Launchpad Pro — Data Processing Agreement
EARLY DART LTD
Version 1.0 — Last updated: 13 September 2026
Parties and incorporation
This Data Processing Agreement (“DPA”) is entered into between:
EARLY DART LTD, a company registered in England and Wales with company number 16156441, whose registered office is at Tall Trees, Beehive Lane, Moulton, Northwich, Cheshire, CW9 8NT (“Early Dart”, “we”, “us”, “Processor”); and
the customer who has accepted the Launchpad Pro Terms of Service (“Customer”, “you”, “Controller”).
Each a “Party” and together the “Parties”.
This DPA is incorporated into and forms part of the Launchpad Pro Terms of Service (the “Agreement”) and takes effect on the date you accept the Agreement. Where this DPA conflicts with any other part of the Agreement on a matter of data protection, this DPA prevails. Where the Standard Contractual Clauses, the International Data Transfer Agreement or the UK Addendum apply, those prevail over this DPA to the extent of any conflict.
1. Definitions
“Applicable Data Protection Law” means all law applicable to the processing of Customer Personal Data, including the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), and — where applicable to a Party — the EU GDPR (Regulation (EU) 2016/679), in each case as amended or replaced from time to time.
“Customer Personal Data” means personal data that Early Dart processes on behalf of the Customer in the course of providing the Services. It does not include the Customer’s own account and billing data, which Early Dart processes as controller under the Privacy Policy.
“Data Subject Request” means a request from a data subject to exercise rights under Chapter III of the UK GDPR.
“IDTA” means the International Data Transfer Agreement issued by the Information Commissioner under section 119A of the Data Protection Act 2018, as revised from time to time.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
“Restricted Transfer” means a transfer of Customer Personal Data to a country or international organisation outside the UK that is not covered by UK adequacy regulations.
“Services” means the Launchpad Pro platform and related services provided under the Agreement.
“Sub-processor” means any third party engaged by Early Dart to process Customer Personal Data.
“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018.
“UK GDPR” means Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.
The terms “controller”, “processor”, “personal data”, “data subject”, “processing”, “special categories of personal data” and “supervisory authority” have the meanings given in the UK GDPR.
Capitalised terms not defined here have the meaning given in the Agreement.
2. Roles and scope
2.1 Roles
- Where the Customer is the controller of Customer Personal Data, Early Dart is the Customer’s processor.
- Where the Customer is itself a processor acting for its own clients, Early Dart is the Customer’s sub-processor, and the Customer warrants that it has authority from its clients to appoint Early Dart on these terms.
- In respect of the Customer’s own account, billing, support and marketing data, Early Dart is a controller in its own right, and that processing is governed by the Privacy Policy, not this DPA.
2.2 Duration
This DPA takes effect on the date the Agreement takes effect and continues for as long as Early Dart processes Customer Personal Data.
2.3 Scope
This DPA applies to all processing of Customer Personal Data, wherever it originates and wherever it is processed.
2.4 Annexes
The following Annexes form part of this DPA:
- Annex 1 — Details of Processing
- Annex 2 — Technical and Organisational Measures
- Annex 3 — Approved Sub-processors
- Annex 4 — International Transfers and the UK IDTA / UK Addendum
3. The Customer’s obligations
The Customer:
- warrants that it has a valid lawful basis under Article 6 UK GDPR (and, where special category data is involved, a condition under Article 9 UK GDPR and Schedule 1 of the Data Protection Act 2018) for every processing operation it instructs Early Dart to carry out;
- warrants that it has provided all privacy information required by Articles 13 and 14 UK GDPR to the relevant data subjects;
- warrants that its instructions to Early Dart will not cause Early Dart to breach Applicable Data Protection Law;
- is solely responsible for the accuracy, quality and legality of Customer Personal Data and the means by which it was acquired;
- is solely responsible for compliance with PECR in respect of every marketing communication sent using the Services, including obtaining and evidencing consent, screening against the TPS and CTPS, identifying the sender, and honouring opt-outs;
- must not load special category personal data or criminal offence data into the Services without first notifying Early Dart in writing at contact@earlydart.com, so that the Parties can agree appropriate additional safeguards. The Customer accepts that the Services are not designed for, and are not warranted as suitable for, the processing of health data, and that no NHS Data Security and Protection Toolkit assurance is given;
- must set and apply appropriate retention periods for Customer Personal Data using the controls available in the Services, and must delete or anonymise data that is no longer required;
- is registered with the ICO and pays the data protection fee, unless exempt; and
- will maintain its own record of processing activities under Article 30(1) UK GDPR.
4. Early Dart’s obligations
Early Dart will:
4.1 Process only on documented instructions
Process Customer Personal Data only on the Customer’s documented instructions, including in respect of transfers outside the UK, unless required to do otherwise by law — in which case Early Dart will inform the Customer of that legal requirement before processing, unless the law prohibits it on important grounds of public interest.
The Agreement, this DPA and the Customer’s use of the Services’ configuration options constitute the Customer’s documented instructions. Additional instructions must be agreed in writing and may be chargeable where they require material additional work.
4.2 Tell the Customer if an instruction appears unlawful
Immediately inform the Customer if, in Early Dart’s reasonable opinion, an instruction infringes Applicable Data Protection Law.
4.3 Confidentiality
Ensure that every person authorised to process Customer Personal Data is subject to a binding contractual or statutory duty of confidentiality, has been trained in data protection, and has been subject to appropriate background checks where the role warrants it.
4.4 Security
Implement and maintain the technical and organisational measures set out in Annex 2, appropriate to the risk, as required by Article 32 UK GDPR. Early Dart may update those measures provided the overall level of security is not reduced.
4.5 Access limitation
Limit access to Customer Personal Data to those personnel who need it to perform the Services, applying role-based access control and least-privilege principles.
4.6 No use for own purposes
Not use Customer Personal Data for its own purposes, and in particular not sell, rent or licence it, and not use it to train general-purpose AI models. Early Dart may generate aggregated, anonymised statistical data from the operation of the Services, provided that data cannot be used to identify the Customer, its clients or any data subject.
4.7 Record of processing
Maintain a record of processing activities carried out on behalf of the Customer, as required by Article 30(2) UK GDPR, and make it available to the Customer or the ICO on request.
5. Sub-processors
5.1 General authorisation
The Customer gives Early Dart general written authorisation to engage sub-processors, subject to this clause 5.
5.2 Existing sub-processors
The Customer authorises the sub-processors listed in Annex 3 and published at earlydart.com/legal/sub-processors.
The Customer acknowledges and accepts that Launchpad Pro is delivered using licensed third-party platform infrastructure, and that the identity of that provider and its own sub-processors is disclosed in Annex 3. Early Dart is required by Article 28(2) UK GDPR to make this disclosure and cannot withhold it.
5.3 Adding a sub-processor
Before engaging a new sub-processor, Early Dart will give the Customer at least 30 days’ written notice, identifying the sub-processor, the processing it will carry out and where it is located. The Customer may ask to be notified of changes as described on the sub-processors page.
5.4 Objection
The Customer may object on reasonable data-protection grounds within 30 days of notice, by written notice to contact@earlydart.com stating the sub-processor objected to and the reason.
If the Customer objects, the Parties will work together in good faith to find a commercially reasonable solution. If no solution is available within 30 days, the Customer may terminate the affected part of the Services, or the Agreement in full, on written notice, with a pro-rata refund of any prepaid Fees for the unused period and no further Fees due.
If no objection is received within 30 days, the Customer is deemed to have consented.
5.5 Terms with sub-processors
Early Dart will:
- carry out due diligence on each sub-processor before engagement;
- impose on each sub-processor, by written contract, data protection obligations that are no less protective than those in this DPA, to the extent relevant to the services that sub-processor provides; and
- restrict each sub-processor’s access to only what is necessary to provide those services.
5.6 Liability for sub-processors
Early Dart remains fully liable to the Customer for the performance of each sub-processor’s data protection obligations.
6. Data subject rights
6.1 Customer responsibility
The Customer is responsible for receiving, assessing and responding to Data Subject Requests relating to Customer Personal Data, within the statutory time limits.
6.2 Requests received by Early Dart
If Early Dart receives a Data Subject Request relating to Customer Personal Data, it will:
- not respond to the request other than to acknowledge it and direct the data subject to the Customer, unless legally required to respond or instructed by the Customer to do so;
- notify the Customer without undue delay and in any event within 3 business days, passing on the request and any supporting information; and
- comply promptly with the Customer’s documented instructions regarding the response.
6.3 Assistance
Taking into account the nature of the processing, Early Dart will assist the Customer by appropriate technical and organisational measures, insofar as possible, to fulfil the Customer’s obligation to respond to Data Subject Requests — including by providing search, export, correction and deletion tooling within the Services.
Where assistance goes materially beyond the self-service functionality of the Services, Early Dart may charge at its then-current professional services rates, notified in advance.
7. Personal data breach
7.1 Notification
Early Dart will notify the Customer without undue delay, and in any event within 24 hours, of becoming aware of a Personal Data Breach affecting Customer Personal Data. The 24-hour period is deliberately shorter than the Customer’s own 72-hour deadline under Article 33 UK GDPR, so that the Customer has time to assess and notify the ICO.
7.2 Contents of notification
The notification will describe, to the extent known and in as much detail as reasonably possible:
- the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned;
- the likely consequences of the breach;
- the measures taken or proposed to address it, including to mitigate its adverse effects; and
- the name and contact details of Early Dart’s data protection contact.
Where the information cannot all be provided at once, Early Dart will provide it in phases without undue further delay.
7.3 Response
On becoming aware of a Personal Data Breach, Early Dart will:
- immediately take reasonable steps to contain the breach and secure the affected data;
- investigate the cause;
- assist the Customer in meeting its obligations under Articles 33 and 34 UK GDPR, including any obligation to notify the ICO or affected data subjects;
- preserve relevant evidence and logs; and
- take reasonable steps to prevent recurrence, and report to the Customer on the remediation undertaken.
7.4 No admission
Notifying or responding to a Personal Data Breach is not an admission of fault or liability by Early Dart.
7.5 Customer’s obligations
The Customer is responsible for deciding whether a breach must be notified to the ICO or to data subjects, for making those notifications within the statutory deadlines, and for bearing the cost of doing so — except where the breach was caused by Early Dart’s breach of this DPA, in which case clause 12 applies.
8. Data protection impact assessments
Taking into account the nature of the processing and the information available to it, Early Dart will provide reasonable assistance to the Customer with:
- data protection impact assessments under Article 35 UK GDPR;
- prior consultation with the ICO under Article 36 UK GDPR; and
- demonstrating compliance with Article 32 UK GDPR.
Early Dart will make available its security documentation, penetration test summaries and Annex 2 measures to support this. Assistance beyond providing existing documentation may be chargeable at Early Dart’s then-current rates, notified in advance.
9. Audit
9.1 Information
Early Dart will make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 UK GDPR and this DPA.
9.2 Audits
Early Dart will allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer, subject to the following:
- the Customer must give at least 30 days’ written notice, except where the audit follows a Personal Data Breach or is required by a supervisory authority, in which case reasonable shorter notice applies;
- audits may be carried out no more than once in any 12-month period, except following a Personal Data Breach or where required by a supervisory authority;
- audits must be carried out during normal business hours, must not unreasonably disrupt Early Dart’s business, and must not compromise the confidentiality or security of other customers’ data;
- the auditor must sign a reasonable confidentiality undertaking and must not be a competitor of Early Dart;
- the Customer bears its own costs, and will reimburse Early Dart’s reasonable costs at its then-current professional services rates where the audit requires more than 2 person-days of effort — except where the audit identifies a material breach of this DPA by Early Dart, in which case Early Dart bears its own costs; and
- Early Dart may satisfy an audit request by providing an up-to-date third-party audit report, certification or penetration test summary, where that reasonably addresses the Customer’s concerns.
9.3 Sub-processor audits
Where the Customer requires an audit of a sub-processor, Early Dart will use reasonable endeavours to exercise its own audit rights against that sub-processor and share the results, subject to confidentiality restrictions.
10. International transfers
10.1 Authorisation
The Customer instructs and authorises Early Dart, and each sub-processor, to transfer Customer Personal Data outside the UK where reasonably necessary to provide the Services, subject to this clause 10 and Annex 4.
10.2 The Customer acknowledges
Customer Personal Data is transferred to and processed in the United States. The underlying platform infrastructure, and several communications, AI and analytics sub-processors, are hosted there. Annex 3 identifies the location of processing for each sub-processor.
10.3 Safeguards
For every Restricted Transfer, Early Dart will ensure that one of the following applies, in this order of precedence:
- an adequacy regulation made under Article 45 UK GDPR — including the UK Extension to the EU–US Data Privacy Framework, where the recipient is validly certified under it and the transfer falls within the scope of that certification;
- the IDTA, incorporated as set out in Annex 4;
- the EU Standard Contractual Clauses as modified by the UK Addendum, incorporated as set out in Annex 4; or
- another safeguard permitted under Chapter V UK GDPR.
10.4 Transfer Risk Assessments
Where Early Dart relies on the IDTA or the UK Addendum, it will carry out and maintain a Transfer Risk Assessment in accordance with ICO guidance, and will make a summary available to the Customer on request.
10.5 Changes to the transfer landscape
If an adequacy regulation is revoked or invalidated, or if a transfer mechanism ceases to be lawful, Early Dart will without undue delay implement an alternative lawful mechanism or, where none is available, cease the affected transfer and notify the Customer. If Early Dart cannot provide the Services without the transfer, either Party may terminate the affected Services on written notice, with a pro-rata refund of prepaid Fees.
10.6 Government access requests
Early Dart will, and will require its sub-processors to:
- require a formally valid legal instrument before considering any request by a public authority for access to Customer Personal Data;
- scrutinise every request for legal validity and challenge or reject any request it reasonably considers invalid, overbroad or unlawful;
- respond as narrowly as possible to any request it is legally obliged to comply with;
- notify the Customer of any such request, unless legally prohibited — and where prohibited, use reasonable and lawful efforts to obtain a waiver or to provide the maximum information it lawfully can;
- not voluntarily disclose Customer Personal Data to a public authority without the Customer’s express agreement, unless legally required; and
- not create or maintain any back door, or modify its business processes to facilitate government access to Customer Personal Data.
Early Dart will notify the Customer if it becomes subject to a legal requirement that prevents it from complying with this clause, and the Customer may then suspend the transfer or terminate the affected Services.
11. Deletion and return
11.1 During the term
Early Dart will provide the Customer with the technical means, consistent with how the Services are provided, to export, correct and delete Customer Personal Data.
11.2 On termination
On termination or expiry of the Agreement, Early Dart will retain Customer Personal Data for 90 days, during which the Customer may reactivate the Account or export its data in a structured, commonly used, machine-readable format.
At the Customer’s written election, made within that 90-day period, Early Dart will delete or return all Customer Personal Data and delete all existing copies. If the Customer makes no election, Early Dart will delete the data at the end of the 90-day period. Early Dart will give the Customer at least 14 days’ notice before deletion.
11.3 Backups
Clause 11.2 does not apply to Customer Personal Data held in backup or archive systems. That data will be securely isolated, protected from further processing, and overwritten on Early Dart’s normal backup rotation cycle, which is 35 days.
11.4 Legal retention
Early Dart may retain Customer Personal Data where required by law, in which case it will retain it only for as long as required, protect its confidentiality, and process it only for the purpose that requires retention.
11.5 Certification
Early Dart will, on written request, provide written confirmation that deletion has been carried out.
11.6 Sub-processors
Early Dart will require each sub-processor to delete or return Customer Personal Data on the same basis.
12. Liability
12.1 General
Subject to clause 12.2 and to Applicable Data Protection Law, each Party’s liability under this DPA is subject to the exclusions and limits of liability in the Agreement.
12.2 Data protection liability
Nothing in the Agreement or this DPA limits:
- either Party’s liability for a fine imposed on it by the ICO for its own breach of Applicable Data Protection Law;
- either Party’s liability to a data subject for compensation under Article 82 UK GDPR, to the extent caused by its own breach; or
- either Party’s liability where the law does not permit limitation.
12.3 Apportionment
Where one Party has paid compensation or a fine in full and the other Party is partly responsible, the Party that paid may claim back from the other the part corresponding to that other Party’s share of responsibility, in accordance with Article 82(5) UK GDPR.
12.4 Super-cap
Subject to clause 12.2 and to Applicable Data Protection Law, each Party’s total aggregate liability to the other arising out of or in connection with a breach of this DPA or of Applicable Data Protection Law, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to £250,000. This cap applies to those claims in place of, and not in addition to, the general cap in the Agreement.
13. General
13.1 Contact points
Data protection notices under this DPA must be sent to:
Early Dart: contact@earlydart.com, marked for the attention of the Data Protection Lead.
Customer: the contact details recorded in the Customer’s Account.
Each Party must keep its contact details current.
13.2 Changes to this DPA
Early Dart may update this DPA where necessary to reflect a change in Applicable Data Protection Law, regulator guidance, or a change in the Services. Early Dart will give the Customer at least 30 days’ written notice of any material change. If the Customer does not accept a material change, it may terminate the affected Services on written notice before the change takes effect, with a pro-rata refund of prepaid Fees.
Early Dart may make non-material changes (correcting errors, clarifying wording, updating contact details) on notice.
13.3 Annexes hosted online
Early Dart may host Annexes 2 and 3 online at this page and at the sub-processors page, and update them in accordance with clauses 4.4 and 5.3. Where an Annex is hosted online, the online version prevails.
13.4 Non-compliance
If Early Dart determines that it can no longer meet its obligations under this DPA or Applicable Data Protection Law, it will notify the Customer promptly and will, at the Customer’s option, cease the affected processing or take other reasonable steps to remedy the position.
13.5 Prior agreements
This DPA supersedes any earlier data processing agreement between the Parties relating to the Services.
13.6 Severability
If any provision of this DPA is held invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable, or severed if that is not possible. The remainder continues in force.
13.7 Disclosure to regulators
Either Party may disclose this DPA to the ICO or another competent supervisory authority, court or regulator on request.
13.8 Governing law
This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction — save that, where the IDTA or UK Addendum applies, the governing law and jurisdiction provisions of that instrument prevail in respect of the transfers it covers.
13.9 Signature
Acceptance of the Agreement constitutes acceptance of this DPA. Where a Customer requires a countersigned copy, it may request one at contact@earlydart.com.
Annex 1 — Details of processing
Part A — Parties
| Data exporter (Controller) | The Customer, as identified in its Launchpad Pro Account, at the address recorded in that Account |
| Data importer (Processor) | EARLY DART LTD, Tall Trees, Beehive Lane, Moulton, Northwich, Cheshire, CW9 8NT, United Kingdom. Company number 16156441 |
| Data protection contact (Early Dart) | Data Protection Lead — contact@earlydart.com |
| Data protection contact (Customer) | As recorded in the Customer’s Account |
| Controllership | Customer = controller; Early Dart = processor. Where the Customer is a processor for its own clients, Early Dart is sub-processor |
| Transfer roles | Customer = data exporter; Early Dart = data importer (and, in respect of onward transfers to US sub-processors, further data exporter) |
Part B — Details of the processing
| Subject matter | Provision of the Launchpad Pro CRM and marketing automation platform under the Agreement |
| Nature of the processing | Collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, alignment, combination, restriction, erasure and destruction — as necessary to provide the Services |
| Purpose | To enable the Customer to operate customer relationship management, sales pipeline management, marketing automation, appointment scheduling, communications (email, SMS, voice, chat), forms and surveys, funnels and websites, payments and invoicing, reporting, and (where enabled) AI-assisted features |
| Duration | For the term of the Agreement, plus the 90-day post-termination retention period in clause 11.2, plus the backup rotation period in clause 11.3 |
| Frequency of transfer | Continuous, for as long as the Customer uses the Services |
| Categories of data subject | Determined by the Customer. Typically includes: the Customer’s employees and users; the Customer’s clients and prospective clients; the Customer’s clients’ own customers, leads and contacts; website visitors; form and survey respondents; appointment bookers; and recipients of communications sent using the Services |
| Categories of personal data | Determined by the Customer. Typically includes: name; email address; telephone number; postal address; job title and employer; IP address and device data; website and campaign interaction data; communications content (email, SMS, chat and call content, including call recordings and voicemail where enabled); appointment and calendar data; pipeline and opportunity data; form and survey responses; transaction, invoice and payment metadata; consent and opt-out records; notes, tags and custom fields created by the Customer |
| Special categories of personal data | Not anticipated. The Customer must not load special category data or criminal offence data without first notifying Early Dart in writing under clause 3(f) so that additional safeguards can be agreed. Where such data is loaded despite this, it will typically be because the Customer has entered it into free-text notes or custom fields |
| Sensitive data restrictions | Where the Parties agree in writing to the processing of special category data, additional measures will apply, including: restricted access, enhanced audit logging, encryption of the relevant fields where technically feasible, and specific retention limits |
| Sub-processor processing | As above, to the extent necessary for the sub-processor to provide its element of the Services. See Annex 3 |
Annex 2 — Technical and organisational measures
Early Dart implements and maintains at least the following measures, and requires equivalent measures of its sub-processors.
Note: Many of these measures are implemented at the platform infrastructure layer by our infrastructure provider. Early Dart has verified these measures through supplier due diligence and contractual commitments. Where a measure is provided by a sub-processor, Early Dart remains fully liable under clause 5.6.
| Measure | Description |
|---|---|
| Pseudonymisation and encryption | All personal data at rest is encrypted using AES-256. All personal data in transit is encrypted using TLS 1.2 or above. |
| Confidentiality, integrity, availability and resilience | Endpoint protection on all user devices. Uptime monitoring with automated alerting. Role-based access control (RBAC) and sub-account-level authentication. Infrastructure provided through managed cloud services (AWS and Google Cloud) with their own integrity and availability controls. |
| Restoration of availability and access | Data backed up across AWS and Google Cloud with fine-grained recovery points, enabling restoration following a physical or technical incident. Documented restore procedures, tested periodically. |
| Testing, assessing and evaluating effectiveness | Third-party vulnerability scanning of externally facing infrastructure. Annual third-party penetration testing of systems that store and process personal data. A standard patch management process covering all devices used to access, process or store personal data. |
| User identification and authorisation | Encrypted signed tokens, role-based authorisation, password protection with complexity requirements, and two-factor authentication available and recommended on all accounts. |
| Protection during transmission | Valid TLS certificates and HTTPS enforced on all data transmission. TLS 1.2+. |
| Protection during storage | AES-256 encryption at rest. Logical separation of customer data. |
| Physical security | All personal data stored in AWS and Google Cloud facilities. Physical security, environmental controls and access management handled by those providers under their published security standards. |
| Event logging | Logging of all user actions and audit trails. Application and infrastructure monitoring via Google Cloud Operations and AWS CloudWatch. Logs retained for 12 months. |
| System configuration | Configurations held in version control. Containers built from standardised managed images. Updates, upgrades and vulnerability patching managed by the cloud provider under its standard policies. |
| IT and IT security governance | Dedicated IT and security function at infrastructure level, with third-party managed security service provider (MSSP) SOC monitoring. Early Dart maintains its own information security policy, reviewed at least annually. |
| Data minimisation | Minimum data requirements set at field level. Optional fields may be left blank by users. Customers control which fields they collect. |
| Data quality | Customers can update and correct personal data directly within the Services. Application monitoring and validation on key fields. |
| Limited retention | Retention can be configured by the Customer’s administrator at record level. Automated purge routines where configured. |
| Accountability | Access to personal data restricted by role. Documented data protection policies. Data protection training for all staff with access. Records of processing maintained under Article 30(2). |
| Portability and erasure | Customers can export their personal data from within the Services in a structured, machine-readable format. Customers can request a copy or deletion at any point, and on separation. Requests tracked through the support ticketing system. |
| Personnel | Confidentiality obligations in all employment and contractor agreements, surviving termination. Background checks appropriate to role. Access revoked promptly on departure. |
| Supplier management | Due diligence before engaging any sub-processor. Article 28-compliant written contracts with every sub-processor. Periodic review. |
| Incident response | Documented incident response plan, with defined roles, escalation paths and notification timelines consistent with clause 7. |
| Business continuity | Backup, restoration and multi-region resilience are provided at infrastructure level as described above. Early Dart does not currently commit to separate recovery time or recovery point objectives. |
Annex 3 — Approved sub-processors
Last updated: 13 September 2026. Also published at earlydart.com/legal/sub-processors, where you can ask to be notified of changes.
A. Platform infrastructure
| Sub-processor | Processing carried out | Location |
|---|---|---|
| HighLevel LLC (and its affiliates, including HighLevel India and LeadConnector LLC) | Provision and operation of the underlying CRM, marketing automation and communications platform; support | United States; India |
| Amazon Web Services, Inc. | Data storage and hosting | United States |
| Google Cloud | Data storage, hosting and monitoring | United States |
B. Communications
| Sub-processor | Processing carried out | Location |
|---|---|---|
| Twilio Inc. | SMS, MMS and voice services | United States |
| Mailgun (Sinch) | Email delivery | United States |
C. Payments
| Sub-processor | Processing carried out | Location |
|---|---|---|
| Stripe, Inc. | Payment processing | United States |
| Chargebacks911 | Chargeback management | United States |
D. Analytics and operations
| Sub-processor | Processing carried out | Location |
|---|---|---|
| Pendo | Product analytics | United States |
| ChartMogul | Subscription analytics | United States |
| Mozart Data | Data analytics | United States |
| People Data Labs | Data enrichment and analytics | United States |
| Freshworks | Customer support and communication tooling | United States |
| Zapier | Workflow automation | United States |
| Persona Identities | Identity verification | United States |
E. Artificial intelligence
| Sub-processor | Processing carried out | Location |
|---|---|---|
| OpenAI, L.L.C. | AI content generation | United States |
| BotPress | AI chatbot | United States |
| RetellAI | AI voice | United States |
| Synthflow | AI voice | United States |
F. Early Dart’s own sub-processors
Early Dart does not currently use any sub-processors of its own beyond those listed above. Customer support is provided directly by Early Dart personnel in the United Kingdom.
Annex 4 — International transfers
1. UK transfers
For Restricted Transfers of Customer Personal Data subject to UK data protection law, the Parties agree as follows.
1.1 Order of precedence. The mechanisms in clause 10.3 apply in the order stated there.
1.2 Incorporation of the IDTA. Where the IDTA applies, it is incorporated into this DPA by reference and the Parties are deemed to have executed it. The tables of the IDTA are completed as follows:
| IDTA Table | Content |
|---|---|
| Table 1 — Parties | As set out in Annex 1, Part A |
| Table 2 — Transfer details | Linked Agreement: the Launchpad Pro Terms of Service and this DPA. Start date: the date the Agreement takes effect. Exporter: Controller. Importer: Processor. The transfer is ongoing for the term of the Agreement |
| Table 3 — Transferred data | As set out in Annex 1, Part B |
| Table 4 — Security requirements | As set out in Annex 2 |
| Extra protection clauses | Clause 10.6 of this DPA (government access requests) |
| Commercial clauses | The Agreement |
| Ending the IDTA before the end of the term | Neither Party may end the IDTA before the end of the term as set out in section 29 of the IDTA, other than as provided in the IDTA itself |
1.3 Incorporation of the EU SCCs as modified by the UK Addendum. Where a sub-processor’s transfer arrangements are built on the EU Standard Contractual Clauses, the UK Addendum applies and is incorporated by reference. For the purposes of the EU SCCs as so modified:
| Clause | Selection |
|---|---|
| Module | Module Two (controller to processor) where the Customer is a controller; Module Three (processor to sub-processor) where the Customer is a processor |
| Clause 7 (docking) | The optional docking clause is included |
| Clause 9(a) | Option 2 — general written authorisation, with the notice period in clause 5.3 of this DPA (30 days) |
| Clause 11(a) | The optional independent dispute resolution body language is not included |
| Clause 13 / Annex I.C | Competent supervisory authority: the Information Commissioner’s Office |
| Clause 17 | Governed by the law of England and Wales |
| Clause 18 | Disputes to be resolved by the courts of England and Wales. A data subject may also bring proceedings in the courts of any part of the United Kingdom |
| Annex I(A) and (B) | As set out in Annex 1 |
| Annex II | As set out in Annex 2 |
| Annex III | As set out in Annex 3 |
| UK Addendum Table 4 (ending) | Neither Party may end the UK Addendum as set out in section 19 of the UK Addendum |
1.4 Updates to transfer mechanisms. If the ICO issues a revised IDTA, a revised UK Addendum, or approves a new transfer mechanism, the Parties are deemed to have agreed to adopt it, and Early Dart may update this Annex 4 accordingly on notice under clause 13.2.
2. EU transfers
Where Customer Personal Data is subject to the EU GDPR, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference, with the same module selections and options as set out in paragraph 1.3 above, save that:
- the competent supervisory authority is the supervisory authority of the Member State in which the Customer is established, or where the Customer is not established in the EU, the supervisory authority of the Member State in which the Customer’s EU representative is established;
- Clause 17 is governed by the law of the Republic of Ireland; and
- Clause 18 disputes are to be resolved by the courts of the Republic of Ireland.
3. Supplementary measures
In addition to the measures in Annex 2, the following apply to all Restricted Transfers:
- Encryption. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Key management is controlled by the importer and its infrastructure providers.
- Government access. The commitments in clause 10.6 apply, including the obligation to challenge invalid requests, respond narrowly, notify the Customer where lawful, and refuse voluntary disclosure.
- No back doors. Early Dart confirms that it has not created, and requires its sub-processors to confirm that they have not created, back doors or similar programming enabling government access to Customer Personal Data, and that it has not modified its business processes to facilitate such access. If Early Dart becomes aware that any of this ceases to be true, it will notify the Customer without undue delay, and the Customer may terminate on short notice.
- Transparency reporting. Early Dart will, where lawful, tell the Customer on request whether it has received any government access request affecting Customer Personal Data during a given period.
- Onward transfers. No onward transfer to a further recipient is permitted except to a sub-processor listed in Annex 3, under a contract meeting the requirements of clause 5.5.
END OF DATA PROCESSING AGREEMENT
EARLY DART LTD, registered in England and Wales, company number 16156441.