Privacy Policy

Updated: 26 May 2026 · Effective from: 26 May 2026

1. Data controller

BondVX — operational service (operated by: Davide Bondavalli)
Operational base: Emilia-Romagna, Italy
Email: privacy@bondvx.com

Invoicing entity: [TO BE FILLED — partner Italian S.r.l.]
VAT: [TO BE FILLED]
Registered office: [TO BE FILLED]
(In our first months of operation BondVX invoices via a partner Italian limited company. See docs/setup_legale.md.)

2. Types of data we collect

Contact data: name, surname, email, phone, company name, role.
Navigation data: anonymized IP, pages visited, time on site.
Commercial data: interaction history, quotes sent, invoices (for paying clients).
Outreach data: for contacted prospects, we hold the publicly-available business email and subsequent interactions (opens, clicks, replies).

3. Purposes of processing

Purpose	Legal basis	Retention
B2B commercial outreach	Legitimate interest (art. 6.1.f)	30-90 days if no reply
Client contract execution	Contract (art. 6.1.b)	Contract duration + 10 years (invoices)
Service communications	Contract (art. 6.1.b)	Contract duration
Marketing to existing clients	Legitimate interest (soft opt-in)	Until opposition
Newsletter / content	Consent (art. 6.1.a)	Until revocation
Tax / legal obligations	Legal obligation (art. 6.1.c)	10 years

4. Legal basis for cold B2B outreach

Sending cold commercial communications to publicly-available business email addresses is based on legitimate interest under art. 6.1.f of EU Regulation 2016/679.

This is limited to:

Publicly findable business addresses (info@, sales@, etc.) — NEVER personal addresses (Gmail, Libero, etc.)
Content relevant to the recipient's business (relevant B2B proposals)
Footer with sender identification and one-click opt-out in every email
Immediate cessation of sending upon recipient request

5. Data sharing

Data may be shared with third parties acting as data processors (with signed DPAs):

Resend (email delivery) — USA, DPF certified
Stripe (payments) — USA, DPF certified
Supabase (database) — USA, DPF certified
Anthropic (AI inference) — USA, DPF certified; no identifying personal data sent
Cloudflare (hosting, DNS, email routing) — USA/EU
Apify (public data scraping) — EU/USA

For paying clients, data may also be shared with: tax advisor (invoicing), Italian Revenue Agency (SDI electronic invoicing).

6. Your rights under GDPR

Access to your data (art. 15)
Rectification of inaccurate data (art. 16)
Erasure ("right to be forgotten", art. 17)
Restriction of processing (art. 18)
Portability (art. 20)
Objection to legitimate-interest processing (art. 21)
Complaint to supervisory authority: Italian Data Protection Authority

To exercise your rights, write to: privacy@bondvx.com. We will respond within 30 days of the request.

7. Opt-out (unsubscribe)

Every outreach email sent by BondVX contains a one-click opt-out link at the bottom. Clicking it removes you permanently from our list.

Alternatively: write to privacy@bondvx.com with subject "Unsubscribe".

8. Cookies and tracking

The bondvx.com site uses only essential technical cookies (session) and aggregated analytics (Cloudflare Web Analytics, IP-anonymized). No third-party profiling cookies.

Outreach emails contain an open-tracking pixel for measuring engagement (aggregated). The pixel is automatically disabled if you click the unsubscribe link.

Details: Cookie Policy.

9. Policy changes

Substantial changes to this privacy policy will be communicated by email to all active clients with at least 30 days notice. The current version is always available at this URL.

10. Contact

For any question on the protection of your personal data:
Email: privacy@bondvx.com
Supervisory authority: www.garanteprivacy.it

← Back to BondVX