Explainers
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
Tillster
GDPR evidence
Take control of every channel, shape every guest interaction, and turn your restaurant data into revenue with Tillster's composable
No public evidenceTillster and GDPR
CertReports found no public GDPR evidence for Tillster as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
ExpiredInactive
as of 2 Nov 2026 · confidence 100%- Kind
- Listing
- Scope
- Tillster, Inc. provides white-label digital ordering, loyalty and customer-engagement software to restaurant brands. Tillster receives personal data from the European Union, United Kingdom and Switzerland in its capacity as a service provider (data processor) to those brands, which are the data controllers. Tillster processes the data only on the brand’s documented instructions and does not use it for its own purposes. The personal data is collected from the brand’s customers through the brand’s website and mobile app and is used to: Take and fulfil orders — create and manage customer accounts; receive, confirm and transmit orders to the restaurant; process payment through the brand’s payment provider using payment tokens; and send order confirmations and receipts. Operate loyalty and rewards programmes — record purchases, award and redeem points and offers, and show the customer their balance and history. Send communications on the brand’s behalf — order status, account and security messages, and marketing messages where the customer has consented. Provide customer support — respond to customer enquiries and resolve order, account or payment issues. Run and secure the service — authenticate users, prevent fraud and abuse, monitor performance and errors, keep audit logs, and meet PCI DSS and other security obligations. Report to the brand — produce order, loyalty and engagement reporting and analytics for the brand’s business use. Categories of data: name, contact details, account credentials, order and loyalty history, payment tokens (not full card numbers), device and usage data, and customer-support records. Tillster does not process HR data under this certification. Data is hosted in the European Union (AWS, Ireland) and accessed from the United States by Tillster personnel for support, administration and reporting. Tillster shares personal data only with sub-processors engaged to deliver the service (cloud hosting, content delivery and security, messaging, analytics, identity and support tools), each under a written contract that limits use to the purposes above, and with the brand’s own payment provider. Tillster does not sell personal data or disclose it to third parties for their own purposes. Individuals may exercise their rights by contacting the brand, or Tillster at [[email protected]]; Tillster will cooperate with the brand to respond. Tillster has elected the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 2 Nov 2026 | Tillster: Inactive | Live pagesha256 07f7691344 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Tillster GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 18 Sep 2026First indexed by CertReports2 evidence rows across 1 framework entered the index.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Travel and hospitality category) whose GDPR row is verified or vendor-stated, ranked by similarity.
Revinate
Travel and hospitality
We power 950 million+ guest profiles and $17.2 billion in direct revenue for over 12,500 hotels
Mews Systems
Travel and hospitality
Mews is a cloud-based hospitality management software trusted by 15,000+ properties to automate operations, boost revenue & power the guest
Understand GDPR evidence
All articlesHow-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read