Legal document
Privacy policy.
We collect a name, an email address and the text of a message from one form. Everything you need to know about that is below — no cross-references to three other documents.
Version of 9 September 2026
Who is responsible for your data
Bold Banana is a sole trader business (self-employed) run by Mariusz Krawczyk from West Yorkshire in the United Kingdom; Mariusz Krawczyk is the data controller. For anything concerning your data, write to boldbanana.agency@gmail.com. We have not appointed a data protection officer and, at our scale, we are not required to. Trading name: BoldBanana Agency. Postal address for data protection correspondence: 4 Lynwood Crescent, WF9 5DU Fitzwilliam, UK.
What we collect
From the contact form: your name, email address, the text of your message, the consent confirmation, the language of the page, and the date and time it was sent. You can optionally provide a chosen package, business type, budget range and intended start date. We do not enrich this data from other sources. If you put anything extra in the message itself — a phone number, a company name — it reaches us with the message.
Why, and on what legal basis
There is one purpose: to answer your message and, if you want, to talk about working together. The legal basis is your consent — Article 6(1)(a) UK GDPR — given by ticking the box next to the form. You can withdraw it at any time with a single email to boldbanana.agency@gmail.com; withdrawal does not undo what we lawfully did before. We run no newsletter and we do not use this data for marketing.
How long we keep it
We keep the message and contact details for 24 months from the last exchange on that matter, then delete them from the database. If the conversation turns into a commission, the data needed for invoicing is kept for as long as tax and accounting law requires. You can ask for earlier deletion — we delete without asking why.
Who else sees it
We do not sell data and we do not pass it on for marketing. Three providers process it on our behalf: Vercel Inc. (site hosting), Supabase Inc. (the database the form writes to) and Resend Inc. (email delivery — a confirmation to you and an internal notification; we pass your name, email address and the full text of your message). Apart from them, only Mariusz, the sole trader, has access to submissions. The Supabase database is located in Stockholm, Sweden (eu-north-1). The site’s Vercel server functions process submissions in the Washington, D.C., USA region (iad1). Resend stores customer data, including message content and delivery logs, in the USA, regardless of the sending region. Form data is therefore processed outside the United Kingdom and, by Vercel and Resend, also outside the European Economic Area. Resend describes transfer safeguards in its Data Processing Addendum (DPA), including Standard Contractual Clauses and the UK Addendum. The sending region and retention period for our Resend account, and documentation of transfer safeguards for the complete flow, still need to be confirmed.
Your rights
You have the right to access your data and get a copy, to rectification, erasure, restriction of processing, data portability, objection to processing, and withdrawal of consent. To use any of them, one email to boldbanana.agency@gmail.com is enough — we reply within a month at the latest. We do not profile anyone and we make no automated decisions.
Complaint to a supervisory authority
If you believe we process your data unlawfully, you can complain to the UK supervisory authority — the Information Commissioner's Office (ico.org.uk). If you live in the European Union, you can also approach the authority for your country; in Poland that is the President of the Personal Data Protection Office.
Cookies and statistics
Until you decide in the banner on the site, we load no analytics tools and no advertising pixels — nothing tracks in the background. We store your choice only in the browser’s localStorage, not in a cookie, and only after you click “Allow” or “Decline”. If you allow analytics, we run Google Analytics 4 (GA4) — a service of Google Ireland Limited. GA4 collects information about how the site is used: visited page addresses, approximate region, device and browser type, time on site and referral source; GA4 cookies may appear (including _ga, _ga_*). We do not ask GA4 for a name or email address. The legal basis is your consent — Article 6(1)(a) UK GDPR. You can withdraw it at any time: click “Privacy settings” in the footer or on this page — the banner returns and you can decline; after a decline the GA4 script is not started. Separately from analytics, a technical NEXT_LOCALE cookie may remember your chosen language — it does not identify a person and it is not used to follow you across sites.
Security
Submissions go into a database with Row Level Security enabled. The key published in the application can only insert a new row — it cannot read any row, including yours. Only Mariusz, the sole trader, reads submissions after signing in to the database panel. The connection to the site is encrypted (HTTPS).
Changes to this document
If we change how we process data, we change this document and the date next to its heading. If a change matters to people who have already written to us, we will tell them by email.
What this document still lacks
One gap remains: confirmation of the ICO registration duty. We do not invent these details.
- The ICO registration number (Data Protection Fee) — the registration duty has to be confirmed and paid.