This notice explains what personal data Launch Register collects, why, for how long, and how to exercise your rights. It covers everyone who visits the site, signs up, or is named in a workspace's own records — not only paying customers.
Who we are
Launch Register is operated by Dawson Digital Ventures Ltd (company number 17463710), trading as Launch Register — the controller for the personal data described in this notice, except where a row below says a customer's practice is the controller instead. Contact us at [email protected] or through Contact Launch Register.
Scope
This notice covers the Launch Register website and subscription service: the account and billing data you give us directly, the workspace content a practice enters about the companies it reviews, and the Companies House company data we filter and display. It does not cover a practice's own use of that data once it has left the service — for example, a letter a practice sends and files outside Launch Register.
The data we process
The table below is an original summary produced by reconciling this notice against the running product and its settings on 17 September 2026 — every row states what the code and configuration actually do, not an aspiration. A row for a feature that is switched off does not appear.
| Data | Whose | Source | Purpose | Lawful basis | Recipients / processors | Location | Retention | How to exercise rights |
|---|---|---|---|---|---|---|---|---|
| Account and login data | You, the account holder | You, at signup | Create and secure your account | Contract | DigitalOcean (hosting) | London | While your workspace is open | Contact us |
| Team / workspace membership | You and colleagues you invite | You, when inviting someone | Control who can use the workspace | Contract; legitimate interest | DigitalOcean | London | While the workspace is open | Contact us |
| Billing | The workspace's billing contact | You, at checkout | Charge the £29 monthly subscription | Contract | Stripe holds your card details; we store only identifiers and subscription status | Stripe — we confirm the safeguard used with each provider | Kept for financial record-keeping; not removed by workspace closure alone | Contact us |
| Search profiles and volume estimates | Your workspace | You, configuring a profile | Filter Companies House data; show a historical volume estimate | Contract | DigitalOcean | London | While the workspace is open | Contact us |
| Workspace decisions, notes and contact/follow-up records | Companies, and any individual your practice names in a note | Entered by your practice | Track review decisions, contact made and follow-ups | Held on your practice's instructions, as processor; your practice sets the basis for its own outreach | DigitalOcean | London | While the workspace is open; erased on closure (see "Retention and deletion") | Ask your practice directly, or contact us for our part |
| Extra digest recipients | People a practice adds beyond its own team members | A workspace admin | Deliver the digest to that address | Contract; legitimate interest | Brevo (email delivery) | Brevo — we confirm the safeguard used with each provider | While listed as a recipient | Unsubscribe link on every digest |
| Transactional and digest emails | You and your recipients | Generated by the service | Send the digest, receipts and service notices | Contract | Brevo | Brevo — we confirm the safeguard used with each provider | Kept; no automatic deletion schedule is enabled yet. Evidence that someone unsubscribed is always kept | Contact us |
| Marketing and lifecycle emails | Team members at a subscribed or sampled practice | Your account activity | Re-engagement, tips and upgrade prompts | Soft opt-in, from our dealings with you; you can object at any time | Brevo | Brevo — we confirm the safeguard used with each provider | Until you unsubscribe or the account closes | Unsubscribe link on every message |
| Anonymous analytics events | Site visitors, before any account exists | Automatic, from visiting the site | Measure which pages and campaigns work, without an identifier | Legitimate interest | DigitalOcean | London | 180 days | Carries no identifier that could be linked back to you |
| Google Analytics | Visitors who accept analytics cookies | Automatic, only after consent | Understand how the site is used | Consent | Google — we confirm the safeguard used with each provider | Set by Google | Accept, decline or withdraw on the Cookies page | |
| Cookies | Every visitor | Set by our server or your browser | Sign-in, CSRF protection, remembering your cookie choice | Strictly necessary cookies need no consent; _ga needs consent |
Google, only if _ga is set |
— | Session or up to a year (lr_consent); _ga only while consent
stands |
Cookies page |
| Server logs and error monitoring | Visitors and users, incidentally | Automatic | Diagnose faults, keep the service secure | Legitimate interest | DigitalOcean; Sentry, where enabled | London; Sentry per its own configuration | Provider-managed rotation | Contact us |
| Support enquiries | Anyone who emails us | You | Answer your question | Legitimate interest; contract if you are a customer | Our email provider | — | While needed to resolve, and a reasonable record afterwards | Contact us |
| Companies House company data | Companies on the public register | The public Companies House register | Build the matches your search profile shows | Legitimate interest (our filtering of already-public data) | Shown inside your workspace | London | Indefinite — public-register reference data | Corrections go to Companies House; see Product Data and Methodology |
Companies House data
Company names, numbers, registered addresses and Standard Industrial Classification (SIC) codes come from the public Companies House register, made available under the Open Government Licence v3.0. This is public information Companies House already publishes; using it does not remove it from data-protection law, so where it identifies a person — a sole trader's registered company name, or a director — we still treat it as personal data.
An error in the underlying Companies House record is corrected with Companies House, not us; see Product Data and Methodology for the correction route, and Contact Launch Register if we have displayed a correct record incorrectly.
Cookies and analytics
Session, CSRF and lr_consent cookies are set for everyone because the service will
not work without them. The Google Analytics cookie (_ga) is set, and Google Analytics
itself is loaded, only after you actively accept analytics cookies — declining or withdrawing
consent stops it loading and clears its cookies where we can. Visit the
Cookies page to make or change that choice at any time.
Retention and deletion
Retention differs by data class — the table above states each one — but three figures are worth stating plainly because they are the ones we actually enforce today:
- Delivered digest files (CSV/XLSX) are deleted from storage 30 days after creation; the in-app download is rebuilt from the underlying records and is unaffected.
- Anonymous analytics events — recorded before you have an account, and carrying no identifier — are deleted after 180 days.
- Closing a workspace (from Team Settings) revokes access immediately; we keep the data for 30 days in case of a mistake, then an automatic nightly process erases it permanently. You can ask us to erase it sooner.
A separate, faster timer — deleting a practice's workspace content automatically once a subscription simply lapses, rather than the workspace being closed — exists in the product but is not yet switched on. Do not rely on it: while a workspace is lapsed but not closed, its content is retained until closure or a specific erasure request.
International transfers
Launch Register itself is hosted in London (DigitalOcean's lon region). Some of the
processors we use — including Stripe, Brevo, Google and, where its check is enabled, Cloudflare —
operate internationally, and personal data may be processed outside the UK as a result. Where that
happens we rely on appropriate safeguards, such as UK adequacy regulations, standard contractual
clauses, or the International Data Transfer Addendum, and we confirm the specific safeguard in use
with each provider.
Your rights
Subject to the usual legal conditions, you can ask us to: give you access to your personal data; correct it; erase it; restrict how we use it; give you a portable copy; and stop processing it on objection — objection to direct marketing is absolute and free, with an unsubscribe link on every marketing message. Where a practice, rather than Launch Register, is the controller for a piece of workspace content (see the table above), we will help you identify the right practice to ask.
To exercise a right, use Contact Launch Register or email [email protected]. If you are unhappy with our response, you can complain to the Information Commissioner's Office (ICO).
Changes to this notice
Version 2026-09-17. We will post a new version here, with an updated date, whenever what we process, why, or for how long changes materially.