Privacy Policy

1. Who We Are

DCISN Services UG (haftungsbeschränkt) ("DCISN", "we", "us", "our") operates the DCISN platform available at dcisn.com. Our registered address is Pollux Tower, Platz der Einheit 2, 60327 Frankfurt, Germany.

For privacy-related enquiries, contact us at: info@dcisn.com

2. Data We Collect

We collect the following personal data when you use DCISN:

• Account data: email address, full name, hashed password, account type, profile photo (optional)
• Task and decision data: tasks created, feedback submitted, votes cast, comments posted, round timings and results
• Communication data: email notifications sent and received via the platform
• Uploaded files: documents, images and attachments uploaded to tasks, responses or comments
• Technical data: IP address, browser type, device information, session cookies, access timestamps

3. How We Use Your Data

We use your data exclusively to:

• Provide, operate and maintain the DCISN platform
• Send transactional emails — task invitations, round notifications, reminders and decision results
• Enable AI-assisted features (Prof. Simon Wright) where explicitly activated — your uploaded documents and feedback may be processed by our AI provider to generate responses
• Maintain platform security and prevent abuse
• Comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

4. AI Features and Third-Party Processing

When you use the Simon Wright AI agent (Pro and Premium plans), the content of your task, uploaded documents and round feedback may be sent to our AI model provider (DeepSeek) for processing. This data is used solely to generate AI responses within your task and is not used to train AI models.

By activating Simon Wright on a task, you confirm that you have the right to share the relevant content with our AI provider for this purpose.

5. Legal Basis for Processing (GDPR)

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR) — processing necessary to provide the DCISN service you have subscribed to
• Legitimate interests (Art. 6(1)(f) GDPR) — platform security, fraud prevention, service improvement
• Legal obligation (Art. 6(1)(c) GDPR) — where processing is required by applicable law
• Consent (Art. 6(1)(a) GDPR) — where you have explicitly opted in to specific features

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law.

Task data, decisions and associated responses are retained for the lifetime of the account. Uploaded files are deleted when the associated task or account is deleted. Backup copies may be retained for up to 90 days for security and business continuity purposes.

7. Data Transfers

DCISN is operated from Germany. If you access the platform from outside the EU/EEA, your data may be transferred to and processed in EU-based infrastructure. Where we use third-party service providers outside the EU (including our AI provider), we ensure appropriate safeguards are in place in accordance with GDPR Chapter V.

8. Your Rights (GDPR)

If you are located in the EU/EEA, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right of rectification — request correction of inaccurate data
• Right of erasure — request deletion of your personal data ("right to be forgotten")
• Right to restriction — request that we limit how we process your data
• Right to portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests

To exercise any of these rights, contact us at info@dcisn.com. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

9. Cookies

We use only essential session cookies required for platform operation — to maintain your login session and CSRF security tokens. We do not use tracking cookies, advertising cookies or third-party analytics.

A single preference cookie (dcisn_lang) is stored to remember your language choice. This cookie contains no personal data and expires after 12 months.

10. Security

We implement technical and organisational measures to protect your personal data, including encrypted data transmission (HTTPS), hashed password storage, CSRF protection on all authenticated requests and session-based authentication. Access to production data is restricted to authorised personnel only.

11. Changes to This Policy

We will notify registered users of material changes to this policy via email or in-platform notification. The updated policy will be published at dcisn.com/privacy/ with the revised effective date. Continued use of the platform after notification constitutes acceptance of the updated policy.

12. Contact

DCISN Services UG (haftungsbeschränkt)
Pollux Tower, Platz der Einheit 2
60327 Frankfurt, Germany
Email: info@dcisn.com