Privacy policy

1. Who is responsible and how to contact us

Duckham Meridian Group Ltd (DMG) operates LetThread. Registered in England and Wales, company number 17488344; ICO registration reference ZC265320. ICO registration is not certification or approval of the service. DMG is the controller for information it uses to administer accounts, handle enquiries, manage its customer relationship and protect the service. A controller decides why and how personal information is used.

Contact DMG at support@dmg-limited.com with “LetThread privacy request” in the subject, or see our contact page.

For tenancy, landlord, repair, inspection and certificate records uploaded or collected for a customer organisation, that landlord or letting agent is normally the controller and DMG processes the records on its behalf. The customer is responsible for its own lawful basis, privacy information, permissions and retention instructions. Contact that organisation first about its records; DMG can assist with routing your request.

2. Information we handle and where it comes from

• Account and organisation information: names, email addresses, organisation details, roles, account identifiers and subscription entitlement status. This is provided by you, an organisation administrator or the DMG account centre.
• Property and tenancy records: addresses, units, landlord and tenant contact details, tenancy dates, rent and deposit records, checklists, certificates and supporting documents supplied by customers and their staff.
• Operational records: repair descriptions, inspection findings and photographs, contractor details, appointments, evidence, document acknowledgements and delivery records. These may come from tenants, landlords, agents or contractors using a portal or invitation link.
• Security and technical information: IP addresses, request and device information, access and audit events, password hashes, sign-in sessions, and encrypted authenticator secrets and hashed recovery codes when MFA is enabled.
• Communications and AI inputs: enquiries, support messages, questions submitted to the AI assistant and document contents submitted for extraction. Only provide information relevant to the task.

Do not upload unnecessary identity documents, health details, criminal-offence information or other sensitive personal information. If a customer needs to record special-category data, the customer must establish an appropriate UK GDPR Article 9 condition as well as an Article 6 lawful basis before doing so.

3. Purposes and lawful bases

For processing where DMG is the controller, the purpose and basis depend on the relationship:

• Providing an account and delivering the requested service: performance of a contract, or steps you request before entering a contract, where you are the contracting individual (Article 6(1)(b)). For staff and contacts of an organisation customer, our legitimate interests in providing and administering that organisation’s service apply (Article 6(1)(f)).
• Answering enquiries and providing support: contractual steps where relevant, otherwise our legitimate interests in answering requests, resolving problems and maintaining customer relationships (Article 6(1)(f)).
• Security, fraud prevention and service reliability: our legitimate interests in protecting accounts, personal information and the service against misuse and investigating incidents (Article 6(1)(f)). We consider the impact on individuals and limit data to what is needed.
• Meeting applicable legal duties: legal obligation (Article 6(1)(c)), for example where tax or accounting rules require business records, or a binding legal requirement requires disclosure.
• Optional uses requiring consent: consent (Article 6(1)(a)) where explicitly requested. You can withdraw it at any time without affecting earlier lawful processing. Account access is not conditional on consenting to marketing.

For customer-controlled property and tenancy data, the customer determines the purposes and lawful bases. LetThread supports record keeping, reminders, inspections, repairs and human review; using the software does not itself establish a lawful basis.

4. Who can receive information

Customer records are available to authorised users in the relevant organisation according to their access. Customers can share selected records through tenant portals, acknowledgement links, contractor requests, reports and exports. Public portal information may be accessible to anyone with its link, so customers should check what they publish.

LetThread uses Abacus.AI for application hosting and services including AI processing, email delivery and PDF generation, and cloud storage for documents and photographs. These services process the information needed for the requested function; for example, AI extraction sends document contents and the assistant processes the question and supplied context. The DMG account centre handles account and subscription administration separately; payment-card entry is not handled by LetThread.

Professional advisers, authorities or other recipients may receive information where needed to meet a legal obligation, investigate misuse or establish, exercise or defend legal claims. Ask DMG for the current provider and subprocessor information relevant to your use.

5. International processing

Service providers may process information outside the UK. The applicable hosting locations, onward processors and contractual transfer safeguards for this service are being confirmed; this notice does not claim UK-only storage or a verified transfer mechanism. Contact DMG for the current position before uploading information subject to location or transfer restrictions.

Where a restricted transfer takes place, UK data protection law requires an applicable adequacy arrangement or appropriate safeguards, such as a UK International Data Transfer Agreement or UK Addendum, together with any required assessment. You can ask us for details and a copy of the safeguards relevant to your information. This section will be updated when the service-specific arrangements are confirmed.

6. Retention and deletion

Retention depends on the purpose, the customer’s instructions, the duration of the relationship, applicable record-keeping duties and whether information is needed for a dispute or security investigation. There is no single retention period for all LetThread records.

• Account and support records: retention is assessed against the need to provide the account, resolve enquiries, meet applicable legal duties and deal with disputes. Contact DMG to request closure or deletion; cancellation alone does not automatically erase records.
• Customer property records and files: retained for the customer’s instructed use and record-keeping needs. A certificate expiring, a tenancy ending or an invitation link expiring does not delete the underlying record. Customers should review their records and request deletion when no longer needed, subject to applicable obligations.
• Authentication: sign-in sessions have a maximum lifetime of 30 days and can be revoked earlier. Email sign-in codes expire after 10 minutes. Expiry stops their use; it is not a promise that all associated audit or security records are erased at that time.
• Security, audit and delivery records: assessed against incident investigation, prevention of misuse, service accountability and legal-claim needs. Backups and service-provider copies may follow separate lifecycles; ask DMG for the applicable deletion and backup position.

LetThread does not currently apply a universal automatic deletion schedule to customer portfolios. DMG must assess deletion requests with the relevant controller, including any information that must be retained and why. Specific operational retention schedules and provider backup periods remain subject to confirmation.

7. Your rights and requests

Depending on the circumstances, you have rights to access your personal information, correct inaccurate information, request erasure, restrict processing, receive a portable copy of information you supplied, and object to processing based on legitimate interests. You can object to direct marketing at any time. Where processing is based on consent, you can withdraw it.

Email our privacy contact to exercise a right. We may request proportionate information to verify your identity and locate the records. Requests are normally answered within one month. Where the law allows an extension for a complex request, we will explain the reason and timescale. Rights are not absolute; if a request cannot be fulfilled, we will explain the applicable reason. Requests are normally free of charge.

For customer-controlled tenancy or property records, contact your landlord or letting agent. We assist the customer in responding rather than independently changing their records without authority.

8. Complaints to the ICO

You can raise a concern with DMG using the contact details above. You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (ICO). Visit ico.org.uk or telephone 0303 123 1113. You do not have to complete our complaints process before contacting the ICO.

10. AI, required information and children

AI extraction and answers are aids for staff, not legal advice or decisions about an individual’s rights. Certificate findings require human review. LetThread does not use these features to make solely automated decisions with legal or similarly significant effects about individuals.

Account identifiers and authentication information are required to provide secure access. Without them, we cannot create or authenticate your account. Customers decide which tenant and property information they require and should explain any legal or contractual requirement and consequences of not providing it. Unnecessary personal information should not be supplied.

LetThread is intended for landlords, agents and their authorised users, not as a service directed at children. Customer records should contain children’s information only where necessary and lawful for the customer’s purpose.

11. Changes to this notice

We will update this page when the service or its data practices change. The date at the top identifies this version. Material changes affecting how your information is used should be communicated through the service or the relevant customer contact.