Privacy Policy

1. Introduction

TilNow Ltd ("we", "our", "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our Regulatory Intelligence platform (the "Service").

We are the data controller for the personal data we process. Our registered office is at:

• TilNow Ltd
• 5 West Victoria Dock Road
• Dundee, Scotland
• DD1 3JT, United Kingdom
• Company Number: SC900898

When we determine why and how personal data is processed, TilNow Ltd acts as data controller. Where we process personal data on behalf of a business customer under its instructions, that customer is the controller and we act as its processor; the customer's privacy notice governs that processing.

2. Legal Basis for Processing

We rely on contract where processing is necessary to create and administer your account, provide the Service, and manage your subscription. We rely on legitimate interests to secure, maintain, and improve the Service, prevent fraud and misuse, and support our business operations, provided those interests are not overridden by your rights and interests. We rely on legal obligation where processing is necessary to comply with applicable law. We rely on consent where required for optional analytics technologies or marketing, and you may withdraw consent at any time without affecting processing carried out before withdrawal.

3. Information We Collect

3.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Organization/company name (optional)
• Password credentials, stored using secure cryptographic hashing

3.2 Usage Information

When you use our Service, we automatically collect:

• Login times and IP addresses
• Pages and features accessed
• Search queries and filters applied
• Browser type and device information
• Regulatory documents viewed and downloaded

3.3 Subscription and Payment Information

For paid subscriptions:

• Billing address
• Payment method details (processed by our payment provider)
• Transaction history

Note: We do not store your complete credit card numbers. Payment processing is handled by our PCI-compliant payment providers.

3.4 Communications

If you contact us, we retain:

• Email correspondence
• Support ticket history
• Feedback and survey responses

We may also receive personal data from your employer or organisation when it creates or administers your account, from payment providers when they confirm transactions, and from service providers that support authentication, security, and customer support. The data received may include your name, business contact details, organisation, account status, and transaction or support information.

4. How We Use Your Information

We use your personal data for the following purposes:

• Service provision: To create and administer accounts, authenticate users, provide access to regulatory data, and deliver subscribed features.
• Communications: To send operational updates and security alerts, respond to enquiries, and provide customer support.
• Billing and administration: To process payments, manage subscriptions, maintain transaction records, and handle account changes.
• Service improvement: To understand how the Service is used, troubleshoot issues, test features, and improve performance and usability.
• Security and fraud prevention: To protect accounts and systems, investigate suspicious activity, and prevent fraud, misuse, and unauthorised access.
• Legal compliance: To meet legal, regulatory, tax, accounting, and record-keeping obligations and respond to lawful requests.
• Marketing: To send relevant promotional communications where permitted by law. We may rely on consent, legitimate interests, or the electronic-marketing soft opt-in, as applicable. You can opt out at any time using the unsubscribe method in the communication or by contacting us.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and secure the Service and, where you choose, to measure usage and support marketing. We provide information about these technologies and obtain consent before using non-essential cookies or similar technologies, except where an applicable legal exemption permits their use. You can change your choices using the controls described in our Cookie Policy.

• What cookies we use
• How you can control cookies
• Your choices regarding analytics and marketing cookies

6. Data Sharing and Third Parties

We do not sell your personal data. We may share your information with:

6.1 Service Providers

We engage service providers that support cloud hosting and infrastructure, authentication, email delivery, customer support, payment processing, subscription management, security monitoring, and analytics. These providers process personal data under written contracts and may use it only as instructed by us, unless they act as independent controllers for specified activities. Further information about relevant providers and their locations is available on request.

6.2 Legal Requirements

We may disclose your information if required by law, court order, or government authority, or to protect our rights, property, or safety.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the new owner, subject to the same privacy protections.

7. International Data Transfers

Your personal data is primarily stored and processed in the UK. Where we initiate a restricted transfer of personal data outside the UK, we use a lawful transfer mechanism where required, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses. Where appropriate, we also carry out a transfer risk assessment. You may contact us for further information about the safeguards used and how to obtain a copy.

8. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy:

• Account data: Retained while your account is active and for a limited period afterwards to complete closure, address queries, and maintain essential account history.
• Subscription and transaction records: Retained as needed for contractual, accounting, tax, dispute-resolution, and enforcement purposes, normally for up to six years where that period is relevant.
• Usage and security logs: Typically retained for 12–24 months to maintain security, investigate incidents, analyse performance, and improve the Service.
• Support communications: Retained for as long as needed to resolve the matter and maintain an appropriate record of the support provided.
• Marketing preferences: Retained while marketing is active, together with a minimal suppression record after you opt out so that we can respect your choice.
• Exceptions: A shorter or longer period may apply where required or permitted by law, or where reasonably necessary for legal claims, fraud prevention, or regulatory enquiries.

After the retention period, we securely delete or anonymize your data.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access: You can ask whether we process your personal data and request a copy, together with information about how it is used.
• Right to rectification: You can ask us to correct inaccurate personal data or complete information that is incomplete.
• Right to erasure: You can ask us to delete personal data in certain circumstances, subject to legal obligations and other permitted grounds for retaining it.
• Right to restrict processing: You can ask us to limit the use of your personal data in certain circumstances, for example while its accuracy is being checked.
• Right to data portability: Where processing is automated and based on consent or contract, you can request personal data you provided in a structured, commonly used, machine-readable format and, where technically feasible, ask us to transmit it to another controller.
• Right to object: You can object to processing based on legitimate interests in certain circumstances, and you can object to direct marketing at any time.
• Right to withdraw consent: Where we rely on consent, you can withdraw it at any time without affecting processing carried out before withdrawal.

To exercise any of these rights, please contact us at privacy@til-now.com.

Response Time: We normally respond to requests without undue delay and within one month. Where a request is complex or you have made several requests, we may extend this period by up to two further months. If we do so, we will tell you within one month and explain the reason for the extension. We may also need to verify your identity before fulfilling a request.

We do not currently use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects for you. If this changes, we will provide information about the logic involved, the significance and likely consequences of the processing, and the safeguards available to you.

10. Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Strong password requirements and secure hashing
• Multi-factor authentication option
• Regular security audits and vulnerability assessments
• Access controls and staff training
• Secure backup and disaster recovery procedures

While we strive to protect your data, no internet transmission is 100% secure. Please use strong passwords and keep your login credentials confidential.

11. Children's Privacy

The Service is intended for business users and is not directed at children. We do not knowingly create accounts for, or collect personal data directly from, individuals under 18. If you believe a child has provided personal data to us, please contact us so that we can investigate and take appropriate action.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date and may notify you by email or through a prominent notice on the Service.

We may ask you to acknowledge that you have been shown or have read an updated Privacy Policy, and we may retain a record of that acknowledgement. An acknowledgement does not constitute consent to processing. Where a change introduces processing for which consent is required, we will request separate consent before that processing begins. Where we change our contractual terms, we may require acceptance of the revised terms in accordance with those terms and applicable law.

We encourage you to review this policy periodically and whenever we notify you of an update.

13. Complaints and Supervisory Authority

If you have concerns about how we handle your personal data, please contact us first at privacy@til-now.com. We will investigate and respond promptly.

You also have the right to lodge a complaint with the UK supervisory authority:

• Information Commissioner's Office (ICO)
• Wycliffe House, Water Lane
• Wilmslow, Cheshire
• SK9 5AF, United Kingdom
• Helpline: 0303 123 1113
• Website: https://ico.org.uk

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Privacy/Data Protection: privacy@til-now.com
• General Inquiries: info@til-now.com
• Post: Privacy Team, TilNow Ltd, 5 West Victoria Dock Road, Dundee, DD1 3JT, United Kingdom