Legal
Privacy statement
This statement explains what personal data we collect through this website, why we collect it, and the rights you have over your data.
Last updated: 21 July 2026
This privacy statement applies to the Tilia website at tilia.app (the "Website"). It explains how we handle personal data when you visit the Website, request a demo, or otherwise get in touch with us.
Personal data that we process on behalf of our customers within the Tilia platform (for example data about their guests and bookings) is governed by the separate agreement and data processing agreement we have with those customers, and not by this statement.
1. Who we are
The controller responsible for the personal data described in this statement is:
Tilia B.V., Kikkertstraat 3, 1795 AA, De Cocksdorp. Chamber of Commerce (KvK) number: 85162892. VAT number: NL863531398B01.
For any questions about this statement or your personal data, you can contact us at [email protected].
2. What personal data we collect
We collect the following categories of personal data:
- Information you provide to us: when you submit a demo request or contact form, we collect your name, business name, email address, phone number (if provided), and the content of your message.
- Technical and usage data: when you visit the Website, we automatically collect information such as your IP address, device and browser type, operating system, the pages you view, and the website you came from.
- Cookie data: information collected through cookies and similar technologies, as described in the "Cookies and analytics" section below.
3. Why we use your data and our legal bases
We process personal data for the following purposes and on the following legal bases under the GDPR:
- To respond to your demo requests and enquiries and to take steps at your request before entering into a contract (legal basis: taking steps at your request / our legitimate interest in responding to you).
- To operate, secure, maintain and improve the Website and to prevent fraud and abuse (legal basis: our legitimate interest in a safe, functioning website).
- To analyse how the Website is used, where you have consented to analytics cookies (legal basis: your consent).
- To comply with legal obligations that apply to us (legal basis: compliance with a legal obligation).
4. Cookies and analytics
We use cookies and similar technologies to make the Website work, to remember your preferences, and — with your consent — to understand how the Website is used. We use Google Analytics for the latter, which is only loaded after you consent.
We manage cookie consent through the Usercentrics consent management platform. When you first visit the Website you are asked to accept or decline non-essential cookies, and non-essential scripts are blocked until you give consent. You can withdraw or change your choice at any time via the cookie settings on the Website. Refusing non-essential cookies will not affect the core functionality of the Website.
5. Sharing your data
We do not sell your personal data. We share it only where necessary, with:
- Service providers (processors) that help us run the Website and our business, such as hosting, email and analytics providers, who process data only on our instructions.
- Advisers and authorities where we are legally required to do so, or to establish, exercise or defend legal claims.
6. International transfers
Your data is primarily processed within the European Economic Area (EEA). Where a service provider processes data outside the EEA, we ensure appropriate safeguards are in place, such as the European Commission’s Standard Contractual Clauses.
7. How long we keep your data
We keep personal data only for as long as necessary for the purposes described in this statement. Demo requests and enquiries are retained for as long as needed to handle your request and for a reasonable follow-up period, unless a longer retention period is required by law.
8. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and request a copy of it.
- Have inaccurate or incomplete data corrected.
- Request erasure of your data in certain circumstances.
- Restrict or object to our processing of your data.
- Receive your data in a portable, machine-readable format.
- Withdraw consent at any time, without affecting processing carried out before withdrawal.
9. Security
We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. No method of transmission over the internet is completely secure, but we work to protect your data using industry-standard safeguards.
10. Children
The Website is intended for businesses and is not directed at children. We do not knowingly collect personal data from children.
11. Changes to this statement
We may update this privacy statement from time to time. When we do, we will change the "Last updated" date above. We encourage you to review this statement periodically.
12. Contact and complaints
To exercise any of your rights or ask a question about this statement, contact us at [email protected].
If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or with the supervisory authority in your country of residence.