Privacy policy

Last updated: 21 October 2026

This policy explains how personal data is processed on the Boneleads website and service, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), Spain's national data protection act.

1. Data controller

2. What data we process and why

2.1. Customers and registered users

• Data: name, company, email address, encrypted password (or Google identifier if you sign in with Google), account usage data and, when you connect a mailbox, the credentials needed to send emails and read replies.
• Purpose: to create and manage your account, provide the service, send you necessary emails (verification, password recovery, service notices) and answer your queries.
• Legal basis: performance of a contract (art. 6.1.b GDPR) and, for the security of the service, legitimate interests (art. 6.1.f GDPR).

2.2. Contact persons at companies in the index

• Data: business details published by the companies themselves (trading name, website, contact email and phone number, sector and location) and the results of the technical analysis of their website.
• Source: publicly accessible sources and the companies' own websites.
• Purpose: to provide customers with a company search tool for business-to-business prospecting.
• Legal basis: legitimate interests (art. 6.1.f GDPR) in B2B prospecting, limited to business data published by the companies themselves.
• If you appear in the index and would rather not, email us at hola@boneleads.com and we'll remove you.

2.3. Visitors to this website

We measure visits with Umami, an analytics tool installed on our own servers that uses no cookies and does not store your IP address: we only get aggregate data such as pages viewed, country, language or browser. We do not use advertising tools. The server also keeps technical logs (IP address, date and page requested) for a limited time for security purposes.

3. Recipients and processors

We do not sell or share your data. The providers that supply services we need (hosting and email delivery) may access it under a data processing agreement. If any of them processes data outside the European Economic Area, this will be done with the safeguards provided for in the GDPR, such as standard contractual clauses.

4. Retention

We keep account data while the account is active and afterwards for the statutory limitation periods. Technical logs are kept only for as long as strictly necessary for security. Addresses that unsubscribe are kept on the suppression list to make sure they are never contacted again.

5. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by emailing hola@boneleads.com and stating which right you are exercising. If you feel we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority in your country.

6. Security

We apply appropriate technical and organisational measures: encrypted connections, hashed passwords, separation of each customer's data and restricted access to our systems.

7. Changes

If we change this policy, we will publish the new version on this page with its update date and, if the change is significant, we will let customers know by email.