Privacy notice: business outreach and website concepts

Version 1.0, 18 September 2026.

This notice explains how we use information about people when we research UK companies, prepare private website concepts for them, and contact them about our services. It is written for anyone whose details we may hold for that purpose.

1. Who we are

Bond Design & Co is a trading name of Print Vortex Limited, a company registered in England and Wales, company number 10442453. Registered office: 4th Floor, 18 St. Cross Street, London, EC1N 8UN.

We are the controller for the information described here.

We have not appointed a Data Protection Officer because the law does not require one for this activity. Privacy questions go to the email address above.

2. Who this notice is about

We contact limited companies and limited liability partnerships only. We do not contact sole traders or partnerships by email. Company information is not personal data, but some of what we handle about a company can identify a person. This notice covers:

  • people whose names or contact details appear in a company's details, for example an email address or phone number that belongs to one person;
  • people named in facts we take from a company's own website or page, for example "run by Sam and Alex";
  • people who wrote reviews of the company, where we record the review and the name or initials shown with it;
  • people who appear incidentally, for example in the background, in photographs the company posted of its own work (see "Photographs of people" below);
  • people who reply to us, answer our calls, or ask us to stop;
  • people who open a concept link, whose device address is recorded in our host's logs.

3. What we collect

  • Company contact details: company email address, phone number, website address
  • Facts about the business: services, areas covered, short "about" facts, as the business states them
  • Reviews: review text, star rating, the reviewer's first name or initials as displayed, date, where it was posted
  • Photographs: photos the business itself posted of its work; occasionally a person in the background
  • Brand material: logo, colours, typefaces from the business's own channels
  • Correspondence: your replies to us, notes of phone calls (outcome only, see below)
  • Opt-out record: see section 9
  • Technical data: IP address, time and page requested when a concept link is opened (host server logs)

We do not seek: directors' home addresses, dates of birth, personal social media profiles, or any special category information (health, religion and so on). We do not record phone calls. We do not put tracking pixels in our emails.

Photographs of people. We use photos of the work, not of people. We do not use a photo where a person is the main subject, we never use photos of children, we leave out or crop any photo in which a person can be identified, and we leave out any photo that shows something sensitive about a person (for example a health condition). A person may still appear small or in the background of a photo of a job. We do not use photos to identify anyone or to learn anything about them. If you are in a photo we hold and want it removed, tell us and we will delete every copy within one working day.

4. Where it comes from

We did not collect this information from you directly. It comes from:

  1. Companies House: company name, number, status, type, registered office, date of incorporation.
  2. The company's own website: services, areas, contact details, photos, stated facts.
  3. The company's Google Business Profile listing: contact details, reviews, photos the business posted.
  4. The company's Facebook page: services, contact details, reviews, photos the business posted.

We do not use photos uploaded by customers or other members of the public, comments by visitors, or bought-in contact lists.

5. What we use it for

  1. To decide whether a company fits our offer: an active limited company or LLP whose current website could work harder for it.
  2. To prepare a private website concept for that company, using its own facts, photos and reviews, so it can see what we would build before deciding anything.
  3. To send one email to the company's business address about the concept, and possibly one follow-up message or phone call.
  4. To respect objections: to make sure we never contact a company again once it has asked us not to.
  5. To handle replies, complaints and requests about your information.

6. Our lawful basis

We rely on legitimate interests (UK GDPR Article 6(1)(f)). Our interest is offering our website services to businesses that may benefit from them. Direct marketing is recognised in UK GDPR as something that can be a legitimate interest.

We have balanced that interest against yours in a written legitimate interests assessment. In short: we contact companies, not individuals; we use business details the company chose to publish; the concept is private to the company; we send very few messages; and we stop the moment anyone asks. You can ask us for a copy of the assessment.

For keeping an opt-out record after you object, our lawful basis is also legitimate interests: we need it to make sure we honour your objection. See section 9.

7. Who we share it with

We do not sell or rent information. We use these service providers, who process it on our instructions:

  • Vercel Inc.: hosts the private concept pages; keeps server logs; USA, served through its global network
  • 20i Ltd: hosts our outreach mailbox, which sends and stores our emails; UK
  • OpenRouter, Inc. routing to Anthropic PBC: drafts website copy from the business facts; USA
  • Google LLC (Gemini API): enhances the company's photos and generates labelled sample images; USA
  • Google LLC (Google Fonts): delivers typefaces when a concept page is opened, which shares the viewer's IP address; USA

We keep copy and image requests to the minimum needed: business facts, service names and photographs.

We do not send reviews, reviewers' names, contact details or opt-out records to the provider that drafts copy.

We may also disclose information where the law requires it, or to our professional advisers.

8. International transfers

Some providers are based outside the UK.

Where a US provider is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on that. Otherwise we rely on the data transfer terms in the provider's contract, based on the ICO's International Data Transfer Addendum. Access by our staff in Bulgaria relies on the UK's adequacy regulations for the European Economic Area.

9. How long we keep it

In summary (full detail in our retention schedule):

  • Concept pages are set to expire 30 days after we prepare them. We take a concept down and delete it within one working day after its expiry date, or within one working day of the company asking.
  • Research about a company we do not contact is deleted within 30 days.
  • Research about a company we contacted is deleted 6 months after our last message if there is no ongoing conversation.
  • Emails with a company that replied with interest are kept for 12 months from the last contact if no contract follows.
  • Call notes (outcome only) are kept for 6 months; records that we screened a number against the preference registers, and records of approving a message, for 2 years.
  • Requests about your information and complaints are kept for 2 years after they are closed.
  • Server and provider logs are deleted on our hosting and email providers' standard schedules. We do not export or keep copies of them.
  • If you ask us to stop, we take the concept down and delete everything else, apart from a minimal opt-out record: the company number, website domain, email address, phone number, registered office postcode, the date and how you asked. We keep that record for as long as we carry out this kind of marketing, because without it we could contact you again by mistake.
  • If you become a client, a separate client privacy notice applies.

10. Your rights

You have the right to:

  • object to our use of your information for direct marketing. This right is absolute. If you object, we stop;
  • access the information we hold about you;
  • have inaccurate information corrected;
  • have information erased, apart from the opt-out record above, which exists to protect your choice;
  • restrict our use of your information in some circumstances;
  • object to other processing based on legitimate interests.

We do not make decisions about people with legal or similarly significant effects by automated means alone. Software helps us shortlist companies, but a person reviews every company and every message before anything is sent.

There is no charge for exercising your rights. We respond within one month.

11. How to object or be removed

Any of these work, and there is no set form of words:

We record your request within 1 working day, take down any concept for your company, and do not contact you again. Full process: our suppression and opt-out procedure.

12. Complaints

Please tell us first at help@studio.bonddesign.co and we will try to put it right. We acknowledge complaints within 30 days and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113, or ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

13. Changes

We will update this notice if how we work changes, and show the date at the top.