Privacy Policy
Last updated 25 September 2026
This privacy policy explains what personal data TulipFrame collects when you use www.tulipframe.cc, what we do with it, and what rights you have. We process personal data in line with the General Data Protection Regulation (GDPR, in Dutch: AVG) and Dutch law.
Who we are
TulipFrame is the controller for the personal data described in this policy.
- TulipFrame, operating the website www.tulipframe.cc
- Email: hello@tulipframe.nl
For any question about privacy, or to exercise your rights, email hello@tulipframe.nl.
What TulipFrame does
TulipFrame matches people who want a photoshoot with photographers in the Netherlands. You send a request through our form, we look for a suitable photographer, a quote is sent to you, and you decide whether to book. To do that, we need some information about you and your plans.
What we collect
When you send a request
The request form asks for:
- the type of shoot (service), city, date and approximate time;
- the number of people and your budget range;
- your message, with anything you choose to tell us about the shoot;
- your name and email address;
- optionally, a phone or WhatsApp number.
Along with the request, the website sends some technical and source information:
- the page on which you started your visit (landing page) and the website that referred you, if any;
- campaign (UTM) parameters from the link you used to reach us, if any.
Please don't include sensitive information (for example about health) in your message unless it is needed for the shoot — and if it is, only what is needed.
Your IP address
When you submit the form, your IP address is used briefly to protect the form against abuse and spam, for example by limiting the number of requests from one address in a short time. We do not store your IP address with your request.
When you browse the site
Our hosting provider processes technical data such as IP addresses and browser information to deliver and protect the website (see "Hosting and security" below). With your consent, we use Google Analytics to understand how the site is used (see "Analytics" below and our cookie policy).
Why we use your data, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Handling your request: finding a photographer, getting you a quote, answering questions | Request details, name, email, phone/WhatsApp if given | Taking steps at your request before entering into a contract (Art. 6(1)(b)) |
| Performing a booking you make | Request details, contact details, booking details | Performance of a contract (Art. 6(1)(b)) |
| Protecting the form and website against spam and abuse | IP address (transient), technical data | Our legitimate interest in a secure, working website (Art. 6(1)(f)) |
| Understanding which pages and campaigns bring in requests | Landing page, referrer, UTM parameters sent with your request | Our legitimate interest in understanding and improving our marketing (Art. 6(1)(f)) |
| Website analytics | Analytics cookies and usage data | Your consent (Art. 6(1)(a)) |
| Bookkeeping for bookings | Booking and invoice records | Legal obligation (Art. 6(1)(c)) |
We don't send marketing emails or newsletters unless you have separately agreed to receive them, and you can unsubscribe at any time. Replying to your request is not marketing.
Where we rely on legitimate interest, we have weighed our interest against your privacy and limited the data to what is needed. You can object at any time (see "Your rights").
How your request reaches us
There is no website database. When you submit the form, the website sends your request directly to the TulipFrame team as a message through the Telegram Bot API. We use Telegram only as an internal notification channel: you don't need a Telegram account, and we don't contact you through Telegram unless you ask us to. We then follow up with you by email, phone or WhatsApp, depending on the contact details you gave us.
Who we share your data with
- Photographers. To get you a quote, we share your request with the photographer or photographers we propose to match you with — only the information they need to quote and prepare the shoot. If you book, the photographer receives the details needed to carry out the shoot. We ask photographers to use your data only for your request or booking.
- Service providers (processors) that we use to run the website and our business:
- Cloudflare, Inc. — website hosting (Cloudflare Workers), content delivery and security;
- Telegram (Telegram Messenger Inc. / Telegram FZ-LLC) — internal notification of new requests;
- Google Ireland Ltd. / Google LLC — Google Analytics, only if you consent;
- our email and messaging providers, for corresponding with you (for example email, and WhatsApp if you choose to be contacted that way).
- Authorities, if we are legally required to.
We don't sell your personal data.
Transfers outside the European Economic Area
Some of these providers process data outside the EEA — including Telegram (whose infrastructure is operated from outside the EEA), Cloudflare and Google (in the United States). Where data is transferred to a country without an EU adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, or on the EU–US Data Privacy Framework where the recipient is certified under it. You can ask us for more information about these safeguards.
Hosting and security
The website runs on Cloudflare's network (Cloudflare Workers). Cloudflare processes technical data such as IP addresses, request headers and browser information to deliver the site and protect it against attacks, bots and abuse. If enabled, we use Cloudflare Turnstile on the request form to tell humans from bots; Turnstile processes technical signals from your browser for that purpose.
Analytics
With your consent, we use Google Analytics 4 (possibly loaded through Google Tag Manager) to measure how visitors use the website, such as which pages are visited and how people find us. Analytics is off until you accept it in the cookie banner; we use Google Consent Mode so that analytics cookies are not set without your consent. Google processes IP addresses in line with its own policies; Google Analytics 4 does not log or store IP addresses, according to Google.
You can withdraw your consent at any time through the "Cookie settings" link in the footer. Our cookie policy lists the cookies and browser storage we use.
How long we keep your data
- Requests and correspondence: deleted from our messaging channels and inboxes no later than 24 months after our last contact with you, unless you booked a shoot.
- Bookings: booking and invoice records are kept for seven years, as required by Dutch tax law (fiscale bewaarplicht).
- Analytics data: kept for the retention period configured in Google Analytics.
- Consent choice: stored in your own browser until you change it or clear your browser storage.
You can ask us to delete your request earlier (see below), unless we have to keep it by law.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectification of data that is wrong or incomplete;
- erasure of your data ("right to be forgotten");
- restriction of processing;
- data portability — receiving your data in a structured, commonly used format;
- object to processing based on our legitimate interest;
- withdraw your consent at any time, without affecting processing before the withdrawal.
To exercise any of these rights, email hello@tulipframe.nl. We may ask you to confirm your identity, and we will respond within one month.
If you believe we are not handling your data correctly, please tell us first so we can try to resolve it. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Security
We take appropriate measures to protect your data, such as encrypted connections (HTTPS), and access limited to the people who need it to handle your request.
Children
Our services are aimed at adults. If a shoot involves children, the request should be made by a parent or guardian.
Changes to this policy
We may update this policy when our website or services change. The date of the latest version is shown on this page. If the changes are significant, we will make that clear on the website.