1. Scope

This privacy notice applies exclusively to the EUDI Verifier demo service operated by youniqx Identity AG, accessible at sandbox.eudi-verifier.youniqx.com. It describes how personal data is handled when you use your EUDI Wallet to present credentials to this verifier.

For the privacy notice covering youniqx Identity AG as a company and the main website www.youniqx.com, please see: youniqx.com/data-privacy .

2. Controller

youniqx Identity AG

Tenschertstraße 7, 1230 Vienna, Austria

Tel.: +43 1 206 66-0

Email: office@youniqx.com

Data Protection Officer: privacy@youniqx.com

3. What this service does

This service is a demonstration verifier for the European Digital Identity (EUDI) Wallet ecosystem. It requests and displays identity credentials (such as PID — Person Identification Data) that you voluntarily present from your EUDI Wallet via the OpenID4VP protocol. The purpose is to demonstrate credential verification flows as part of the EUDI Wallet framework.

4. Personal data processed

When you initiate a verification flow by scanning the QR code with your EUDI Wallet, the following data may be transmitted to this service and displayed on screen:

• PID Basic: given name, family name.
• PID Full: given name, family name, date of birth, place of birth, address, nationality, and further attributes as defined in the EUDI ARF.
• Age Verification (PID / AV): age-over-18 attestation (a boolean attribute only — no other personal data).

The exact data shared depends on the flow you select and which attributes you consent to disclose in your EUDI Wallet.

5. No storage of personal data

youniqx Identity AG does not store any personal data received through the verifier. Credential data is processed transiently in memory solely for the purpose of displaying the verification result in your browser session. Once the session ends, no personal data is retained.

This service does not use:

• Databases or logs containing personal data.
• User accounts or registration.
• Cookies or tracking technologies.
• Analytics or profiling.

The live statistics displayed on the service (total scan count, success rate, flow distribution) contain no personal data — only aggregate counters.

6. Legal basis

The transient processing of credential data takes place on the basis of Article 6(1)(b) GDPR (processing necessary for the performance of a task at the request of the data subject — i.e., the credential presentation you initiate) and/or Article 6(1)(f) GDPR (legitimate interest in operating a technically functional EUDI Wallet demonstration environment in compliance with the eIDAS 2.0 framework).

7. Technical connection data

When you access this service, standard server log data is temporarily processed (IP address, browser type, timestamp, requested URL). This data is used solely for ensuring technical operation and security, is not linked to credential content, and is deleted within 7 days. The legal basis is Article 6(1)(f) GDPR (legitimate interest in IT security).

8. Recipients

Personal data from credential presentations is not transferred to any third party. No data processors have access to credential content, as none is persisted.

9. International transfers

No credential data is transferred to third countries. Server infrastructure is located within the EU.

10. Your rights

Even though no personal data is stored after your session, you retain the following rights under GDPR as long as your session is active or to the extent any data is processed:

• Right of access (Art. 15 GDPR).
• Right to rectification (Art. 16 GDPR).
• Right to erasure (Art. 17 GDPR).
• Right to restriction of processing (Art. 18 GDPR).
• Right to object (Art. 21 GDPR).
• Right to lodge a complaint with the Austrian Data Protection Authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at.

To exercise your rights, contact: privacy@youniqx.com.

11. Sandbox / demo status

This service is a sandbox environment intended for testing and demonstration purposes within the EUDI Wallet ecosystem. It is not intended for production use cases or for processing real identity data beyond demonstration flows.