Privacy Notice
Last updated: 1 October 2026
1. Data Controller
Duckham Meridian Group Limited is the data controller for personal data processed through InvoiceThread. Contact: [email protected]
2. Data We Collect
We collect: account information (name, email), organisation details (company name, VAT numbers), invoice data (buyer/seller details, line items, amounts), and usage data (login times, feature usage).
3. Legal Basis
We process data on the basis of: contractual necessity (to provide the Service), legal obligation (tax record retention), and legitimate interest (service improvement and security).
4. Data Security
Personal data and financial information are encrypted at rest using AES-256-GCM encryption. All data is transmitted over TLS. We maintain hash-chained audit logs for integrity verification.
5. Your Rights
Under UK GDPR, you have the right to access, rectify, and port your data. You may request erasure; however, please note that erasure of invoice records may be limited by statutory tax retention obligations (e.g., 6 years UK, 10 years France).
6. Data Retention
Account data is retained for the duration of your subscription plus 30 days. Invoice records are retained for the statutory period required by the applicable tax jurisdiction. Audit logs are retained for the same period as the related invoices.
7. Third-Party Processors
We use third-party processors for: e-invoice delivery (Peppol access point providers), cloud hosting, and AI-assisted document processing. All processors are bound by data processing agreements compliant with UK GDPR.
8. Contact
For privacy enquiries: [email protected]