Data processing terms
Last updated 7 September 2026.
These terms apply when a TillProof business customer is the controller of personal data entered into its workspace and SNOW MONSTER, S.L. processes that data on the customer’s behalf. They form part of the TillProof Terms of service.
Parties and roles
Customer is the controller and SNOW MONSTER, S.L. (NIF/CIF B44654275), Carrer Nou de la Rambla 30, 1º 2ª, 08001 Barcelona, Spain is the processor for Customer Personal Data. Each party remains independently responsible for personal data it processes for its own purposes, such as TillProof account administration and billing.
Subject matter, duration and purpose
Processing covers hosting, storing, organizing, retrieving, displaying, securing, backing up, exporting and transmitting Customer Personal Data as needed to provide TillProof. It continues for the period the customer uses the service and any limited retention needed to return, delete, secure or lawfully retain the data.
Data and people concerned
Customer Personal Data may include names, work email addresses, roles, workspace membership, close notes, support content and operational records that the customer chooses to enter. Data subjects may include customer owners, managers, staff, accountants and other people whose details the customer lawfully includes. Customers should not use TillProof for special-category or highly sensitive personal data unless expressly agreed.
Documented instructions
The customer instructs TillProof to process Customer Personal Data only as necessary to provide and secure the selected service features, comply with these terms and follow documented customer actions in the product or support channels. If we believe an instruction violates applicable data-protection law, we will inform the customer unless prohibited by law.
Confidentiality and security
People authorized to process Customer Personal Data are subject to confidentiality obligations. TillProof uses measures appropriate to the service and risk, including encrypted transport, access controls and role separation, hashed credentials and sessions, tenant scoping, revision history, operational monitoring and backup/recovery controls. Security measures may evolve without materially reducing protection.
Sub-processors
The customer gives general authorization to use sub-processors needed to provide the service. Current core sub-processors include Vercel (application hosting), Neon (database infrastructure) and Resend (transactional email). We impose applicable data-protection obligations on sub-processors and remain responsible for their processing to the extent required by law. Material additions or replacements will be reflected in these terms or otherwise notified before they are used where required, giving the customer an opportunity to object on reasonable data-protection grounds.
International transfers
We process or transfer Customer Personal Data outside the EEA only on documented service instructions and in compliance with GDPR Chapter V. Where a sub-processor transfer requires safeguards, an applicable adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism must be used.
Assistance and incidents
Taking into account the nature of the processing and information available to us, we will reasonably assist the customer with data-subject requests and with obligations concerning security, breach notification, data-protection impact assessments and supervisory-authority consultation. We will notify the customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data where GDPR requires processor notification.
Return and deletion
Customers can export workspace data while they have access. On termination, the customer may request return or deletion of Customer Personal Data. We will delete or return it as applicable after the service ends unless Union or Member State law requires retention, and may retain secure backup copies only for normal backup expiry or legal requirements.
Audit and compliance information
We will make available information reasonably necessary to demonstrate compliance with these processor obligations. Audits should first use available documentation and remote evidence and must protect other customers, security and confidential information. On-site inspection is reserved for cases where documentation is insufficient and applicable law reasonably requires it.
Controller obligations
The customer determines the lawful purposes and means of its processing, gives lawful instructions, provides required notices to data subjects, handles legal bases and ensures the data it enters is adequate, relevant and limited to what is necessary.
Contact and order of precedence
Data-processing questions can be sent to seb@snowmonster.es. If these Data processing terms conflict with the general Terms of service on processing Customer Personal Data, these Data processing terms control for that subject.