PRIVACY NOTICE

The controller for the personal data described here is the business trading as 99ICONS, established in the Netherlands. The contact and identification details are listed below.

Contact for privacy questions and requests: hello@99icons.com. The same address is used for general enquiries and data-subject requests; a separate privacy mailbox can be added later if the business chooses to.

We do not ask for more than we need. This website has three forms, and the data comes only from what you type into them:

• Creator application: name, email address, social handle or link, niche, location (city/country level), and an optional follower range.
• Brand brief: company/brand name, contact name, email address, a description of what you are looking for, and an optional budget indication.
• General enquiry: name, email address, an optional brand or handle reference, and your message.

Anything you volunteer inside a free-text field is also processed, so please do not include sensitive information (such as health, religion or political views) — we never need it.

We do not build advertising profiles, we do not buy personal data, and we do not ask for special categories of data.

• Reading and responding to your enquiry or application.
• Evaluating whether a working relationship between you and 99ICONS could make sense, and discussing it with you.
• Keeping the website and our mailbox secure and usable — including basic spam prevention on the forms.

We rely on the following legal bases under Article 6 GDPR:

• Steps at your request prior to a possible contract (Art. 6(1)(b)): where you approach us about representation or a campaign and the handling of your details is part of taking those pre-contractual steps.
• Legitimate interests (Art. 6(1)(f)): handling general business enquiries, keeping a short record of correspondence, and protecting the site and our systems against abuse and spam. Our interest is running a responsive, secure business; we balance it against your privacy by minimising what we store and deleting it on the schedule below.
• Consent (Art. 6(1)(a)): only where we actually ask for it. Today we do not run marketing sign-ups or non-essential tracking, so there is no consent to give and none is bundled into the forms. If that changes, consent will be asked separately, never pre-ticked, and can be withdrawn at any time.
• Legal obligation (Art. 6(1)(c)): where retention or disclosure is required by law, for example administrative obligations once a commercial relationship exists.

Submitting a form is voluntary. If you would rather not use a form, you can email us instead.

The forms deliberately ask for the smallest set of fields that lets us reply properly, and optional fields are marked as optional. Our analytics integration (Google Analytics 4) measures aggregate site usage only after your explicit opt-in consent, which you can withdraw at any time, and it is designed so that it can never receive the values you type: only technical event names. Declining keeps it fully off. See the cookies & storage page for the full current picture.

We do not sell personal data and we do not share it for others' marketing. Beyond the people at 99ICONS who need it, data may be processed by service providers acting on our instructions. Active providers are named; others are described by category while contracts are still being finalised:

• Website hosting & content delivery: Serving this website and its media files, and keeping it available and secure. [in use]
• Web font delivery (third-party stylesheet): Loading the typefaces used in the site design. Your browser requests these files directly from the provider, which means your IP address is visible to it. Provider: Google Fonts. [in use]
• Email / enquiry delivery: Delivering website form submissions to our monitored mailbox (hello@99icons.com). The connection can only send on our behalf; it cannot read the inbox. Provider: Google (Google Workspace / Gmail API). [in use]
• Analytics: Measuring aggregate website usage (page views, button and form-funnel events). Runs ONLY after explicit opt-in consent via the banner, and never receives form contents or personal details. Declining or ignoring the banner keeps it fully off. Provider: Google (Google Analytics 4). [in use]

We may also disclose data where we are legally required to, or to advisers where necessary to protect our rights.

Our aim is to keep processing inside the European Economic Area. Some providers may process data outside the EEA — for example the third-party web font service used for the site's typefaces receives your IP address when your browser requests the font files. Where a transfer outside the EEA applies, we rely on an appropriate safeguard such as an adequacy decision or the European Commission's Standard Contractual Clauses. A transfer overview is available on request, and this section is updated whenever our providers change.

• Enquiries that do not lead to a relationship: up to 12 months after our last contact.
• Creator and brand applications: up to 12 months, so we can come back to you if a relevant opportunity appears.
• Security and anti-spam records: up to 6 months.

Where a commercial relationship starts, related records are kept for as long as required by Dutch statutory obligations (for example administrative/tax retention).

We do not keep enquiry data indefinitely.

The site is served over HTTPS and access to submissions is limited to the people who need it. We use spam-resistant form handling rather than storing extra tracking data. No method of transmission is perfect, so please avoid sending confidential material through a web form.

There is none. In this version of the site nobody is accepted, rejected or scored automatically, and we do no profiling. A person reads every submission.

Under the GDPR/AVG you can ask us to:

• give you access to the personal data we hold about you;
• correct data that is wrong or incomplete;
• erase your data where there is no overriding reason to keep it;
• restrict processing while a dispute is being resolved;
• object to processing we base on legitimate interests, including any direct marketing;
• receive your data in a portable format, where the request concerns data you provided and the processing is based on consent or contract;
• withdraw consent, where consent is what we actually relied on.

To exercise a right, contact hello@99icons.com. We may need to check who you are before we act, and we aim to respond within one month.

You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the supervisory authority where you live.

This site is aimed at businesses and at creators working professionally; it is not directed at children. If you are under 16, please ask a parent or guardian before sending us your details. We do not knowingly keep data from children, and if we receive it we will delete it.

As the site grows, this notice will be updated and the effective date at the top will change. Material changes will be highlighted on this page.