Effective date: October 10, 2026
This Data Processing Addendum ("DPA") is part of the agreement between The Launch Point, LLC ("Launch Point") and the Customer for the Launch Point service (the "Agreement", including the Terms of Service). It applies when Launch Point processes personal data contained in Customer Data on the Customer's behalf. If this DPA conflicts with the Agreement, this DPA wins for that subject.
1. Definitions
- Data Protection Laws means all privacy and data protection laws that apply to the processing. These include the EU and UK General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act (CCPA).
- Personal Data means personal data contained in Customer Data that Launch Point processes for the Customer.
- Terms such as controller, processor, data subject, processing and personal data breach have the meanings given in the GDPR. Under the CCPA, Launch Point is a "service provider".
2. Roles and instructions
- The Customer is the controller, or a processor acting for its own customers. Launch Point is the processor.
- Launch Point processes Personal Data only on the Customer's documented instructions. Those instructions are the Agreement, this DPA, and the Customer's use and configuration of the Service, including the actions Users request and the permissions they set for connected tools.
- Launch Point will tell the Customer if it believes an instruction breaks Data Protection Laws.
- Launch Point will not sell or share Personal Data, will not use it outside the direct business relationship with the Customer, and will not combine it with personal data from other sources, except as Data Protection Laws allow.
- Launch Point will not use Personal Data to train AI models.
3. Confidentiality
Launch Point makes sure everyone authorized to process Personal Data is bound by confidentiality obligations.
4. Security
Launch Point keeps in place the technical and organizational measures in Annex 2. Launch Point may update them, but never in a way that lowers the overall level of protection.
5. Subprocessors
- The Customer authorizes Launch Point to use the subprocessors listed at launchpointbrands.com/legal/subprocessors.
- Launch Point will give at least 30 days' notice, by email to the workspace owner, before adding or replacing a subprocessor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may end the affected part of the Service and receive a refund of prepaid fees for the unused period.
- Launch Point imposes data protection terms on each subprocessor that are at least as protective as this DPA, and remains responsible for its subprocessors.
6. Data subject requests
Taking into account the nature of the processing, Launch Point will help the Customer respond to requests from data subjects to use their rights. If Launch Point receives a request directly, it will refer the person to the Customer.
7. Personal data breaches
- Launch Point will notify the Customer without undue delay, and in any case within 72 hours, after confirming a personal data breach affecting Personal Data.
- The notice will include what Launch Point knows about the nature of the breach, the data involved, the likely consequences, and the measures taken or proposed. Launch Point will update the Customer as more becomes known.
8. Assistance
Launch Point will give reasonable help with data protection impact assessments and consultations with supervisory authorities, to the extent they relate to the Service.
9. Return and deletion
When the Agreement ends, Launch Point will make Customer Data available for export for 30 days. After that, Launch Point deletes it. Deleted data leaves backups within 7 days, unless the law requires Launch Point to keep it.
10. Audits
- On written request, no more than once a year, Launch Point will provide information reasonably needed to show compliance with this DPA. That includes its security documentation and written answers to reasonable security questionnaires.
- If that information is not enough to meet a requirement under Data Protection Laws, the Customer may carry out an audit at its own cost. The audit must be on 30 days' notice, during business hours, and under confidentiality, and the parties will agree its scope in advance.
11. International transfers
- Launch Point processes Personal Data in the United States.
- For transfers of personal data from the European Economic Area, the EU Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor) are incorporated by reference. Annex 1 completes their annexes.
- For transfers from the United Kingdom, the UK International Data Transfer Addendum applies. For transfers from Switzerland, the clauses apply with the changes Swiss law requires.
12. Liability
Each party's liability under this DPA is subject to the limitations of liability in the Agreement.
Annex 1: Details of processing
- Subject matter and purpose: providing the Launch Point service, an AI workspace for marketing teams that includes tasks, knowledge, chat, AI agents, scheduled routines, meeting notes and connections to the Customer's tools.
- Duration: the term of the Agreement plus the deletion period in section 9.
- Nature of processing:
- hosting, storage, retrieval and display;
- AI processing to answer requests and produce Output;
- reading from and acting in connected tools as instructed;
- recording and transcribing meetings when the Customer turns this on.
- Categories of data subjects: the Customer's Users, and people whose data the Customer puts into the Service or connects to it, such as employees, contacts, leads, customers and meeting participants.
- Categories of Personal Data:
- names, email addresses and job details;
- contact and CRM records from connected tools;
- the content of messages, documents and forwarded emails;
- meeting recordings, voices and transcripts;
- usage data.
- Special categories: none intended. The Customer should not put special category data into the Service unless the law allows it.
- Transfers: continuous, for the duration of the Agreement.
Annex 2: Technical and organizational measures
- Encryption: TLS for data in transit. AES-256 encryption at rest. Connected-tool credentials are additionally encrypted with AES-256-GCM, and they are never sent to AI models or included in exports.
- Access control:
- Each workspace is isolated, with membership and role checks on every request and database row-level security.
- Production access is limited to a small number of authorized people using multi-factor authentication.
- Users can turn on two-factor authentication.
- Permissions and approvals: per-tool permission settings (always allow, needs approval, blocked). Approval is required before actions that publish, send, spend or delete. Agents and routines use read access only unless a User allows more.
- Logging: request logging, an audit log of administrative actions, and error monitoring.
- Resilience: daily backups kept for 7 days, and tested restore procedures.
- Incident response: a documented incident response plan, with customer notice within 72 hours of a confirmed incident.
- Vendor management: subprocessors are reviewed and bound by data protection terms.
- Data minimization and deletion:
- Deleted items are kept for 30 days, then purged.
- Workspace deletion erases content, which leaves backups within 7 days.