Privacy Policy

PlanThread is provided by Duckham Meridian Group Limited, trading as DMG (“DMG”, “we”, “us”), a company registered in England and Wales. We are registered with the Information Commissioner's Office (ICO) under registration number ZC265320.

For any privacy question or request, email [email protected] with “Privacy” in the subject line. We are not required to appoint a Data Protection Officer, but a named person at DMG is responsible for data protection.

DMG is the controller for personal data we need to run our business: your user account, sign-in and security records, subscription status, support conversations, website enquiries and (with consent) website analytics.

Your organisation is the controller for the business data it puts into PlanThread, such as parts, stock, purchase orders, supplier contacts, staff names in RACI registers and forwarded supplier emails. For that data DMG acts as a processor and only processes it on your organisation's instructions under our Data Processing terms. If you are a supplier or employee of a PlanThread customer, please contact that organisation first.

We do not sell personal data, and we do not use it for advertising or profiling.

Paid plans are billed via the DMG Account Centre at dmg-limited.com. Card details are handled by DMG's payment provider and are never stored in PlanThread. PlanThread only receives your plan and subscription status.

• Password safety check. When you set a password we check it against known data breaches using the Have I Been Pwned range service. Only the first five characters of a one-way hash leave our servers; your password is never sent.
• Supplier risk. Company information for suppliers is looked up from the public Companies House register.
• Supplier portal and RFQs. Suppliers receive single-use magic links by email. We store the supplier contact's name and email as provided by your organisation.
• Email intake. Supplier emails your organisation forwards to PlanThread are read so AI can propose changes. A buyer always reviews and applies them.
• AI features. Text you send to the AI assistant, agent or email reader is processed by AI model providers to produce a suggestion. AI only suggests: a person approves every change, apart from auto-replenishment rules your planners set and control. We do not allow providers to train models on your data.
• Integrations you switch on. ERP connections (for example Orbis ERP, Sage, Business Central, SAP Business One, NetSuite, Xero, QuickBooks, Shopify), Microsoft Teams or Slack alerts and webhooks exchange data with services your organisation chooses. Your organisation is responsible for those services.
• Scheduled reports. Reports are emailed to the recipients your organisation sets up.

PlanThread produces forecasts, risk scores and recommendations, but none of them make decisions about individuals with legal or similarly significant effects. Supplier risk scores relate to companies, not people.

We use a small number of carefully chosen service providers (sub-processors) for hosting, databases, email delivery, AI models and, with consent, analytics. They act only on our instructions under written contracts. The current list is on our GDPR & Data Processing page. We may also disclose data where the law requires it, or to protect our rights, users or the public.

Some providers may process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, the “UK-US data bridge”) or the ICO's International Data Transfer Agreement or Addendum, together with appropriate security measures.

Data is encrypted in transit (HTTPS) and at rest, access is limited to people who need it, and PlanThread offers two-factor authentication, session controls, IP allowlists, account lockout and a tamper-evident audit trail. No system is perfectly secure, but we will tell you and the ICO without undue delay if a breach puts your rights at risk.

Under UK GDPR you have the right to:

• access a copy of your personal data
• have inaccurate data corrected
• have your data erased
• restrict how we use your data
• object to processing based on legitimate interests
• data portability (receive your data in a reusable format)
• withdraw consent at any time, for example for analytics cookies
• not be subject to decisions based solely on automated processing

Email [email protected] to use any of these rights. We reply within one month. We may need to confirm your identity first. There is normally no charge.

Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

PlanThread is a business service and is not intended for anyone under 18.

We will update this page when our practices change and revise the “Last updated” date. If a change materially affects you we will tell you in the app or by email. Cookies are explained in our Cookie Policy.