Privacy Policy

This policy explains what personal data ICA Media Ltd collects, why we collect it, how long we keep it and what you can ask us to do with it. It applies to this website and to the enquiries, submissions and business relationships that come through it.

1. Who we are

ICA Media Ltd is a talent agency registered in England and Wales. We represent gaming and digital creators and arrange brand partnerships on their behalf. For the purposes of UK data protection law we are the data controller for the personal data described in this policy — that is, we decide why and how it is used.

If you have a question about this policy, or you want to exercise any of the rights set out in section 8, write to us at hello@incharacteragency.com and put “Data protection” in the subject line. We do not currently have a statutory obligation to appoint a Data Protection Officer, so enquiries are handled by the agency’s directors.

2. The data we collect

Site visitors

When you visit this website our hosting provider processes technical data on our behalf: your IP address, the pages you request, your browser and device type, approximate region, and the page that referred you. This is ordinary server and delivery-network activity, and it is what allows the site to load, stay available and be defended against abuse. We do not use it to build a profile of you.

Enquiry form and email

If you send us an enquiry through the contact form we collect your name, your email address, the enquiry type you selected and the content of your message. If you email us directly we collect whatever you choose to put in that email, including any attachments and the contact details in your signature. We may also keep a record of our reply and any correspondence that follows, so that whoever picks the conversation up next has the context.

Talent applicants and creators

If you approach us about representation, or apply for a role with us, we collect the material you send: channel and social media links, audience and performance figures, showreels, rate expectations, CVs, and any details you give about your current representation or commitments. Where a relationship progresses we will also hold the information needed to work together and pay you correctly — legal name, business or company details, billing address, bank details, and tax or VAT registration numbers.

Brand and agency contacts

For people working at brands, media agencies and platforms we hold ordinary business contact information: name, job title, employer, email address and phone number, plus a record of campaigns and conversations.

We do not ask for special category data — information about health, ethnicity, religion, sexual orientation, political opinions or trade union membership. Please do not send it to us unprompted. If it arrives anyway as part of an application or a message, we will delete it unless there is a clear reason to keep it and a lawful basis for doing so.

3. Why we use it, and our lawful bases

UK GDPR requires us to have a lawful basis for every use of personal data. Ours are as follows.

• Legitimate interests

  Responding to enquiries, assessing creator submissions, running the agency day to day, keeping business contact records, securing the site and understanding in aggregate how it is used. We have considered whether this is fair to you, and we think it is: you would reasonably expect an agency to reply to your message and to keep a note of the conversation. You can object at any time — see section 8.

• Contract

  Representing a creator, negotiating and administering brand partnerships, issuing invoices and making payments. Where you are signed to us, or you are the named contact on a deal, we process the data needed to perform that agreement or to take steps at your request before entering into one.

• Legal obligation

  Keeping accounting and tax records, responding to regulators, and meeting advertising disclosure requirements.

• Consent

  Any non-essential cookies or analytics, and any marketing email you have asked to receive. Where we rely on consent you can withdraw it at any time, and withdrawing it does not affect anything we did before you did so.

4. Cookies and analytics

This site is deliberately light on tracking. We use only the cookies and local storage strictly necessary to serve the site, remember your session and keep it secure. These are exempt from the consent requirement under the Privacy and Electronic Communications Regulations because the site cannot work properly without them.

We may use privacy-respecting, aggregated analytics to understand which pages are read and which are not. If we introduce analytics or advertising technology that identifies you individually or tracks you across other sites, we will ask for your consent through a cookie banner before it runs, and we will update this policy first. Most browsers also let you block or delete cookies through their settings, although parts of the site may then behave unpredictably.

5. Who we share it with

We do not sell personal data, and we do not share it for anyone else’s marketing. We do share it in these situations.

• Brand partners

  When we put a creator forward for a campaign we share the information needed to consider and run it — name or handle, channel links, audience and performance data, rates and deliverables. Where a creator is represented by us, this is done under our agreement with them and with their knowledge. We do not pass a brand your personal contact details unless you have asked us to.

• Service providers

  Suppliers who process data on our instructions as processors: website hosting and content delivery, email and file storage, customer and campaign management tools, accounting software, and payment providers. Each is bound by a written contract that requires appropriate security and forbids them from using the data for their own purposes.

• Professional advisers and authorities

  Our accountants, auditors, insurers and lawyers, and any regulator, court or public authority where we are legally required to disclose. If our business is reorganised, sold or merged, data may transfer to the new owner under the same protections.

Some of our providers operate outside the UK. Where personal data is transferred abroad we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

6. How long we keep it

We keep personal data only for as long as it is useful for the purpose we collected it, and then delete it.

• General enquiriesTwelve months from our last exchange, unless the conversation turns into a working relationship.
• Unsuccessful talent submissionsTwelve months, so we can come back to you if the roster changes shape. Ask us and we will remove it sooner.
• Job applicationsSix months after the role is filled or withdrawn.
• Represented creators and clientsFor the duration of the agreement and six years afterwards, to cover contractual claims and rights questions.
• Financial recordsSix years from the end of the accounting period, as required by tax law.
• Server logsShort-lived, typically no more than thirty days, and then overwritten.

7. Keeping it secure

The site is served over HTTPS. Access to enquiry data, contracts and financial records is limited to the people who need it, protected by unique accounts and multi-factor authentication, and reviewed when someone joins or leaves. We store data with established providers rather than on personal devices. No system is perfect, and if a breach occurs that is likely to risk your rights and freedoms we will report it to the Information Commissioner’s Office within 72 hours and tell you directly where the risk is high.

8. Your rights

Under UK GDPR you have the following rights over your personal data. Most are not absolute, and we will explain if an exemption applies.

• Access. Ask for a copy of the personal data we hold about you, and an explanation of how we use it.
• Rectification. Have inaccurate data corrected or incomplete data completed.
• Erasure. Ask us to delete data where we no longer need it, or where we relied on your consent.
• Restriction. Ask us to pause our use of your data while a dispute about it is resolved.
• Objection. Object to processing based on legitimate interests, and object at any time to direct marketing, which we will always stop.
• Portability. Receive data you gave us in a common machine-readable format, or have it sent to another controller, where processing is based on consent or contract and carried out by automated means.
• Withdraw consent. Where consent is our basis, withdraw it at any time without affecting earlier processing.
• Automated decisions. We do not make decisions about you by automated means alone, and we do not profile you.

To exercise any of these, email hello@incharacteragency.com. We may ask you to confirm your identity so that we do not hand your data to someone else. We respond within one month, and will tell you if a complex request needs longer. There is no charge unless a request is manifestly unfounded or excessive.

9. Complaints

If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office, at any time.

10. Changes to this policy

We review this policy at least once a year and whenever we change how we work with personal data. The date at the top of the page always shows the current version. If a change materially affects you — a new purpose, a new category of recipient, or anything relying on your consent — we will make that clear rather than quietly amending the text.

This policy was last updated on 10 September 2026.