Privacy Policy

We take the protection of your data seriously. Your personal data is processed confidentially and in accordance with EU GDPR and this privacy policy. doWallet is hosted in Germany; your data only leaves the EEA in the cases listed in section 11.

1. Controller

The controller under GDPR is Applox GmbH, Röhrichtweg 29, 44263 Dortmund, Germany. Contact and management are in the Imprint.

2. Data Protection Officer

Reach our DPO at dsb@dowallet.de.

3. Data collected and purposes

3.1 Account & usage

• Email, name, argon2id-hashed password · account + auth.
• Organization / workspace membership, role.
• Session metadata (IP, user agent, timestamp) · abuse detection.
• Audit log: who changed what, before/after diff. IP and user agent are removed after 90 days; the entry is kept per tenant setting (default 365 days).
• Login codes and invitations, each only for as long as they are valid.

3.2 Pass data

• Template + campaign definitions (entered by the customer).
• Issued passes with serial, AES-256-GCM-encrypted auth token, attributes, UTM attribution.
• Apple Wallet device registrations (the device's Wallet library identifier and push token, which the device itself registers with doWallet).
• Lifecycle events (activated, deactivated, reactivated).
• Link clicks and events for campaign reporting. IP and user agent of link clicks are removed after 7 days, e-mail keys in events after 90 days.

3.3 Pass holders (your customers' customers)

When an end user claims a pass, we store the device registration and any optionally provided e-mail · solely on behalf of the pass issuer (data processing under Art. 28 GDPR, see the DPA in our Terms).

3.4 Public landing pages

On landing pages under /p/<slug> the pass issuer (our customer) distributes passes to its end users. For the data collected there, the pass issuer is the controller and doWallet the processor. Name and e-mail are only collected if the end user ticks an explicit checkbox. A device key (cookie dw_attr_<slug> plus local storage, 180 days) ensures that only one pass is issued per phone. It is strictly necessary and contains no personal details.

3.5 Pitch decks

Presentations under /pitch/<token> collect simple first-party usage analytics (slides viewed, duration). For this an opaque session id is held in the browser's memory only. No cookie is set and neither IP address nor user agent is stored. Retention 12 months.

3.6 Contact form requests

If you contact us through a form on dowallet.de we store your details to handle the request. IP and user agent are removed after 30 days; the request itself is deleted after 24 months. A notification with your name, e-mail, company, chosen plan and message is sent by e-mail to an Applox GmbH mailbox at Google Workspace (section 5).

3.7 Cookieless, data-minimising reach measurement

To know which of our pages are read, we count page views on the public pages of dowallet.de (home, product, solutions, pricing, roadmap, changelog, documentation, Trust Center and legal texts) and on the landing pages under /p/<slug>. We use the open-source software Umami for this, which Applox GmbH runs itself on its own servers at Hetzner in Falkenstein (Germany). No third party receives this data. The app after sign-in, the sign-in and registration pages, the back office, pitch decks, the scanner and invitation, unsubscribe and pass links are never counted.

Your browser sends the page view to dowallet.de itself, not to another server. What is sent: the page address without parameters (on the public pages only the campaign tags utm_source, utm_medium and utm_campaign are kept; landing pages are counted without any parameter), on the public pages the page title, the website you came from (its domain name only), and what your browser sends with every page request anyway: browser identifier (user agent), preferred language and IP address. We shorten the IP address on our servers before it reaches the statistics (IPv4 by the last byte, IPv6 to the first 48 bits); the full IP address is neither passed on nor stored in the statistics (like every request, the page view appears in the server access log, section 3.8). Only the page view is stored, together with the browser, operating system, device type and approximate location derived from it (country, region and city as far as they follow from the shortened IP address), and a visit identifier: a hash of the shortened IP address, the browser identifier, a secret key and the current day, so it changes daily. The visit identifier is a pseudonym and therefore not anonymous data: whoever knows the key could recompute it for a known shortened IP address and browser identifier. We do not do that and do not combine the statistics with any other data; visits on different days cannot be linked.

No cookie is set, nothing is placed in your browser's storage, and no properties of your device such as screen size or language settings are read. Because nothing is stored on your device and no information is read from it that is not transmitted with the page request anyway, in our assessment no consent under Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act) is required; that is why there is no cookie banner. The legal basis is our legitimate interest in understanding the reach and use of our website and improving it (Art. 6(1)(f) GDPR). Applox GmbH is also the controller for the counting on landing pages; the pass issuer does not receive this data. The data is deleted after 25 months.

Objection: if you have switched on “Do Not Track” or “Global Privacy Control” in your browser, we count no page views. You can also object to the processing under Art. 21 GDPR (dsb@dowallet.de); since the statistics contain neither a name nor an IP address and we cannot find you in them, the browser setting is the effective way.

3.8 Server access logs

For every request to dowallet.de and its subdomains (app., api. and pass.dowallet.de, so also landing pages, pass links and the requests of the wallet apps) the web server writes a line to the access log: time, requested host, method, path including the parameters in the address (for example campaign tags or identifiers in links), status code, bytes sent, response time, the full IP address, the browser identifier (user agent), the referring page (referer) and a request identifier. For the address search of the location editor only the path without parameters and without the referring page is logged, so search terms and coordinates never are.

The purpose is operational security: detecting, fending off and investigating attacks and abuse, and finding errors (Art. 6(1)(f) GDPR). The log stays on the server for up to 90 days. Every night an encrypted copy goes to the backup storage at Hetzner in Falkenstein, where it is deleted automatically after 365 days. We do not use the log for profiles and do not combine it with other data; it cannot be searched by person because it contains neither names nor e-mail addresses. The application itself logs requests only with a shortened IP address (IPv4 /24, IPv6 /64) and without the parameters of the address; these logs stay on the server for 30 days and for 365 days in the encrypted copy.

3.9 Status page and availability monitoring

We check ourselves whether doWallet is reachable: the open-source software Gatus, which Applox GmbH runs on its own servers at Hetzner in Falkenstein (Germany), calls the public addresses of doWallet every minute and reports outages. No personal data is processed for this, and no external monitoring service receives any data.

The result is shown on the status page status.dowallet.de. It sets no cookie, stores nothing in your browser and loads nothing from other servers. As with every request, the Applox GmbH server in front of it (also at Hetzner in Falkenstein) writes the request with the full IP address, browser identifier (user agent) and referring page to its access log. The log stays 14 days on that server and 30 days in our log store, which is also in Falkenstein. The purpose is the secure operation of the page (Art. 6(1)(f) GDPR).

4. Legal bases

• Art. 6(1)(b) · contract performance · platform provision.
• Art. 6(1)(c) · legal obligation · tax retention.
• Art. 6(1)(f) · legitimate interest · security, fraud prevention, audit log, server access logs (section 3.8), bot protection, cookieless reach measurement (section 3.7), status page and availability monitoring (section 3.9).
• Art. 6(1)(a) · consent · e-mails to pass holders, name and e-mail on landing pages.

5. Recipients and processors

• Hetzner Online GmbH (Germany) · server hosting, object storage, backups, access logs, map tiles and address search; DPA in place.
• Apple Inc. (USA) · Apple Wallet: push notifications via APNs to devices on which a pass is stored. Apple only receives the device's push token and the pass type identifier; the device downloads the pass directly from doWallet. The transfer is made on the instruction of the pass issuer, because it issues wallet passes. Legal basis: see section 11.
• Google LLC (USA) · Google Wallet API: the pass content as a Wallet class and object, including the details about the pass holder that the template places on the pass. The transfer is made on the instruction of the pass issuer, because it issues wallet passes. Legal basis: see section 11.
• Brevo (Sendinblue SAS, France) · transactional e-mails (login codes, invitations, invoices, pass e-mails) unless the tenant has configured its own SMTP server; DPA in place.
• doCaptcha (Applox GmbH, Germany) · bot protection for sign-in, the forms and, with Page Guard, the website. A service of the same company on servers in Germany, not a third party; see section 6.1.
• sevDesk GmbH (Germany) · invoicing and bookkeeping: company details and billing contact of our customers; DPA in place.
• Google Ireland Limited (Google Workspace, Ireland) · the Applox GmbH mailboxes. They currently receive the notifications about contact requests (section 3.6) and about uploaded payment proofs (organisation, invoice number, amount, the customer's note), as well as reports to security@applox.com and replies to our e-mails, until these mailboxes move to a provider in Germany. For processing in the USA see section 11.
• Recipients configured by the customer · its own SMTP server, webhook endpoints, the API of its system for the value of the pass (when issuing a pass, doWallet sends the details the customer sets up for it, for example the pass ID, serial number, template, campaign tags and attributes of the pass, also the pass holder's name and e-mail if the holder consented) and addresses for images per pass (doWallet fetches the image once from that address). These transfers are made on the customer's instruction; the customer chooses these recipients and is responsible for them.

Availability monitoring, the status page and reach measurement are run by Applox GmbH itself on servers at Hetzner in Germany (sections 3.7 and 3.9); there is no further recipient for them. doWallet uses no external service for monitoring, status pages or error reports.

6. Embedded services

6.1 doCaptcha (bot protection)

Sign-in, requesting a login code, “Forgot password” and the contact form are protected by doCaptcha, a service of Applox GmbH (Germany), the company that also runs doWallet; the data never leaves the company or Germany. When Page Guard is enabled, doCaptcha also checks the other pages of the website and the app. Pages that pass holders open from their wallet, a QR code or an e-mail (landing pages, personal invitations, pass links, unsubscribe, scanner) never run doCaptcha. Your browser loads a script from widget.docaptcha.com and talks to the doCaptcha API. It transmits your IP address, the user agent and technical signals that reveal automated access: browser properties, counts and timing of pointer moves, clicks and key presses and, with Page Guard, the time spent and the number of inputs per page change. What you type, which keys you press, page addresses and link texts never leave your browser. When an AI agent identifies itself through its user agent or a signature (Web Bot Auth), doCaptcha checks those details; search engines and link previews are exempt. The service sets exactly one first-party clearance cookie (__dc_clr, 30 minutes, strictly necessary) once Page Guard is enabled; it proves that your browser passed the check. The form widget itself sets no cookie and uses no browser storage. The protection serves solely to block automated access, sign-in attempts and abusively triggered e-mails (Art. 6(1)(f) GDPR; access to your device under Section 25(2) no. 2 TDDDG).

6.2 Maps and address search

The location editor in the app shows a map and offers address search. Your browser loads map tiles, fonts and symbols from doWallet's object storage at Hetzner in Falkenstein. Search terms and clicked map points go to the doWallet API, which answers them with its own geocoding service on doWallet servers in Germany. No third party receives your IP address or your search. Search terms and coordinates never go into a database or a log. To keep repeated searches fast, the search term and rounded coordinates serve, as a hash value only, as the key of a cache: together with the answer they stay in the memory of doWallet's servers for up to 24 hours (10 minutes when nothing was found), without any link to you (Art. 6(1)(b) GDPR). Map data © OpenStreetMap contributors, available under the Open Database License (ODbL).

On landing pages, the “In Karten öffnen” button opens your device's maps app (Apple Maps on iPhone, Google Maps elsewhere) only after you tap it; only then does that provider receive the location's coordinates, under its own terms.

7. Cookies

We only use strictly necessary cookies and preference storage. There are no analytics and no marketing cookies; the reach measurement (section 3.7) works without cookies and without browser storage. Every single entry is described with purpose and duration in our Cookie Policy. Your settings are always reachable here: Cookie settings

8. Your rights

• Art. 15 · Access · full export of your data.
• Art. 16 · Rectification.
• Art. 17 · Erasure · 30-day grace period, reversible.
• Art. 18 · Restriction.
• Art. 20 · Portability · JSON archive.
• Art. 21 · Objection, and withdrawal of consent (Art. 7(3)).
• Right to lodge a complaint with a supervisory authority (for Dortmund: LDI NRW).

How to exercise them:

• Customers: export and deletion under Settings → Profile → Data Rights. An overview of the data processing agreement (DPA) is downloadable there as a PDF; the agreement to sign is available via dsb@dowallet.de.
• Pass holders: withdraw e-mails about a pass via the link in every e-mail. The pass stays in your wallet. Request erasure of your data through the pass issuer or at dsb@dowallet.de.
• Pass issuers can remove the personal data of a pass in the pass list via "Personenbezogene Daten löschen".

Everything else goes to dsb@dowallet.de.

9. Retention

Active accounts are kept for the duration of the contract. The server access logs follow section 3.8. All other data follows the defaults below, enforced automatically by a daily job:

10. Technical & organizational measures

• TLS 1.2 or higher, TLS 1.3 preferred; unencrypted requests are redirected to HTTPS.
• Wallet credentials + pass auth tokens AES-256-GCM with rotatable keys.
• Passwords hashed with argon2id.
• Rate limit, CSRF, helmet CSP, CORS allowlist.
• Hetzner Cloud firewalls and server firewalls with allowlists, rate limits at the reverse proxy; database backups every 6 hours, encrypted before upload.
• Vulnerability scan of every image before rollout; an external penetration test is planned. Audit log with IP address and user agent (removed after 90 days).

11. International data transfers

We run hosting, database, backups, map tiles, address search, reach measurement, monitoring and the status page in Germany (Hetzner, Falkenstein). Brevo (Sendinblue SAS) sends transactional e-mails from France, i.e. within the EU.

We only transfer data from passes to the USA where it arises because our customer issues wallet passes and you save a pass to your wallet: to Apple Inc., for Apple Wallet, your device's push token and the pass type identifier (your device downloads the pass itself directly from doWallet); to Google LLC, for Google Wallet, the pass content including the details about you that the template places on the pass. For Google LLC the legal basis is the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework of 10 July 2023 (Art. 45 GDPR), under which Google LLC is certified, supplemented by Standard Contractual Clauses. Apple Inc. is not certified under the Data Privacy Framework; for Apple the transfer relies on the Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

The Applox GmbH mailboxes are provided by Google Ireland Limited (Google Workspace, Ireland); Google may also process the data in them in the USA. The legal basis is the adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified, supplemented by Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Recipients a customer configures itself (section 5) may be located outside the EU; that transfer is made on the customer's instruction and under its responsibility. Tools of our operations based outside Germany (GitLab and Let’s Encrypt in the USA, 1Password in Canada) receive no data about you; they are listed in the Trust Center.

doWallet has no AI features and sends no data to AI providers.

12. Changes to this policy

We reserve the right to update this policy; material changes are notified by e-mail.