1. Introduction
Dream MRP ("we", "our", "us") is operated by Manu Online Limited, a company registered in England and Wales (company number 07273799). We are committed to protecting your personal data in accordance with the UK Data Protection Act 2018, the UK GDPR, and the EU GDPR where applicable.
This Privacy Policy explains how we collect, use, and protect your personal data when you use our Manufacturing Resource Planning service that integrates with Xero accounting software.
2. Information We Collect
2.1 Account Information
- Name and email address from your Microsoft account
- Organisation name and details
2.2 Xero Data
When you connect your Xero account, we access and process:
- Inventory items and stock levels
- Purchase orders and supplier information
- Bills of Materials and manufacturing data
- Contacts (suppliers and customers)
- Sales orders/invoices
2.3 Usage Data
- Log data (IP address, browser type, pages accessed)
- Service usage patterns and features used
- Error reports and performance data
2.4 Payment Information
Payment processing is handled through the Xero Marketplace. We do not store credit card details directly.
3. How We Use Your Information
We use your data to:
- Provide and maintain the Dream MRP service
- Process MRP calculations using your Xero inventory data
- Generate and submit purchase orders to your Xero account
- Authenticate your identity and manage your account
- Send service notifications, updates, and support communications
- Improve our service through usage analytics
- Comply with legal obligations
- Detect and prevent fraud or abuse
3.1 Legal Bases (UK/EU GDPR)
- Contract performance: Processing necessary to provide the Service
- Legitimate interests: Service improvement and fraud prevention
- Legal obligation: Compliance with applicable laws
- Consent: Marketing communications (where opted in)
4. Data Storage and Security
4.1 Storage Location
Your data is stored in Microsoft Azure data centers. The specific region is assigned when your account is created and aligns with your geographic location (e.g., UK South for UK users).
4.2 Security Measures
- All data is encrypted in transit (TLS 1.2+) and at rest
- Xero OAuth tokens are encrypted using Microsoft Data Protection API
- Access controls and audit logging are in place
- Regular security assessments are conducted
4.3 Data Breach
In the event of a data breach affecting your rights and freedoms, we will notify the ICO within 72 hours and affected users as soon as reasonably practicable.
5. Data Sharing
We do not sell your personal data. We share data only with:
- Xero Limited: Required for OAuth authentication and API access
- Microsoft Azure: Cloud infrastructure provider (data processor)
- Stripe: Payment processing (billing data only)
- Legal authorities: When required by law or court order
All third-party processors are subject to data processing agreements and are required to maintain appropriate security measures.
6. Your Rights and Choices
Under UK/EU GDPR, you have the right to:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate personal data
- Erasure: Request deletion of your data ("right to be forgotten")
- Restriction: Limit how we process your data
- Portability: Receive your data in a machine-readable format
- Object: Object to processing based on legitimate interests
- Withdraw consent: Where processing is based on consent
To exercise these rights, contact us at privacy@dreammrp.com. We will respond within 30 days. You have the right to lodge a complaint with the ICO (ico.org.uk).
7. Data Retention
- Active accounts: Data retained while your subscription is active
- Cancelled accounts: Data deleted within 30 days of cancellation
- Xero tokens: Immediately deleted upon disconnection or account closure
- Usage logs: Retained for 12 months for security and performance analysis
- Billing records: Retained for 7 years as required by UK law
8. Cookies and analytics
We use the following cookies:
- Session cookies: Required for authentication and maintaining your session
- Preference cookies: Remembering your selected Xero organisation
- Consent cookie:
dreammrp_consent records your cookie choice on this website and lasts one year - Website analytics: Google Analytics 4, loaded through Google Tag Manager on this marketing website, and only after you accept analytics cookies. Until you accept, Google Consent Mode v2 keeps analytics storage denied and no analytics identifiers are stored on your device.
- Application analytics: Anonymous usage and performance statistics inside the Dream MRP application, via Microsoft Application Insights
You can change or withdraw your analytics consent at any time using the Manage cookies link in the footer, or the button on our Cookie Policy page, which also lists every cookie this website sets. You can control cookies through your browser settings as well. Blocking essential cookies will prevent the Service from functioning.
9. International Data Transfers
Your data is primarily stored in the UK/EU Azure regions. Any transfers outside the UK or EU are subject to appropriate safeguards, including Standard Contractual Clauses. All data processing by Microsoft Azure is covered by their Data Processing Agreement and EU-US Data Privacy Framework certification.
10. Children's Privacy
Dream MRP is a business service not intended for individuals under 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, contact us immediately.
11. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notification at least 30 days before they take effect. Continued use after changes constitutes acceptance.
12. Contact Us
For privacy inquiries or to exercise your rights:
For complaints, contact the ICO: ico.org.uk or call 0303 123 1113.
13. Xero Marketplace Compliance
As a Xero Marketplace application, we comply with Xero's data security requirements and partner programme obligations. We only request permissions necessary to provide the Dream MRP service and do not use Xero data for any purpose other than providing you with the Service.
- We request only the minimum required Xero API scopes
- Xero data is never shared with third parties for their commercial purposes
- Xero connection can be revoked at any time through your Xero account or Dream MRP settings