Privacy Notice

International Color Consortium (ICC)
Effective Date: January 1, 2026
Last Updated: January 1, 2026

1. Who We Are

The International Color Consortium (“ICC,” “we,” “us,” or “our”) is an unincorporated association that develops, publishes, and promotes open, vendor-neutral color management specifications, technical reports and standards.

For purposes of applicable data protection laws, ICC is the data controller of personal information described in this Privacy Notice. ICC is based in the United States and has no legal entity, branch, or office outside the United States. ICC’s standards activities involve participants located in many countries, including in the European Economic Area, United Kingdom, and Switzerland.

Contact: Email: [email protected]

Mailing Address:

International Color Consortium 450 Rev Kelly M Smith Way Nashville, TN 37203 U.S.A.

EU, UK, and Swiss Privacy Contact

If you are located in the European Economic Area, United Kingdom, or Switzerland, you may contact ICC regarding matters relating to the processing of your personal data at:

Phil Green ICC Technical Secretary Postboks 191, NO-2802 Gjøvik, Norway

You may also contact ICC directly at [email protected].

2. Scope of This Notice

This Privacy Notice describes how we collect, use, disclose, and safeguard personal information when you:

Visit our websites;
Register for membership, events, or programs;
Purchase publications or services;
Subscribe to communications;
Contact us;
Participate in ICC working groups, mailing lists, or technical committees; or
Otherwise contact or interact with ICC in connection with its standards activities.

3. Personal Information We Collect

We collect personal information directly from you, automatically through your use of our websites, and from limited third-party service providers.

A. Information You Provide Directly

Name
Business affiliation and job title
Postal address
Email address
Telephone number
Account credentials (if applicable)
Payment and billing information
Communications you send to us
Survey responses
Ballot responses
Working group and mailing list participation records

We do not store full payment card numbers. Payments are processed by PCI-DSS compliant third-party payment processors.

B. Information Collected Automatically

When you use our website, we collect the following information through Cloudflare security logs:

IP address
Browser type and settings
Referring website
Pages visited
Date and time of access

Web traffic is routed through Cloudflare as part of its content delivery and security services. We do not use third-party analytics scripts or tracking pixels.

C. Information from Third Parties

We may receive limited information from:

Payment processors (Stripe)
Event registration platforms
Email service providers

We do not purchase personal data from data brokers.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases:

Contract – To fulfill memberships, working group participation agreements, publication orders, and other services you request, including sending communications integral to membership such as working group activity updates and mailing list communications.
Legitimate Interests – To operate and secure our website (including Cloudflare security log analysis), and maintain the integrity and completeness of the standards development record — including attribution of contributions in published specifications, technical reports and standards. Contributors reasonably expect their name and organizational affiliation to be recorded as part of the development process; the data retained is minimal; and we have assessed that these interests are not overridden by your rights and freedoms.
Legal Obligation – To comply with applicable laws, including tax, accounting, and legal process requirements.

5. How We Use Personal Information

We use personal information to:

Develop and publish open color management specifications, technical reports and standards
Record and preserve the history of development decisions, including contributions, ballots, and working group deliberations
Provide memberships, publications, and services
Process event registrations and payments
Respond to inquiries
Send administrative communications, announcements, event invitations, and mailing list communications relevant to ICC’s activities
Improve website functionality and user experience
Maintain security and prevent fraud
Comply with legal obligations
Enforce our Terms of Use

We do not use personal information for automated decision-making that produces legal or similarly significant effects.

6. Cookies and Tracking Technologies

We use strictly necessary cookies for the operation and security of our website. These cookies serve two purposes:

Session management – to enable secure login to the member portal and authenticated areas of our website; and
Security – to detect and prevent automated abuse. We use Cloudflare for content delivery and abuse protection; Cloudflare may set cookies on your device solely for these security purposes. The cookies Cloudflare sets are determined by Cloudflare and may change as Cloudflare updates its services.

No cookies are used for behavioral tracking, advertising, or cross-site tracking. We do not use third-party technologies for behavioral tracking or advertising.

You may configure your browser to block or delete cookies; however, doing so will prevent access to member-only areas of our website and may affect other security features.

We honor Global Privacy Control (GPC) signals. Because we use only strictly necessary cookies and do not sell or share personal information, a GPC signal will be treated as confirmation of your privacy preferences. It will not affect our cookie use, which is already limited to what is strictly necessary for website operation and security.

We do not sell personal information.

We may disclose personal information to:

A. Service Providers

Vendors providing:

Payment processing (Stripe)
Content delivery and security (Cloudflare)
Website hosting (Cloudflare, GitHub)
IT support
Email distribution (MailmanLists)
Cloud storage (Cloudflare)
Event management platforms
Document Management (Microsoft)

These vendors are contractually required to protect personal data and, where required by applicable law, are engaged under data processing agreements.

B. Legal and Compliance

We may disclose information:

To comply with legal obligations
In response to lawful requests
To protect rights, safety, or property
In connection with a merger or asset transfer

In the event of a merger, acquisition, or asset transfer, we will ensure that personal data remains protected under terms consistent with this Privacy Notice and applicable law.

8. International Data Transfers

ICC is based in the United States.

If you are located outside the United States, your information may be transferred to and processed in the United States or other countries where our service providers operate.

When personal data is transferred to service providers operating outside your country (including to the United States), we ensure that appropriate safeguards are in place, such as:

Standard Contractual Clauses approved by the European Commission
UK International Data Transfer Addendum
Other legally recognized transfer mechanisms

You may request additional information about these safeguards by contacting us.

9. Data Retention

We retain personal information for the following periods:

Category	Retention Period	Basis
Membership account data (login credentials, contact information, website preferences, mailing list membership)	Removed upon membership termination; routinely purged from backup systems	Contract; data minimization
Official attribution records (name and organizational affiliation only) — in published specifications, technical reports and standards, working group minutes, ballot records, and roll calls	Permanently	Legitimate interests; forms part of the official standards development record; published standards are distributed and adopted globally and are not revised to remove contributor attribution once distributed; copies may exist outside ICC’s control (see §16)
Internal working group operational records	Retained only as necessary for standards development and accountability	Legitimate interests
Payment and transaction records	As required by applicable tax and accounting law (typically 7 years)	Legal obligation
General inquiries and correspondence	Until the matter is resolved, plus a reasonable follow-up period	Legitimate interests
Server logs	routinely purged from systems	Security monitoring and abuse prevention

When personal information is no longer required for any of the above purposes, we securely delete or anonymize it.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

Access personal information we hold about you
Request correction of inaccurate information
Request deletion of personal information
Object to or restrict certain processing
Request data portability
Lodge a complaint with the data protection supervisory authority in your country of residence

To exercise these rights, contact: [email protected]

Deletion requests: Upon a verified request, we will delete your membership account data from our systems, including your login credentials, contact information, website preferences, and mailing list membership.

Where ICC retains your name and organizational affiliation as part of its official attribution records — including in published specifications, technical reports and standards, ballot records, and roll calls — it does so on the basis of Legitimate Interests (GDPR Art. 6(1)(f)). Under Art. 21(1), you have the right to object to processing carried out on that basis. Upon receiving an objection or erasure request relating to these records, ICC will assess whether its legitimate interests override your individual interests. ICC’s assessment is that the interest in maintaining an accurate and unalterable historical record of contributor attribution — including in documents that have already been publicly distributed and may have been adopted by third parties worldwide — constitutes compelling legitimate grounds that override the interest in removal. Accordingly, ICC will not remove name and organizational affiliation from official attribution records in response to such requests. See §16 for further information.

We may need to verify your identity before fulfilling a request. We will respond to your request within one month of receipt. Where a request is complex or we receive a high volume of requests, we may extend this period by a further two months and will notify you accordingly. We will not charge a fee for reasonable requests.

For requests under applicable U.S. state privacy laws, we will respond within 45 days (extendable by an additional 45 days where reasonably necessary).

11. U.S. State Privacy Rights (Including California)

Categories of Personal Information Collected

In the preceding 12 months, ICC has collected the following categories of personal information:

Category	Specific Data Elements	Source
Identifiers	Name, email address	Directly from you
Professional or employment information	Company or organizational affiliation, job title	Directly from you
Internet or network activity	IP address, browser type and settings, pages visited, date and time of access	Automatically collected
Commercial information	Payment transaction records (processed by Stripe; ICC does not store card numbers)	Directly from you; Stripe
Preferences	Website preferences, mailing list subscriptions	Directly from you

Sensitive Personal Information

ICC does not collect sensitive personal information as defined under CPRA, including Social Security numbers, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, health or medical information, biometric data, genetic data, or the content of private communications.

Categories of Third Parties and Business Purposes for Disclosure

In the preceding 12 months, ICC has disclosed personal information to third parties solely for the following business purposes:

Category Disclosed	Recipients	Business Purpose
Identifiers	Email service providers, website hosting, IT support	Delivering communications; operating and securing the website
Internet or network activity	Website hosting providers, Cloudflare	Website operation and security
Commercial information	Stripe	Payment processing

Note: Contributor name and organizational affiliation also appear in ICC’s published standards, standards registries, working group minutes, and ballot and roll call records, which are retained permanently as official attribution records. This is described further in §16.

ICC does not sell personal information or use it for advertising purposes.

Your Rights

If you are a California resident, you may have the right to:

Know the categories of personal information collected, the sources, and the business purposes for collection and disclosure
Access specific pieces of personal information ICC holds about you
Request deletion of personal information (subject to the exception for standards records described in §10)
Correct inaccurate personal information
Opt out of the sale or sharing of personal information (ICC does not sell or share — no opt-out action is required)
Limit the use or disclosure of sensitive personal information (ICC does not collect sensitive personal information)
Not be discriminated against for exercising any of these rights

Residents of Virginia, Colorado, Connecticut, Texas, Oregon, and other states with comprehensive privacy laws may have similar rights under their respective state laws.

To submit a request, email [email protected]. ICC will respond within 45 days (extendable by an additional 45 days where reasonably necessary).

12. Children’s Privacy

Our services are intended for professionals and organizations and are not directed to children. We do not knowingly collect personal information from individuals under the age of 13 (or under 16 where required by applicable law, including under the GDPR).

If we become aware that we have inadvertently collected personal information from a child below the applicable age threshold, we will take prompt steps to delete it.

13. Information Security

We implement reasonable technical and organizational measures to protect personal information, including:

Encryption in transit (HTTPS)
Encryption at rest for stored personal data
Access controls
Vendor security requirements
Payment processing through PCI-DSS compliant providers

However, no system can guarantee absolute security. In the event of a personal data breach, we will notify regulators and affected individuals as required by applicable law.

14. Third-Party Websites

Our website may contain links to third-party sites. We are not responsible for their privacy practices. Please review their privacy policies before providing personal information.

15. Changes to This Privacy Notice

We may update this Privacy Notice periodically. When we do, we will revise the “Last Updated” date above. We will notify you of material changes by posting a notice on our website and, where appropriate, by sending an email to members and registered users.

16. Standards Development and Public Attribution

ICC’s primary mission is to develop and publish open, vendor-neutral color management specifications, technical reports and standards. This section explains how that mission affects the personal information of participants in ICC’s standards activities.

What May Be Publicly Attributed

When you contribute to ICC’s standards development process — including participation in working groups, voting on ballots, attending technical committee meetings, or otherwise contributing to the development of an ICC standard — your name and organizational affiliation may appear in:

Published ICC specifications, technical reports and standards
Standards registries and related technical documentation

These documents are publicly available and may be distributed and adopted by organizations and individuals worldwide.

Your name and organizational affiliation are also recorded in official ballot and roll call records and working group minutes, which form part of ICC’s permanent official attribution records (see §9).

Your name and organizational affiliation may also appear in other internal working documents retained only as necessary for standards development and accountability.

Why Attribution Is Permanent

Published standards are public technical documents. Once distributed, they are not revised to remove contributor attribution, and copies may exist outside ICC’s control. This is similar in nature to academic authorship or patent inventorship: attribution in a published document forms part of the public technical record and is not retracted after distribution.

If you submit a deletion request under §10, ICC will delete your membership account data — including your login credentials, contact information, website preferences, and mailing list membership — from its systems.

Name and organizational affiliation in official attribution records — published specifications, technical reports and standards, working group minutes, ballot records, and roll calls — are retained permanently and will not be removed in response to a deletion request. The legal framework for assessing such requests is described in §10.

What Is Not Published

Only name and organizational affiliation appear in published standards and official records. Contact details — including email address, telephone number, and postal address — are not published in standards documents and will be removed from ICC’s internal systems upon your departure from ICC, as described in §9.

Notice to Participants

By participating in ICC’s standards development activities, you acknowledge that your name and organizational affiliation will form part of the permanent public record of those activities as described in this section.

17. Contact Us

If you have questions about this Privacy Notice or our data practices, please contact: