Privacy Policy

Who we are

ICONS BV (Singel 268, 3311 HK Dordrecht, the Netherlands, Chamber of Commerce 60385898) is the controller for personal data processed through icons.nl and app.icons.nl. Send privacy questions to legal@icons.nl.

When we process data on behalf of a client, for example the visitors or enquiries of that client’s website, the client is the controller and we are the processor, under a data processing agreement. This policy covers the data ICONS itself is responsible for.

What data and why

Booking a call. When you fill in the form on icons.nl, we receive your name, company, email address, phone number (if you give it), the subject and your message. We use them to answer your question and schedule a call. Legal basis: your request and our legitimate interest in responding to it.

Requesting a package. When you request a Marketing Suite package, we keep your company name, name, contact details, website and message to handle the request and enter into an agreement with you. Legal basis: (preparing) the contract.

The chat. When you ask a question in the chat on our site, we process your message and the details you share in it, such as your name, phone number or question, to help you and pass your request on. Answers are produced with an AI model; a member of staff can read the conversation back. Legal basis: your request and our legitimate interest.

Site visits. We measure how the site is used with Google Analytics: which pages are viewed, where visitors come from and on which device. This helps us improve the site. See cookies below.

Clients and the client portal. When you log in to app.icons.nl, we process your name, email address, your role, what you do in the portal and the data needed for invoicing and payment. Legal basis: the contract and legal obligations, such as tax record keeping.

Learning what works: data sharing

For clients we record what our services do and what they deliver: which pages go live, how often Google shows and clicks them, rankings, the number of enquiries, and the weekly figures from Search Console and Google Analytics (visits, channels, search terms and landing pages). These are weekly totals, not data about any visitor. An enquiry is counted without name or contact details, and a search term that looks like an email address or phone number is left out.

Data sharing is on by default. We then learn from these figures, together with those of other clients, what works, and give those patterns back to you, for example which kind of page gets found faster in your line of business. Outside ICONS we only show patterns that rest on at least five businesses and can never be traced to one. You can switch data sharing off in the portal at any time; your figures are then used only for your own reports, including what was already collected. Legal basis: our legitimate interest in improving our services, with the right to switch it off. When the agreement ends you can ask us to delete these figures.

Data from your Google account

When you connect your Google account in the portal, we ask for read-only access to Search Console (https://www.googleapis.com/auth/webmasters.readonly) and Google Analytics (https://www.googleapis.com/auth/analytics.readonly). With it we read the figures of the website you choose: impressions, clicks, positions and search queries from Search Console, and sessions, channels, conversions and landing pages from Analytics, as weekly totals. We change nothing in your Google account and read no other data.

We use this data only for what you see in the portal and for the work we do for you: your reports, deciding which pages we write and improve, and, when data sharing is on, the patterns we give back to you. Search queries are classified (for example buying intent or a question) by Anthropic’s AI model, which does not use them to train models. We do not sell this data, do not use it for advertising and do not give it to others. Staff look at it only when needed for your service, for security, or when the law requires it.

ICONS’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time in the portal or at https://myaccount.google.com/permissions; we then keep no access and delete the stored figures on request.

Recognising companies on clients’ websites

When a client has the Company visitors module, we show which companies looked at its website. For that we use the IP address of a visit from our servers’ logs, only to find the organisation behind a business connection. For that we use the connection’s public server name (reverse DNS), the addresses companies publish themselves in their e-mail settings (SPF), and office addresses we know because at least two employees of the same company logged in to app.icons.nl from there; of such a login we keep only the company (the domain of the e-mail address) with an encrypted form of the address, never who it was. We do not keep the IP address; we keep the company and the pages it viewed, for thirteen months. Visitors on a home or mobile connection are not recognised, and we never try to identify a person. No cookie or script is added. For clients’ websites we act as processor and the client is the controller. Across all sites we host we only count how many visitors there were and how many we could place, without keeping the company. Legal basis: the client’s legitimate interest in knowing which companies are interested.

How long we keep data

• Enquiries and chats that lead nowhere: up to two years after the last contact.
• Client data: for as long as the agreement runs, and afterwards as long as needed to settle it and handle any disputes.
• Invoices and the records behind them: seven years, as Dutch law requires.
• Statistics in Google Analytics: fourteen months.

Who we share data with

We do not sell data. We share it only with parties that help us deliver the service, and only what they need:

• Hosting: our servers are in the Netherlands (Hostnet, Amsterdam). Our email runs there too.
• Google, for Google Analytics.
• Anthropic, for the AI model behind the chat and our assistants.
• Mollie, for client payments.

Some of these parties are outside the European Economic Area. Transfers take place only with appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

Cookies and similar technologies

• Google Analytics sets cookies (including _ga) to count and recognise visits, for up to two years.
• The chat keeps a session and the page you arrived on in your browser, so a conversation is not lost and we know where an enquiry came from.
• On app.icons.nl the portal sets a session cookie to keep you logged in. That cookie is strictly necessary.

You can refuse or delete cookies in your browser. The site keeps working; only the statistics miss your visit.

Security

Connections are encrypted, access to data is limited to those who need it, logging in uses a personal link without a password, and we make encrypted backups.

Your rights

You may access, correct or delete your data, restrict or object to its processing, and receive it in a common format. Send your request to legal@icons.nl; we respond within a month. If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

If the way we process data changes, we update this policy. The date at the top shows when that last happened.