Privacy notice: business outreach and website concepts

Version 1.3, 15 October 2026.

This notice explains how we use information about people when we research UK companies, prepare private website concepts for them, and contact them about our services. It is written for anyone whose details we may hold for that purpose.

1. Who we are

Bond Design & Co is a trading name of Print Vortex Limited, a company registered in England and Wales, company number 10442453. Registered office: 4th Floor, 18 St. Cross Street, London, EC1N 8UN.

We are the controller for the information described here.

• Email: webpro@studio.bonddesign.co
• Post: the registered office above

We have not appointed a Data Protection Officer because the law does not require one for this activity. Privacy questions go to the email address above.

2. Who this notice is about

We contact limited companies and limited liability partnerships only. We do not contact sole traders or partnerships by email. Company information is not personal data, but some of what we handle about a company can identify a person. This notice covers:

• people whose names or contact details appear in a company's details, for example an email address or phone number that belongs to one person;
• people named in facts we take from a company's own website or page, for example "run by Sam and Alex";
• people who wrote reviews of the company, where we record the review and the name or initials shown with it;
• people who appear incidentally, for example in the background, in photographs the company posted of its own work (see "Photographs of people" below);
• people who reply to us, answer our calls, or ask us to stop;
• people who open a concept link, whose device address is recorded in our host's logs;
• people who use the form on that private page to ask us about the website, a call or a question.

3. What we collect

• Company contact details: company email address, phone number, website address
• Facts about the business: services, areas covered, short "about" facts, as the business states them
• Reviews: review text, star rating, the reviewer's first name or initials as displayed, date, where it was posted
• Photographs: photos the business itself posted of its work; occasionally a person in the background
• Brand material: logo, colours, typefaces from the business's own channels
• Correspondence: your replies to us, notes of phone calls (outcome only, see below)
• Record of what we sent: an archived copy of each concept as we sent it, with the information it was built from and the result of our quality check
• Opt-out record: see section 9
• Technical data: IP address, time and page requested when a concept link is opened (host server logs); in our own records, only the time of each visit and the kind of device (phone, tablet or computer)
• Enquiries from the private page: your name, the email address and/or phone number you give, your message if you write one, which option you chose (the website, a call first, or a question), the sentence you agreed to and when, the version of our offer the page showed you, and the kind of device

We do not seek: directors' home addresses, dates of birth, personal social media profiles, or any special category information (health, religion and so on). We do not record phone calls. We do not put tracking pixels in our emails.

Photographs of people. We use photos of the work, not of people. We do not use a photo where a person is the main subject, we never use photos of children, we leave out or crop any photo in which a person can be identified, and we leave out any photo that shows something sensitive about a person (for example a health condition). A person may still appear small or in the background of a photo of a job. We do not use photos to identify anyone or to learn anything about them. If you are in a photo we hold and want it removed, tell us and we will delete every copy within one working day.

4. Where it comes from

Apart from what you send us yourself (replies, and the enquiry form on your private page), we did not collect this information from you directly. It comes from:

1. Companies House: company name, number, status, type, registered office, date of incorporation.
2. The company's own website: services, areas, contact details, photos, stated facts.
3. The company's Google Business Profile listing: contact details, reviews, photos the business posted.
4. The company's Facebook page: services, contact details, reviews, photos the business posted.

We do not use photos uploaded by customers or other members of the public, comments by visitors, or bought-in contact lists.

5. What we use it for

1. To decide whether a company fits our offer: an active limited company or LLP whose current website could work harder for it.
2. To prepare a private website concept for that company, using its own facts, photos and reviews, so it can see what we would build before deciding anything.
3. To send one email to the company's business address about the concept, and possibly one follow-up message or phone call.
4. To respect objections: to make sure we never contact a company again once it has asked us not to.
5. To handle replies, complaints and requests about your information.
6. If you use the enquiry form on your private page: to reply to you, arrange a call or a quote if you ask for one, and keep a record of what you asked and which offer you saw. We also use the form's details to stop duplicate and automated submissions.

6. Our lawful basis

We rely on legitimate interests (UK GDPR Article 6(1)(f)). Our interest is offering our website services to businesses that may benefit from them. Direct marketing is recognised in UK GDPR as something that can be a legitimate interest.

We have balanced that interest against yours in a written legitimate interests assessment. In short: we contact companies, not individuals; we use business details the company chose to publish; the concept is private to the company; we send very few messages; and we stop the moment anyone asks. You can ask us for a copy of the assessment.

For keeping an opt-out record after you object, our lawful basis is also legitimate interests: we need it to make sure we honour your objection. See section 9.

If you use the enquiry form, we rely on taking steps at your request before entering into a contract (UK GDPR Article 6(1)(b)) when you ask for the website or a call, and on legitimate interests (Article 6(1)(f)) in answering you when you ask a question, in recording visits to your private page, and in keeping the form free of spam. The box you tick records that you asked us to reply; we do not use your details for anything else, and you can ask us to stop at any time (section 11).

7. Who we share it with

We do not sell or rent information. We use these service providers, who process it on our instructions:

• Vercel Inc.: hosts the private concept pages; keeps server logs; USA, served through its global network
• 20i Ltd: hosts our outreach mailbox, which sends and stores our emails; UK
• OpenRouter, Inc. routing to Anthropic PBC: drafts website copy from the business facts; USA
• OpenRouter, Inc. routing to OpenAI: generates AI example images of people at work for a concept, from the trade, the kind of work and the town only; no photographs or personal information are sent; USA
• OpenRouter, Inc. routing to Anthropic PBC and to OpenAI: checks the company's photos (for people, quality and lettering) and screenshots of the concept pages before a concept is sent; USA
• Vercel Inc.: hosts the private page your link opens and its enquiry form; keeps server logs; USA, served through its global network
• Supabase, Inc.: stores the record of visits to your private page and what you send through its form, for our team only; UK (London, eu-west-2)
• Sendinblue SAS (Brevo): sends our team an alert email that a company has used the form; the alert names the company and what was asked, not your contact details or message; France (EU)

We keep copy and image requests to the minimum needed: business facts, service names and photographs.

We do not send reviews, reviewers' names, contact details or opt-out records to the provider that drafts copy.

We may also disclose information where the law requires it, or to our professional advisers.

8. International transfers

Some providers are based outside the UK.

Where a US provider is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on that. Otherwise we rely on the data transfer terms in the provider's contract, based on the ICO's International Data Transfer Addendum. Access by our staff in Bulgaria relies on the UK's adequacy regulations for the European Economic Area.

9. How long we keep it

In summary (full detail in our retention schedule):

• Concept pages are set to expire 30 days after we prepare them. We take a concept down and delete it within one working day after its expiry date, or within one working day of the company asking.
• Research about a company we do not contact is deleted within 30 days.
• The record of what we sent (an archived copy of the concept, with the information it was built from) is kept for the same period as the research about that company, so that we can show exactly what you were sent if you ask or complain. Older copies are deleted automatically, and every copy is deleted with the rest of that company's research.
• Research about a company we contacted is deleted 6 months after our last message if there is no ongoing conversation.
• Emails with a company that replied with interest are kept for 12 months from the last contact if no contract follows. What you send through the enquiry form is kept on the same terms: 12 months from our last contact if no contract follows, then deleted.
• Call notes (outcome only) are kept for 6 months; records that we screened a number against the preference registers, and records of approving a message, for 2 years.
• Requests about your information and complaints are kept for 2 years after they are closed.
• Server and provider logs are deleted on our hosting and email providers' standard schedules. We do not export or keep copies of them.
• If you ask us to stop, we take the concept down and delete everything else, apart from a minimal opt-out record: the company number, website domain, email address, phone number, registered office postcode, the date and how you asked. We keep that record for as long as we carry out this kind of marketing, because without it we could contact you again by mistake.
• If you become a client, a separate client privacy notice applies.

10. Your rights

You have the right to:

• object to our use of your information for direct marketing. This right is absolute. If you object, we stop;
• access the information we hold about you;
• have inaccurate information corrected;
• have information erased, apart from the opt-out record above, which exists to protect your choice;
• restrict our use of your information in some circumstances;
• object to other processing based on legitimate interests.

We do not make decisions about people with legal or similarly significant effects by automated means alone. Software helps us shortlist companies, but a person reviews every company and every message before anything is sent.

There is no charge for exercising your rights. We respond within one month.

11. How to object or be removed

Any of these work, and there is no set form of words:

• reply STOP to any email from us;
• email webpro@studio.bonddesign.co with STOP in the subject;
• tell us any other way.

We record your request within 1 working day, take down any concept for your company, and do not contact you again. Full process: our suppression and opt-out procedure.

12. Complaints

Please tell us first at webpro@studio.bonddesign.co and we will try to put it right. We acknowledge complaints within 30 days and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113, or ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

13. Changes

We will update this notice if how we work changes, and show the date at the top.