LaunchPoint

Privacy Policy

Effective Date: October 2026Version 2.0UK GDPR & Data Protection Act 2018

Important Notice: LaunchPoint (trading as LaunchPoint Thanet) is owned and operated by Reece Cartwright as a sole trader. He intends to incorporate as a limited company in due course. This Privacy Policy will be updated accordingly and Clients will be notified of any material changes with no less than 30 days' notice, consistent with our Terms of Service.

Privacy at a glance

•Who we are: Reece Cartwright, a sole trader trading as LaunchPoint Thanet. We are responsible for the personal data described in this Policy.

•We collect only what we need to answer your enquiry, build and host your Website, take your monthly payments and meet our legal duties.

•We never sell your data. We share it only with the providers who help us deliver the service: Krystal (hosting), Stripe (payments), Framer (our own website) and our email providers.

•Your Website is a WordPress.org site hosted with Krystal. If it collects data from your customers or visitors, you are responsible for that data and we look after it on your behalf (Section 8).

•You can ask to see, correct, delete or move your data, or object to how we use it, at any time, free of charge. You can also complain to the ICO.

This summary is for convenience. The full Policy below applies.

This Privacy Policy explains how LaunchPoint (trading as LaunchPoint Thanet, a sole trader business owned and operated by Reece Cartwright) collects, uses, stores, shares, and protects personal data in connection with our pay-monthly website design, hosting, maintenance, and associated digital services, and in connection with our own website at launchpointweb.co.uk.

This Policy should be read alongside our Terms of Service (launchpointweb.co.uk/legal/terms), which govern the commercial relationship between LaunchPoint and its Clients. By using our website or engaging our services, you confirm that you have read and understood this Policy.

Contents

Section 1

Introduction

LaunchPoint is committed to protecting the privacy and security of personal data belonging to our Clients, website visitors, and other individuals we interact with in the course of business.

This Policy applies to personal data processed through our website, enquiry and sign-up forms, email correspondence, billing systems, social media channels, and any other channel through which LaunchPoint collects or receives personal data in connection with our pay-monthly website services.

Section 2

Who We Are (Data Controller)

LaunchPoint (trading as LaunchPoint Thanet) is owned and operated by Reece Cartwright as a sole trader (“LaunchPoint”, “we”, “us”, “our”). For personal data we use for our own business purposes, we are the Data Controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

ICO registration number: [ADD YOUR ICO REGISTRATION NUMBER]

Address: [ADD YOUR POSTAL ADDRESS HERE]

You can contact us about any data protection matter through our contact page (the email address hello@launchpointweb.co.uk takes you there).

Section 3

Definitions

Client

Any individual, sole trader, or business entity that engages LaunchPoint for Services, as defined in our Terms of Service.

Personal Data

Any information relating to an identified or identifiable living individual, as defined under UK GDPR.

Processing

Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.

Data Controller

The person or organisation that decides why and how personal data is used.

Data Processor

A third party that processes personal data on behalf of, and under the instruction of, a controller. For example, Krystal and Stripe act as our processors for some purposes, and we act as your processor for data collected through your Website.

Section 4

Personal Data We Collect

Depending on your interaction with LaunchPoint, we may collect the following categories of personal data:

•Identity data: name, job title, and business name.

•Contact data: email address, telephone number, and business address.

•Enquiry and sign-up data: the details you give us about your business and what you want your Website to do, including your plan and Add-On Service choices.

•Billing data: Stripe customer and subscription identifiers, billing history, and invoices. We do not collect or store full card numbers.

•Business content: logos, text, images, and other assets provided by the Client for use on their Website, as governed by Section 3 of our Terms of Service.

•Testimonial and portfolio data: your name, location, photo and comments, where you agree to us featuring your feedback or Website.

•Technical and usage data: IP address, browser type and version, device type, operating system, time zone, pages viewed and referral source when you use our website.

•Communication data: the contents of emails, enquiry forms, social media messages, and other correspondence with LaunchPoint.

We do not intentionally collect special category data (such as health, religious, or biometric data) and ask that Clients do not submit such data to us unless it is strictly necessary and lawful to do so.

Personal data collected through a Client's own Website is covered separately in Section 8.

Section 5

How We Collect Data

•Directly from you via our website enquiry, sign-up and contact forms.

•Directly from you via email, telephone or messages on social media platforms.

•Through Stripe at the point of checkout or during ongoing subscription billing.

•Automatically, through the hosting and analytics tools behind our own website (provided via Framer).

•Through the ongoing delivery of Services, including support requests and change requests as described in Section 11 of our Terms of Service.

Section 6

How We Use Personal Data

We use personal data for the following purposes:

•To respond to enquiries and take steps you ask for before you sign up.

•To design, build, host, maintain and support your Website and deliver any Add-On Services you choose.

•To manage Subscriptions, process payments (including your first monthly payment and any renewals), send receipts and renewal reminders, and keep billing records via Stripe.

•To maintain, secure, and troubleshoot Client Websites.

•To understand and improve the performance and usability of our own website and Services.

•To display testimonials and completed Websites in our portfolio and marketing, where you have agreed or where the Terms of Service permit.

•To detect, investigate, and prevent fraud, misuse, or breaches of our Acceptable Use policy.

•To comply with our legal, tax, and accounting obligations.

Section 7

Legal Basis for Processing

We only process personal data where we have a valid lawful basis to do so under UK GDPR. Depending on the purpose, we rely on:

•Performance of a contract (including steps taken at your request before a contract is made): to deliver the Services set out in our Terms of Service, including enquiries, onboarding, development, hosting, and billing.

•Legal obligation: to meet accounting, tax, and other regulatory requirements.

•Legitimate interests: to operate, secure, and improve our business, including fraud prevention, service communications, and showing completed Websites in our portfolio, provided these interests are not overridden by your rights. You can object at any time (Section 18).

•Consent: for optional marketing communications, for featuring your name, photo or testimonial, and for non-essential cookies where required. You may withdraw consent at any time.

Section 8

Client Websites: Where We Act as Your Processor

Every Website we build is a WordPress.org website hosted with Krystal. If your Website collects personal data from your own customers or visitors, you are the Data Controller for that data and we act as your Data Processor. The processing terms are in Section 14 of our Terms of Service.

Depending on how your Website is set up, that data can include:

•Contact form and enquiry submissions (stored in your Website's database and often emailed to you).

•WordPress user accounts, such as administrator logins.

•On an E-Commerce Website, customer names, delivery addresses, order history and contact details. Card details are handled by your payment provider and are not stored by us.

•Server logs and backups held with our hosting provider.

Some plugins can send data to third parties (for example spam protection, email delivery, maps, analytics or payment gateways). We will tell you which third-party services your Website uses so you can reflect them in your own privacy notice.

As the controller, you are responsible for having a privacy notice and, where needed, cookie consent on your Website, and for having a lawful basis for the data you collect. We will help you set these up on request.

Section 9

Cookies & Tracking Technologies

Our own website uses essential cookies required for core functionality. These do not need consent and cannot be disabled without affecting site performance.

We may also use non-essential analytics cookies, described in Section 10. Where the law requires your consent (under the Privacy and Electronic Communications Regulations), we will ask for it before setting them, and you can change your preferences at any time.

Client Websites built on WordPress use essential cookies (for example for admin logins and, on E-Commerce Websites, shopping baskets). Any other cookies depend on the plugins a Client chooses, and the Client is responsible for their cookie notice and consent tools.

Section 10

Analytics

We use analytics tools provided by Framer, which hosts our own website, to understand how visitors use it. This may include page views, session duration, and general geographic location derived from IP address.

Analytics data is used in aggregate form wherever possible and is not used by LaunchPoint to build individual profiles for marketing purposes. Analytics on a Client Website are only in place if the Client asks for a plugin such as Google Analytics, and are the Client's responsibility as controller.

Section 11

Payment Processing

All Subscription and Buyout payments are processed securely through Stripe, a PCI-DSS compliant payment processor. LaunchPoint does not receive, store, or have access to full card numbers, CVV codes, or other sensitive payment card data. By subscribing you authorise recurring payments as described in Section 4 of our Terms of Service.

Stripe acts as an independent Data Controller in respect of the payment data it processes on its own systems (for example for fraud prevention), in addition to acting as our Data Processor for billing records. Stripe's own privacy practices are available at stripe.com/privacy.

Section 12

Data Sharing & Third-Party Processors

We do not sell or rent personal data. We only share personal data with third parties where necessary to deliver the Services, and only under appropriate contractual safeguards. Our current third-party providers include:

•Krystal: hosting and backups for Client Websites.

•Stripe: payment processing and subscription billing.

•Framer: hosting and analytics for our own website (launchpointweb.co.uk).

•Email service providers: for sending and receiving business correspondence.

•Theme and plugin providers, and WordPress.org update services: these may receive technical information such as your Website address and software versions when checking for licences and updates.

•Professional advisors (such as accountants), where necessary for our legal and tax obligations.

•Regulatory or law enforcement authorities, where we are legally required to disclose data.

We do not permit third-party processors to use personal data for their own marketing purposes. We will update this list if our providers change.

Section 13

International Data Transfers

Some of our providers may process personal data outside the United Kingdom, including in the United States or the European Economic Area. You can contact us to find out where a particular provider processes your data.

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as an adequacy decision recognised by the UK Government (including the UK-US data bridge for certified US companies), the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the Standard Contractual Clauses.

Section 14

Data Retention

We retain personal data only for as long as reasonably necessary for the purposes set out in this Policy, in line with the following general principles:

•Active Client data: retained for the duration of the Client's Subscription and ongoing business relationship.

•Cancelled Client data and Website files: retained for six (6) months following cancellation, in line with Section 6 of our Terms of Service, to allow for reactivation or Buyout.

•Enquiries that do not become Clients: retained for up to 12 months, then deleted.

•Financial and billing records: retained for six to seven (6–7) years to meet HMRC and other statutory accounting obligations.

•Marketing data: retained until you withdraw consent or, where no interaction has occurred, for no longer than 24 months.

•Testimonials and portfolio material: retained until you ask us to remove them.

•General correspondence: retained for as long as reasonably necessary to resolve any related matter, and no longer than is proportionate.

Where data is no longer required, we will securely delete or anonymise it.

Section 15

Website Data on Cancellation or Termination

Where a Client's Subscription is cancelled or terminated, personal data collected through that Client's Website (for example, via contact forms or shop orders) will be handled in accordance with Section 14 of our Terms of Service, under which the Client is the controller and we are the processor.

Following the six-month storage period, or sooner where the Subscription is terminated for serious breach (Section 15 of our Terms of Service), we will permanently delete stored Website data, including any personal data contained within it. On request before deletion we will provide the Client with a copy of personal data collected through their Website so they can keep it lawfully.

Section 16

Data Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include keeping WordPress, themes and plugins updated as part of Website maintenance, and relying on the security infrastructure of reputable providers such as Krystal and Stripe.

No method of electronic transmission or storage is completely secure. While we take reasonable steps to protect personal data, we cannot guarantee its absolute security.

Access to Client data within LaunchPoint is limited to Reece Cartwright, and to third-party providers strictly as required to deliver the Services.

Section 17

Automated Decision-Making

LaunchPoint does not use personal data for any form of automated decision-making or profiling that produces legal effects or similarly significant effects concerning an individual.

Section 18

Your Rights Under UK GDPR

Subject to certain exemptions and conditions, you have the right to:

•Request access to the personal data we hold about you.

•Request correction of inaccurate or incomplete data.

•Request erasure of your personal data, subject to our legal and contractual retention obligations.

•Request restriction of, or object to, certain processing activities, including processing based on legitimate interests.

•Object at any time to direct marketing, which we will always honour.

•Request a copy of your data in a portable format.

•Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us through hello@launchpointweb.co.uk (which takes you to our contact page). There is no charge. We will respond within one month, which we may extend by up to two further months for complex or numerous requests, in which case we will tell you why. We may ask for proof of identity before actioning a request. If your request concerns data collected through a Client's Website, we may need to pass it to that Client, who is the controller.

Section 19

Marketing Communications

Where you have consented, or where permitted under the “soft opt-in” exemption for existing Clients, we may send service updates or marketing communications by email. You may opt out at any time by using the unsubscribe link provided or by contacting us.

Opting out of marketing communications does not affect service-related communications necessary for the delivery of your Subscription.

Section 20

Children's Privacy

Our Services are intended for business use and are not directed at, or knowingly used by, individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected such data, we will take reasonable steps to delete it promptly.

Section 21

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, LaunchPoint will assess the breach without undue delay and, where legally required, notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it.

Where a breach is likely to result in a high risk to affected individuals, we will notify those individuals directly and without undue delay, together with guidance on steps they can take to protect themselves.

Where a breach affects data we process on behalf of a Client, we will tell that Client without undue delay so they can meet their own obligations.

Section 22

Complaints

If you have any concerns about how LaunchPoint handles your personal data, please contact us first through our contact page so we can attempt to resolve the matter directly. We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or by calling their helpline, if you remain unsatisfied with our response.

Section 23

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Where changes are material, we will provide no less than 30 days notice to existing Clients by email, consistent with the amendment provisions in our Terms of Service.

If the business incorporates as a limited company, this Policy will be updated to name the company as the Data Controller, and we will tell you in line with our Terms of Service.

The most current version of this Policy will always be available at launchpointweb.co.uk/legal/privacy, together with its effective date.

Section 24

Contact Information

For any questions, requests, or concerns relating to this Privacy Policy or how we handle personal data, please contact us using the details below:

LaunchPoint (trading as LaunchPoint Thanet)

Email: hello@launchpointweb.co.uk

Contact page: launchpointweb.co.uk/contact

Website: launchpointweb.co.uk

Owned and operated by: Reece Cartwright (sole trader)

Address: [ADD YOUR POSTAL ADDRESS HERE]

LaunchPoint Privacy Policy | Version 2.0 | Effective October 2026 | hello@launchpointweb.co.uk | launchpointweb.co.uk