Privacy Policy

Who to contact

For questions about the portal’s handling of personal data, GDPR requests or the identity and details of the responsible operator, contact the sandbox team. Data protection / DPO contact: sandbox@eudi-wallet.fi.

This notice covers the portal and its registry and certificate connections. Wallet apps, Google Play, linked websites and your organization’s own services may process data separately under their own privacy notices.

Data we process

Account and login data: your registration email, account identifier, authentication session information, and login-code records including hashed codes, expiry times and failed-attempt counters. Login uses emailed one-time codes, not a portal password.

Organization information: legal and trade names, identifier type and value (EUID, VAT or LEI), country, public-sector status and related legal details; general and data-protection email addresses, phone number, website, support and privacy-policy URLs; supervisory authority name; entitlements, service descriptions, intended purposes, requested credential formats, namespaces or schema types and claims; and the Issuer URL or intermediary identifier, trade name and registry URI.

Certificate information: the public Access Certificate, organization and domain details contained in it, file and record identifiers, and creation timestamps. Newly generated private keys exist temporarily to produce your download and are not stored. Keys from older certificates may remain stored until their certificate is replaced or deleted.

Technical and support data: language preference, session storage, messages you send us, and operational diagnostics such as error messages, stack traces and page paths. Hosting and security services may also process connection data such as IP addresses and request information. Avoid including personal data in free-text fields unless needed.

Purposes and GDPR legal bases

We use account and registration data to provide participant access, maintain organization information and enable certificate and relying-party registration services. Where you personally enter into a service agreement, processing necessary to provide that service relies on Article 6(1)(b) GDPR. For organizational representatives and contacts, necessary service administration relies on legitimate interests under Article 6(1)(f), subject to balancing those interests against your rights.

Preventing login abuse, protecting the sandbox, investigating faults and responding to support requests rely on legitimate interests in operating a secure service (Article 6(1)(f)). Processing specifically required by law relies on Article 6(1)(c). Optional processing that requires consent must use a separate consent process; reading this policy is not consent.

Required form fields are necessary for registration and certificate services. Without a registered email you cannot sign in; without the required organization details you cannot complete registration or generate a certificate. The portal does not make automated decisions producing legal or similarly significant effects about you.

Service communications

We use your registration email and organization contact details to send operational service communications: login codes, security notices, maintenance and downtime notices, changes to standards, schemas, APIs or these documents, and announcements about the sandbox and the Finnish EUDI Wallet testing ecosystem relevant to your participation. These rely on our legitimate interest in operating the sandbox (Article 6(1)(f)) and are part of the service.

These messages are not commercial marketing. You can object to non-essential announcements at any time by emailing sandbox@eudi-wallet.fi; security, login and essential service notices continue while you have an account.

Recipients and connected services

Cloud hosting, authentication, database and file-storage providers process portal data to operate the service. Resend processes your email address and login-email content for code delivery. Service infrastructure providers may receive technical diagnostics to investigate errors.

The relying-party registry at rp.eudi-wallet.fi receives submitted organization information, including contact details, intended uses and intermediary details. Its whitelist receives your organization identifier, selected registry URI and public certificate. Information sent to these trust services may be made available to wallets and other relying-party ecosystem participants under the registry’s access rules; do not treat registration information as confidential.

We do not sell your personal data. Data may also be disclosed where legally required or necessary to investigate abuse. Contact the DPO address for current provider, recipient and data-location details.

International transfers

Hosting, email delivery and support providers may process data outside the EEA depending on their service configuration. Where GDPR requires safeguards, international transfers must rely on an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses, with additional measures where necessary. Contact sandbox@eudi-wallet.fi for the applicable destinations and safeguards; this notice does not assert that all processing takes place in Finland or the EEA.

Cookies and browser storage

Authentication uses browser storage and, where applicable, cookies to maintain your session. The eudiw-sandbox-language preference is stored in local storage and a cookie to remember Finnish or English; the language cookie lasts up to one year.

These mechanisms support sign-in and your chosen language. You can clear them through your browser, which may sign you out or reset the language. This notice does not authorize optional advertising or tracking cookies; any such processing requiring consent needs a separate choice.

Retention and security

Organization records and certificates remain while you use the service, until you replace or delete them. Login codes expire after 10 minutes; expired code records older than one hour are removed during subsequent login requests, so cleanup is not an immediate scheduled deletion. Codes are stored as hashes, with rate limits and limits on incorrect attempts.

Access controls restrict organization and certificate data to authorized users and service operations. Newly generated private keys are returned once for download rather than retained. No online service can guarantee absolute security.

Account records are separate from organization records. Operational logs, support records, provider logs and backups may have separate retention periods and may persist after active data is deleted where necessary for security, legal obligations or backup rotation. Current provider-specific retention periods are available from the data-protection contact; this notice does not promise immediate deletion of all backups.

Deleting your information

In Organization Information, choose “Delete all information” and confirm. This removes the organization record, certificate records and associated stored files, and sends deletion requests to the connected relying-party registry and whitelist. If a connected service refuses or cannot complete a request, the portal reports an error; contact us if removal is incomplete.

This action does not delete your login account, data already downloaded to your device, or independent third-party copies. To delete your account or request broader erasure, email sandbox@eudi-wallet.fi. We assess any lawful retention exceptions and explain them rather than treating the organization-delete button as full account erasure.

Your GDPR rights

Where applicable, you may request access to and a copy of your personal data, correction, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests; we must assess that objection under GDPR. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Send requests to sandbox@eudi-wallet.fi. We may need proportionate information to verify your identity. GDPR generally requires a response within one month; a necessary extension of up to two further months must be explained within the first month. Rights may be subject to statutory exceptions.

You may complain to the Finnish Office of the Data Protection Ombudsman (tietosuoja.fi) or another competent supervisory authority, including in the EEA country where you live or work. You do not have to contact us first.

Changes to this notice

We update this notice when the service or its data handling changes. The date above identifies the current version. Material changes will be communicated as required, and new processing requiring consent will not be based merely on an updated notice.