GDPR & Data Processing

1. Roles

For personal data in your workspace ("Customer Personal Data"), your organisation is the controller and DMG is the processor under Article 28 of the UK GDPR and, where it applies, the EU GDPR. For account, billing and security data, DMG is the controller, as set out in our Privacy Policy.

2. Processing details

• Subject matter and purpose: providing carbon accounting, reporting and related features of GreenThread.
• Duration: the subscription term plus the 30-day export period.
• Data subjects: your staff and users, supplier contacts, and people named in records or documents you upload.
• Types of data: names, work contact details, job roles, travel and commuting records, and other content you choose to enter. No special category data is expected.

3. Our commitments as processor

• We process Customer Personal Data only on your documented instructions, which are given by your use of GreenThread and these terms.
• Everyone with access is bound by confidentiality.
• We apply appropriate technical and organisational measures (Art. 32). See the Security page.
• We help you respond to data subject requests and with impact assessments and consultations with regulators, as far as the service allows.
• We notify you without undue delay, and aim to within 48 hours, after becoming aware of a personal data breach affecting your data.
• At the end of the service we delete Customer Personal Data after the export period, unless the law requires us to keep it.
• We provide the information needed to show we comply, and support reasonable audits on 30 days' notice, normally met by written answers and documentation.

4. Sub-processors

You give general authorisation for us to use the sub-processors below. Each is bound by written terms giving equivalent protection. We will give account admins at least 30 days' notice of a new sub-processor, and you may object on reasonable data protection grounds.

Subscription status is checked with the DMG account centre at dmg-limited.com, which is operated by Duckham Meridian Group Ltd and is not a third party.

5. International transfers

Where Customer Personal Data leaves the UK or EEA, we rely on adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified) or the UK International Data Transfer Agreement or Addendum and EU Standard Contractual Clauses, with supplementary measures such as encryption in transit and at rest.

6. Tools in the app that help you comply

• Access and portability: CSV exports of emissions data and reports.
• Rectification and erasure: admins and contributors can edit or delete entries in open reporting years. Admins can remove team members.
• Accountability: a hash-chained audit log with CSV export records who changed what and when.
• Least privilege: admin, contributor, viewer and auditor roles.

Keep personal data in free-text notes and uploads to what you need. Carbon reporting rarely needs to identify individuals.

7. Data subject requests

If someone contacts us directly about data in your workspace, we will pass the request to your organisation and will not answer it ourselves unless you ask us to. For requests about data DMG controls, email [email protected].

8. Liability and precedence

Liability under these terms is subject to the limits in our Terms of Service. If these terms conflict with the Terms of Service on data protection, these terms prevail. If you need a countersigned copy of this agreement, email [email protected].

GreenThread helps you comply with data protection law. This page is not legal advice.