How we handle your data on cognaio.com.

1. Who is responsible

This website is run by:

Data protection contact: Stefan Schmid, DTI Schweiz AG, privacy@dti.ch

Representative in the EU (Art. 27 GDPR): DTI GmbH, Im Mediapark 8, 50670 Cologne, Germany, info@dti.group

This policy covers the website cognaio.com. For everything else, for example if you are a customer, apply for a job or attend an event, the general privacy policy of DTI applies. How COGNAiO^® processes data for customers is set out in the customer contracts.

2. Visiting the website

The website is hosted by ALL-INKL.COM – Neue Medien Münnich (owner: René Münnich), Hauptstraße 68, 02742 Friedersdorf, Germany. It works for us as a processor.

When you open a page, your browser sends technical data, and the web server records it in log files:

• your IP address
• date and time of the request
• the page or file requested and whether it was delivered
• the website you came from (referrer)
• browser and operating system

We need this to deliver the website, keep it secure and find errors. Legal basis: our legitimate interest in a secure website that works (Art. 6(1)(f) GDPR). We keep the log files only as long as these purposes require and then delete them.

Everything the page shows when it opens comes from this server: fonts, images and the film. The page loads nothing from Google, YouTube or social networks.

3. Storage in your browser

cognaio.com sets no cookies. The page keeps a few small entries in your browser’s storage. They stay on your device. Only the demo sign-in is sent along, to our relay server, when you run the demo with your own request or document (see section 7).

cognaio-consent

Your choice in the privacy settings, with date and version

Kept for 12 months, then we ask again

cognaio-theme

Light or dark mode, if you switch it yourself

Kept until you delete it in your browser

cognaio-film

Remembers that you entered your email for the full film, so it plays right away next time

Kept until you delete it in your browser

cognaio-pos

Keeps your place on the page when you switch the language

Deleted again right away

cognaio-try-signin

Your sign-in for the demo on /try/: your email address and a signed key

Kept for 30 days, or until you sign out

These entries are needed for functions you use, so they do not need your consent (Art. 6(1)(f) GDPR, § 25(2) no. 2 of the German TDDDG).

4. Statistics with Plausible (only with your consent)

If you agree to “Statistics” in the privacy settings, we measure how the website is used with Plausible Analytics. The provider is Plausible Insights OÜ, Estonia. The data is stored on servers in Germany and stays in the EU. Plausible works for us as a processor.

Plausible sets no cookies and stores nothing in your browser. It records:

• the page you visit and the website or campaign link you came from
• browser, operating system and type of device
• country, region and city, derived from your IP address
• time spent on the page and how far you scroll
• whether you click a link to book a demo or to the Azure Marketplace, whether you start a film, how much of it you watch and whether you enter an address for the full film
• on the try page, whether you start a run with a sample document or your own, whether the result appears or an error occurs, and whether you sign in; never your address, your document or the result

Your IP address and your browser’s identification are not stored. Plausible only uses them to form an anonymous code that changes every day; the key for it is deleted after 24 hours. So Plausible cannot recognise you on another day or on other websites. We only see totals, such as the number of visitors per page, and we do not build profiles.

Legal basis: your consent (Art. 6(1)(a) GDPR). Without it, Plausible does not load at all. You can change or withdraw your choice at any time under “Cookie settings” at the bottom of every page; a withdrawal applies from that moment on. We keep the statistics as long as we use them to improve the website. More in Plausible’s privacy policy.

5. Booking a demo

The buttons “Book a live demo” and “Book a demo” open Microsoft Bookings, the appointment service of Microsoft 365, in a new tab. Microsoft Ireland Operations Limited, Dublin, Ireland, runs it for us as a processor. Nothing is loaded from Microsoft until you click.

On the booking page you enter your name, your email address and any other details the form asks for, and you choose a time. We use this to prepare and hold the demo, usually as a Microsoft Teams meeting, and to get back to you. Legal basis: steps you ask for before a possible contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering requests (Art. 6(1)(f) GDPR).

Microsoft may also process data in the USA. Microsoft is certified under the EU-US and the Swiss-US Data Privacy Framework. If the booking page offers to sign you in with a Microsoft account, Microsoft’s own privacy statement applies to that sign-in; you can also continue as a guest. We delete booking data when we no longer need it, unless the law requires us to keep it.

6. Contacting us by email

If you write to us, for example at info@dti.group, we use your message and your contact details to answer you. Our email runs on Microsoft 365, operated for us by Microsoft Ireland Operations Limited as a processor. Legal basis: Art. 6(1)(b) and (f) GDPR.

7. Trying COGNAiO^® yourself

On cognaio.com/try/ a demo agent reads a document for you. The page sends your request and the document to our relay server, which passes them on to COGNAiO^® and returns the result to your browser. The relay server is run for us by Render Services, Inc., San Francisco, USA, as a processor, on a server in Frankfurt, Germany. COGNAiO^® reads the document on servers in Europe. Neither stores your document, your request or the result; the relay server holds them in memory only until the result is in your browser, at most ten minutes.

The examples and sample documents need no sign-in. For your own request or document you sign in with your work email address. We check that its domain can receive email and is not a free-mail or throwaway provider, and we send you a six-digit code from noreply@cognaio.com (Microsoft 365, see section 6). The relay server keeps the address and the code in memory for at most one hour. After the sign-in, your browser keeps a signed key with your address for 30 days (see section 3). We use the address for the sign-in and the demo’s daily limit. We also tell our team by email (Microsoft 365) that you tried the demo, with your address, the page’s language and the time, and we may contact you once about COGNAiO^®. We do not send newsletters and do not pass the address on outside the DTI Group.

The demo agent also judges each own request. If it is an attempt at misuse, for example to get at the agent’s instructions or for unlawful purposes, the page shows no result but a warning; a second attempt within 24 hours closes the demo for this address and this device for 12 hours. Our team is told by email each time, with the agent’s short reason.

Please only use documents you may share and that contain no particularly sensitive data, such as health data. To prevent abuse, the relay server counts runs per visitor, under a one-way hash of the IP address, and per signed-in address, in memory only, and deletes the counts after 24 hours. Its log records for each run the time, the duration and the kind and size of the document, and for a sign-in the domain of the address; no content and no IP address.

Legal basis: you ask us to run the demo (Art. 6(1)(b) GDPR); the limits against abuse, telling our team and contacting you once are our legitimate interest in a secure demo and in following up on interest in COGNAiO^® (Art. 6(1)(f) GDPR). You can object to this at any time at privacy@dti.ch. Render is certified under the EU-US and the Swiss-US Data Privacy Framework.

8. Watching the full film

Before the full film plays on the start page, we ask for your work email address. Our relay server (Render, see section 7) passes it on by email to our team (Microsoft 365), together with the page’s language, the page and the time. We do not check the address and do not store it, neither on the website’s server nor on the relay server.

We use it to see who is interested in COGNAiO^® and to contact you once about it. We do not send newsletters. Legal basis: your consent when you enter the address (Art. 6(1)(a) GDPR). You can withdraw it at any time by writing to info@dti.group; we then delete your address. Otherwise we delete it as soon as we no longer need it for this purpose.

To prevent abuse, the relay server counts the requests of each visitor for ten minutes, under a one-way hash of the IP address and in memory only, and then deletes the count. Your browser remembers that you entered an address (see section 3). Anyone who has the link to the film page can watch the film without entering an address.

9. Links to other websites

The page links to other websites: the imprint and privacy policy of DTI (dti.group), COGNAiO^® in the Microsoft Azure Marketplace and Microsoft Bookings. These pages only open when you click. From then on, the privacy policy of that website applies.

10. Recipients and transfers abroad

We only share personal data with the processors named above: All-Inkl (Germany), Plausible (Estonia, servers in Germany), Render (USA, server in Germany) and Microsoft (Ireland, possibly USA). Within the DTI Group (DTI Schweiz AG, DTI GmbH, DTI Srl) we share data only where it is needed, for example to answer your request. We do not sell data, and we do not pass it on for advertising.

Switzerland and the EU recognise each other’s level of data protection. For the USA we rely on the Data Privacy Framework (see sections 5 and 7).

11. Your rights

Under the GDPR and the Swiss FADP, and within the legal conditions, you can:

• ask which data we hold about you
• have wrong data corrected
• have data deleted or its use restricted
• object to processing that is based on our legitimate interest
• receive your data in a common electronic format
• withdraw a consent at any time, with effect for the future

Write to privacy@dti.ch. We may ask you to confirm your identity.

You can also complain to a data protection authority: in Switzerland to the Federal Data Protection and Information Commissioner (FDPIC), in the EU to the authority in your country.

12. Security

The website is only available over an encrypted connection (HTTPS). Strict security rules in the browser (Content Security Policy) block code from other servers. The only exception is Plausible, and only after your consent. The demo page also talks to our relay server (see section 7).

13. Changes

We update this policy when the website changes, for example when we add a service. The current version is always on this page.