Privacy Policy for the Federal Government’s AusweisApp eID Software
The Federal Office for Information Security (BSI) attaches great importance to the responsible handling of personal data. The BSI wants you to know what data is collected, when it is collected, and how it is used. The BSI has implemented technical and organizational measures to ensure compliance with data protection regulations. Changes to this privacy policy may become necessary as new technologies are developed and implemented. Therefore, the BSI recommends that you review this privacy policy from time to time for any changes.
Controller
The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is the
Federal Office for Information Security (BSI)
Godesberger Allee 87
53175 Bonn
Phone: +49 (0)228 99 9582-0
Fax: +49 (0)228 9910 9582-0
E-mail: bsi@bsi.bund.de
www.bsi.bund.de
Data Protection Officer at the BSI
Dominic Kastien
Data Protection Officer
Langer Grabenweg 33-43
53175 Bonn
P.O. Box 200363
53133 Bonn
Phone: +49 (0) 228 99 9582-5527
E-mail: datenschutzbeauftragte@bsi.bund.de
Operated on behalf of the BSI (Art. 28 GDPR) by
Governikus
Hochschulring 4
28359 Bremen
Phone: +49 421 204 95-0
Fax: + 49 421 204 95-11
E-mail: kontakt@governikus.de
How does AusweisApp work?
You can use the online identification function of your national ID card, electronic residence permit, or eID card for EU and EEA citizens (hereinafter referred to simply as "ID document") to identify yourself securely online.
To do this, you need eID software—such as AusweisApp—on your PC, laptop, tablet, or smartphone; this software is provided free of charge on behalf of the Federal Office for Information Security (BSI).
When you use the online identification function, AusweisApp connects to the service provider's eID server—the system that needs to read data from your ID document. This eID server is operated by the service provider (or on their behalf) and is not part of AusweisApp itself. Just as your web browser connects to a service provider's web server when you visit their website, AusweisApp connects to their eID server.
AusweisApp displays the name of the service provider and the specific data they wish to read from your ID document; it also allows you to view the service provider's authorization certificate and details of the relevant data protection supervisory authority. Once you enter your PIN, AusweisApp establishes an encrypted connection directly between your ID document and the eID server.
The data is read directly from your ID document by the eID server, which then transmits it to the service provider's website. Neither AusweisApp nor its developer has access to the data being read.
The service provider displayed in AusweisApp is always the party responsible for processing your ID data when the online identification function is used.
A special rule applies when using the "View my data" function in AusweisApp (also known as "self-disclosure"). Just like a standard online ID function process, this feature calls an eID server—operated by the manufacturer of the AusweisApp under their own responsibility—and displays the associated authorization details to you. In this instance, too, the eID server uses the AusweisApp manufacturer’s authorization certificate to read data from your ID card via an end-to-end encrypted connection; it then transmits this data—also in encrypted form—back to the AusweisApp for display. Consequently, after using the "View My Data" function, the retrieved data resides briefly on your local device. You can find the separate privacy policy for the "View My Data" function here.
More about the eID server
Data retrieval and verification are performed via the respective eID server, which is operated by or on behalf of the service provider. The eID server manages authorization certificates and maintains revocation lists. The server handles secure communication with the AusweisApp and the ID card, and forwards the retrieved data to the service. It verifies the authenticity and validity of the ID card, checks whether the cardholder has blocked it, and transmits the results of the online ID function to the service provider’s other systems. An active internet connection is required for identity verification via the eID server to enable the verification process and the encrypted transmission of data. This connectivity is essential for executing cryptographic protocols with the ID card chip and for regularly obtaining the necessary authorization certificates and revocation lists. The eID server complies with the current technical guidelines issued by the BSI (Federal Office for Information Security), thereby ensuring adherence to the state of the art.
More about the authorization certificate
Access to data stored on the national ID card, electronic residence permit, or eID card (for EU and EEA citizens) is only possible if the service provider wishing to access the data first clearly identifies itself. This is done using what is known as an authorization certificate. The identity of the party wishing to access your data is always displayed. Service providers are granted authorization certificates upon application and following a review by the Authorization Certificate Issuing Authority at the Federal Office of Administration. An internet connection is essential to display the technical authorization certificate and to verify the validity of the ID document. For this reason, it is referred to as the "online ID function."
Further details on how the online ID function works can be found here.
Visiting the AusweisApp website
The BSI has commissioned Governikus to operate the download and information portal for AusweisApp (hereinafter referred to as the "AusweisApp Portal")—the Federal Government’s eID software — at the domain www.ausweisapp.bund.de.
Technical provision
When you access the website www.ausweisapp.bund.de, the browser used on your device automatically sends information to our contractor's servers. This data is stored exclusively for statistical and security purposes. Only the Internet Service Provider's IP address, the date and time of access, and the specific target address are recorded, and only for a limited period. The data mentioned is processed by our contractor for the following purposes:
- Ensuring a smooth connection to the website,
- ensuring a user-friendly experience on our website,
- evaluating system security and stability, and
- for other administrative purposes.
Purpose and legal basis
On behalf of the BSI, our contractor processes your data for the technical provision of the AusweisApp Portal based on: Art. 6(1)(c) in conjunction with Art. 32(1) of the General Data Protection Regulation (GDPR); Art. 6(1)(e), (2), and (3) GDPR in conjunction with Section 20(1) and Section 3(1) sentence 2 no. 20 of the Act on the Federal Office for Information Security (BSIG) regarding public relations tasks; and Art. 6(1)(e), (2), and (3) GDPR in conjunction with Section 3(1) sentence 2 no. 1 and Section 8 BSIG. The purpose is to ensure the proper operation of the AusweisApp portal—specifically to implement appropriate technical and organizational measures and fulfill legal obligations—as well as to provide an appealing, technically functional, high-performance, and user-friendly AusweisApp portal and to guarantee the system security of the portal.
Recipients of personal data
Access to your data is granted to those units within the contractor’s organization and within the authority that require it to fulfill the aforementioned purposes.
Furthermore, the BSI only discloses your data if it is legally obliged or authorized to do so—whether by law or court order—such as for the purpose of legal enforcement or criminal prosecution in the event of attacks on internet infrastructure. Data is not disclosed to third parties beyond this scope without your consent.
Transfer to third countries
The BSI does not transfer your personal data to countries outside the EU or the EEA or to international organizations without your consent.
Storage period
During server access, the IP address is processed briefly in the server's RAM and is anonymized before being stored in the web server logs.
Cookies
So-called cookies are used on the website. None of these cookies contain personal data.
Cookies are small units of information stored on the user's computer or mobile device by the contractor's content management system (CMS) and retrieved when the AusweisApp portal is accessed again. Users can restrict or completely prevent the use of cookies by adjusting the settings in their web browser. Cookies that have already been stored can be deleted at any time.
The contractor uses cookies to ensure the technically secure and correct provision of websites. They are intended to enhance the security and functionality of the web applications offered. This includes cookies for server load balancing—such as the JSESSIONID cookie—and for application server session management. The cookies do not contain personal data. No IP addresses or other information that would allow tracing back to the actual user are collected.
| Cookie-Name | Explanation |
| cookiebanner |
|
| matomoTracking |
|
| Able-Player |
|
Newsletter
If you have signed up to receive our newsletter, providing a valid email address is required.
Purpose and legal basis
Personal data is processed based on your consent pursuant to Art. 6(1)(a) of the GDPR. Our contractor uses this data exclusively for sending the newsletter. Processing the personal data you submit is necessary for the purpose of sending the newsletter.
A registration system involving an additional confirmation message containing a link to finalize registration (double opt-in) ensures that you explicitly wish to receive the newsletter.
Recipients of personal data
Access to your data is granted to those units within the contractor’s organization and the authority that require it to fulfill the aforementioned purposes. To manage contact details, our contractor uses the software Mautic (www.mautic.org), which is hosted in dedicated data centers in Germany, deliberately excluding third-party services. No data is passed on to third parties.
Furthermore, the BSI only discloses your data if it is legally obliged or authorized to do so, or required by a court decision—for instance, for the purpose of legal action or criminal prosecution in the event of attacks on internet infrastructure. No further disclosure to third parties takes place without your consent.
Transfer to a third country
The BSI does not transfer your personal data to countries outside the EU or the EEA or to international organizations without your consent.
Storage period
Upon registration, your data is stored on our contractor’s servers, and a confirmation message containing a link to finalize registration is generated and sent to the provided email address. If you do not confirm the registration via the link in this email, the data is deleted after 24 hours. Your data for newsletter distribution will be stored for the duration of your use of the service only after you confirm the link in the email.
If you no longer consent to the storage of your data for this purpose—and thus no longer wish to use the BSI service—you may unsubscribe from the newsletters at any time. A link for this purpose is included in every newsletter. The personal data you provided will then be deleted.
Processing of personal data in the context of contacting support
Our contractor, Governikus, responds to inquiries directed to the provided support contact channels as part of AusweisApp support.
Contacting AusweisApp support
You can contact AusweisApp support via the channels listed on the AusweisApp portal: email, contact form, or hotline.
Our contractor collects only the personal data that you yourself submit. This may include, for example, your contact details, identification data, institutional and company data, or photo and video recordings.
In addition, IT usage data is processed.
Purpose and legal basis
The processing of data transmitted to the BSI’s contractor—and the content of the message itself—is carried out based on Art. 6(1)(e), (2), and (3) of the GDPR in conjunction with Section 20(1) and Section 3(1), sentence 2, no. 20 of the BSIG (BSI Act) for the purpose of providing you with advice and processing your request. Processing the personal data you submit is necessary to handle your request.
Recipients of personal data
Within the scope of AusweisApp support, your request is handled exclusively by employees of the BSI’s contractor. The contractor stores your data solely for the purpose of processing your request. If your request cannot be resolved by the contractor's employees, or for quality assurance purposes, the responsible department at the BSI may review the data. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of personal data, this occurs once the specific conversation with the user has concluded. The conversation is considered concluded when the circumstances indicate that the matter at hand has been fully resolved, that retention is no longer required to address potential follow-up inquiries from the data subject, and that the statutory limitation period for the establishment, exercise, or defense of legal claims has expired.
Transfer to a third country
The BSI does not transfer your personal data to countries outside the EU or the EEA or to international organizations.
Storage period
The data you submit—at a minimum your email address—along with the information contained in the email (including any personal data provided for the purpose of contacting us and processing your request), will be stored in accordance with the retention periods for records set out in the Registry Directive (which supplements the Joint Rules of Procedure of the Federal Ministries, or GGO); the maximum storage period is 30 years.
Contacting the BSI directly
You may also contact the BSI directly. The processing of personal data depends on the communication channel used. Full details regarding the handling of your personal data when contacting us can be found in the privacy policy on the BSI website.
General information on the rights of data subjects
If your personal data is processed, you are a "data subject" within the meaning of the GDPR. Provided the respective conditions are met and subject to any conflicting statutory restrictions or exceptions—specifically those under Sections 34–36 of the Federal Data Protection Act (BDSG) or Sections 21–27 of the Federal Office for Information Security Act (BSIG)—you have the following rights vis-à-vis us as the controller:
1. Right of access
You may request confirmation as to whether we are processing your personal data. If this is the case, you have the right to access this personal data and to receive further information related to the processing (Art. 15 GDPR).
2. Right to rectification
You may request the rectification and, where applicable, the completion of your personal data (Art. 16 GDPR).
3. Right to erasure
You may request the erasure of your personal data (Art. 17 GDPR).
4. Right to restriction of processing
You may request the restriction of the processing of your personal data (Art. 18 GDPR).
5. Right to object
You may object to the processing of your personal data by us at any time (Art. 21 GDPR). This right applies if your personal data is processed pursuant to Art. 6(1)(e) or (f) GDPR—for example, for direct marketing, scientific or historical research, or statistical purposes.
6. Right to data portability
Subject to the conditions of Art. 20 GDPR, you are entitled to request that we provide you with the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format.
7. Right to withdraw consent under data protection law
If you have consented to the processing of your data (Art. 6(1)(a)), you have the right to withdraw your consent at any time. The withdrawal applies only to the future; This means that the withdrawal does not affect the lawfulness of processing carried out based on the consent prior to the withdrawal.
8. Right to lodge a complaint with the supervisory authority
You have the right to lodge a complaint with the supervisory authority—particularly in the Member State of your place of residence—if you believe that the processing of your personal data by us violates the GDPR. The supervisory authority for the BSI is:
The Federal Commissioner for Data Protection and Freedom of Information (BfDI)
Graurheindorfer Str. 153
53117 Bonn
Telephone: +49 (0)228 997799-0
E-mail: poststelle@bfdi.bund.de
Official Data Protection Officer at the BSI
Dominic Kastien
Data Protection Officer
Langer Grabenweg 33-43
53175 Bonn
Postfach 200363
53133 Bonn
Telefon: +49 (0) 228 99 9582-5527
E-Mail: datenschutzbeauftragte@bsi.bund.de