DDM
de

Privacy notice for DDM

This is a translation. The German version is legally binding.

This notice covers DDM – Document Distribution Manager: the CMS in the browser and the "DDM" app in the browser, on iOS, Android and the desktop. DDM is offered to businesses only. Visiting our website is covered by the website's privacy policy.

1. Controller – and who is responsible for what

IQ-ME GmbH
Eupener Straße 59
50933 Köln
Germany
E-mail: kontakt@iq-me.de

  • Your account and registration – we are the controller.
  • Your organisation's content – documents, categories, notes, appointments, your colleagues' names and e-mail addresses: the organisation using DDM is the controller. We process this data on its behalf and on its instructions (Art. 28 GDPR). Questions about it are best addressed to your organisation.

2. What data we process

  • Account: name, e-mail address, password (only as a secure hash), language, organisations and roles.
  • Sign-in through your organisation: if your organisation signs you in through Microsoft, Google, Okta, its own single sign-on or a directory service, we receive your name, e-mail address and an identifier from it.
  • What you do in DDM: notes, favourites, your outbox and the links you send – with the recipients' e-mail addresses –, saved filters, your own templates, reading positions.
  • Calendar: only if you connect a calendar – its appointments with title, time, location, attendees and description.
  • Logs: your organisation's audit log records who changed what and when, with the IP address for security-relevant events. The server logs requests technically.
  • Usage statistics: daily counts that identify nobody – such as how often a document was opened. No IP address, no device identifier, no time stamps of single actions; who did something is counted for one day only, as an irreversible hash, and then discarded. Your organisation can switch the statistics off.
  • On your device: the app keeps your sign-in and – if you want – documents for use without a connection. Signing out and deleting the account remove them.

The app contains no tracking, no advertising and no third-party analytics.

3. Purposes and legal bases

  • Providing DDM and your account: Art. 6(1)(b) GDPR.
  • Security, troubleshooting, audit log and usage statistics: Art. 6(1)(f) GDPR – our and your organisation's legitimate interest in secure, traceable operation.
  • Your organisation's content: on its behalf and on its legal basis.

4. Recipients and service providers

  • Railway Corporation (USA) runs the servers, the database and the file storage in the EU (Netherlands).
  • Resend (USA) sends DDM's e-mails, such as invitations and confirmations.
  • AI providers: only if your organisation switches AI functions on – the content they need then goes to the provider your organisation chose. Details in the user guide under "AI in DDM".
  • Calendar and sign-in services (Microsoft, Google, Apple iCloud, your organisation's single sign-on): only if you or your organisation connect them.

We have data processing agreements with our service providers. Transfers to the USA are safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or the EU-US Data Privacy Framework.

5. Retention

  • Your account, until you delete it, or your organisation removes you and you are in no other organisation.
  • After your account is deleted, your organisation's audit log keeps your name on its entries, so it stays clear who did what (Art. 6(1)(f) GDPR) – as long as the organisation keeps its audit log. Your e-mail address is deleted.
  • Your organisation's content, as long as the organisation decides, at the latest until it is deleted.
  • Usage statistics: daily counts 25 months, search terms 90 days.
  • Server logs at most 90 days.

6. Deleting your account

You can delete your account yourself at any time – in the app under Settings › Delete account or in the CMS under My account. How, and what stays, is described under Delete your account.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Contact kontakt@iq-me.de – for your organisation's content, preferably your organisation. You may also lodge a complaint with a supervisory authority (Art. 77 GDPR); ours is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

As of October 2026