This policy explains what personal data Pillar2OS collects, why we collect it, how we protect it, and your rights under UK GDPR and the Data Protection Act 2018.
The data controller is Ilumis Limited, a company incorporated in England and Wales, trading as Pillar2OS. For all privacy enquiries, contact us at privacy@pillar2os.com.
Pillar2OS provides Pillar Two / GloBE tax compliance software to multinational enterprises and tax advisory firms. Most personal data we process relates to business contacts, not consumers.
| Category | What we collect | Legal basis | Purpose |
|---|---|---|---|
| Account data | Email address, name (optional), password hash (bcrypt) | Contract performance | Authentication and account management |
| Authentication tokens | JWT in a HttpOnly session cookie (token), 2FA TOTP secrets (encrypted at rest) |
Contract performance | Secure access to the platform |
| Financial / tax data | Trial balance data, jurisdictional tax figures, GIR reporting data uploaded by your organisation | Contract performance / legitimate interest | Core platform function — GloBE calculations and compliance reporting. We act as data processor for this data; your organisation is the controller. |
| Usage data | Pages visited, actions taken within the platform, error logs | Legitimate interest | Security monitoring, debugging, product improvement |
| Communication data | Email address used for transactional emails (magic links, password resets, notifications) | Contract performance | Delivering platform communications via Resend (our email sub-processor) |
| Browser preferences | UI state (collapsed panels, theme preference) stored in your browser's localStorage |
Legitimate interest | UI personalisation — stored locally in your browser only; never sent to our servers |
We use a single strictly-necessary cookie:
| Name | Type | Expiry | Purpose |
|---|---|---|---|
token |
HttpOnly, Secure, SameSite=Lax | 24 hours | Holds your JWT session credential. Set on login and cleared on logout. Cannot be read by JavaScript. |
We do not use advertising, analytics, or tracking cookies. This cookie is strictly necessary for the service to function; no consent banner is required under UK PECR.
Our marketing site (pillar2os.com) sets no cookies at all. Fonts are self-hosted; no third-party requests are made.
| Service | Purpose | Location | Safeguard |
|---|---|---|---|
| Resend | Transactional email delivery (magic links, password resets) | USA | SCCs / EU–US Data Privacy Framework |
| Database hosting | Persistent storage of all platform data | EEA / UK | Contractual DPA with hosting provider |
We do not sell personal data to third parties. We do not use any advertising networks. A full Data Processing Agreement is available on request at privacy@pillar2os.com or from our DPA page.
On account termination, personal data is deleted or anonymised within 30 days unless a longer period is required by law or your DPA.
As a data subject you have the right to:
To exercise any right, email privacy@pillar2os.com. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
Key technical measures include:
Our full security controls are published in the Security Trust Centre. Our internal Security Protocol is available to enterprise customers and procurement teams.
We will notify registered users by email of any material changes at least 30 days before they take effect. Minor updates (corrections, clarifications) will be reflected in the "Last updated" date above without separate notice.
For all data protection enquiries:
ICO registration number: available on request.