d-you terms of use

Common Codes GmbH (hereinafter the “Provider” or “we”) provides the EUDI Wallet d-you (hereinafter the “Wallet” or “d-you”) on behalf of the Federal Ministry for Digital Transformation and Government Modernisation (BMDS). d-you is an electronic identification means that enables Users to manage their identity securely, to store digital documents, to authenticate themselves to third-party providers and to use further functionalities.

These Terms of Use govern your use of the Wallet (hereinafter the “User” or “you”).

• Authentication Means are the means used by the User for authentication, in particular possession of the device on which the Wallet is installed (e.g. smartphone, tablet), the lock method of that device (PIN, face scan, fingerprint scan, etc.) and the Wallet PIN set by the User for authentication.
• Wallet PIN means the personal identification number set by the User, which is used as a specific Authentication Means for the use of the Digital ID and, where applicable, other Digital Attestations.
• Digital ID means the person identification data (PID) issued by a competent authority and stored in the Wallet.
• Digital Attestation means all data stored in the Wallet about an attribute, a right or a permission of a person or an object (e.g. digital passport, driving licence, digital receipts, confirmations, certificates, attestations, payment receipts), including electronic attestations of attributes, irrespective of the legal status of the respective attestation.
• Transaction Log means the automated, local record of all transactions carried out in the Wallet, including timestamps and recipient information.
• Relying Party means the natural or legal person that has integrated the Wallet for the provision of its services and that issues Digital Attestations or the Digital ID into the Wallet (Issuing Relying Party), receives them, or uses another functionality (Receiving Relying Party).
• Issuing Relying Party means a Relying Party that issues Digital Attestations, the Digital ID or other content for storage or use in the Wallet. This also includes the provider of PID.
• Receiving Relying Party means a Relying Party that receives or verifies Digital Attestations, the Digital ID or information derived therefrom from the Wallet.
• Wallet means the software application d-you provided by the Provider, which enables the storage, management and use of the Digital ID, Digital Attestations and further functionalities.
• Wallet Instance means the individualised d-you application of an individual User on a User’s device. Each installation and set-up of the Wallet on a device constitutes a separate Wallet Instance.
• Revocation Key means the character string assigned to the User for a Wallet Instance, which serves to identify the User upon revocation of the Wallet Instance and enables the revocation to be carried out.

2.1 These Terms of Use apply to the registration and use of the d-you Wallet. The Wallet is intended for natural persons with full legal capacity and natural persons with limited legal capacity. A User is a person who has successfully set up d-you in accordance with these Terms of Use.

2.2 These Terms of Use apply exclusively. Terms and conditions of the User do not form part of the contract, even if the Provider is aware of them.

2.3 The use of d-you requires the installation of the d-you application and the acceptance of these Terms of Use. As soon as a Wallet Instance has been successfully set up and activated on the respective device, a separate contract of use is concluded for each Wallet Instance in accordance with these Terms of Use.

2.4 All information, recommendations and guidelines on the use of the Wallet, as amended from time to time and made available to you, form a supplementary part of this contract. This includes in particular the user manual for the secure operation of the Wallet (Secure User Guide).

2.5 The contract language and the language of communication is German. Only the German-language versions of the contract documents are authoritative for the contractual relationship. Translations are provided for information purposes only and have no independent legal effect.

2.6 The Provider is entitled to amend these Terms of Use with effect for the future, insofar as this is necessary (in particular for technical or organisational reasons) and reasonable for the User, in order to

a. comply with changes in the legal situation, case law or requirements of public authorities, b. reflect new or changed functions of the Wallet or to further develop existing functions technically, c. respond to changed market conditions that were not foreseeable for the Provider at the time of conclusion of the contract, or d. close regulatory gaps.

2.7 The Provider shall inform the User of an amendment to these Terms of Use by a notice within the Wallet at least four weeks before the planned entry into force. The notice shall contain the full text of the amended provisions and either a comparison with the previous provisions or a summary of the material changes in generally understandable language. The amended Terms of Use shall only become effective if the User expressly consents to them. If the User opens the Wallet after the expiry of the aforementioned period, the amended version of these Terms of Use shall be presented to the User for consent before further use. Further use of the Wallet is only possible after such express consent. If the User does not consent to the amended Terms of Use within the period, further use of the Wallet may be restricted or blocked.

3.1 The use of d-you is open to natural persons only. Individual functionalities of the Wallet, in particular the set-up and use of a Digital ID, may be subject to additional requirements, for example age requirements. The Relying Party responsible in each case will point these out separately.

3.2 A separate Wallet Instance is set up for each device. Each Wallet Instance is operated independently from a technical perspective and constitutes a separate contractual relationship. Blocking, revocation, termination or other measures may therefore be limited to an individual Wallet Instance.

3.3 You may set up any number of Wallet Instances on different devices. Individual functionalities of the Wallet, in particular the Digital ID, may be limited in number, so that these functionalities can only be set up and executed in a limited number of Wallet Instances. The respective Issuing Relying Party will point this out separately.

3.4 The set-up of d-you requires a mobile device with a current operating system supported by the Provider of d-you and a functioning mobile network or internet connection. d-you detects security manipulations of the device, in particular rooting or jailbreaking. The Provider is entitled to restrict or prevent the use of the Wallet on devices manipulated in this way or in the event of security incidents.

3.5 When the Digital ID is set up, the User must set a Wallet PIN. The Wallet PIN serves for authentication and must be handled securely in accordance with clause 4.2. After three incorrect entries of the Wallet PIN, the Digital ID in particular is blocked and cannot be reset.

3.6 Furthermore, for security reasons, it is a mandatory requirement for the set-up and use of the Wallet that a device lock (PIN, face scan, fingerprint scan, etc.) is activated at all times on the device on which the Wallet Instance is set up (cf. clause 4). If the device lock is deactivated, the Wallet Instance will be deleted by the Provider for security reasons.

3.7 During the set-up process, the User is provided with a Revocation Key for the revocation of the Wallet Instance. The revocation of the Wallet Instance serves, in the event of loss or suspected compromise of the Authentication Means, to have the Wallet Instance blocked with the Provider via the Provider’s website. Furthermore, revocation serves to ensure that the respective Wallet Instance is not merely deleted by removing the Wallet application from the device, but that the technical data belonging to this Wallet Instance is also deleted by the Provider. The User undertakes to keep the Revocation Key safe, confidential and separate from the device used until the revocation is carried out or the Wallet Instance is uninstalled. The Revocation Key cannot be reissued if it is lost.

3.8 The Wallet Instance can be revoked, whereupon it, the Digital ID stored therein and any Digital Attestations stored therein lose their validity. The User can carry out the revocation by entering the Revocation Key for the revocation of the Wallet Instance on the Provider’s website.

3.9 The User’s option to revoke the Digital ID with the Issuing Relying Party remains unaffected.

4.1 When setting up and using d-you, the User is obliged to provide truthful and complete information and to update it without undue delay in the event of changes.

4.2 The User shall treat their Authentication Means and the Revocation Key for the revocation of the Wallet Instance as strictly confidential and shall not disclose them to third parties. In the event of loss or compromise of the Authentication Means (in particular the device), the User is obliged to revoke the Wallet Instance without undue delay in accordance with clauses 3.7 and 3.8. In the event of loss of the device, the User should additionally, where available, use the function provided by the manufacturer of the device or of the operating system for remotely locking or erasing the device.

4.3 The User is liable for all damage arising as a result of a breach of duty by the User or non-compliance with the obligations incumbent on the User under these Terms of Use and the resulting misuse of d-you and its Authentication Means. This applies in particular also in favour of Issuing Relying Parties and Receiving Relying Parties with regard to damage incurred by them in relying on the Wallet.

4.4 After uninstalling the Wallet Instance, the User is obliged to destroy the Revocation Key, including all copies (e.g. printouts, files or screenshots).

4.5 Where corresponding functions are offered, the User is responsible for backing up all stored Digital Attestations before the end of the contractual relationship and, where possible, for transferring them to another wallet offering.

4.6 The User is obliged to use an operating system supported by the Provider on the device on which the Wallet Instance is set up and to regularly install available operating system and security updates as well as updates of the Wallet. For this purpose, the User should activate automatic updates. The User must not modify the device by rooting, jailbreaking or comparable interventions and must not use the Wallet on a device modified in this way.

4.7 Before each disclosure of the Digital ID or Digital Attestations, the User shall check the identity of the Receiving Relying Party displayed in the Wallet, the requested data and, where displayed, the purpose of use. The User should only disclose the data required for the respective service and should reject suspicious requests.

5.1 The Provider continuously develops the scope of services of d-you in order to provide you with extensive functionalities for electronic identification, authentication and the management of attestations and other trust services.

5.2 The issuance of Digital Attestations and the Digital ID by Issuing Relying Parties, as well as the request and receipt of attributes from the Digital ID or Digital Attestations by Receiving Relying Parties, take place within the framework of a separate legal relationship with you and are not part of the services of the Provider or of these Terms of Use.

5.3 Wallet-related data, Digital Attestations and the Transaction Log are stored only within the respective Wallet Instance on the respective device. There is no automatic synchronisation between multiple Wallet Instances. Technical data of the respective Wallet Instance may be processed in a secure backend environment.

5.4 The issuance, management and revocation of the Digital Attestations and the Digital ID stored in the Wallet Instance are carried out by the Issuing Relying Parties and fall outside the Provider’s area of responsibility. The Provider is not the issuer of these attestations and, to that extent, assumes no warranty or liability for their availability, content or legal effect. Claims against the Issuing Relying Parties are governed by the separate terms applicable thereto.

5.5 Currently, the following functions are offered in d-you:

Identification Function d-you enables you to store, manage and use the Digital ID securely. Disclosure to Receiving Relying Parties is data-minimising, through the option of selective disclosure of attributes and the use of single-use attestations. The Digital ID can only be used for identification with the respective Wallet Instance and the User’s Wallet PIN. Blocking of the Wallet Instance automatically results in blocking of the Digital ID. Each User can hold up to two Digital IDs in different Wallet Instances.

Attestation Function d-you enables you to store, manage and share Digital Attestations securely. Sharing with Receiving Relying Parties is data-minimising, through the option of selective disclosure of attributes. The specific design and the availability of further functions may vary depending on the type of attestation and are the responsibility of the Issuing Relying Party.

Transaction Log d-you keeps an automated, immutable record of all transactions carried out in the Wallet Instance and stores it locally in the application on the User’s device. The Transaction Log can only be viewed by the User via the Wallet Instance.

Reporting Function d-you gives you the option to submit complaints or reports from within the Wallet, regarding the intended or actual processing of your personal data in connection with a Receiving Relying Party, to the data protection supervisory authority competent for that Receiving Relying Party. For this purpose, the Wallet provides a link to the complaint form of the competent data protection supervisory authority, based on the information provided by the Receiving Relying Party when registering.

6.1 The Provider grants the User a simple, non-exclusive, non-transferable right to use the Wallet in accordance with these Terms of Use for private and commercial purposes. The right of use includes the installation of the Wallet on the User’s devices and the use of the functions offered.

6.2 The User is prohibited from

• using the Wallet for unlawful purposes,
• using the Wallet to commit fraud, identity theft or other criminal offences,
• circumventing, impairing or manipulating the security measures of the Wallet,
• storing or using attestations of other entitled persons or holders without their consent,
• allowing other persons to use the Wallet Instance, the Digital ID or other personal data or Digital Attestations, or allowing other persons to use their own identity. Power of attorney, representation or delegation functions provided for by law or supported by the Wallet remain unaffected.

6.3 In the event of a breach of these usage restrictions, the Provider is entitled, in accordance with clause 10.4 and taking into account the importance of d-you for Users, to terminate the contractual relationship for good cause. Further claims, in particular for damages, remain unaffected.

6.4 The Provider is entitled to delete a Wallet Instance after prior notice if it has been inactive for a period of two years.

7.1 The set-up and use of d-you and the revocation of the Wallet Instance are free of charge.

7.2 For additional services not covered by clause 7.1, the Provider may charge a separate fee on the basis of a separate agreement. The User will be informed of any costs before using the respective service. Fees are stated in euros and are payable in accordance with the respective payment terms.

8.1 The Provider endeavours to make the Wallet available as free of interruption as possible within the framework of technical and operational circumstances. There is no entitlement to a particular availability of the Wallet.

8.2 Temporary restrictions of availability may occur in particular due to maintenance work, technical faults, security measures or circumstances beyond the Provider’s sphere of influence.

8.3 Maintenance work that may lead to a temporary restriction of the availability of the Wallet will be announced in advance where possible. Where necessary for technical or security reasons, maintenance work may also be carried out without prior notice. The Provider endeavours to schedule maintenance windows during periods of low usage and to keep them as short as possible.

8.4 In the event of an unplanned disruption or failure of the Wallet, the Provider will investigate the cause to the extent technically and organisationally reasonable and will work towards restoring functionality in a timely manner.

8.5 The User’s rights under mandatory statutory provisions remain unaffected.

8.6 In the event of force majeure (in particular natural disasters, cyber attacks affecting the Provider’s performance, wars), the Provider’s obligations are suspended for the duration of the force majeure event to the extent of the impediment. The Provider shall inform Users of significant impairments without undue delay in an appropriate manner.

9.1 The Provider’s liability for breach of official duties (Section 839 of the German Civil Code (BGB), Article 34 of the German Basic Law (GG)) is not limited by this contract. The Provider is subject to unlimited liability in cases of injury to life, body or health and under the Product Liability Act.

9.2 In all other respects, the Provider is liable in accordance with the statutory provisions.

9.3 However, the Provider is not liable for damage resulting from an act, omission or technical fault of the Relying Party, unless the Provider is responsible for it.

9.4 Any liability provisions under Regulation (EU) No 910/2014 (eIDAS Regulation) remain unaffected, with the additional benefit that these also apply to situations without a cross-border element.

10.1 The contractual relationship is concluded for an indefinite period, unless otherwise agreed.

10.2 The User may terminate the use of the Wallet Instance at any time by uninstalling it. Upon uninstallation, the contractual relationship relating to the respective Wallet Instance ends. A restoration of the uninstalled Wallet Instance is not possible. A new Wallet Instance must be set up to use d-you again.

10.3 The Provider is not entitled to terminate the contractual relationship with individual Users by ordinary termination. The Provider’s right to discontinue the entire offering pursuant to clause 10.5 remains unaffected.

10.4 The right to terminate for good cause remains unaffected. Good cause for termination by the Provider exists in particular if

• the User materially breaches their obligations under these Terms of Use, or repeatedly does so despite a warning notice and the setting of a reasonable deadline,
• the User uses the Wallet for unlawful purposes,
• there is a reasonable suspicion of misuse or fraudulent use,
• the continued provision of the Wallet is no longer possible for legal or technical reasons.

10.5 If the Provider discontinues the operation of d-you as a whole, it will announce this at least one month in advance and will enable Users to back up their Digital Attestations in accordance with clause 4.5 or to transfer them to another wallet offering.

11.1 Communication between the Provider and the User takes place in text form, unless a stricter form is required by law.

11.2 Notifications to the User may be made in particular:

• via notifications in the Wallet,
• via push notifications on the User’s device,
• via the User Service (clause 11.3).

The User is responsible for activating the notification functions provided by the operating system of the device used if the User wishes to receive security and status messages from the Wallet via this function.

11.3 The Provider provides a User Service for general questions about how the Wallet works. Revocation of the Wallet Instance is not possible via the User Service and is carried out exclusively in accordance with clause 3.8. The Provider processes all concerns and enquiries within a reasonable period.

12.1 The law of the Federal Republic of Germany applies, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG) and the conflict-of-law rules of private international law.

12.2 Should a provision of these Terms of Use be or become invalid, the validity of the remaining provisions shall not be affected thereby. The statutory provisions shall take the place of the invalid provision.

13.1 The following terms apply subject to a condition subsequent for the duration of the Closed Beta and take precedence over the preceding provisions in the event of conflict.

13.2 Closed Beta means the period of test use of the Wallet in the production environment by a limited group of users prior to the public launch, and ends on 1 January 2027 or upon the transition to regular operation, whichever is later. Beta Tester means the User during the Closed Beta.

13.3 The Provider selects the Beta Testers at its own discretion. There is no entitlement to participate in the Closed Beta. The admission procedure communicated by the Provider for the Closed Beta applies. The Provider reserves the right to supplement or amend the participation requirements at any time, insofar as this is necessary for the conduct of the Closed Beta. Participation in the Closed Beta is personal and non-transferable. The Beta Tester may not grant third parties access to the Wallet or to their access credentials.

13.4 The Closed Beta serves for the systematic testing and evaluation of the Wallet under realistic conditions of use. During the Closed Beta, the Wallet is operated in a production environment. The Beta Tester is aware that use in the production environment means that:

• software errors may lead to data loss or data errors,
• real personal data is processed,
• transactions and presentation events are documented,
• the Wallet may not yet fully support all functions

13.5 The Wallet available during the Closed Beta does not correspond to the final scope of functions. The Provider reserves the right to add, remove or change functions and to suspend or terminate the Closed Beta at any time. The Beta Tester has no entitlement to a particular scope of functions during the production phase. Use is at the Beta Tester’s own risk.

13.6 The Beta Tester undertakes to provide feedback on the following aspects:

• malfunctions and errors (bug reports),
• ambiguities or problems in the user interface and user guidance,
• other security incidents or data protection issues,
• other comparable comments on the Wallet

Feedback shall be provided via the feedback channels made available.

13.7 The Beta Tester undertakes to treat as confidential all non-public information about the Wallet that becomes accessible to them in the course of the Closed Beta. The confidentiality obligation applies for the duration of the Closed Beta and for a period of 3 months after its end. The confidentiality obligation does not apply to information that:

• is already publicly available,
• was already known to the Beta Tester before participating in the Closed Beta,
• became known to the Beta Tester independently of participation in the Closed Beta,
• must be disclosed due to statutory obligations.

13.8 Participation in the Closed Beta is free of charge. Any claim for reimbursement of expenses under Section 670 BGB for the use of the Closed Beta is excluded. The Provider’s liability is governed by clause 9 of these Terms of Use also during the Closed Beta.

13.9 The aim is for the Wallet of the Closed Beta to be carried over into regular operation. However, there is expressly no entitlement to continued use of the Wallet, the Digital Attestations and the Digital ID used, or the Wallet Instance for the period after the Closed Beta. The Provider reserves the right to revoke the Wallet Instances and to delete the associated data.