Privacy Policy

This Privacy Policy explains how RBM (“Company,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal information when you use the Tillit Application (the “Platform”), including our web application and related services.

This policy is intended to match the Platform’s current implementation, including passwordless sign-in, onboarding workflows, organization and group management, questionnaires, and policy acceptance tracking.

The Platform is designed for business-to-business (B2B) use in professional contexts and is operated with EU data protection requirements in mind, including the General Data Protection Regulation (“GDPR”).

1. Scope

This Privacy Policy applies to personal information processed through the Platform by:

• individual members and invited users;
• organization, group, and tenant administrators;
• respondents to configured questionnaires, including certain public test links.
  It does not apply to third-party websites, services, or policies linked from the Platform.

B2B Use and GDPR Roles

The Platform is intended for organizations and their representatives, not for public consumer use.
Depending on the context:

• Customer/tenant organizations typically act as the data controller for personal data they upload, manage, or instruct us to process in the Platform.
• We act as a data processor when processing personal data on behalf of customer/tenant organizations.
• We act as an independent data controller for limited platform-operation data, such as account security, abuse prevention, service reliability, billing/contract administration, and legal compliance.
• Where required, data processing terms are governed by contract, including a Data Processing Agreement (“DPA”).

2. Information We Collect

A. Account and profile information

When you create or use an account, we may collect:

• email address;
• first and last name;
• title, honorific, pronouns, gender, biography;
• city, state/province, country, region/subregion, operating regions;
• language and theme preferences;
• avatar/profile image (if uploaded).

B. Organization, group, and invitation information

Depending on your role and onboarding flow, we may collect:

• organization details (for example: name, acronym, website, country, email domain, logo);
• group details (for example: name, acronym, description);
• membership and role information;
• invitation records (inviter, invitee email, invite status/timestamps).

C. Questionnaire and onboarding information

The Platform supports configurable questionnaires. We may collect:

• questionnaire answers (text, select, date, number, boolean, location, and other configured field types);
• uploaded files for file-type fields (where enabled);
• response status and completion timestamps;
• assignment metadata (assignee, due date, completion state).
  For public questionnaire test links, response data may be collected without a logged-in account. File uploads are disabled in public test mode.

D. Authentication, device, and usage/security information

To secure and operate accounts, we collect:

• magic-link token metadata (tokens are stored in hashed/digested form, not plain text);
• member session data, including IP address, user agent, sign-in activity, and session revocation details;
• request metadata such as IP address and request identifiers in server logs;
• rate-limit/security event data (for example, anti-abuse and login protection events).

E. Policy acceptance records

When required policies are accepted, we store records such as:

• policy version accepted;
• acceptance timestamp;
• selected language/locale;
• IP address and user agent at acceptance time.

F. Email delivery event data

When transactional emails are sent, we may receive and store delivery lifecycle events from our email provider (for example, delivery/bounce events), which may include recipient address, provider event IDs, event details, and raw webhook payload data.

3. How We Use Information

We use personal information to:

• create and manage accounts and memberships;
• authenticate users using passwordless magic links;
• deliver transactional emails (for example, login links and invitations);
• run onboarding and profile completion flows;
• provide questionnaire functionality, including file handling where enabled;
• enforce access controls and tenant/organization/group permissions;
• maintain security, detect abuse, and prevent unauthorized access;
• maintain audit trails and operational records;
• comply with legal obligations and enforce platform policies/terms;
• monitor reliability and errors.

Data Use Statement

Use this section to document your organization-specific business purposes in plain language:
Primary business purpose: Manage membership and data collection
Internal users/teams with access: RBM Secretariat
Automated decision-making/profiling (if any): None
Human review points: User management, group management, questionnaire management
**Prohibited uses: **unrelated marketing, solicitation

4. GDPR Legal Bases (EEA/UK)

Where required, we process personal information under one or more of the following bases:

• performance of a contract (Article 6(1)(b) GDPR), including account access and core platform functionality;
• legitimate interests (Article 6(1)(f) GDPR), including platform security, abuse prevention, logging, and service reliability;
• compliance with legal obligations (Article 6(1)(c) GDPR);
• consent (Article 6(1)(a) GDPR), where legally required.
  When we act as a processor, we process personal data only on documented instructions from the relevant controller (customer/tenant organization), unless otherwise required by applicable law.

5. How We Share Information

We do not sell personal information or share it for cross-context behavioral advertising.
We may disclose personal information:

• within your tenant/workspace, to authorized admins/managers/members based on role permissions;
• to service providers that host, secure, monitor, store, or deliver service communications;
• to email delivery providers (for transactional email delivery and event processing);
• to error-monitoring providers (for production/staging reliability monitoring);
• to cloud storage providers when object storage is configured;
• current technical integrations include Mailgun (email delivery/webhook events) and Sentry (error monitoring in staging/production), and - may include Amazon S3 when cloud file storage is enabled;
• where required by law, legal process, or to protect rights, security, and integrity;
• in connection with a merger, acquisition, financing, or asset transfer.

Where required by GDPR, we put appropriate contractual safeguards in place with processors/sub-processors, including data processing terms and confidentiality/security obligations.

6. Cookies and Similar Technologies

The Platform uses essential cookies and session storage needed for authentication, security, and core functionality (for example, maintaining login state and certain in-progress flows).
We do not use advertising cookies in the current implementation.
You can control cookies through your browser settings, but disabling essential cookies may prevent parts of the Platform from functioning.

7. Data Retention

We retain personal information for as long as needed to provide the Platform, meet legal obligations, resolve disputes, and enforce agreements.
Current system-level retention and lifecycle behavior includes:

• magic link tokens expire after 15 minutes;
• expired/used login tokens are eligible for cleanup after 30 days;
• member sessions are revoked on timeout or manual/admin action;
• revoked sessions are eligible for cleanup after 180 days;
• audit/version history and operational logs may persist until deleted per administrative retention practices;
• profile, membership, questionnaire, and policy-acceptance records are generally retained while accounts/tenants remain active, unless - - deleted earlier by administrative action or legal requirement.

Actual deletion timing may depend on operational job scheduling and backup cycles.
When we act as a processor, customer/tenant organizations may define additional retention or deletion instructions under their contractual terms and applicable law.

8. Your Privacy Rights and Choices

Depending on your location and applicable law, you may have rights to:

• access personal information;
• correct inaccurate information;
• request deletion;
• request restriction or object to certain processing;
• request portability;
• withdraw consent where processing is based on consent;
• appeal certain privacy-rights decisions.

In-product controls currently include profile updates, language/theme updates, session visibility/revocation controls, and account deactivation workflows. For formal privacy requests (including deletion/access requests), contact us using the details below.
If your data is processed by us on behalf of a customer/tenant organization (acting as controller), you should generally submit your request to that organization first. We will assist controllers in fulfilling requests where required.

Authorized representatives may submit requests where permitted by law. We may need to verify identity before fulfilling requests.

9. International Data Transfers

We may process and store information in the EU and, where needed for service delivery, in other jurisdictions where we or our service providers operate. Where required, we apply appropriate safeguards for cross-border transfers, including Standard Contractual Clauses (or equivalent lawful transfer mechanisms), plus supplementary technical and organizational measures where appropriate.

10. Children’s Privacy

The Platform is not directed to children under 16, and we do not knowingly collect personal information from children under 16 through normal operation. If you believe such data has been collected, contact us so we can investigate and take appropriate action.

11. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including transport security in production, secure/HTTP-only session cookies, token hashing/digests, webhook signature verification, role-based authorization, and parameter filtering for sensitive values.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Third-Party Links and Policies

The Platform may link to third-party policy documents or external websites. We are not responsible for third-party privacy practices. Review their policies before providing information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above. Where legally required, we will provide additional notice or obtain consent for material changes.

14. Contact Us

For privacy questions or requests, contact:
Privacy contact: RBM
Data Protection Officer (if appointed): RBM
Support contact: RBM
Mailing address: Chem. du Pommier 40, 1218 Le Grand-Saconnex, Switzerland

If you are in a jurisdiction with a designated supervisory authority, you may also have the right to lodge a complaint with that authority.