Privacy policy.

This policy explains how Max Rive Photography B.V. handles personal information when you visit our website, contact us, book a photo tour or buy a digital product or print. We are the controller responsible for the uses described here.

This policy covers our own services. Other providers may also be responsible for information they process independently, as explained below.

What we collect depends on how you use our services. It can include:

• Contact and account details: your name, email, phone number, address, account information and messages.
• Orders and payments: what you book or buy, billing details, payment status, transaction references and refund records. Payment providers or banks handle the payment details needed for your chosen method.
• Tour information: date of birth, gender if supplied, room preferences, travel insurance details, photography experience, guidance preferences and any website or social profile you choose to share.
• Health, dietary and emergency information: relevant medical conditions, medication, allergies, dietary needs and an emergency contact’s name, email and phone number. Section 4 explains how these details are handled.
• Website and digital access information: IP address, browser and device details, pages visited, cookie identifiers and records needed to provide downloads or video access.
• Preferences and contributions: newsletter choices, consent records, reviews, comments, photographs or other material you submit.

We receive information directly from you, through your use of our website and from providers supporting payments, orders and digital access. If someone books on your behalf or lists you as an emergency contact, they may supply your details.

We use personal information for specific purposes, with a legal basis for each use under the GDPR.

Tour health information has additional protections, explained next. Some contact and order details are needed to fulfil a booking or purchase; without them, we may be unable to provide the service. Optional marketing choices do not affect your booking.

We use your tour information to arrange accommodation, meals and personal guidance, prepare for relevant safety needs and contact someone if an emergency arises.

Medical information and allergies

Health information is specially protected. We ask for separate, explicit consent to use relevant medical details, medication information and allergies for tour preparation and support. The same care applies to dietary information that reveals health or religious information. Please share only what is relevant to your participation.

Only the guides and service providers who need particular details for the agreed purpose should receive them—for example, an allergy requirement for a caterer. You can withdraw consent by contacting us. We will discuss whether we can still safely make the arrangements you need; withdrawal does not invalidate earlier lawful use.

In a genuine emergency, necessary information may be used or shared to protect someone’s vital interests where the legal conditions are met, including when a person cannot give consent.

Emergency contacts

Please tell your emergency contact that you are sharing their details and direct them to this policy. We use those details for our legitimate interest in providing emergency support, not for marketing. They can contact us to exercise their own privacy rights.

We do not sell your personal information. We share relevant information with providers and partners where needed to run the services described in this policy:

• Website and customer services: Shopify hosts our store and supports checkout, accounts and orders. We also use tools for forms, reviews, email, website operation and support.
• Digital delivery: download and video providers support access to tutorials, presets and other included content. They may process account, access and device information.
• Payments and administration: banks, payment providers, accountants and professional advisers receive the information needed for their role.
• Tour arrangements: co-guides, accommodation providers, local operators, transport providers and caterers receive relevant details for your trip.
• Email, analytics and advertising: our website includes Mailchimp, Google and Meta integrations. Their use depends on the feature, its settings and the consent required for that use.
• Legal or emergency needs: authorities, insurers, advisers or emergency services may receive information where disclosure is legally required or otherwise lawfully necessary.

Providers working on our instructions must protect the information under appropriate arrangements. Some, including banks and certain platform services, also act as independent controllers. Shopify’s consumer privacy policy explains its independent uses.

Advertising disclosures can count as “sharing” under some privacy laws even where no money changes hands. See the cookie section for the choices that apply to tracking.

Our tours take place around the world, and some technology providers operate internationally. Your information may therefore be processed outside the European Economic Area (the EU, Iceland, Liechtenstein and Norway).

For transfers that require safeguards, we use an applicable adequacy decision or appropriate protections, such as the European Commission’s Standard Contractual Clauses and additional measures where needed. A limited transfer necessary to arrange an overseas tour may instead qualify for a specific legal exception; that does not provide a general permission to transfer all your information.

You can contact us for details of the destinations and safeguards relevant to your information, or to request a copy of applicable safeguards.

Cookies are small files stored on your device. Similar tools, such as pixels, can record visits or interactions. Cookie identifiers and browsing information can be personal data, even when they do not include your name.

Where consent is required, you can accept or refuse optional categories and later change your choice using the website’s cookie controls. Refusing optional tracking should not prevent ordinary browsing or purchasing.

Your browser can also block or remove cookies, although blocking necessary cookies may affect store features. Removing cookies can reset saved preferences. Choices may need to be repeated on another browser or device.

Cookie providers, names and lifetimes depend on the features enabled. Contact us if you cannot find the settings or would like information about a particular technology.

If you subscribe to our newsletter, we use your email and subscription preferences to send photography news, offers and tour announcements. You can unsubscribe using the link in a marketing email or by contacting us.

Booking confirmations, payment records and practical tour or purchase information are service messages. Unsubscribing from marketing does not stop these necessary communications.

If you submit a review, comment or photograph for publication, the material and the name or credit agreed with you may be visible to other visitors. We ask for permission before using identifiable participant photographs or testimonials for our own promotion. Contact us if you would like to discuss a published contribution or withdraw consent where consent is the basis for its use.

Different records serve different purposes. We keep information for the period needed for the relevant service, legal obligation or a justified dispute, then delete or anonymise it.

Orders and accounting

Core Dutch business records generally need to be kept for seven years. Some tax records have longer periods, including ten years for applicable VAT One Stop Shop records.

Accounts and digital access

For as long as needed to operate your account and honour the access included with your purchase, with required transaction records kept separately.

Tour logistics and sensitive details

Only as long as needed to prepare and run the tour and resolve relevant follow-up. Health and emergency information should be deleted when that purpose ends, unless a specific legal reason requires limited continued retention.

Enquiries and correspondence

Until the enquiry and any related follow-up are resolved, with longer retention only where needed for a booking, legal obligation or dispute.

Marketing preferences

While your subscription is active. A limited unsubscribe record may be kept to respect your choice, alongside necessary evidence of consent.

Cookie and analytics retention depends on the technology and configuration. You can ask us for the retention period that applies to a particular record.

We take appropriate technical and organisational measures to protect personal information, including limiting access to the people who need it for their work. No website or storage method can guarantee absolute security.

If a personal data breach occurs, we assess its impact and take action. Where notification is required, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. We also inform affected people without undue delay where the breach is likely to create a high risk to their rights and freedoms, subject to applicable exceptions.

Please use our contact page if you believe your information has been exposed or misused.

Depending on the circumstances, you can ask to access, correct or delete your information, restrict its use, or receive eligible data in a portable format. You can object to processing based on legitimate interests and object to direct marketing at any time. Where we rely on consent, you can withdraw it.

These rights have conditions. For example, a deletion request does not require us to erase records we must keep by law. You also have protections concerning decisions made solely by automated processing that produce legal or similarly significant effects.

Send your request through our contact page or write to the address in section 1. We may ask for proportionate information to verify your identity. Requests are normally free, and we respond without undue delay, usually within one month. For a complex request or multiple requests, the law allows up to two additional months; we will explain any extension within the first month.

We may update this policy when our services, practices or legal obligations change. The date at the top identifies the current version. Where a change requires further notice or a new consent choice, we will provide it as required.

If anything here is unclear, please get in touch. We are happy to explain how it relates to your booking, purchase or visit.