Who sends, and what the rules say.
You are the sender. Bondstone prepares the list and the words, and sends nothing to the businesses in your pack.
Every city we read today is in the UK, so this page sets out the UK rules. It is a reading of the rules, not legal advice. Where the regulator has said something, we link to it rather than paraphrase it.
Email to businesses in the UK
The Privacy and Electronic Communications Regulations, PECR, draw a line between individual subscribers and corporate subscribers.
Regulation 22 restricts unsolicited marketing email to individual subscribers. A limited company, an LLP or a public body is a corporate subscriber, and can be written to without prior consent. Sole traders and most partnerships are individual subscribers and need consent, so the mail merge carries only businesses tied to a company registration. A business we could tie to none can still be on the call sheet as a number to ring, and its row says the number could be a person's own.
Regulation 23 applies to everybody: a marketing email must not disguise or conceal who sent it, and must give a valid address for opting out. Every message in a pack puts your name in the From line and your postal address in the footer, and goes from your own mailbox, so anybody can reply to it to ask you to stop.
UK GDPR still applies to personal data. A named person's work address is personal data even at a limited company. The pack writes to a role mailbox, such as info@ or office@, where the business publishes one on its own site. Where it publishes only a named person's address, that row is in the mail merge marked as a named person.
The ICO's direct marketing guidance is the authority here, and it is written for firms your size.
Tell us when somebody asks you to stop, and by the next weekday morning, UK time, they are on the do-not-contact list for every channel and out of every later pack. The list is live, and it is checked again on the day a pack is built.
What a finding says, and what it does not
A DMARC policy, an SPF record and an in-date certificate are ordinary hygiene. The NCSC asks every UK organisation to publish them.
A finding in a pack is something a business has published about itself, read on a dated day, and the fix is given away in the first message. Nothing in a pack implies a breach, because nothing was breached, and the words in the mail merge are written so they cannot be read that way.
The city reports carry counts only. No business is named on a public page. A business is named only to an IT firm near it, on a private page or in a pack made for that firm, never on a public page. The same issue at a business never goes to two firms within 90 days.
Bondstone's own outreach
Bondstone is operated from Australia, so its own messages to firms like yours are sent under the Spam Act 2003.
Every email we send is signed by the person who wrote it, with Bondstone's name and our UK postal address, and a reply to it reaches us. On LinkedIn the person writes from their own profile, which names Bondstone, and a reply there reaches us too. If you would rather not hear from us, reply and say so. A reply asking us to stop is honoured everywhere: on email, on LinkedIn and by phone, for good. We have taken advice on how we write to firms, and we follow it.
Questions about any of this?
Ask before you buy. A person answers, and if the honest answer is that we do not know, that is the answer you get.