your personal data if we are satisfied they take appropriate measures to protect your personal data.
We or the third parties mentioned above occasionally also share personal data with:
International data transfers
As a global platform, we may transfer and store your information in locations outside your country of residence. By using our services, you acknowledge that your information may be transferred to jurisdictions that may have different data protection laws from your own.
In those cases we will comply with applicable laws designed to ensure the privacy of your personal data. In particular, whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
Please contact us by emailing us at privacy@tillo.io if you want further information on the specific mechanism used by us when transferring your personal data internationally.
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
Please contact us by emailing us at privacy@tillo.io if you want further information about how long we will retain your personal data.
Under certain circumstances, you have rights under data protection laws in relation to your personal data. Please see below to find out more about these rights.
You have the right to:
If you wish to exercise any of these rights please contact privacy@tillo.io.
No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
If you are located in the United Kingdom (UK), European Union (EU), or Australia and believe that your data privacy rights have been violated, you have the right to file a complaint with the appropriate regulatory authority (see below). We would, however, appreciate the chance to deal with your concerns before you approach a regulatory authority, so please contact us in the first instance:
If you have any questions about this policy or about how we handle your data, please contact our data privacy team as follows:
Email: privacy@tillo.io.