Jurisdictional Scope

This Privacy Policy applies to personal data collected via this Website from individuals located in:

• European Economic Area (EU GDPR)
• United Kingdom (UK GDPR & Data Protection Act 2018)
• Japan (Act on the Protection of Personal Information (APPI))
• Singapore (Personal Data Protection Act 2012 (PDPA))
• Malaysia (Personal Data Protection Act 2010 (PDPA))
• India (Digital Personal Data Protection Act, 2023 (DPDP Act))
• Other Asia-Pacific jurisdictions

Categories of Personal Data

Tillman may collect:

Data provided voluntarily:

• Name
• Company name
• Job title
• Email address
• Telephone number
• Business inquiry details

Automatically collected data:

• IP address
• Device identifiers
• Browser type
• Log files
• Cookies and usage analytics

How We Use Personal Data

We may use personal data to:

• respond to enquiries and requests;
• communicate regarding our business, projects and services;
• evaluate potential commercial relationships;
• administer and improve the Website;
• monitor Website performance and security;
• comply with legal and regulatory obligations; and
• establish, exercise or defend legal claims where necessary.

Lawful Basis for Processing

EU & UK: Processing is based on:

• Legitimate interests
• Contractual necessity
• Compliance with legal obligations
• Consent (where required)

Japan: Personal data is processed in accordance with the Act on the Protection of Personal Information (APPI), including restrictions on cross-border transfers and third-party disclosures.

Singapore / Malaysia: Personal data is processed in accordance with the respective Personal Data Protection Act (PDPA), including consent, purpose limitation, and access rights obligations.

India: For individuals in India, personal data is processed in accordance with the Digital Personal Data Protection Act, 2023. Processing is undertaken for lawful purposes based on consent or other permitted grounds under the Act.

Cross-Border Transfers

Due to Tillman’s international operations, personal data may be transferred to, stored and processed in jurisdictions outside the country in which it was collected.

Where required under applicable law, Tillman implements appropriate safeguards for such transfers, including contractual protections and other legally recognised transfer mechanisms. Transfers are carried out in accordance with applicable data protection laws, including Chapter V of the EU GDPR, the UK GDPR, Japan's APPI, Singapore's PDPA, Malaysia's PDPA, India's DPDP Act, and other applicable legal requirements.

Security of Personal Data

Tillman maintains appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the nature of the personal data and the risks associated with processing. No method of transmission or storage is completely secure, and Tillman cannot guarantee absolute security.

Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, accounting, reporting and legitimate business requirements. When personal data is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with applicable law.

Data Subject Rights

Subject to applicable law, individuals may have the rights to:

• Access personal data
• Request correction of inaccurate or incomplete personal data
• Request deletion or erasure, where applicable
• Object to or restrict certain processing activities, where applicable
• Withdraw consent where processing is based on consent
• Request information regarding the processing of their personal data, where required by law
• Lodge a complaint with the relevant supervisory or regulatory authority

Requests may be submitted via contact information provided on this Website.