Privacy policy

1. Who we are

Bon.do ApS, Rantzausmindevej 228, 5700 Svendborg, Denmark, CVR 43473425, is the data controller for personal data collected through bon.do. You can contact us at info@bon.do or +45 22 44 59 22.

This policy explains what we collect, why we collect it, how long we keep it and the rights you have under the GDPR and Danish data protection law.

2. What we collect

We collect the information you give us when you contact us or apply for a job: your name, email address, phone number, company, the content of your message and any files you choose to send.

We also receive technical information that is necessary to serve the website, such as the IP address, browser type and the page requested. This information is processed by our hosting provider to deliver the page and protect the service.

3. Why we use it

We use your contact information to answer your inquiry, prepare a project assessment or estimate, and manage a potential or existing customer relationship. The legal basis is our legitimate interest in answering business inquiries and, where relevant, the steps needed before entering a contract.

We use job application data to assess your application and communicate with you about the recruitment process. The legal basis is our legitimate interest in recruiting, and your consent where we ask for it.

4. Cookies, analytics and advertising

We use a consent banner (Privaci). Apart from the banner itself and the cookieless Cloudflare Web Analytics, no analytics, session-recording or advertising tool is loaded until you have given consent in the banner, and each tool only loads with the category it needs: statistics or marketing. You can change or withdraw your consent at any time from the banner; tools that need the withdrawn category stop loading from the next page.

The tools below are the ones the website can use. Google tags (Google Analytics and Google Ads) are loaded through Google Tag Manager, which itself only loads after you consent to statistics; the other tools are loaded through it as well, and only with the category listed. We do not sell personal data.

What we measure: which pages are seen, which buttons and links are used, how far visitors get in our forms and the booking flow and where they stop (the step, the field that had an error, the time spent on the step), and whether an enquiry, quote request, meeting or job application was completed. These measurements contain fixed values only, such as the form type, the step and a random event id. They never contain your name, email address, phone number, company, message, files or meeting time.

When you send a form or book a meeting after giving consent, we also send that conversion to the tools you consented to from our server, together with the same random event id, so it is counted once. With marketing consent this can include the ad click id from the link you arrived through (for example gclid, msclkid, fbclid or li_fat_id), which we keep in your browser for up to 90 days.

• Privaci: the consent banner. It stores your choice (privaci_consent) so we can respect it. Consent category: necessary (no consent needed).
• Cloudflare Web Analytics: cookieless page-view and performance statistics, without identifying individual visitors. Consent category: necessary (no consent needed).
• Google Tag Manager: loads the Google tags and the other tools listed here, each only with its consent. It sets no cookies itself. Consent category: statistics.
• Google Analytics 4: statistics on pages, buttons and the steps of our forms (cookies _ga, _ga_*). No Google Signals, no ad personalisation. Consent category: statistics.
• Google Ads: measures which Google ads lead to an enquiry, quote request or booked meeting (cookies such as _gcl_au). Consent category: marketing.
• Microsoft Clarity: session recordings and heatmaps that show how the pages and forms are used, with form input masked (cookies _clck, _clsk). Consent category: statistics.
• Microsoft Advertising (UET): measures which Microsoft Advertising (Bing) ads lead to an enquiry (cookies _uetsid, _uetvid). Consent category: marketing.
• Meta Pixel: measures which Facebook and Instagram ads lead to an enquiry (cookies _fbp, _fbc). Consent category: marketing.
• LinkedIn Insight Tag: measures which LinkedIn ads lead to an enquiry (cookies such as li_fat_id and lidc). Consent category: marketing.

5. Who we share it with

We share personal data with service providers who help us run the website and our business, such as hosting, email, project management and accounting providers. They process the data on our instructions and under a data processing agreement.

We may also disclose data if we are required to do so by law, or to establish, exercise or defend a legal claim. We do not sell personal data.

6. Transfers outside the EU/EEA

Some of our providers are based outside the EU/EEA, including in the United States. Where that happens, we rely on an adequacy decision, the EU-US Data Privacy Framework, or Standard Contractual Clauses with supplementary measures.

7. How long we keep it

Contact inquiries are kept for up to 24 months after the last contact, unless a customer relationship or a legal obligation requires a longer period. Job applications are kept for up to 12 months after the recruitment process ends, unless you ask us to delete them earlier.

Hosting logs are kept for a short period, normally no more than 30 days, and are used for security and troubleshooting.

8. Security

We use TLS for all traffic, access control on our systems, least-privilege access for the people who need it, and encrypted storage where it matters. No system is perfect, but we work to keep the data we hold to the minimum and the access to it deliberate.

9. Your rights

You have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to receive your data in a portable format. You can withdraw a consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise a right, email info@bon.do. We will respond within one month. If you are not satisfied, you can complain to the Danish Data Protection Agency, Datatilsynet, at datatilsynet.dk.

10. Changes

We may update this policy when the way we work changes. The current version is always on this page, with the date at the top. If a change is significant, we will make it clear on the site.