Privacy policy

5.1 Controller

Bunny Honey Club S.R.L. (Trassa), Strada Petricani 4, Demisol Boxa Nr. 10, 023842 București, Romania. J2024009993406 · RO50157240 · represented by Arthur Hof. For anything concerning data, and for objections: privacy@trassainfra.com, phone +49 163 7830812. A data protection officer is not required by law here (art. 37 GDPR); the address above is responsible.

5.2 We process the data of two groups of people

This policy covers (a) suppliers and their staff whom we approach or who receive the report, and (b) people who appear in the award data we publish. The second group is rarely considered — here it is explicit: §5.5.

5.3 (a) Suppliers we approach

Categories: company name, legal form, address, switchboard number, the e-mail address your company publishes (usually a general address; for a sole trader, or where the company gives a personal address as its contact, that one too), website, product classes, delivery regions; the name, role, business contact details and public professional profile (e.g. LinkedIn) of decision-makers at your company — including people we have not yet spoken to; call notes, consents, objections; the text of your replies to us with the technical header lines of the e-mail; whether and when the sample page made for your company was opened (§5.7). Source: public registers — RO: ANAF, Registrul contribuabililor · DE: Handelsregister / Unternehmensregister · AT: Firmenbuch · MD: ASP, Registrul de stat · UA: ЄДР · and the public company register of every other country we write to — Romania's award notices in SICAP (the contact details an awarded company itself gave there), the award notices published on TED, the EU's Official Journal (the name, town and e-mail address an awarded company gave there), plus your own company website and public exhibitor and business directories. The name, role and profile of a contact person come from LinkedIn or from a page your company publishes of its own accord (team, contact, about or press page) — never from the legal notice (Impressum) and never from a register: what a company publishes only because the law requires it, we do not use to approach a person. Art. 14 information: on the phone on request, in the e-mail after a consent and on every sample page as the short notice; a LinkedIn connection request names only the notice page trassainfra.com/en/notice, and only the first message after the request is accepted carries the short notice in full; a first e-mail without earlier contact has not carried the short notice since 8 October 2026 — it is plain text and ends with its signature; the short notice is on the sample page our second e-mail links and in the privacy notice of the domain the e-mail comes from. Purposes and legal bases:

• approaching you and sending the personalised sample, to show you published contract awards in your

product class — legitimate interest (art. 6(1)(f)): our interest in B2B direct approach and your interest in relevant business opportunities; balanced by using the contact details your company publishes itself and approaching by name only decision-makers whom LinkedIn or a page of their own company names — each of them receives the art. 14 information or, with a LinkedIn connection request, the pointer to it —, by every approach having a concrete occasion, and by an objection that works by any route and for every channel: a reply such as "stop" to any of our e-mails, the link on the sample page, the form at trassainfra.com/en/object, or an e-mail to privacy@trassainfra.com;

• a first business e-mail to the e-mail address your company publishes and at most one follow-up, sent from

our sending domains mandarestudio.com and mandare-labs.com — legitimate interest (art. 6(1)(f)): the address comes from a public award notice or from your company's website; we write to companies, with one concrete contract in your product class as the occasion, and never again after an objection. Where that address belongs to a sole trader, or is a personal address (such as firstname.lastname@) that the company itself publishes as its contact, we write to it as well: anyone who runs a business can be our customer. The first e-mail is plain text, ends with its signature and names neither Bunny Honey Club S.R.L., nor where the address came from, nor a way to object; the follow-up links your company's sample page, which carries these details and the objection link. A reply such as "stop" to either e-mail is enough to object. There is no consent for these e-mails, and we do not claim one;

• sending the weekly report — consent (art. 6(1)(a)), withdrawable at any time;
• entering into and performing a subscription — art. 6(1)(b);
• evidencing consents and objections, and statutory record-keeping — art. 6(1)(c) and (f).

Calls are not recorded. We note the date, time, the person, the outcome and the exact wording of any consent given.

5.4 Retention

• Prospect data: until you object, at most 24 months after the last contact.
• Consent and objection evidence: 5 years (the duty to demonstrate consent, art. 7(1) GDPR).
• Suppression list (objections): indefinitely — company, contact address and the date of the objection;

it is the only way to not approach you again (art. 21(3) GDPR).

• Page views: IP address truncated immediately (IPv4 to /24, IPv6 to /48), user agent 30 days.
• A trial that ends without payment and without an invoice: 12 months after it ends, with every delivery.
• Contract and accounting records: as Romanian commercial and tax law requires.

5.5 (b) People who appear in the award data we publish

We process Romania's official award notices (SICAP / e-licitatie.ro, families CAN and SCNA), those of the Republic of Moldova (MTender) and the notices published on TED (the EU's Official Journal) by contracting authorities in Germany, Austria, France, the Netherlands, Spain, Poland, Belgium, Portugal, Italy, the Czech Republic, Hungary and Switzerland. Besides company data, those notices sometimes contain contact details relating to a natural person. Source: the public notices named above. Purpose: informing suppliers who has been awarded a public contract and what work it covers. Legal basis: legitimate interest (art. 6(1)(f)) in analysing already published award information. What we deliberately do not do: we publish company-level contact data only — the switchboard number, the general address. The mobile number of a named individual is never published and never sent; our processing filters it out. Your rights apply unchanged: access, rectification, erasure and objection at privacy@trassainfra.com. On objection we name you on none of our pages and in none of our reports — nor the address you objected from. The official notice itself, and our copy of it, we do not change: it is public and stays as published.

5.6 Recipients and processors

We pass data only to service providers working for us; the encrypted backup copy of our database is also kept in Apple iCloud, and only we hold the key. Where a processor agreement under art. 28 GDPR is in place with a provider, it is stated next to that provider.

• Vercel — serving the website and the sample pages, and processing what you send us through the site: the report form, the objection and the appointment booking (serverless functions in Frankfurt, EU). Processor agreement under art. 28 GDPR.
• Supabase — storing page events, consents, objections and booking data. Processor agreement under art. 28 GDPR.
• Resend — sending consented e-mail, the confirmation e-mail of a sign-up for the report and the confirmation of an objection. Processor agreement under art. 28 GDPR.
• IONOS — the mailboxes and sending of the domains mandarestudio.com and mandare-labs.com, from which the first e-mail to companies and the one follow-up leave and in which replies to them arrive (IONOS SE, Germany).
• Cal.com — appointment booking, if you use our booking link: your name, e-mail address, the chosen time and your answers to the booking questions are then processed by Cal.com, Inc. (USA) under its own privacy policy (cal.com/privacy; Cal.com states that transfers to the USA rest on the EU standard contractual clauses or the EU-US Data Privacy Framework). Using the link is optional: you can arrange the call just as well by phone on +49 163 7830812 or by e-mail to info@trassainfra.com — then nothing goes through Cal.com.
• Cloudflare — registrar and DNS for our domain, and forwarding of all e-mail to our addresses, including objections sent to privacy@trassainfra.com. Processor agreement under art. 28 GDPR.
• Google Workspace — the mailbox where your replies and objections arrive and are read, and through which we send our internal operational alerts. Processor agreement under art. 28 GDPR.
• Anthropic — AI service of Anthropic PBC (USA), which we use to research contact persons named in public sources and to pre-sort incoming replies and award notice texts. Anthropic processes this data under its own privacy policy (anthropic.com/legal/privacy; Anthropic states that transfers to third countries rest on adequacy decisions or the EU standard contractual clauses).

Where a transfer to a third country occurs, it rests on the EU standard contractual clauses for the providers with a processor agreement, and for Cal.com and Anthropic on the basis each states above. We do not pass data to third parties for their own marketing, and we do not sell address lists.

5.7 Cookies and audience measurement

This site sets no advertising or analytics cookies and embeds no ad networks. To know whether a sample page was opened, and whether it was printed or saved as a PDF (the browser's print command), we store for each event the time, the kind of event ("opened" or "printed"), the page token, a truncated IP address (IPv4 /24, IPv6 /48) and the user agent. Each sample page belongs to exactly one company; where we sent its link to a person known by name, a visit can be attributed to that person. We use it to decide whether and when to approach the company again.

5.8 Your rights

Access (art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection to direct marketing (21) — at any time, without giving reasons, with immediate effect, and withdrawal of consent (art. 7(3)). We carry out no automated decision-making or profiling within the meaning of art. 22. The fastest route: object in one click or privacy@trassainfra.com. Right to complain: ANSPDCP, B-dul G-ral. Gheorghe Magheru 28-30, 010336 Bucharest, Romania (anspdcp.ro). You may also contact the supervisory authority where you live or work.

5.9 Version

This policy applies from 24.10.2026. Earlier versions on request.