Last updated: 31 August 2026
Version 1.2 Adopted by the board on 31 August 2026. This statement replaces the Privacy Statement of 7 October 2023 and the Webshop Privacy Statement of 16 April 2024.
This is a translation of the Dutch original. Where the two versions differ, the Dutch text prevails (Article 2.8 of our Terms and Conditions).
Stichting Tulpenrallye organises the Tulpenrallye and its constituent sections, runs a webshop and sends out a newsletter. For these purposes we process personal data.
This statement sets out which data we process about you, why we do so, on what legal basis, how long we keep it, with whom we share it and what rights you have. It applies to everything we do: the website www.tulpenrallye.nl including the entry system and the webshop, the newsletter, the organisation and running of the events, and the contact around them — digitally, on paper and during the event itself.
We process your data in accordance with the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act.
The controller within the meaning of the GDPR is:
Stichting Tulpenrallye Vossenlaan 22, 3735 KN Bosch en Duin, the Netherlands Chamber of Commerce number 41188732 VAT identification number NL815546531B01 Telephone +31 (0)6 20 36 17 85 or +31 (0)6 53 26 38 60 Email rallyoffice@tulpenrallye.nl (rally and general) · webshop@tulpenrallye.nl (webshop)
We are not required to appoint a data protection officer and have not done so. Privacy questions reach the Rally Office; the board bears ultimate responsibility.
Below, for each purpose, is the data we use and why we are allowed to. Retention periods are set out in Article 8.
Data: email address, encrypted password, language preference, sign-in moments.
Why: you need an account in order to enter, to change your details and to follow your entry.
Legal basis: performance of the agreement and the steps preceding it (Article 6(1)(b) GDPR).
Data: form of address, first name, initials, name prefix, surname, date of birth, nationality, occupation, address, telephone number, email address, clothing size and cut, whether this is your first time, your face photograph, the class and category chosen, your team-mate, your competition number and entry number, the choices you make in the entry form (such as accommodation, additional options, whether you bring your own helmet, and the handover location) and the terms you have accepted with the moment of acceptance.
Why: to handle your entry, to accept you or place you on the waiting list, to compile the entry list and starting order, to produce and issue rally documentation and clothing, and to correspond with you about your participation. We use your occupation and the number of previous entries when allocating classes and teams, and for the hall of fame and the anniversary listings. We also use your date of birth to establish whether you qualify for an age-related discount and whether you meet the minimum age set by the regulations.
Legal basis: performance of the agreement (Article 6(1)(b) GDPR). For the allocation of classes and teams and for composing the fields of entrants we also rely on our legitimate interest in a competitively balanced and safe event (Article 6(1)(f) GDPR).
Data: registration number and country of registration, make, model, cubic capacity, date of first registration, photograph of the car, the outcome of the RallyAuto Advies, measured exhaust noise and assessment of the liveries.
Why: a car must be eligible and must comply with the regulations. We check the registration number against the public vehicle data held by the RDW and — if you opt for it — request the RallyAuto Advies from its provider. Combined with your details, a registration number is personal data; that is why we mention it here.
Legal basis: performance of the agreement and our legitimate interest in the safety of the event and compliance with the regulations (Article 6(1)(b) and (f) GDPR).
Data: whether you eat vegetarian food, your allergies and other particulars you provide yourself, whether you are a doctor, and the telephone number of your emergency contact.
Why: we pass the number and nature of the meals to the hotels and caterers, and in the event of an incident we want to know whether someone on the route can provide medical assistance and whom we should call on your behalf. We use this data for nothing else.
Legal basis: your explicit consent (Article 9(2)(a) GDPR in conjunction with Article 6(1)(a) GDPR). See Article 5.
Data: name, the hotel arrangements and room allocation you have chosen, arrival and departure times, and your team-mate's details in so far as these are needed for the booking.
Why: to reserve rooms and to arrange the logistics of the start and finish venues.
Legal basis: performance of the agreement (Article 6(1)(b) GDPR).
Data: the email address you use for the GPS app — this may be an address other than your entry address — your competition number, and the data the app transmits during the event, including your position, your passages past controls and your times.
Why: to give you access to the app, to send you the route and the instructions, to process the timing and the controls, to calculate the results, to be able to find you if you come to a standstill or need help on the route, and to carry out speed checks.
About the speed check. The regulations provide that the organisation checks speed at specific points on the route, and that exceeding the local speed limit by more than 10% incurs penalty points. That check uses the data from the app. This is not a by-product of the timing but a purpose in its own right, which is why we mention it separately. Infringements are announced through the app and may lead to penalty points or exclusion.
We do not pass this data to the police or other enforcement authorities on our own initiative. If an authority demands it on a statutory basis, we are obliged to cooperate.
Legal basis: performance of the agreement — taking part means observing the regulations and the organisation supervising that (Article 6(1)(b) GDPR). For the safety element — knowing where a crew is if something goes wrong, and acting against excessive speed — we also rely on our legitimate interest in the safety of participants, staff and other road users (Article 6(1)(f) GDPR).
We use position data during the event, for the results and for the speed check. We do not track you outside the event, and we do not share your position with other participants except where the regulations require it.
The app is supplied by iSource BV in Leiden. It processes the data on our instructions, under a data processing agreement. iSource keeps the log files containing GPS data for no more than three months; they are then destroyed.
Data: the amount payable and the payment status, the payment references of our payment service provider, the direct debit mandate you have given with the moment of acceptance, and, for a business entry, the company name, Chamber of Commerce number, VAT number, invoice address, invoice email address, the desired reference on the invoice and a purchase order number.
Your bank account number is processed by our payment service provider and is not stored by us. We keep only a customer reference enabling the payment service provider to collect the direct debit.
Why: to collect your entry fee, to produce invoices and to keep our accounts.
Legal basis: performance of the agreement (Article 6(1)(b) GDPR) and compliance with our statutory accounting and retention obligations (Article 6(1)(c) GDPR).
Data: name, email address, telephone number, delivery address including country, the items and variants ordered, the order number, the payment status and payment references, and the consignment number and track-and-trace data.
Why: to handle your order, to deliver it, to invoice it and to deal with questions or complaints about it.
Legal basis: performance of the agreement (Article 6(1)(b) GDPR) and the statutory retention obligation for our accounts (Article 6(1)(c) GDPR).
Data: name, email address, language preference, and whether and when you subscribed or unsubscribed.
Why: to keep you informed about the Tulpenrallye.
Legal basis: your consent (Article 6(1)(a) GDPR). If you have been a participant or a customer, Article 11.7(3) of the Dutch Telecommunications Act also allows us to inform you about our own events without separate consent. In both cases every newsletter contains an unsubscribe link.
Unsubscribing from the newsletter does not mean you will no longer receive email from us about an entry you have made. Those messages belong to the agreement and we will continue to send them.
Data: name of the driver and the navigator, nationality, competition number, class, make, type and year of manufacture of the car, photograph of the car, and the result achieved.
Why: the Tulpenrallye has existed since 1949 and the results are the heart of that archive. We publish provisional and final entry lists, daily classifications and final classifications on the website, in the programme book, in the results book and in the Tulpenrallye app, and we keep those results as part of the history of the event. When a final classification is published we notify you by email or text message. The regulations also require that penalties imposed and infringements observed during the event are made known through the notice board and the app; that publication belongs to the running of the competition and is removed after the event has finished.
Legal basis: performance of the agreement — taking part in a competition means appearing in the results — and our legitimate interest in a complete and reliable sporting-historical archive (Article 6(1)(b) and (f) GDPR), also in the light of Article 89 GDPR on archiving in the public interest.
These publications are permanent. You may object to this; see Article 13. We will then weigh your interest against the interest of a complete archive and tell you what we decide.
Data: the face photograph you supply yourself, the photograph of your car, and photographs and videos taken during the event and the gatherings around it.
Why: for the entry list, the programme book, the results book, the app, the website, our social media and the reporting of the event.
Legal basis: see Article 6.
Data: technical data about your visit, including your IP address, the time, the page requested and your browser type, as recorded in the log files of our hosting provider. On forms and login attempts we use the IP address briefly to limit the number of attempts.
Why: to make the website work, to resolve faults and to counter abuse such as automated attacks.
Legal basis: our legitimate interest in a working and secure website (Article 6(1)(f) GDPR).
We do not use visitor statistics and we do not use advertising or tracking techniques. See Article 11.
Data: brief internal notes the rally office may add to an entry — for example that there has been a telephone call about a change, that a payment has been agreed separately, or that a crew needs extra support.
Why: to be able to retrieve arrangements and moments of contact, so that you do not have to explain the situation afresh each time.
Legal basis: our legitimate interest in a workable entrant administration (Article 6(1)(f) GDPR).
These notes are factual and businesslike. They form part of your data: if you request access, you will be shown them.
Data: the declaration prescribed by the regulations and signed by you, stating that you are physically and mentally fit to take part, that you know and accept the risks, and that your car is roadworthy and insured. If a member of the crew is under eighteen, it also bears the signature of his or her legal representative.
Why: the regulations require this declaration before the start. It is the evidence that you were informed and that you declared yourself able to take part. If a liability claim follows later, we need it in order to defend ourselves.
Legal basis: performance of the agreement (Article 6(1)(b) GDPR). Because the declaration contains a statement about your health, the exception for the establishment, exercise or defence of legal claims also applies (Article 9(2)(f) GDPR). That is why we keep this declaration longer than the other health data; see Article 8.
Where a law obliges us to, or where it is necessary in order to deal with a complaint, a liability claim or a dispute, we process the data required for that purpose.
Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR) and our legitimate interest in conducting a defence and establishing rights (Article 6(1)(f) GDPR).
Your allergies and other medical particulars are data concerning your health. Whether you eat vegetarian food may say something about your beliefs. These are special categories of personal data within the meaning of Article 9 GDPR. A strict regime applies to them, and we observe it:
The fact that you are a doctor is not health data about you, but we treat it with the same care, because it serves solely to organise help quickly in the event of an incident.
The photographs you supply yourself. When entering, you supply a face photograph and a photograph of the car and declare that these are royalty-free and that you consent to publication. We use those photographs for the entry list, the programme book, the results book, the app, the website and the announcement of the event. Legal basis: your consent (Article 6(1)(a) GDPR).
Photographs and videos taken during the event. A rally is a public event that is reported on. We and the photographers and videographers we engage make images of the start, the route, the finish and the gatherings, and publish them on the website, in our publications, on our social media and in the app. Legal basis: our legitimate interest in reporting on and promoting the event (Article 6(1)(f) GDPR).
You can do something about this. If you do not want a particular photograph or video of you to remain published, let us know at rallyoffice@tulpenrallye.nl. On request we remove images in which you are recognisable from our own channels, unless there is a compelling reason not to. We cannot remove anything from channels that are not ours, such as the social media of other participants or the press.
When entering, you provide data about other people: your team-mate and your emergency contact. We assume that you have told those people that you are passing their data to us and for what purpose. We ask you to do so. We use an emergency contact's data solely in order to reach that person if something happens to you during the event.
If a complaint, a liability claim or proceedings are pending, we keep the data required for that matter until it has been concluded.
The periods for health data and log files are choices made by the board; the seven-year tax retention obligation and the five-year limitation period follow from the law.
For most data: you provide it because we need it in order to perform your entry or your order. If you do not provide it, we cannot perform the agreement and the entry or the order cannot proceed. That applies, for example, to your name, your address, your date of birth, your contact details and the details of the car.
Some data is voluntary, and you may omit it without consequences:
Where a field is compulsory, this is indicated on the form.
With each of these parties we have a data processing agreement as referred to in Article 28 GDPR, recording that they use your data only on our instructions and secure it appropriately.
We do not sell your data and we do not rent it out.
Only staff and volunteers who need your data for their task, and no further. Our system works with roles: the entrant administration, the results office, the financial administration and the webmaster each see their own part. Data about your health is shielded additionally; see Article 5. Anyone exporting data, for example to produce a mailing list, is responsible for keeping that list secure and for no longer than necessary.
We store your data within the European Economic Area (EEA).
Two places on our website contain material from outside the EEA:
For these transfers we rely on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, to which both Meta and Google adhere. If that decision lapses, we will rely on the European Commission's standard contractual clauses or remove the parts of the website concerned.
A cookie is a small file that a website stores on your device. We use only cookies that are necessary to make the website work. Under Article 11.7a(3) of the Dutch Telecommunications Act no consent is required for these, which is why you see no cookie banner on our site.
We use no analytics cookies, no visitor statistics, no advertising cookies, no tracking pixels and no social media buttons that observe you. The references to our social media are ordinary links.
If you nevertheless wish to refuse or delete cookies, you can do so through your browser settings. Without the cookies above you cannot sign in and cannot enter.
We take appropriate technical and organisational measures as referred to in Article 32 GDPR. Among others:
If you believe your data is not properly secured, or you see indications of misuse, please report it at once to rallyoffice@tulpenrallye.nl. In the event of a personal data breach posing a risk to you, we report it to the Dutch Data Protection Authority within 72 hours and inform you where the law requires it.
You have the following rights. You exercise them by sending a message to rallyoffice@tulpenrallye.nl, or, for the webshop, to webshop@tulpenrallye.nl.
We respond within one month. If your request is complex, or if we have several at once, we may extend that period by two months; we will tell you within that first month if we do. We may ask you to identify yourself, so that we can be sure we are giving the data to the right person. Exercising your rights is free of charge.
Our website and our webshop are not aimed at children. For participation, a navigator must be at least sixteen years old. If a member of the crew is under eighteen, his or her legal representative must co-sign the declaration of acceptance and waiver of recourse.
If you are under sixteen, we may process your data only with the consent of your parent or guardian. If you believe we hold a child's data without that consent, please contact us; we will then erase it.
We do not take decisions about you based solely on automated processing which produce legal effects concerning you or similarly significantly affect you, as referred to in Article 22 GDPR. Decisions on acceptance, class allocation and eligibility of the car are taken by people. The RallyAuto Advies is an assessment determined by its provider; we decide ourselves what we do with it and you can always contact us about it. We do not create profiles for marketing purposes.
We may amend this statement, for example if we start doing something differently or if the law changes. The current version is always published at www.tulpenrallye.nl, with the date of the last change. Where a change is of importance to you, we will let you know through the newsletter or by email. An amendment will never conflict with the GDPR.
If you have a question about this statement or about what we do with your data, please contact the Rally Office:
Stichting Tulpenrallye — Rally Office rallyoffice@tulpenrallye.nl · +31 (0)6 20 36 17 85 or +31 (0)6 53 26 38 60 Vossenlaan 22, 3735 KN Bosch en Duin, the Netherlands
