Privacy Policy

About this Privacy Policy

This Privacy Policy explains how BondMako processes personal data when individuals visit BondMako websites, create or use BondMako accounts, communicate with us or otherwise interact with Services for which BondMako acts as controller.

Where BondMako processes personal data on behalf of a business Customer, BondMako normally acts as a processor and the Customer acts as the controller. Such processing is governed by the applicable Data Processing Agreement and the Customer’s own privacy obligations.

1. Controller

The controller for processing described in this Privacy Policy is:

BondMako UG (haftungsbeschränkt)

Rohrdamm 65

13629 Berlin

Germany

Commercial Register: Amtsgericht Charlottenburg

HRB 292270 B

Privacy contact: privacy@bondmako.com

If BondMako appoints a formally designated Data Protection Officer, the relevant contact information will be published in this section.

2. Data we may process

Depending on the Services used, we may process:

Account and identity information

This may include name, business email address, organisation, user ID, workspace membership and account preferences.

Authentication information

This may include authentication identifiers, security events, session information and authentication-provider information.

Where a user chooses sign-in through an external provider such as Google, Microsoft or Apple, we receive the account information made available to BondMako through that authentication process.

Where passkeys are used, BondMako receives the authentication credential necessary to validate the passkey. Biometric recognition performed locally by a user’s device is not itself supplied to BondMako simply because the user authenticates using device biometrics.

Business and workspace information

This may include organisation names, roles, workspace configuration, permissions and other information required to administer Services.

Billing and transaction information

This may include subscription information, invoice details, billing contacts, transaction status and information required for tax and accounting obligations.

Payment-card details may be processed directly by the relevant payment provider rather than stored by BondMako where the payment flow is structured that way.

Technical and security information

This may include IP address, browser or device information, operating system, timestamps, application events, logs, security events, approximate location derived from IP address and diagnostic information.

Communications

We process messages and information provided when individuals contact support, legal, privacy, billing or other BondMako teams.

Usage information

We may process information concerning the way Services are accessed and used where necessary for operation, security, troubleshooting, service improvement and permitted analytics.

Customer Data

Customers may submit information about their personnel, clients, guests, patients, suppliers or other persons into BondMako Services.

For such data, BondMako generally processes the information on the Customer’s behalf as processor, rather than for BondMako’s independent purposes.

Certain Services may permit Customers to process sensitive or special-category information. The Customer remains responsible for determining whether such processing is lawful and for providing instructions to BondMako under the relevant DPA.

3. Purposes and legal bases

BondMako may process controller-side personal data for the following purposes.

Providing accounts and Services: processing necessary to create accounts, authenticate users, deliver Services and perform contractual obligations. Legal basis: Article 6(1)(b) GDPR where applicable.

Security and fraud prevention: detecting abuse, securing accounts, maintaining logs, defending infrastructure and protecting users. Legal basis: Article 6(1)(f) GDPR, based on BondMako’s legitimate interest in protecting its systems and customers.

Billing, tax and accounting: issuing invoices, administering payments and keeping mandatory business records. Legal bases may include Article 6(1)(b) and Article 6(1)(c) GDPR.

Support and communications: responding to requests and managing the customer relationship. Legal bases may include Article 6(1)(b) and Article 6(1)(f).

Compliance and legal claims: complying with legal obligations and establishing, exercising or defending legal claims. Legal bases may include Article 6(1)(c) and Article 6(1)(f).

Product improvement and reliability: diagnosing failures, analysing service performance and improving Services where compatible with users’ rights and expectations. Legal basis: Article 6(1)(f), or consent where consent is legally required.

Marketing: sending marketing communications where permitted by applicable law. Processing may rely on consent or another lawful basis where permitted. Recipients may unsubscribe from electronic marketing using the mechanism provided.

4. Customer-controlled processing

Where a Customer uses BondMako to process personal data for its own purposes, the Customer generally determines:

• why the information is processed;

• which persons’ information is included;

• which information is entered;

• who may access it; and

• how long the Customer requires it.

In these circumstances the Customer is generally the controller and BondMako is its processor.

Requests concerning Customer-controlled data should normally be directed to the relevant Customer.

BondMako supports Customers in fulfilling applicable processor obligations in accordance with the DPA.

5. Cookies, local storage and similar technologies

BondMako may use cookies, local storage and comparable technologies necessary for functions such as:

• sign-in and authentication;

• security;

• session continuity;

• user preferences; and

• load balancing or technical operation.

Technologies that are not strictly necessary will be used only where the legally required basis has been established, including consent where required.

Where BondMako deploys non-essential analytics, advertising or comparable technologies, the relevant consent controls and information should be presented before those technologies are activated.

6. Authentication providers

If a user chooses an external authentication provider, relevant account and authentication information may be exchanged with that provider.

The provider may process data under its own privacy terms for its independent services.

BondMako processes authentication data only to the extent required to authenticate, secure and administer access to the Services and for related security purposes.

7. Service providers and recipients

BondMako may disclose personal data where necessary to categories of recipients such as:

• cloud hosting and infrastructure providers;

• authentication and identity providers;

• payment and billing providers;

• email and communications providers;

• security and monitoring providers;

• customer-support providers;

• professional advisers;

• auditors;

• governmental or judicial authorities where legally required; and

• processors and subprocessors required to operate the Services.

8. International data transfers

Where personal data is transferred outside the European Economic Area, BondMako will use a transfer mechanism permitted under GDPR Chapter V where required.

This may include an adequacy decision or appropriate safeguards such as Standard Contractual Clauses, together with supplementary measures where necessary.

9. Retention

BondMako retains personal data only for as long as reasonably necessary for the purpose for which it was collected or as required by law.

Retention may vary according to the category of information.

Account information may be retained while an account remains active and for an appropriate period afterwards.

Security logs may be retained for a limited period necessary for investigation, prevention and security assurance.

Invoices, accounting records and legally required business records may be retained for applicable statutory retention periods.

Support communications may be retained for an appropriate period for service continuity, dispute handling and legitimate business records.

Customer Data processed on behalf of Customers is retained and deleted in accordance with the Customer agreement, DPA, applicable product settings and applicable law.

10. Security

BondMako uses technical and organisational safeguards appropriate to the nature of the Services and relevant risks.

Measures may include, as appropriate:

• access controls;

• encryption;

• authentication controls;

• logging and monitoring;

• backup and recovery procedures;

• environment separation;

• vulnerability management; and

• least-privilege access.

No internet-based service can guarantee absolute security.

11. Data-subject rights

Subject to the conditions and limitations of applicable law, individuals may have rights including:

• access to personal data;

• correction of inaccurate data;

• erasure;

• restriction of processing;

• data portability;

• objection to certain processing; and

• withdrawal of consent where processing is based on consent.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Requests concerning data for which BondMako is controller may be sent to:

privacy@bondmako.com

Where BondMako processes data solely on behalf of a Customer, we may refer the request to the relevant Customer or assist that Customer in responding.

12. Automated decision-making

BondMako Services may contain AI and automated features.

Unless expressly disclosed for a specific Service, BondMako does not intend its controller-side processing to subject individuals to decisions based solely on automated processing that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.

Customers remain responsible for assessing their own use of automated functionality where they determine the purposes and means of processing.

13. Children’s data

BondMako is a B2B service and is not directed to children as customers.

Where a Customer lawfully processes information concerning children through a BondMako Service, such data is processed on the Customer’s instructions and subject to the applicable DPA.

14. Complaints

Individuals have the right to lodge a complaint with an appropriate data-protection supervisory authority.

BondMako is established in Berlin. The Berlin supervisory authority is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit

Alt-Moabit 59–61

10555 Berlin

Germany

Email: mailbox@datenschutz-berlin.de

15. Changes to this Privacy Policy

BondMako may update this Privacy Policy where Services, processing operations or legal requirements change.

The current version will display its effective or last-updated date.

Material changes will be communicated where required or reasonably appropriate.

16. Contact

Privacy questions and requests:

privacy@bondmako.com

BondMako UG (haftungsbeschränkt)

Rohrdamm 65

13629 Berlin

Germany