Privacy policy

1. Who we are

BONDS Executive Ltd ("we") is the controller of the personal data described in this policy. Our details are shown above. For any question about your data, or to exercise your rights, write to us at the e-mail address above or by post to our registered office.

2. What data we collect

• Contact form: first and last name, e-mail address, phone number and company (optional), the topic you choose and your message.
• Source of your visit: the page and campaign link that brought you to the website (for example a Google or LinkedIn link). It is sent together with the form, not collected in the background.
• E-mails and calls: the details you give us when you write to us or call us.
• Technical data: to protect the form against spam we keep a one-way hash of your IP address for one hour; our hosting provider keeps standard server logs (IP address, browser, time of the request) for security.
• Visit statistics: we count visits on our own server, without cookies and without storing IP addresses. To tell visitors apart within one day, a code is made from the IP address and the browser together with a random value that changes every day; the code is deleted the next day and cannot be used to recognise you later. We keep only totals: pages viewed, the website or campaign that led to us, device type (from the screen width) and browser language.

We do not ask for special categories of data (such as health or political opinions). Please do not include them in your message.

3. Why we use it and on what legal basis

• To answer your enquiry and take the steps you ask for before entering into an agreement: your consent given in the form (Article 6(1)(a) UK GDPR) and steps prior to a contract (Article 6(1)(b)).
• To keep a record of our contacts and manage our business relationships: our legitimate interests (Article 6(1)(f)).
• To keep the website and the form secure and free of spam: our legitimate interests (Article 6(1)(f)).
• To understand how the website is used and improve it (visit statistics without cookies): our legitimate interests (Article 6(1)(f)).
• To meet legal and regulatory obligations, for example accounting or know-your-customer checks if we do business together: legal obligation (Article 6(1)(c)).

We do not use your data for marketing, we do not sell it and we do not make decisions about you by automated means.

4. Who receives it

• HubSpot, Inc.: our customer relationship management (CRM) system. Messages from the contact form are stored in our HubSpot account, hosted in HubSpot's EU data centre.
• Hostinger International Ltd: hosting of the website and of our e-mail.
• Elementor Ltd: our cookie banner keeps a record of your cookie choice (consent log), and the accessibility button (Ally) is loaded from Elementor's servers when you first interact with the page.
• Google Ireland Limited: Google Analytics 4 statistics, only if you accept analytics cookies (see Cookies below).
• Our offices and professional advisers (for example lawyers and auditors), bound by confidentiality, where this is needed to handle your enquiry.
• Public authorities, where the law requires it.

Our service providers process personal data only on our instructions and under data processing agreements.

5. Transfers outside the UK and the EEA

Some providers (for example HubSpot, Inc., a US company) may access data from outside the UK and the European Economic Area. These transfers are protected by adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or by standard contractual clauses together with the UK International Data Transfer Addendum.

6. How long we keep it

We keep enquiries and related correspondence for 24 months after our last contact with you. If we start working together, we keep the data for as long as the relationship lasts and afterwards for as long as the law requires (for UK company records, generally six years). Server logs and the spam-protection hash are kept only for a short time. Visit statistics are kept as totals that do not identify anyone.

7. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its use, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time; this does not affect what we did before. To exercise a right, write to us at the e-mail address above. We reply within one month.
If you are not satisfied with our answer, you can complain to the Information Commissioner's Office (ICO), https://ico.org.uk, or to the data protection authority of the country where you live or work.

8. Cookies

The cookie that stores your cookie choice is always set. Our own visit statistics use no cookies and store nothing on your device. Other cookies (for example for statistics) are only set if you accept them in the cookie banner. You can change your choice at any time with "Cookie settings" at the bottom of every page. The website does not load HubSpot's tracking code, and its fonts are served from our own server.

Statistics: if you accept analytics cookies, we use Google Analytics 4 (Google Ireland Limited) to understand how the website is used – pages viewed, approximate location (country/city), device and browser, and how you arrived. Google Analytics 4 does not store IP addresses. The data is kept for 14 months and is not used for advertising. Google may process it in the United States under the EU-US Data Privacy Framework (with the UK Extension). Without your consent Google Analytics is not loaded, and you can withdraw your consent at any time with "Cookie settings".

9. Changes to this policy

We may update this policy. The date at the top shows the current version.