Launchpad Pro — Privacy Policy
EARLY DART LTD
Version 1.0 — Last updated: 13 September 2026
1. Who we are and how to contact us
EARLY DART LTD (“Early Dart”, “we”, “us”, “our”) operates Launchpad Pro. We are registered in England and Wales, company number 16156441, registered office Tall Trees, Beehive Lane, Moulton, Northwich, Cheshire, CW9 8NT.
We are registered with the Information Commissioner’s Office (ICO) as a data controller.
| Privacy enquiries | contact@earlydart.com |
| General contact | contact@earlydart.com |
| Telephone | 07956 980552 |
| Post | Data Protection Lead, EARLY DART LTD, Tall Trees, Beehive Lane, Moulton, Northwich, Cheshire, CW9 8NT |
We have not appointed a Data Protection Officer, as we are not required to under Article 37 UK GDPR. Our Data Protection Lead can be contacted at contact@earlydart.com.
2. What this policy covers — and the important distinction
This policy explains how we handle personal data where we are the controller. That means:
- personal data about you, as our customer, prospective customer, or visitor to our website;
- personal data about the individual users you add to your Account; and
- personal data we collect through our own marketing, website and support channels.
This policy does NOT cover the personal data you put into the Platform. When you load contacts, leads, customers, form submissions or campaign data into Launchpad Pro, you are the controller of that data and we act as your processor. That relationship is governed by our Data Processing Agreement, not by this policy.
If you are an individual whose data has been loaded into Launchpad Pro by one of our customers, and you want to exercise your rights over that data, please contact the business that holds your data. We will pass any request we receive directly to them.
3. The personal data we collect
3.1 Data you give us
| Category | Examples |
|---|---|
| Identity data | Name, job title, business name, company number, username |
| Contact data | Email address, telephone number, postal address |
| Account data | Login credentials (passwords are stored hashed, never in plain text), account settings, preferences, 2FA details |
| Financial data | Billing address, VAT number, partial payment card details (last four digits and expiry only — we do not store full card numbers; see section 3.4) |
| Transaction data | Subscription plan, payment history, invoices, wallet balance, usage charges |
| Support data | Content of support tickets, emails, chat messages and calls with us, including any recordings |
| Marketing data | Your preferences for receiving marketing from us, and your engagement with it |
3.2 Data we collect automatically
| Category | Examples |
|---|---|
| Technical data | IP address, browser type and version, operating system, device type, time zone, screen resolution, login timestamps |
| Usage data | Pages and features accessed, actions taken in the Platform, session duration, error logs, feature adoption |
| Cookie data | See our Cookie Policy for detail |
| Security data | Authentication events, failed login attempts, audit logs, security alerts |
3.3 Data from third parties
- Payment providers — transaction confirmations and fraud signals (we do not receive full card details)
- Our infrastructure providers — technical and operational data required to deliver the Platform
- Analytics providers — aggregated usage insight
- Publicly available sources — Companies House, LinkedIn and business directories, where we are researching a prospective business customer
- Referrers and partners — where someone has referred you to us
3.4 Payment card data
We do not store, process or transmit full payment card numbers. Card payments are handled by our PCI DSS Level 1 compliant payment processor, Stripe, who acts as an independent controller for the purposes of payment processing and fraud prevention. Its own privacy notice applies.
3.5 Special category data
We do not intend to collect special category personal data (Article 9 UK GDPR — health, race or ethnicity, political opinions, religious beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation) or criminal offence data about our customers.
If you volunteer such data to us — for example in a support ticket — we will process it only so far as necessary to deal with your request, and we will delete it as soon as we can.
You must not load special category data into the Platform without first satisfying yourself that you have an Article 9 condition, a Schedule 1 DPA 2018 condition where required, and an appropriate policy document where required. See our Terms of Service, clause 9(h).
3.6 Children
The Platform is for business use. We do not knowingly collect personal data from anyone under 18. If we learn we have, we will delete it. If you believe a child has given us personal data, contact contact@earlydart.com.
4. Why we use your data, and our lawful basis
Under Article 6 of the UK GDPR we must have a lawful basis for every processing activity. Here is ours.
| What we do | Why | Lawful basis |
|---|---|---|
| Create and administer your Account | To give you access to the Platform | Contract — necessary to perform our contract with you |
| Provide the Platform and its features | To deliver what you have paid for | Contract |
| Take payment and manage your subscription, wallet and invoices | To get paid and meet accounting obligations | Contract; Legal obligation (tax and accounting records) |
| Provide customer support | To help you use the Platform | Contract; Legitimate interests (running an effective support function) |
| Send service and transactional messages (outages, security alerts, changes to terms, renewal reminders) | To keep you informed about the service you are using | Contract; Legal obligation |
| Monitor, secure and troubleshoot the Platform | To keep the service running and safe | Legitimate interests (network and information security); Legal obligation (Article 32 UK GDPR) |
| Detect, investigate and prevent fraud, abuse and breaches of our terms | To protect users, ourselves and third parties | Legitimate interests; Legal obligation |
| Analyse aggregated usage to improve the Platform | To make the product better | Legitimate interests (product development) |
| Send marketing about our products and services | To grow our business | Consent where required by PECR; otherwise Legitimate interests under the soft opt-in |
| Verify identity where there is an account ownership dispute | To protect account holders | Legitimate interests; Legal obligation where relevant |
| Respond to regulators, law enforcement and legal process | To comply with the law | Legal obligation; Legal claims |
| Establish, exercise or defend legal claims | To protect our position | Legitimate interests; Legal claims |
| Sanctions and financial crime screening | To comply with UK sanctions law | Legal obligation |
4.1 Where we rely on legitimate interests
Where we rely on legitimate interests, we have carried out a balancing assessment (a Legitimate Interests Assessment) to satisfy ourselves that our interests do not override your rights and freedoms. You can ask us for a summary of any of these assessments by emailing contact@earlydart.com.
4.2 Marketing
We will send you marketing about Launchpad Pro and our other services where:
- you have given us consent; or
- you bought from us or negotiated to buy from us, the marketing relates to similar products, and you were given an easy opportunity to opt out at the point of collection and in every message (the “soft opt-in” under regulation 22 of PECR).
You can opt out at any time — click “unsubscribe” in any marketing email, reply STOP to any marketing SMS, or email contact@earlydart.com. Opting out of marketing does not stop service and transactional messages, which we must send you while you hold an Account.
We do not sell your personal data. We do not share it with third parties for their own marketing.
4.3 We do not use solely automated decision-making
We do not make decisions about you by solely automated means that produce legal or similarly significant effects (Article 22 UK GDPR). If that changes, we will update this policy and tell you.
5. Who we share your data with
We share personal data with:
a) Our processors and sub-processors. These are organisations that process personal data on our instructions to help us deliver the Platform — including our infrastructure provider, hosting providers, communications providers, payment processors, support tooling and analytics providers. Every one of them is bound by a written contract meeting Article 28 UK GDPR. The current list is published at earlydart.com/legal/sub-processors, where you can also ask to be notified of changes.
b) Professional advisers. Lawyers, accountants, auditors and insurers, bound by professional confidentiality obligations.
c) Regulators and law enforcement. Including the ICO, HMRC, Ofcom, the police and the National Crime Agency, where we are required by law or where disclosure is necessary to protect our rights, your safety or the safety of others.
d) A purchaser of our business. If we sell, merge or reorganise, personal data may transfer as part of the transaction. We will tell you before your data becomes subject to a different privacy policy.
e) Payment providers. As independent controllers, for payment processing and fraud prevention.
We do not sell, rent or trade your personal data.
6. International transfers
Some of your personal data is transferred outside the United Kingdom, principally to the United States. This is because the software infrastructure underlying Launchpad Pro, and several of the communications, AI and analytics services it uses, are hosted in the United States.
Where we transfer personal data outside the UK, we rely on one or more of the following safeguards under Chapter V of the UK GDPR:
- an adequacy regulation made by the Secretary of State under Article 45 UK GDPR — including the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified under it;
- the International Data Transfer Agreement (IDTA) issued by the ICO under section 119A of the Data Protection Act 2018;
- the UK Addendum to the EU Standard Contractual Clauses; or
- another mechanism permitted by the UK GDPR.
Where we rely on the IDTA or the UK Addendum, we carry out a Transfer Risk Assessment (TRA) to satisfy ourselves that the protection provided is not undermined by the laws and practices of the destination country, and we apply supplementary measures — including encryption in transit (TLS 1.2+) and at rest (AES-256) — where appropriate.
You can request a copy of the relevant safeguards by emailing contact@earlydart.com. We may redact commercially confidential information.
7. How long we keep your data
| Data | Retention period | Why |
|---|---|---|
| Account and profile data | Duration of your Account, then 90 days after termination | To allow reactivation and data export |
| Content and data you loaded into the Platform | Duration of your Account, then 90 days | As above — see Terms clause 11.4 |
| Billing, invoice and transaction records | 6 years from the end of the accounting period | Companies Act 2006 s.388; HMRC requirements |
| Support tickets and correspondence | 3 years from closure | Service quality, dispute handling |
| Marketing consent and opt-out records | Indefinitely for opt-out (suppression) records; consent records 2 years after consent is withdrawn or the relationship ends | To honour opt-outs and evidence compliance with PECR |
| Security and audit logs | 12 months | Security monitoring and incident investigation |
| Website analytics and cookie data | Per our Cookie Policy — generally 14 months or less | Analytics |
| Records relating to a legal claim or investigation | Until 6 years after the claim is finally resolved | Limitation Act 1980 |
| Sanctions screening records | 5 years | Sanctions and AML record-keeping |
After the applicable period, we securely delete or irreversibly anonymise the data. Backup copies are isolated and overwritten on our normal backup rotation, which is 35 days.
8. Your rights
Under the UK GDPR you have the following rights over personal data for which we are the controller.
| Right | What it means |
|---|---|
| Access (Art. 15) | Get a copy of the personal data we hold about you, and information about how we use it |
| Rectification (Art. 16) | Have inaccurate data corrected, or incomplete data completed |
| Erasure (Art. 17) | Have your data deleted, where there is no overriding reason for us to keep it |
| Restriction (Art. 18) | Ask us to pause processing while a dispute about accuracy or lawfulness is resolved |
| Portability (Art. 20) | Receive data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible |
| Object (Art. 21) | Object to processing based on legitimate interests. You have an absolute right to object to direct marketing at any time |
| Withdraw consent (Art. 7(3)) | Where we rely on consent, withdraw it at any time. This does not affect the lawfulness of processing before withdrawal |
| Automated decisions (Art. 22) | Not be subject to solely automated decisions with legal or similarly significant effects. We do not currently make such decisions |
How to exercise your rights
Email contact@earlydart.com or write to us at the address in section 1. Tell us clearly which right you want to exercise and give us enough information to find your data. We may need to verify your identity.
We will respond within one month. We may extend this by up to two further months for complex or numerous requests — if we do, we will tell you within the first month and explain why.
There is no charge, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse. We will explain our reasoning if we do.
Complaints
If you are unhappy with how we have handled your data or your request, please tell us first at contact@earlydart.com so we can put it right.
You also have the right to complain to the Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — helpline 0303 123 1113 — ico.org.uk/make-a-complaint.
9. Security
We have implemented technical and organisational measures appropriate to the risk, as required by Article 32 UK GDPR. These include:
- Encryption — TLS 1.2 or above for data in transit; AES-256 for data at rest
- Access control — role-based access control, least-privilege principles, and access limited to personnel who need it
- Authentication — two-factor authentication available and recommended on all accounts; encrypted signed tokens
- Monitoring — application and infrastructure logging, audit trails of user actions, uptime monitoring and security alerting
- Testing — regular vulnerability scanning of externally facing infrastructure and periodic third-party penetration testing
- Patching — a documented patch management process
- Backups — regular encrypted backups with the ability to restore
- Physical security — data centre security managed by our cloud infrastructure providers
- People — confidentiality obligations in all staff and contractor contracts, and data protection training
- Suppliers — Article 28 contracts with every processor, and due diligence before engagement
No system is completely secure. You are responsible for keeping your login credentials confidential and for enabling two-factor authentication.
If we suffer a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required, and we will notify you without undue delay where the breach is likely to result in a high risk to you.
10. Cookies
Our website and the Platform use cookies and similar technologies. Under regulation 6 of PECR we must obtain your consent before setting any cookie that is not strictly necessary. Full detail — including the categories we use, their purpose, their duration and how to change your preferences — is in our separate Cookie Policy.
11. Third-party links and integrations
The Platform lets you connect third-party services. When you do, you are sharing data with that provider under their terms and privacy policy, not ours. We are not responsible for their practices. Review their privacy notices before connecting them.
Our website may link to third-party sites. We do not control them and are not responsible for their privacy practices.
12. Changes to this policy
We may update this policy. Where a change is material, we will notify you by email to the address on your Account and by notice within the Platform at least 30 days before it takes effect. The “last updated” date at the top always shows when this version was published. Previous versions are available on request.
13. Your obligations as a controller
If you are a Launchpad Pro customer, remember:
- You are the controller of the personal data you load into the Platform.
- You must have your own privacy policy covering that data, and it must be at least as protective as this one.
- You must have a lawful basis for every processing activity you carry out through the Platform.
- You must provide privacy information to the individuals whose data you hold (Articles 13 and 14 UK GDPR).
- You must handle data subject rights requests from those individuals within one month.
- You must be registered with the ICO and pay the data protection fee, unless exempt.
- You must comply with PECR before sending any marketing email, SMS or call.
Our Data Processing Agreement sets out the full split of responsibilities.
EARLY DART LTD, registered in England and Wales, company number 16156441. Launchpad Pro is a product of EARLY DART LTD.