DMN/Software

Privacy policy

This translation is provided for convenience. The German version is legally binding: Datenschutzerklärung.

Controller

The controller responsible for data processing on this website is:
DMN Software
[first and last name]
[street and house number]
[postcode and city]
Email: kontakt@dmn-software.com

Overview

This website consists of static pages and a contact form (see below), without a newsletter and without any analytics or tracking services. No cookies are set and no data is stored in the visitor's browser (no Local Storage, no Session Storage). Usage behavior is not analyzed. The subpages notebook.dmn-software.com, minigames.dmn-software.com and bewerbungen.dmn-software.com are subject to the exceptions in the sections further down.

Hosting and delivery

The website is operated on its own rented server. Provider of the server: Avoro, a service of dataforest GmbH, Taunusstraße 52, 65830 Kriftel, Germany. [A data processing agreement under Art. 28 GDPR is in place with the provider.]

Transmission is encrypted via TLS with certificates from Let's Encrypt. The legal basis for operating the website and the technically necessary processing involved is Art. 6(1)(f) GDPR (legitimate interest in providing the website securely and in working order).

When the website is accessed, the web server in use (Caddy) necessarily processes the visitor's internet protocol address (IP) in order to transmit the page content. This processing takes place only in the memory of the existing connection. The hosting provider may independently process its own connection data on its own infrastructure (e.g. at network or firewall level); the operator of this website has no influence over this.

Server log files

The web server is configured so that no access logs containing internet protocol addresses are stored. No log files about individual page views are created or analyzed. The server's operational logs only record technical messages about the renewal of TLS certificates; these contain no visitor data.

Contact form on the home page

A contact form is available on the home page. It asks for name, email address and the message, as well as a checkbox confirming that this privacy policy has been read. The form also contains a field that is not visible to visitors and a timestamp. Both serve exclusively to detect automated form submissions and are neither stored nor passed on to third parties.

The legal basis for processing the data entered is Art. 6(1)(b) GDPR where the request relates to entering into or performing a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in handling incoming requests). The checkbox does not constitute separate consent under Art. 6(1)(a) GDPR, it only confirms that this policy has been read. The detection of automated submissions is based on Art. 6(1)(f) GDPR (legitimate interest in protecting the form against misuse).

Transmission is encrypted via TLS to the operator's own server at Avoro, a service of dataforest GmbH (see the section "Hosting and delivery"). A small service running there checks the input and then sends the message as an email through the provider Resend, Resend, Inc., USA. The form data itself is not stored in a database on the server. To protect against mass submissions, the service counts the times of submissions per internet protocol address within the last ten minutes. The address and times are held exclusively in memory for this purpose and are discarded automatically no later than twenty minutes after the last submission. Neither the internet protocol address nor the content of the message is logged.

Resend acts as a processor for sending the email. As Resend is based in the USA, this involves a transfer of personal data to a third country. [legal basis for the transfer, e.g. adequacy decision (EU US Data Privacy Framework) or standard contractual clauses]. [confirm data processing agreement with Resend]

The email sent by Resend goes to the address kontakt@dmn-software.com. Incoming email to this address is forwarded via Cloudflare Email Routing, Cloudflare, Inc., USA, to the personal mailbox of the controller; replies are sent from kontakt@dmn-software.com. This, too, is processing by a processor based in a third country. [legal basis for the transfer, e.g. adequacy decision (EU US Data Privacy Framework) or standard contractual clauses]. [confirm data processing agreement with Cloudflare] For the domain, Cloudflare otherwise only provides name resolution (DNS); access to this website itself does not run through Cloudflare.

The receiving mailbox is operated by Google Ireland Limited (Gmail). Processing there is governed by that provider's own privacy notices.

Messages received through the contact form are deleted as soon as the request has been conclusively dealt with, unless statutory retention obligations apply, for example for business letters under § 257 HGB or § 147 AO (retention for up to six years).

Contact by email

When you get in touch by email, for example to kontakt@dmn-software.com or an address given in the legal notice, the data provided (for example sender address, content of the message) is processed exclusively to handle the request and any follow up communication. The legal basis is Art. 6(1)(b) GDPR where the request relates to entering into or performing a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering incoming requests). For the address kontakt@dmn-software.com, the information in the section "Contact form on the home page" on forwarding via Cloudflare Email Routing and on the mailbox provider also applies.

Minigames on minigames.dmn-software.com

This address offers twelve minigames in the browser. The same page can also be embedded in a FiveM game client through a frame (iframe). The same information applies whether the page is opened through the game client or in an ordinary browser.

Anyone submitting a result to the leaderboard can enter a freely chosen name. This name, the score achieved, the game played and the time of the entry are stored in a dedicated database on the server in use. The name is not checked for authenticity. [make it clear in the application that no real name should be entered here]

To protect against mass or automated submissions, the server combines the internet protocol address with a secret extra value into a hash and uses only this hash as a counter per address. The actual internet protocol address is neither stored nor logged for this purpose. The legal basis for adding the requested entry to the leaderboard is Art. 6(1)(b) GDPR, the legal basis for hashing the address to protect against misuse is Art. 6(1)(f) GDPR. [define a storage period for leaderboard entries]

Unlike the rest of the website, this subpage stores one number in the browser's Local Storage, namely the visitor's own best result per game, so it can be shown again on the next visit. This number never leaves the device and is not transmitted to the server. This storage is strictly necessary to provide the function explicitly requested (§ 25(2) no. 2 TDDDG); consent is therefore not required. Beyond that, no cookies are set and no analytics or tracking services are embedded. The page also sends no messages to a surrounding window.

NotebookLM clone on notebook.dmn-software.com

This address offers a tool for uploading your own documents (PDF, DOCX, text, web addresses) and asking questions about them, plus a spoken summary with two voices. Sign in uses an email address and password through a self hosted directory service on the operator's own server at Avoro; there is no sign in through a third party.

For sign in, the application sets a cookie that only confirms the session. This cookie is strictly necessary to provide the function explicitly requested (§ 25(2) no. 2 TDDDG); consent is therefore not required. The legal basis for processing account data and uploaded documents is Art. 6(1)(b) GDPR.

A publicly accessible demo account with a prepared example notebook is available to try the tool. Uploading, renaming and deleting are blocked for this account, while asking questions and the summary function remain available. The demo account is shared by all visitors, so questions asked and content generated by one visitor may be visible to others. [add a clear notice about the demo account: do not enter real personal information] To limit usage, the server keeps the internet protocol address in memory only, for at most one hour, together with a daily total count for all visitors that resets at midnight Central European time; no permanent storage takes place for this purpose. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a working, publicly accessible demonstration).

Uploaded documents and questions asked are processed by the Gemini interface of the provider Google in order to answer questions, to build search vectors (embeddings) and to produce the spoken summary. [confirm the contracting Google entity: Google Ireland Limited or Google LLC] [confirm a data processing agreement with Google] [legal basis for the transfer to a third country, e.g. adequacy decision (EU US Data Privacy Framework) or standard contractual clauses] [check whether the interface terms allow input to be used for training further models]

Account data, uploaded documents and the vectors derived from their text are kept in the operator's own database and file storage on the operator's own server at Avoro; access is restricted per account to that account's own rows through database rules. Account data is kept until the account is deleted. [define a storage period for content in the shared demo account]

Job application portal on bewerbungen.dmn-software.com

This address offers a private tool for managing your own applications to job postings. [confirm whether registration is open or requires an invite code] Processing includes, among other things, account data, uploaded CVs, references, certificates and writing samples, structured career facts derived from them, suggested matching jobs and the status of individual applications. The legal basis is Art. 6(1)(b) GDPR (contract for the use of the application).

When an account is created, agreement to the terms of use and acknowledgement of this policy are recorded as consent with a timestamp; the same applies to the separate consent to pass profile information to the language models named below for evaluation, and to the separate consent to have career pages of outside companies crawled on the account holder's behalf. Each of these consents can be withdrawn individually at any time with effect for the future in account management; the legal basis for them is Art. 6(1)(a) GDPR.

Signing in can require an additional one time code from an app of your own (the method known as TOTP); the secret key stored for this is encrypted. Signing in is also possible through GitHub, Google or LinkedIn. The chosen provider then passes name, email address and, depending on the provider, further public information such as projects or a profile picture to the application; the access tokens received in that process are stored encrypted. The legal basis for linking such an account is consent under Art. 6(1)(a) GDPR, given when the account is linked and revocable at any time with effect for the future in account management.

To evaluate uploaded documents, match them against job postings and draft cover letters, the application processes profile information at the providers Anthropic and Google (Gemini) as processors, and only where the separate consent mentioned above has been given. [confirm the contracting entities and location of Anthropic and Google for this processing] [confirm data processing agreements with Anthropic and Google] [legal basis for the transfer to a third country, e.g. adequacy decision (EU US Data Privacy Framework) or standard contractual clauses] Vectors used to match profile against job postings are, by contrast, computed on the operator's own server, without this information being sent to an outside provider for that purpose.

Every action in the application is recorded in an ongoing log that can afterwards be neither changed nor deleted. It records the account that performed the action, the type of action, the object affected, the internet protocol address, the browser identifier and the time. The log serves protection against misuse and troubleshooting; each person sees their own history in the application. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the traceability of account actions). [define a storage period for the log]

Status messages, reminders and summaries are sent by the application as email through the provider Resend, Resend, Inc., USA (see the section "Contact form on the home page" for the processing agreement and third country transfer concerning Resend). Sign up emails currently run through the operator's own mail server. [add the provider of the operator's own mail server and the planned move to Resend for sign up emails]

Through account management, every person can download their data as an archive file (Art. 15 and Art. 20 GDPR) and delete their account for good (Art. 17 GDPR). When an account is deleted, the related entries in the log are kept but anonymised, so that the traceability of past actions for other accounts remains intact.

No cookies, § 25 TDDDG

No cookies, no comparable technologies and no other information are stored on or read from visitors' devices. Consent under § 25 TDDDG is therefore not required. This applies to dmn-software.com itself; Local Storage for the minigames and the session cookie of the NotebookLM clone are described in the respective sections above. [add cookies and browser storage used by the job application portal]

Rights of data subjects

Under the GDPR, data subjects have the following rights against the controller:

  • Access to the personal data processed (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing, in particular to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

Where consent has been given, it can be withdrawn at any time with effect for the future. An informal message to the email address given in the legal notice is sufficient to exercise these rights.

Right to lodge a complaint with a supervisory authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority, in particular with the authority responsible for the controller's place of business: [competent state data protection authority].

Storage period

Personal data from email contacts is deleted as soon as it is no longer required for the purpose of its processing, unless statutory retention obligations prevent deletion. As no log files with visitor data are created on dmn-software.com itself, no separate storage period applies in this respect. The applications on the subpages follow the retention periods stated in their sections.

Date of this policy

Last updated: September 2026.