d-you Privacy Policy

Common Codes GmbH ("we", "us") provides the EUDI-Wallet d-you ("Wallet" or "d-you") on behalf of the Federal Ministry for Digital Transformation and Government Modernisation (BMDS). This notice explains how we process your personal data when you set up and use the Wallet.

The Wallet is designed so that your data is stored as a rule exclusively on your device. Your person identification data (PID), your electronic attestations of attributes and your transaction log remain exclusively in your wallet unit. We have no access to this content. We do not know which electronic attestations of attributes you hold or which relying parties you share data with. Our systems process only the data required to operate your wallet unit securely. This data is anonymized. It contains neither your name nor any other information from your PID.

The Wallet is an electronic identification means. It allows you to store and manage your PID and electronic attestations of attributes securely and to present them to relying parties.

We process personal data to provide the Wallet and its functionalities as required by the eIDAS Regulation. This includes ensuring the security and integrity of your wallet unit. In particular, we verify the authenticity of the app and the security of your device, manage the validity status of your wallet unit and revoke it where necessary. We also process personal data to handle your requests and to improve and strengthen trust in the EUDI ecosystem.

The controller responsible for the processing is

Common Codes GmbH, Zionskirchstraße 73a, 10119 Berlin, Germany Managing Directors Anna Förster, Dr. Torsten Lodderstedt, René Wienholtz Email INFO@COMMON.CODES

We have appointed a data protection officer. For any data protection questions, please contact us at the address above or by email at PRIVACY@COMMON.CODES.

Your PID is issued by the provider of person identification data (PID provider) acting as an independent controller under its own responsibility. Electronic attestations of attributes are likewise issued by their respective providers acting as independent controllers under their own responsibility. Relying parties with whom you share data from the Wallet also process that data as independent controllers. Please refer to their privacy notices for information on how they process your data.

Before any data is shared, the Wallet shows you who is requesting data and which data is requested. Data is only shared once you have confirmed the request.

Apple and Google act as independent controllers for downloading the Wallet via the Apple App Store or Google Play Store.

The following data is stored exclusively on your device:

• Person identification data (PID)
• Electronic attestations of attributes
• Transaction log (time, recipient and type of data shared)
• Cryptographic keys held in the secure storage of your device
• Wallet settings (e.g. language)

The following data is processed in our systems:

• Anonymous identifier of your wallet unit and its validity status (valid or revoked), including the time of any revocation
• Public cryptographic keys of your wallet unit and your Wallet PIN
• Hash value of your revocation key (we do not store the revocation key itself)
• Counter of incorrect Wallet PIN entries
• Device information for security checks (device model, operating system version, security patch level, app version) and the result of the app authenticity check
• Push token, if you have enabled push notifications

Your Wallet PIN is stored in plain text neither on your device nor in our systems.

The Wallet offers the following functionalities.

• Set-up and security checks. When you set up the Wallet and on an ongoing basis during use, we verify the authenticity of the app and the security of your device. In particular, we check for manipulation such as rooting or jailbreaking. For this purpose we use the verification mechanisms provided by Apple and Google.
• Identification function. Your PID is stored here and the attributes you release are presented to relying parties. Data is transmitted directly from your device to the relying party and not via our systems.
• Attestation function. Your electronic attestations of attributes are stored here and the attributes you release are presented to relying parties. This data is also transmitted directly from your device.
• Transaction log. The Wallet records all transactions locally on your device. Only you can view the log. It is not transmitted to us.
• Reporting function. This function allows you to lodge a complaint about the intended or actual processing of your personal data by a relying party with the competent data protection supervisory authority. The Wallet redirects you to the authority's complaint form. We are not informed of your report.
• Revocation of the wallet unit. You can revoke your wallet unit on our website using your revocation key. For this purpose we process the revocation key to match it against the stored hash value, together with technical connection data.

If you enable push notifications, we use Firebase Cloud Messaging, a service of Google Ireland Limited. This service only sends a content-free signal to your device. The Wallet then retrieves the actual content of the notification directly from our servers. Google receives the push token, technical device and app data and the time of the notification. Google does not receive the content of the notification.

If you contact our user support, we process the personal data you provide and any data required to handle your request.

We do not use automated individual decision-making within the meaning of Art. 22 GDPR. We neither analyse your usage behaviour nor create profiles. We do not collect information about the use of the Wallet unless this is necessary to provide the Wallet services. Your data is processed only for the purposes described above.

The legal basis for processing in connection with the provision and use of the Wallet is Art. 6(1)(e) in conjunction with Art. 6(3) GDPR. The provision of the Wallet is a task carried out in the public interest, which we perform on behalf of the BMDS on the basis of the eIDAS Regulation, its implementing regulations and the Act on the European Digital Identity Wallet (EBDIG). This also covers security checks, revocation and the handling of your requests by our user support.

The legal basis for storing information on your device and accessing it is Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), insofar as this is strictly necessary to provide the Wallet.

The legal basis for push notifications is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You give your consent via the permission prompt of your operating system. You may withdraw it at any time in your device settings. Without push notifications, you will only receive security and status messages from the Wallet the next time you open the app. The protection provided by revoking your wallet unit remains unaffected.

As a rule, personal data processed in connection with the Wallet is not disclosed to third parties. The only exceptions are disclosures that you initiate yourself or that we are legally required to make. We engage carefully selected processors under a data processing agreement. They support us in operating and hosting the Wallet systems and in providing user support.

Based on the relevant configuration, all personal data in our Wallet systems is stored on servers located in the European Union. Transfers to Google LLC or Apple Inc. in the United States cannot be ruled out when push notifications are used. Both companies are certified under the EU-U.S. Data Privacy Framework. These transfers are therefore covered by an adequacy decision of the European Commission. In addition, we have agreed the standard contractual clauses of the European Commission with the respective providers.

Where processing is based on your consent, you may withdraw it at any time with effect for the future. This does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.

Under the GDPR you have the following rights.

a. You have the right to obtain confirmation as to whether we process your personal data and, where that is the case, access to that data (Art. 15 GDPR). b. You have the right to have inaccurate personal data rectified (Art. 16 GDPR). c. Where the legal requirements are met, you have the right to erasure or to restriction of processing (Art. 17 and 18 GDPR). d. You have the right to object, on grounds relating to your particular situation, to processing of your personal data (Art. 21 GDPR). e. Where processing is based on your consent or on a contract and is carried out by automated means, you may have the right to data portability (Art. 20 GDPR).

Note: As we process the data of your wallet unit in our systems only in anonymized form, we are in principle unable to attribute this data to any person (Art. 11(2) GDPR). You can view and delete the data stored on your device at any time within the Wallet.

If you exercise any of the rights mentioned above, we will check whether the legal requirements are met. You also have the right to lodge a complaint with the relevant data protection supervisory authority (Art. 77 GDPR).

As a rule, we erase personal data as soon as it is no longer required.

Data stored locally on your device is deleted when you uninstall the Wallet. The data of your wallet unit in our systems is erased when you delete or revoke your wallet unit. If you uninstall the Wallet without revoking it first, the data of your wallet unit is erased after 24 months of inactivity.

Data relating to user support requests is erased once the request has been finally resolved. Where the data is still needed to assess, exercise or defend legal claims, it may be retained until the end of the regular limitation period under German law (three years from the end of the year in which the claim arose).

During the Closed Beta, we additionally process the data required for the admission procedure (e.g. invitation code, contact details) and the feedback you submit via the provided feedback channels. The legal basis is Art. 6(1)(b) GDPR, as this processing is necessary to perform the Closed Beta under the Terms of Use. We erase this data after the end of the Closed Beta.