This data processing agreement is between Bondstone Global and the Client named below. It was drawn up on 1 November 2026, alongside the Services Agreement between the same parties, and forms part of it.
The parties
Bondstone Global, ABN 46 950 504 862, of Melbourne, Victoria, Australia, which operates Bondstone (“Bondstone”). Bondstone can be reached at sales@bondstone.app.
The Client
- Company name (“the Client”)
- the company named on the order
- Website
- its website
- Registered address
The parties’ roles
The parties’ roles under the UK GDPR for each service are to be confirmed by counsel before first use. This draft assumes that for the Pack, Bondstone collects and supplies public business information on its own account, and the Client decides how it uses what it receives; for the Programme, the same holds for each month’s pack, and Bondstone also keeps the do-not-contact list up to date from what the Client tells it, so that nobody who asked to be left alone is in a later pack. Nothing in this draft is a conclusion about those roles.
The information
- Public business information: what a business publishes on its own website (its home page; up to six more of its own pages to find how to reach it, those the home page links to about contact, about or team, then common addresses such as /contact, /about and /legal; the privacy, terms, cookie and data processing pages the home page links to; its robots.txt, sitemap and llms.txt; and its careers page, the one the home page links to or /careers), its public DNS records and the certificate its website presents, up to two public job boards its pages link to, its domain’s public registration record (RDAP), the Companies House register (used under the Open Government Licence) and Overture Maps (used under its open licences).
- Where a business publishes a person’s name or work address on its own site or on the register, Bondstone may hold it as part of that business’s record, for contact between businesses about that business.
- The name, email address and role of the Client’s own contact, to run the Services Agreement.
- What the Client tells Bondstone came back: opt-outs, replies and requests to be left alone.
What Bondstone does with it
- It collects business information from public sources only. It never scans or probes a system, logs in anywhere or submits a form on anybody’s site.
- It does not write to sole traders itself. A pack can hold a business that no company registration could be tied to, which may be a sole trader or a partnership; where it does, that business’s row says so, and whether to contact it is the Client’s decision.
- It supplies a pack only to the Client the pack is made for, and never names a business on a public page.
- It keeps a do-not-contact list that covers every channel: email, phone and LinkedIn. Anybody on it is left out of every later pack.
- It honours an opt-out on every channel. Once a business or a person asks to be left alone, Bondstone does not contact them again by any channel, and the pack’s do-not-contact list tells the Client.
What the Client does with it
- It uses a pack for its own firm only, and does not resell it or publish the names in it.
- It decides whom to contact and how, sends from its own mailbox and rings from its own phone.
- It keeps its name, its postal address and a way to opt out in every message it sends.
- It screens numbers against the Telephone Preference Service and the Corporate TPS before an unsolicited sales call.
- It tells Bondstone about every opt-out and every request to be left alone that reaches it, so that the do-not-contact list covers it.
Who helps Bondstone
These companies handle information for Bondstone, each for its own part of the service:
- Railway: hosting the application and its database.
- Cloudflare: DNS, the TLS certificate for Bondstone’s site, and routing email.
- Google Workspace: Bondstone’s email.
- Anthropic: AI reading of the public pages of businesses, and of replies.
- ConnectSafely: Bondstone’s LinkedIn activity.
- Stripe: taking payments.
- Companies House: looking up the public register.
Requests from people
Anybody can ask Bondstone what it holds about them or their business, ask for it to be corrected or deleted, or ask to be left alone, by writing to sales@bondstone.app. When such a request about something in a pack reaches the Client, the Client passes it to Bondstone. The do-not-contact list is kept for good, because it is what stops anybody being contacted again.
The laws named
For the UK businesses Bondstone reads and the Client contacts: the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). In Australia, where Bondstone is based: the Privacy Act 1988 (Cth) and the Spam Act 2003. This agreement says what each party does; it is not a claim that either party has been assessed against any of them.
The law
This agreement is governed by the law of Victoria, Australia.