Legal
Privacy notice
What this site and the customer account process, and what remains local.
Effective 3 September 2026.
1. Controller
The controller of personal data processed through this website and the customer account is Jean-Francois Dufour, operating PM Control Workbench. Privacy contact: privacy@pmcontrolworkbench.com.
2. Scope
This notice describes processing that the public site and first-party commercial services actually perform. Project content in the local Workbench is not uploaded to this website.
3. Website operation
Data: IP address, time, requested path, and user-agent in reverse-proxy logs. Purpose: operate, secure, and diagnose the website. Legal basis: Art. 6(1)(f) GDPR (operation and security of the site). Recipients: hosting on Hetzner. Retention: logs are kept only as long as needed for security and operation, then deleted or anonymised. No analytics product, advertising pixel, or error-reporting SaaS is connected. This website has no on-site contact form and does not collect enquiry submissions on the page.
4. Account and authentication
Data: verified email, display name, optional organisation, customer identifier, account status, session metadata, and invitation state. Purpose: create and operate a customer account. Legal basis: Art. 6(1)(b) GDPR where you request or use an account; Art. 6(1)(f) for security of the identity system. Recipients: Clerk (identity provider) and the first-party account database hosted on Hetzner. Sign-in uses a short-lived email code. Passwords are not collected. Passkeys and authenticator-app MFA are not enabled. Retention: for the life of the account and as long as needed to secure it, then deleted or restricted except where a legal duty requires keeping a record.
5. Licensing
Data: licence model, owner, status, seats, update eligibility, pseudonymous device identifiers, public keys, activation history, and bounded audit events. Purpose: issue and enforce licence and device activation. Legal basis: Art. 6(1)(b) and (f) GDPR. Recipients: the self-hosted licensing authority on the operator’s Hetzner host. It does not store Workbench project content. Retention: for the life of the licence and related security records.
6. Device and activation data
Device records identify an activation, not the contents of a portable project folder. Moving the Workbench folder on the same computer does not by itself copy activation to another computer.
7. Payments
Purchasing is not currently open. Card numbers are not entered on this site. First-party commerce is disabled. Stripe is not used to take live payments on this website today.
8. Email you send us
If you write to a published role address, we process the message content, your address, and related metadata to respond. Legal basis: Art. 6(1)(b) or (f) GDPR, depending on the request. Retention: as long as needed to handle the correspondence and any related legal claims.
9. Cookies and storage
See Cookies and storage.
10. Recipients
See Recipients and processors.
11. International transfers
Hetzner hosting for this site is in the EU. Clerk and Cloudflare are organisations that may process data outside the EEA. This notice does not claim a specific transfer tool (adequacy decision, standard contractual clauses, or otherwise) unless that tool is separately documented.
12. Your rights
Subject to GDPR conditions, you may request access, rectification, erasure, restriction, objection, and portability, and you may withdraw consent where processing is based on consent. Send requests to privacy@pmcontrolworkbench.com.
13. Complaint authority
You may lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, or with another supervisory authority in your EU member state.
14. Security wording
Access to the customer account uses managed identity and TLS on the public origin. No certification, audit, encryption guarantee, availability SLA, or “GDPR certified” claim is made.