Privacy Policy

1. Who we are

GreenThread is operated by Duckham Meridian Group Ltd, a company registered in England and Wales, trading as DMG ("DMG", "we", "us"). For privacy questions or to exercise your rights, email [email protected].

2. Our role

• Controller: we are the controller for account, billing, support, security and website data, meaning the data we need to run our business and your relationship with us.
• Processor: for personal data your organisation puts into GreenThread (for example staff names on travel records, supplier contacts or uploaded bills), your organisation is the controller and we process it only on its instructions. See GDPR & Data Processing.

3. What we collect

• Account data: name, work email, organisation, role, password hash, two-step sign-in settings.
• Subscription data: plan and subscription status from the DMG account centre. Card details are handled by our payment provider and never reach GreenThread.
• Customer content: activity data, emissions figures, targets, initiatives, offsets, supplier requests and documents you upload.
• Security and usage data: IP address, browser type, sign-in times, audit log entries and error logs.
• Enquiries: what you send us through the contact form or by email.

We do not intentionally collect special category data and ask you not to upload it.

4. How we use it and our lawful basis

We do not sell personal data, use it for advertising or make decisions with legal or similar effects about you by automated means alone. AI document extraction only suggests values, and a person always reviews them before saving.

5. Who we share it with

We share data only with sub-processors that help us run GreenThread, under written contracts. The current list is on our GDPR page. We may also disclose data where the law requires it or to protect our rights, and to a buyer if our business is sold (with the same protections).

6. International transfers

Some of our providers process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified) or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

7. How long we keep it

• Customer content: for your subscription, then 30 days for export, then deleted from live systems. Backups roll off within a further 35 days.
• Audit log entries: as long as the organisation's workspace exists, because the log is tamper-evident.
• Billing records: 6 years, to meet UK tax law.
• Security logs: up to 12 months.
• Enquiries: up to 2 years after the last contact.

8. Cookies

GreenThread uses only strictly necessary cookies for sign-in, session security and CSRF protection. We do not use advertising or third-party analytics cookies, so no consent banner is needed. You can block cookies in your browser, but you will not be able to sign in.

9. Security

Data is encrypted in transit and at rest, access is role-based, two-step sign-in is available, and changes are recorded in a hash-chained audit log. See our Security page.

10. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict, port and object to processing of your personal data, and to withdraw consent where we rely on it. Email [email protected]. We reply within one month. If your data is held for your employer's workspace, we may refer your request to them as controller.

You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). Please contact us first so we can try to help.

11. Children

GreenThread is a business service and is not intended for anyone under 18.

12. Changes

We will post updates here and tell account admins by email about material changes.