This privacy notice applies to Tilia’s website at tilia.app (the “Website”). It explains how we handle personal data when you visit the Website, request a demo or contact us in any other way.

Personal data that we process on behalf of our customers within the Tilia platform, such as data relating to their guests and bookings, is not covered by this statement. That processing is governed by the separate agreement and data processing agreement with the customer in question.

1. About us

The data controller for the personal data described in this statement is Tilia B.V., with its registered office at Kikkertstraat 3, 1795 AA De Cocksdorp, registered with the Chamber of Commerce under number 85162892, VAT number NL863531398B01.

If you have any questions about this statement or about your personal data, please contact us via [email protected].

2. What personal data we process

We process the following categories of personal data:

Information that you provide yourself. When you request a demo or fill in a contact form, we process your name, company name, email address, your telephone number (if provided) and the content of your message. Your name, company name and email address are required, as we cannot process your request without this information.
Technical specifications and usage data. When you visit the Website, we automatically process data such as your IP address, the type of device and browser you are using, your operating system, the pages you view and the website you came from.
Cookie data. Data collected via cookies and similar technologies, as described in Article 4.

3. Purposes and principles

We process personal data for the following purposes and on the following legal bases set out in the General Data Protection Regulation (GDPR):

Handling demo requests and enquiries. Legal basis: taking steps at your request prior to entering into a contract.
To ensure the Website operates correctly, to secure it, to maintain it and to improve it, and to prevent fraud and misuse. Legal basis: our legitimate interest in ensuring a secure and properly functioning website.
Analysing the use of the Website, only if you have given your consent to analytical cookies. Legal basis: your consent.
To comply with the legal obligations incumbent upon us. Legal basis: legal obligation.

We do not make any decisions about you that are based solely on automated processing, and we do not use profiling.

4. Cookies and analytics

We use cookies and similar technologies to ensure the Website functions properly, to remember your preferences and, with your consent, to gain an understanding of how the Website is used. For the latter, we use Google Analytics, which is only loaded once you have given your consent. We also use Matomo, which we host ourselves and which only starts running once you have given your consent for statistics.

Your cookie consent is managed via consentOS, our own consent management system. On your first visit to the Website, you will be asked to accept or refuse non-essential cookies. Until you give your consent, non-essential scripts will be blocked. You can change or withdraw your choice at any time via the cookie settings on the Website, where you will also find an up-to-date overview of the cookies used. Refusing non-essential cookies does not affect the basic functionality of the Website.

We do not sell your personal data. We only share it when necessary, with:

Service providers (data processors) who support us with the Website and our business operations, including Google (website analytics), Cloudflare (security and fast delivery of the Website) and our email service provider. These parties process your data solely in accordance with our instructions.
External advisers, such as accountants and lawyers, to the extent necessary for them to provide their services to us.
Government bodies and other parties, where we are legally obliged to do so, or where it is necessary to bring, exercise or defend legal claims.

6. International data transfers

The Website is hosted on servers within the European Economic Area (EEA). Visitor traffic is routed via Cloudflare, and Google processes analytics data only with your consent. These service providers may also process data outside the EEA. In such cases, we ensure appropriate safeguards are in place, such as the European Commission’s standard contractual clauses, or a decision by the European Commission recognising the level of protection as adequate.

7. How long we keep your data

We do not retain personal data for longer than is necessary for the purposes described in this statement, unless a longer retention period is required by law. Specifically, we apply the following retention periods:

Demo requests and contact messages: two years since the last contact.
Technical data (server logs): up to 30 days, after which they are deleted.

8. Your rights

Under the GDPR, you have the right to:

to access your personal data and receive a copy of it;
to have incorrect or incomplete information corrected;
to have your data deleted in certain circumstances;
to have the processing of your data restricted;
to receive your data in a commonly used, machine-readable format;
to withdraw your consent at any time. This does not affect the processing that took place prior to the withdrawal.

Right to object. Where we process your data on the basis of our legitimate interest, you may object to that processing at any time.

You can exercise these rights by sending an email to [email protected]. We will respond to your request within one month. To prevent data from falling into the wrong hands, we may ask you to confirm your identity.

9. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access.

10. Children

The Website is intended for businesses and is not aimed at children. We do not knowingly collect personal data from individuals under the age of 16.

11. Changes to this statement

We may amend this privacy notice from time to time. In that case, we will update the ‘Last updated’ date at the top of this page. We recommend that you consult this notice regularly.

12. Contact and complaints

If you have any questions about this statement or wish to exercise your rights, please contact us at [email protected].

Do you believe that we are not processing your personal data correctly? If so, you have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl), or with the supervisory authority in your country of residence. We would appreciate it if you could contact us first, so that we can work together to find a solution.

Privacy Policy