Effective date: 10 September 2026 | Version: 2.0
1. Who we are
99Ways is operated by Nazari Ecom Solutions, trading as Ninety Nine Ways and using the 99Ways brand (“99Ways”, “we”, “us”, or “our”).
Business details
- Address: Mr. Treublaan 7, 1097 DP Amsterdam, the Netherlands
- Dutch Chamber of Commerce (KVK) number: 91552451
- VAT number: NL004899587B87
- Privacy contact: privacy[@]99ways.io
For the processing described in this policy, Nazari Ecom Solutions is normally the controller of your personal data.
This policy applies to 99ways.io, its articles and interactive features, free accounts, contact forms, consultation-booking flow, analytics, experiments, and related communications. It does not govern personal data that we process on behalf of a consulting client. That processing is addressed in the applicable client agreement and, where required, a data processing agreement.
2. What 99Ways is and why analytics are central to it
99Ways is a free publishing and experimentation project about analytics, conversion, product experience, and website optimisation. We use the site to publish practical material and to demonstrate how websites can be measured, analysed, tested, and improved using real usage data.
Analytics are therefore a substantial part of the project rather than an incidental page-counting function. If you consent to optional analytics, we may collect detailed information about how you navigate and interact with the site. We use that information to:
- understand which content and features are useful;
- study journeys, engagement, drop-off, and repeated use;
- compare behavior over time, including year-over-year patterns;
- design and evaluate experiments;
- detect regressions and technical problems;
- improve content, navigation, forms, and account experiences;
- produce aggregated findings, case studies, and demonstrations of analytical methods; and
- assess the effectiveness of traffic sources and campaigns.
You can use the public site without agreeing to optional analytics. Necessary server, security, and network processing still occurs when you request a page. Optional analytics and session recording require the choice described in Section 6.
3. Personal data we collect
3.1 Data generated when you use the site
Our hosting, WordPress installation, security tools, content-delivery providers, and server logs may process:
- your full or partial IP address;
- date and time of a request;
- requested URL and page;
- referring URL or domain;
- HTTP headers and response information;
- browser type and version;
- device type, operating system, language, screen or viewport information;
- approximate location derived from IP address;
- network, performance, error, and diagnostic information;
- cookie or local-storage identifiers where applicable; and
- security events, suspicious requests, login attempts, and actions taken to protect the service.
We collect this information to deliver pages, maintain availability, diagnose faults, prevent abuse, investigate security incidents, and maintain evidence of how the service operated.
3.2 Analytics, experiments, and interaction data
If you consent to analytics, we and our analytics providers may process:
- pseudonymous visitor, device, session, or account identifiers;
- IP address and approximate location, subject to each tool’s configuration;
- pages viewed and the order in which they were viewed;
- clicks, taps, scroll depth, mouse movement, navigation, and time spent;
- referring pages, campaign parameters, and traffic source;
- browser, device, operating system, language, viewport, and performance data;
- events generated by forms, links, downloads, searches, accounts, and content features;
- experiment eligibility, variant assignment, exposure, and measured outcomes;
- return visits and interactions across sessions when the identifier permits this;
- errors, failed interactions, and technical diagnostics; and
- account or profile properties where we have a defined reason to connect analytics to a registered user.
We may use PostHog and Microsoft Clarity to create session replays or similar reconstructions of an interaction. A replay may show page content, cursor or touch movement, scrolling, clicks, and the sequence of actions taken. We intend to mask passwords and form fields and to exclude pages or elements that are likely to contain sensitive information. You should still avoid entering special-category, confidential, or unnecessary personal data into free-text fields.
We use analytics data at visitor, session, cohort, content, and aggregate levels. We may combine current and historical events to study long-term patterns. We do not use website analytics to make decisions that produce legal or similarly significant effects about an individual.
3.3 Free accounts and sign-in
If you create or use a free account, we may collect:
- name;
- email address;
- username;
- password hash and authentication information;
- account status, role, permissions, and preferences;
- registration, login, and access history;
- content or features made available to the account;
- support and account-management correspondence; and
- technical and security data associated with account activity.
If you sign in with Google, Google provides the account information you authorise it to share, usually a Google account identifier, name, email address, and profile image. Google also processes the sign-in request under its own terms and privacy policy. We do not receive your Google password.
3.4 Contact forms and consultation booking
When you contact us or request a consultation, we may collect:
- first and last name;
- email address;
- organisation or role, if provided;
- the content of your message;
- preferred date, time, time zone, and booking information;
- subsequent correspondence and notes needed to handle the request; and
- IP address, device information, submission time, and anti-abuse signals associated with the form.
The booking flow may use Calendly and connected calendar or communication services. Those providers receive the information needed to arrange and deliver the booking.
Submitting an enquiry does not subscribe you to marketing. If we later introduce a newsletter, we will provide a separate opt-in and explain the processing at the point of collection.
3.5 Embedded content and external services
Pages may contain videos, maps, scheduling tools, social sign-in, fonts, or other third-party resources. Loading or interacting with these services can disclose your IP address, browser information, the page you visited, and information you submit to the provider. Where applicable, we delay optional resources until the relevant consent has been given.
3.6 Data we do not ask you to provide
99Ways is not intended for health information, biometric data, political or religious beliefs, sexual-orientation data, government identifiers, payment-card details, or other highly sensitive information. Do not include such information in contact forms, booking notes, account fields, or feedback unless we have specifically asked for it and explained why it is required.
4. Why we use personal data and our legal bases
| Purpose | Main data involved | Legal basis |
|---|---|---|
| Deliver pages, balance traffic, maintain availability, and remember necessary preferences | IP address, request data, necessary cookies, device and network information | Our legitimate interests in operating a reliable website and providing the page you requested |
| Protect accounts and the site, prevent abuse, investigate incidents, and maintain security evidence | IP address, logs, device data, authentication and security events | Our legitimate interests in protecting 99Ways, its users, and its systems; legal obligations where applicable |
| Create and administer a free account | Registration, authentication, profile, access, and support data | Performance of our agreement to provide the account and requested features |
| Respond to enquiries and arrange consultations | Contact, message, booking, and correspondence data | Steps taken at your request before a possible contract, or our legitimate interests in responding to communications |
| Measure use, build journeys and cohorts, compare long-term behavior, evaluate traffic sources, and improve the site | Analytics identifiers, IP-derived information, events, page and interaction data | Your consent where required for analytics storage, access, or tracking technologies |
| Run and evaluate website experiments | Eligibility, variant, exposure, behavior, outcome, and related analytics data | Your consent where the experiment relies on optional analytics; our legitimate interests for non-identifying aggregate evaluation where permitted |
| Create session replays and diagnose interaction problems | Screen and interaction reconstruction, page data, device data, analytics identifiers | Your consent |
| Establish, exercise, or defend legal claims and comply with law | Relevant account, log, correspondence, consent, and transaction evidence | Legal obligation or our legitimate interests in protecting legal rights |
Where we rely on legitimate interests, we consider the purpose, necessity, and effect on individuals. You may object to processing based on legitimate interests as described in Section 11.
If we ask for consent, you may refuse or later withdraw it without losing access to public articles. Withdrawal does not make earlier processing unlawful, but it stops future processing that depends on that consent.
5. How we use analytics findings
We may turn usage data into statistics, analyses, demonstrations, and editorial material. Published findings are intended to be aggregated or otherwise presented without identifying individual visitors. For example, we may publish that one design produced a higher conversion rate than another, or that a particular content journey was associated with stronger engagement.
We may retain and use information that has been irreversibly anonymised because it is no longer personal data. We do not publish raw IP addresses, account identifiers, contact messages, session replays, or a visitor-level activity history as part of an article or case study.
6. Cookies and similar technologies
Cookies are small files stored by a browser. Similar technologies include local storage, pixels, tags, scripts, and software-generated identifiers.
Necessary technologies
Necessary technologies support page delivery, load balancing, security, login, account sessions, fraud and abuse prevention, consent preferences, and other functions requested by the visitor. These may operate without optional consent where permitted by law because the requested service cannot function correctly without them.
Analytics and experimentation technologies
With consent, analytics technologies help us recognise a browser or session, understand behavior across pages and visits, assign or record experiment variants, measure outcomes, and maintain longitudinal analytics. They may use first-party or provider cookies, local storage, or similar identifiers.
Session-replay technologies
With consent, replay tools may reconstruct how a page was used. These tools can be particularly detailed. We use them for usability analysis, debugging, and demonstrating optimisation methods, subject to masking, access controls, and the retention period in Section 10.
Managing your choice
When the consent panel is shown, optional choices start off. You may accept all optional technologies, reject them, or choose by category. A Privacy choices control remains available on the site so you can change or withdraw your selection.
Your browser may also allow you to delete or block cookies. Blocking necessary cookies can prevent login, preference storage, or other requested features from working. Browser-level deletion does not by itself erase data already received by us; Section 11 explains how to make a rights request.
7. Analytics and technology providers
Depending on the page and your choices, we use or may use the following providers:
| Provider or service | Function | Typical data involved |
|---|---|---|
| WordPress, our hosting environment, and site plugins | Publishing, accounts, forms, security, caching, and site operation | Account, form, IP, request, device, security, and content-interaction data |
| Cloudflare | Content delivery, network security, traffic management, and performance | IP address, request headers, security and network data, necessary identifiers |
| PostHog EU Cloud | Product analytics, experiments, cohorts, event analysis, and possible session replay | Analytics identifiers, events, page and interaction data, device data, IP-derived information, experiment data |
| Google Tag Manager and Google Analytics | Delivery of configured tags, traffic and campaign measurement, and website analytics | Identifiers, pages, events, traffic source, device data, IP-derived information |
| Microsoft Clarity | Interaction analytics, heatmaps, and session replay | Identifiers, page and interaction data, device data, IP-derived information |
| Google reCAPTCHA | Form security and abuse detection | IP address, device/browser signals, interaction and risk data |
| Google Sign-In | Optional account authentication | Google identifier, name, email address, profile image, authentication events |
| Calendly and connected booking services | Consultation scheduling | Contact, availability, booking, time-zone, device, and interaction data |
| Google-hosted resources or embedded services | Fonts, videos, maps, or other resources where present | IP address, page/request data, device data, and interactions with the embedded service |
| Email and infrastructure providers | Delivery of account, contact, booking, security, and legal communications | Email address, message metadata and content, delivery information |
Some providers act as our processors, while others may act as independent controllers for parts of their service. Their own privacy notices explain their independent processing.
8. Who receives personal data
We disclose personal data only where relevant to the purpose described in this policy, including to:
- hosting, content-delivery, security, analytics, authentication, scheduling, email, and technical-service providers;
- professional advisers such as legal, accounting, security, or insurance advisers where needed;
- public authorities, courts, or other parties when disclosure is legally required or necessary to protect legal rights; and
- a buyer, investor, successor, or adviser involved in a genuine reorganisation, financing, sale, or transfer of the business, subject to appropriate confidentiality and lawful processing.
We do not sell personal data. We do not provide visitor-level analytics or contact details to data brokers. We may share aggregated or irreversibly anonymised findings because those findings do not identify an individual.
9. International processing
99Ways is operated from the Netherlands. Some providers or their subprocessors may process data elsewhere in the European Economic Area, the United States, or other countries.
Where personal data is transferred outside the EEA and a transfer safeguard is required, we use an available lawful mechanism appropriate to the recipient and transfer. This may include an adequacy decision, the EU–US Data Privacy Framework for an eligible certified recipient, European Commission standard contractual clauses, or another mechanism permitted by data-protection law. Additional technical or organisational measures may be used where appropriate.
You may contact us for information about the safeguard used for a particular transfer.
10. How long we keep data
Our standard retention horizon is three years because 99Ways studies long-term website behavior, compares periods and experiments, diagnoses delayed effects, protects the service, and maintains evidence of its operations. The applicable period depends on the record and normally runs as follows:
| Data | Standard retention |
|---|---|
| Server, access, network, security, and diagnostic logs, including IP addresses | Up to three years after the logged event |
| Analytics events, identifiers, journeys, cohort membership, experiment assignments and outcomes, interaction records, and IP-derived information | Up to three years after collection |
| Session replays and replay metadata | Up to three years after collection, although a provider may apply a shorter technical retention period |
| Consent and privacy-choice records | Up to three years after the choice is replaced or withdrawn |
| Contact-form enquiries, booking information, and related correspondence | Up to three years after the last substantive interaction |
| Free-account data | For the life of the account, followed by up to three years after closure; inactive accounts are reviewed after three years without activity |
| Authentication, account-security, and support records | Up to three years after the event or closure of the related matter |
| Privacy requests and our response record | Up to three years after the request is closed |
| Backups containing personal data | Until the backup is securely overwritten under the backup rotation, ordinarily no longer than three years |
At the end of the applicable period, we delete the data, irreversibly anonymise it, or conduct and document a review if continued identifiable retention is still necessary for the stated purpose.
We may keep limited information longer when required by law, when needed for an active security incident or legal claim, when a legal hold applies, or when another mandatory retention period governs the record. Dutch tax and basic business records, if any, may need to be kept for at least seven years. We may delete information earlier when it is no longer useful or when a valid deletion request requires it.
Irreversibly anonymised statistics may be retained without a fixed end date because they no longer identify a person.
11. Your data-protection rights
Subject to the conditions and exceptions in applicable law, you may ask us to:
- confirm whether we process your personal data and provide access to it;
- correct inaccurate or incomplete data;
- delete data;
- restrict processing;
- provide certain data in a portable format;
- object to processing based on legitimate interests;
- withdraw consent for future analytics, experimentation, or session recording; and
- explain any solely automated decision producing legal or similarly significant effects, if we ever introduce one.
Send a request to privacy[@]99ways.io. Please describe the account, email address, browser/session context, or interaction that will help us locate the relevant data. Analytics data is often pseudonymous, so we may be unable to connect a record to you unless you can provide the relevant browser identifier. We will not connect unrelated data merely to identify a requester.
We may ask for proportionate information to verify identity and prevent disclosure to the wrong person. We normally respond within one month. A complex or numerous request may permit an extension under applicable law; if so, we will explain the delay.
The right to deletion is not absolute. We may retain limited data where processing is required by law or necessary for security, freedom of expression and information, or the establishment, exercise, or defence of legal claims.
You may complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, through autoriteitpersoonsgegevens.nl. You may also have the right to contact the supervisory authority in the EU or EEA country where you live or work.
12. Account closure
You may request closure of a free account by emailing [email protected] from the address associated with the account. Closing an account ends access to account-only features. It does not necessarily erase every associated record immediately; the retention periods and legal exceptions in Section 10 continue to apply.
13. Security
We use technical and organisational measures intended to protect personal data, including access controls, software maintenance, security monitoring, encrypted transport, backups, and restrictions on who can access detailed analytics and replays. No internet service can guarantee absolute security. If you believe your account or personal data has been compromised, contact us promptly.
14. Children
99Ways is intended for people aged 16 and older and is directed toward professional and business topics. We do not knowingly invite children under 16 to create accounts or submit personal data. If you believe a child has provided data, contact us so we can assess and address it.
15. Automated decisions
We use analytics, cohorts, and experiments to understand and change website experiences. We do not currently use personal data to make solely automated decisions that produce legal or similarly significant effects about an individual.
16. Changes to this policy
We may update this policy when our purposes, tools, legal obligations, or site features change. We will change the effective date and publish the new version. If a change materially affects registered users or how we use data already collected, we will provide an additional notice where appropriate and seek new consent where required.
17. Contact
Questions or requests about this policy or our use of personal data may be sent to:
Nazari Ecom Solutions / 99Ways
Mr. Treublaan 7
1097 DP Amsterdam, the Netherlands
privacy[@]99ways.io
