GDPR & Data Processing

When your organisation (the Customer) puts personal data into PlanThread, the Customer is the controller and Duckham Meridian Group Limited (DMG) is the processor. These Data Processing terms form part of the Terms of Service. DMG is registered with the ICO under number ZC265320.

For account, billing, security and website data DMG acts as an independent controller, as described in our Privacy Policy.

DMG will:

• process personal data only on the Customer’s documented instructions (these terms and the Customer’s use of the service), unless the law requires otherwise, in which case we will tell the Customer first where allowed
• make sure everyone authorised to process the data is bound by confidentiality
• apply appropriate technical and organisational security measures (section 6)
• use sub-processors only as described in section 4
• help the Customer respond to data subject requests, including through in-app export and deletion
• help the Customer with security, breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the information available to us
• notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer data
• delete or return personal data at the end of the service (30-day export window, then deletion; backups roll off within 35 days), unless the law requires us to keep it
• make available the information needed to demonstrate compliance with Article 28, and allow for and contribute to reasonable audits, normally by providing written answers and documentation, with at least 30 days’ notice
• tell the Customer immediately if we believe an instruction breaks data protection law

The Customer gives general authorisation for DMG to use the sub-processors below. We impose data protection obligations on each of them that are no less protective than these terms, and we remain responsible for their performance. We will give at least 30 days' notice of a new sub-processor by updating this page and notifying account owners; the Customer may object on reasonable data protection grounds, and if we cannot resolve the objection the Customer may cancel the affected service.

Not sub-processors: services the Customer chooses to connect (ERP, accounting, Microsoft Teams, Slack, webhooks) act for the Customer. Companies House (public register lookups by company number) and the Have I Been Pwned range check (receives only a partial password hash) do not receive Customer personal data. Google Analytics runs only on the public website with visitor consent.

Where a sub-processor processes personal data outside the UK, DMG ensures a lawful transfer mechanism is in place: UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the ICO's International Data Transfer Agreement or the Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.

• Encryption in transit (TLS) and at rest
• Logical separation of every customer workspace, with access checked on every request
• Two-factor authentication, configurable session length, IP allowlists and account lockout after repeated failed sign-ins
• Passwords stored with strong one-way hashing and checked against known breaches
• Role-based permissions and a RACI register controlling who can release, approve and award
• Hash-chained, tamper-evident audit log
• Web application firewall with automatic blocking of abusive traffic
• API keys stored as hashes, with scopes, expiry dates, IP restrictions and rate limits
• Regular backups with 35-day roll-off, and least-privilege staff access

PlanThread is not currently certified to ISO 27001 or Cyber Essentials Plus. These are on our roadmap.

If DMG receives a request from someone whose data the Customer controls, we will pass it to the Customer without undue delay and will not respond directly except to confirm that we have forwarded it.

For data protection questions, to request a signed copy of these terms or to raise an objection to a sub-processor, email [email protected] with “Privacy” in the subject line.