Privacy policy

Privacy statement of Stichting Tulpenrallye

Version 1.2 Adopted by the board on 31 August 2026. This statement replaces the Privacy Statement of 7 October 2023 and the Webshop Privacy Statement of 16 April 2024.

This is a translation of the Dutch original. Where the two versions differ, the Dutch text prevails (Article 2.8 of our Terms and Conditions).

1. What this statement covers

Stichting Tulpenrallye organises the Tulpenrallye and its constituent sections, runs a webshop and sends out a newsletter. For these purposes we process personal data.

This statement sets out which data we process about you, why we do so, on what legal basis, how long we keep it, with whom we share it and what rights you have. It applies to everything we do: the website www.tulpenrallye.nl including the entry system and the webshop, the newsletter, the organisation and running of the events, and the contact around them — digitally, on paper and during the event itself.

We process your data in accordance with the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act.

2. Who is responsible

The controller within the meaning of the GDPR is:

Stichting Tulpenrallye Vossenlaan 22, 3735 KN Bosch en Duin, the Netherlands Chamber of Commerce number 41188732 VAT identification number NL815546531B01 Telephone +31 (0)6 20 36 17 85 or +31 (0)6 53 26 38 60 Email rallyoffice@tulpenrallye.nl (rally and general) · webshop@tulpenrallye.nl (webshop)

We are not required to appoint a data protection officer and have not done so. Privacy questions reach the Rally Office; the board bears ultimate responsibility.

3. Whose data we process

• participants in our events: drivers and navigators, including where your entry is not yet definitive;
• people you name when entering, such as your team-mate and your emergency contact;
• customers and visitors of our webshop;
• subscribers to our newsletter;
• visitors to our website;
• contacts at partners, sponsors, hotels, suppliers and motorsport organisations;
• staff, officials, marshals and volunteers of the organisation.

4. What data we process, for what purpose, and on what legal basis

Below, for each purpose, is the data we use and why we are allowed to. Retention periods are set out in Article 8.

4.1 Your account on our website

Data: email address, encrypted password, language preference, sign-in moments.

Why: you need an account in order to enter, to change your details and to follow your entry.

Legal basis: performance of the agreement and the steps preceding it (Article 6(1)(b) GDPR).

4.2 Your entry and your participation

Data: form of address, first name, initials, name prefix, surname, date of birth, nationality, occupation, address, telephone number, email address, clothing size and cut, whether this is your first time, your face photograph, the class and category chosen, your team-mate, your competition number and entry number, the choices you make in the entry form (such as accommodation, additional options, whether you bring your own helmet, and the handover location) and the terms you have accepted with the moment of acceptance.

Why: to handle your entry, to accept you or place you on the waiting list, to compile the entry list and starting order, to produce and issue rally documentation and clothing, and to correspond with you about your participation. We use your occupation and the number of previous entries when allocating classes and teams, and for the hall of fame and the anniversary listings. We also use your date of birth to establish whether you qualify for an age-related discount and whether you meet the minimum age set by the regulations.

Legal basis: performance of the agreement (Article 6(1)(b) GDPR). For the allocation of classes and teams and for composing the fields of entrants we also rely on our legitimate interest in a competitively balanced and safe event (Article 6(1)(f) GDPR).

4.3 The car you compete in

Data: registration number and country of registration, make, model, cubic capacity, date of first registration, photograph of the car, the outcome of the RallyAuto Advies, measured exhaust noise and assessment of the liveries.

Why: a car must be eligible and must comply with the regulations. We check the registration number against the public vehicle data held by the RDW and — if you opt for it — request the RallyAuto Advies from its provider. Combined with your details, a registration number is personal data; that is why we mention it here.

Legal basis: performance of the agreement and our legitimate interest in the safety of the event and compliance with the regulations (Article 6(1)(b) and (f) GDPR).

4.4 Catering, medical assistance and safety during the event

Data: whether you eat vegetarian food, your allergies and other particulars you provide yourself, whether you are a doctor, and the telephone number of your emergency contact.

Why: we pass the number and nature of the meals to the hotels and caterers, and in the event of an incident we want to know whether someone on the route can provide medical assistance and whom we should call on your behalf. We use this data for nothing else.

Legal basis: your explicit consent (Article 9(2)(a) GDPR in conjunction with Article 6(1)(a) GDPR). See Article 5.

4.5 Accommodation and logistics

Data: name, the hotel arrangements and room allocation you have chosen, arrival and departure times, and your team-mate's details in so far as these are needed for the booking.

Why: to reserve rooms and to arrange the logistics of the start and finish venues.

Legal basis: performance of the agreement (Article 6(1)(b) GDPR).

4.6 The rally app and your position during the event

Data: the email address you use for the GPS app — this may be an address other than your entry address — your competition number, and the data the app transmits during the event, including your position, your passages past controls and your times.

Why: to give you access to the app, to send you the route and the instructions, to process the timing and the controls, to calculate the results, to be able to find you if you come to a standstill or need help on the route, and to carry out speed checks.

About the speed check. The regulations provide that the organisation checks speed at specific points on the route, and that exceeding the local speed limit by more than 10% incurs penalty points. That check uses the data from the app. This is not a by-product of the timing but a purpose in its own right, which is why we mention it separately. Infringements are announced through the app and may lead to penalty points or exclusion.

We do not pass this data to the police or other enforcement authorities on our own initiative. If an authority demands it on a statutory basis, we are obliged to cooperate.

Legal basis: performance of the agreement — taking part means observing the regulations and the organisation supervising that (Article 6(1)(b) GDPR). For the safety element — knowing where a crew is if something goes wrong, and acting against excessive speed — we also rely on our legitimate interest in the safety of participants, staff and other road users (Article 6(1)(f) GDPR).

We use position data during the event, for the results and for the speed check. We do not track you outside the event, and we do not share your position with other participants except where the regulations require it.

The app is supplied by iSource BV in Leiden. It processes the data on our instructions, under a data processing agreement. iSource keeps the log files containing GPS data for no more than three months; they are then destroyed.

4.7 Payment, direct debit and administration

Data: the amount payable and the payment status, the payment references of our payment service provider, the direct debit mandate you have given with the moment of acceptance, and, for a business entry, the company name, Chamber of Commerce number, VAT number, invoice address, invoice email address, the desired reference on the invoice and a purchase order number.

Your bank account number is processed by our payment service provider and is not stored by us. We keep only a customer reference enabling the payment service provider to collect the direct debit.

Why: to collect your entry fee, to produce invoices and to keep our accounts.

Legal basis: performance of the agreement (Article 6(1)(b) GDPR) and compliance with our statutory accounting and retention obligations (Article 6(1)(c) GDPR).

4.8 Your order in the webshop

Data: name, email address, telephone number, delivery address including country, the items and variants ordered, the order number, the payment status and payment references, and the consignment number and track-and-trace data.

Why: to handle your order, to deliver it, to invoice it and to deal with questions or complaints about it.

Legal basis: performance of the agreement (Article 6(1)(b) GDPR) and the statutory retention obligation for our accounts (Article 6(1)(c) GDPR).

4.9 The newsletter

Data: name, email address, language preference, and whether and when you subscribed or unsubscribed.

Why: to keep you informed about the Tulpenrallye.

Legal basis: your consent (Article 6(1)(a) GDPR). If you have been a participant or a customer, Article 11.7(3) of the Dutch Telecommunications Act also allows us to inform you about our own events without separate consent. In both cases every newsletter contains an unsubscribe link.

Unsubscribing from the newsletter does not mean you will no longer receive email from us about an entry you have made. Those messages belong to the agreement and we will continue to send them.

4.10 Results, entry lists and the historical archive

Data: name of the driver and the navigator, nationality, competition number, class, make, type and year of manufacture of the car, photograph of the car, and the result achieved.

Why: the Tulpenrallye has existed since 1949 and the results are the heart of that archive. We publish provisional and final entry lists, daily classifications and final classifications on the website, in the programme book, in the results book and in the Tulpenrallye app, and we keep those results as part of the history of the event. When a final classification is published we notify you by email or text message. The regulations also require that penalties imposed and infringements observed during the event are made known through the notice board and the app; that publication belongs to the running of the competition and is removed after the event has finished.

Legal basis: performance of the agreement — taking part in a competition means appearing in the results — and our legitimate interest in a complete and reliable sporting-historical archive (Article 6(1)(b) and (f) GDPR), also in the light of Article 89 GDPR on archiving in the public interest.

These publications are permanent. You may object to this; see Article 13. We will then weigh your interest against the interest of a complete archive and tell you what we decide.

4.11 Images

Data: the face photograph you supply yourself, the photograph of your car, and photographs and videos taken during the event and the gatherings around it.

Why: for the entry list, the programme book, the results book, the app, the website, our social media and the reporting of the event.

Legal basis: see Article 6.

4.12 The website, security and prevention of abuse

Data: technical data about your visit, including your IP address, the time, the page requested and your browser type, as recorded in the log files of our hosting provider. On forms and login attempts we use the IP address briefly to limit the number of attempts.

Why: to make the website work, to resolve faults and to counter abuse such as automated attacks.

Legal basis: our legitimate interest in a working and secure website (Article 6(1)(f) GDPR).

We do not use visitor statistics and we do not use advertising or tracking techniques. See Article 11.

4.13 Rally office notes

Data: brief internal notes the rally office may add to an entry — for example that there has been a telephone call about a change, that a payment has been agreed separately, or that a crew needs extra support.

Why: to be able to retrieve arrangements and moments of contact, so that you do not have to explain the situation afresh each time.

Legal basis: our legitimate interest in a workable entrant administration (Article 6(1)(f) GDPR).

These notes are factual and businesslike. They form part of your data: if you request access, you will be shown them.

4.14 The declaration of acceptance and waiver of recourse

Data: the declaration prescribed by the regulations and signed by you, stating that you are physically and mentally fit to take part, that you know and accept the risks, and that your car is roadworthy and insured. If a member of the crew is under eighteen, it also bears the signature of his or her legal representative.

Why: the regulations require this declaration before the start. It is the evidence that you were informed and that you declared yourself able to take part. If a liability claim follows later, we need it in order to defend ourselves.

Legal basis: performance of the agreement (Article 6(1)(b) GDPR). Because the declaration contains a statement about your health, the exception for the establishment, exercise or defence of legal claims also applies (Article 9(2)(f) GDPR). That is why we keep this declaration longer than the other health data; see Article 8.

4.15 Statutory obligations, complaints and disputes

Where a law obliges us to, or where it is necessary in order to deal with a complaint, a liability claim or a dispute, we process the data required for that purpose.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR) and our legitimate interest in conducting a defence and establishing rights (Article 6(1)(f) GDPR).

5. Data about your health and your beliefs

Your allergies and other medical particulars are data concerning your health. Whether you eat vegetarian food may say something about your beliefs. These are special categories of personal data within the meaning of Article 9 GDPR. A strict regime applies to them, and we observe it:

• You provide them voluntarily. You may leave these fields blank. Your entry will proceed as normal.
• You provide them deliberately and knowing why. Before you fill in these fields, we state what we use them for. Filling them in is your consent, and we record the moment. You may withdraw that consent at any time by clearing the field in your account or sending a message to the Rally Office. Withdrawal takes effect for the future; what we have done up to that moment remains lawful.
• They are shielded. In our system, only you and the few members of staff with an expressly granted right can see these fields. Those who may view the entry list do not see them.
• We do not pass them on with your name attached where that is not necessary. Hotels and caterers receive numbers and dietary requirements, not medical files.
• We keep them briefly. See Article 8. One exception: we keep the declaration you sign before the start for longer, because we need it if a claim follows. See Article 4.14.

The fact that you are a doctor is not health data about you, but we treat it with the same care, because it serves solely to organise help quickly in the event of an incident.

6. Images and portrait rights

The photographs you supply yourself. When entering, you supply a face photograph and a photograph of the car and declare that these are royalty-free and that you consent to publication. We use those photographs for the entry list, the programme book, the results book, the app, the website and the announcement of the event. Legal basis: your consent (Article 6(1)(a) GDPR).

Photographs and videos taken during the event. A rally is a public event that is reported on. We and the photographers and videographers we engage make images of the start, the route, the finish and the gatherings, and publish them on the website, in our publications, on our social media and in the app. Legal basis: our legitimate interest in reporting on and promoting the event (Article 6(1)(f) GDPR).

You can do something about this. If you do not want a particular photograph or video of you to remain published, let us know at rallyoffice@tulpenrallye.nl. On request we remove images in which you are recognisable from our own channels, unless there is a compelling reason not to. We cannot remove anything from channels that are not ours, such as the social media of other participants or the press.

7. Other people's data that you give us

When entering, you provide data about other people: your team-mate and your emergency contact. We assume that you have told those people that you are passing their data to us and for what purpose. We ask you to do so. We use an emergency contact's data solely in order to reach that person if something happens to you during the event.

8. How long we keep your data

• Data about your health, diet and whether you are a doctor — until no later than three months after the end of the event for which you provided it
• Your account and your personal data as a participant — until five years after your last participation or your last contact with us
• Your emergency contact's data — until no later than three months after the end of the event
• Financial and tax records, including invoices and payments — seven years, under Article 52(4) of the Dutch State Taxes Act
• Webshop orders — seven years, for the same reason
• Newsletter data — until you unsubscribe, and after that only the unsubscription itself, so that we do not approach you again
• Entry lists, results and classifications — indefinitely, as part of the historical archive of the Tulpenrallye
• Images of the event — indefinitely, as part of the archive, subject to a request as referred to in Article 6
• Website log files — no more than thirty days at our hosting provider
• GPS data from the rally app — no more than three months at iSource BV, then destroyed
• Correspondence about a complaint or dispute — until five years after conclusion, in line with the limitation period in Article 3:310 of the Dutch Civil Code
• The signed declaration of acceptance and waiver of recourse — until seven years after the event, because it is our evidence if a claim follows
• Personal injury files — until seven years after conclusion, because a claim for injury may come to light later and the ordinary absolute period does not apply to it

If a complaint, a liability claim or proceedings are pending, we keep the data required for that matter until it has been concluded.

The periods for health data and log files are choices made by the board; the seven-year tax retention obligation and the five-year limitation period follow from the law.

Do you have to provide this data?

For most data: you provide it because we need it in order to perform your entry or your order. If you do not provide it, we cannot perform the agreement and the entry or the order cannot proceed. That applies, for example, to your name, your address, your date of birth, your contact details and the details of the car.

Some data is voluntary, and you may omit it without consequences:

• your allergies, your dietary requirement and whether you are a doctor (Article 5) — without this data we simply cannot take it into account in the catering and the medical cover;
• your occupation;
• your newsletter subscription;
• an email address for the GPS app other than your entry address.

Where a field is compulsory, this is indicated on the form.

9. With whom we share your data

9.1 Parties working for us (processors)

With each of these parties we have a data processing agreement as referred to in Article 28 GDPR, recording that they use your data only on our instructions and secure it appropriately.

• Supabase — database and storage of files and photographs (where the data is held: Frankfurt, Germany)
• Vercel — hosting of the website and the entry system (where the data is held: European Union)
• Mollie — payments and direct debit (where the data is held: the Netherlands)
• Brevo — sending system email, the newsletter and text messages (where the data is held: European Union)
• Spryng — sending text messages (where the data is held: the Netherlands)
• MyParcel — creating shipping labels for the webshop (where the data is held: the Netherlands)
• iSource BV — the rally system, the Tulpenrallye app, the timing and position data during the event, and the results (where the data is held: Leiden, the Netherlands)

9.2 Other recipients

• PostNL and other carriers, for the delivery of your order. They are themselves responsible for what they do with the data.
• The hotels and venues on the route, for your reservation, the room allocation and your dietary requirements. Where the law of the country we are staying in requires it, we pass on the guest data required there.
• The provider of the RallyAuto Advies, if you use that service. We pass on the registration number for that purpose.
• The RDW, where we check the registration number against the public vehicle register.
• The KNAF, the FIA and the national motorsport authorities of the countries the event passes through, for the permit, the licence check and the official results.
• Authorities, where they request it on a statutory basis.
• Our accountant, insurer, lawyer and debt collection agency, in so far as necessary for their engagement.
• Partners and sponsors receive no entrant data, unless you have given consent yourself for a specific activity.

We do not sell your data and we do not rent it out.

9.3 Who within the organisation has access

Only staff and volunteers who need your data for their task, and no further. Our system works with roles: the entrant administration, the results office, the financial administration and the webmaster each see their own part. Data about your health is shielded additionally; see Article 5. Anyone exporting data, for example to produce a mailing list, is responsible for keeping that list secure and for no longer than necessary.

10. Transfers outside the European Economic Area

We store your data within the European Economic Area (EEA).

Two places on our website contain material from outside the EEA:

• The Instagram tiles on the home page. The images are held on Meta's content network in the United States. Your browser does not fetch them from there: our server retrieves the image and passes it on, so Meta does not receive your IP address. Meta sees only a request from our server. No entrant data is sent there.
• YouTube videos. We load these only after you click play yourself. Until that moment nothing goes to Google. As soon as you play, Google receives your IP address and information about your device. We use the youtube-nocookie.com variant, which does not place advertising cookies.

For these transfers we rely on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, to which both Meta and Google adhere. If that decision lapses, we will rely on the European Commission's standard contractual clauses or remove the parts of the website concerned.

11. Cookies and measurement data

A cookie is a small file that a website stores on your device. We use only cookies that are necessary to make the website work. Under Article 11.7a(3) of the Dutch Telecommunications Act no consent is required for these, which is why you see no cookie banner on our site.

• tr_taal — remembers whether you want the site in Dutch or English (how long: up to one year)
• wizard-sessie — keeps your entry together as you work through the steps (how long: until you complete or abandon the entry)
• payload-token — keeps you signed in to your account or to the admin panel (how long: until you sign out or the session expires)

We use no analytics cookies, no visitor statistics, no advertising cookies, no tracking pixels and no social media buttons that observe you. The references to our social media are ordinary links.

If you nevertheless wish to refuse or delete cookies, you can do so through your browser settings. Without the cookies above you cannot sign in and cannot enter.

12. How we secure your data

We take appropriate technical and organisational measures as referred to in Article 32 GDPR. Among others:

• all traffic with our website runs encrypted over HTTPS, with a strict security policy for the browser;
• passwords are stored encrypted and are readable by no one, including us;
• after a number of failed sign-in attempts an account is temporarily locked;
• access to data is arranged by role, and data about your health sits behind a separate right;
• data is held at suppliers within the EEA, under a data processing agreement;
• we limit the number of people with access and withdraw access rights when someone lays down a task.

If you believe your data is not properly secured, or you see indications of misuse, please report it at once to rallyoffice@tulpenrallye.nl. In the event of a personal data breach posing a risk to you, we report it to the Dutch Data Protection Authority within 72 hours and inform you where the law requires it.

13. Your rights

You have the following rights. You exercise them by sending a message to rallyoffice@tulpenrallye.nl, or, for the webshop, to webshop@tulpenrallye.nl.

• Access (Article 15 GDPR): you may ask which data we hold about you and what we do with it. Much of it you can see yourself in your account.
• Rectification (Article 16 GDPR): you may have inaccurate data corrected and incomplete data completed. You can change most of it yourself in your account, for as long as your entry has not been locked.
• Erasure (Article 17 GDPR): you may ask us to erase your data. We will do so, unless we still need it for a current entry, our statutory retention obligation or the historical archive; see Article 4.10.
• Restriction (Article 18 GDPR): you may ask us to suspend the use of your data temporarily, for example while we assess an objection from you.
• Objection (Article 21 GDPR): you may object to processing we base on a legitimate interest. You may object to use for direct marketing at any time and without giving reasons; we then stop immediately.
• Portability (Article 20 GDPR): you may receive the data you gave us yourself in a common digital file, or ask us to send it to another organisation.
• Withdrawal of consent (Article 7(3) GDPR): where you have given consent, you may withdraw it at any time. This takes effect for the future.
• Complaint to the supervisory authority (Article 77 GDPR): you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Postbus 93374, 2509 AJ The Hague, autoriteitpersoonsgegevens.nl. We would appreciate it if you tried with us first.

We respond within one month. If your request is complex, or if we have several at once, we may extend that period by two months; we will tell you within that first month if we do. We may ask you to identify yourself, so that we can be sure we are giving the data to the right person. Exercising your rights is free of charge.

14. Minors

Our website and our webshop are not aimed at children. For participation, a navigator must be at least sixteen years old. If a member of the crew is under eighteen, his or her legal representative must co-sign the declaration of acceptance and waiver of recourse.

If you are under sixteen, we may process your data only with the consent of your parent or guardian. If you believe we hold a child's data without that consent, please contact us; we will then erase it.

15. Automated decision-making and profiling

We do not take decisions about you based solely on automated processing which produce legal effects concerning you or similarly significantly affect you, as referred to in Article 22 GDPR. Decisions on acceptance, class allocation and eligibility of the car are taken by people. The RallyAuto Advies is an assessment determined by its provider; we decide ourselves what we do with it and you can always contact us about it. We do not create profiles for marketing purposes.

16. Changes to this statement

We may amend this statement, for example if we start doing something differently or if the law changes. The current version is always published at www.tulpenrallye.nl, with the date of the last change. Where a change is of importance to you, we will let you know through the newsletter or by email. An amendment will never conflict with the GDPR.

17. Questions

If you have a question about this statement or about what we do with your data, please contact the Rally Office:

Stichting Tulpenrallye — Rally Office rallyoffice@tulpenrallye.nl · +31 (0)6 20 36 17 85 or +31 (0)6 53 26 38 60 Vossenlaan 22, 3735 KN Bosch en Duin, the Netherlands