Last update: 31/08/2026

Wallet idCAT is an application for mobile devices that allows users to manage digital identity credentials and personal attributes, store them securely and use them to identify themselves, authenticate themselves or accredit certain data to public and private services.

El Open Administration of Catalonia Consortium (AOC) put Wallet idCAT available to citizens and is responsible for protecting the rights and privacy of users in relation to the processing of personal data carried out within the framework of the Portfolio.

This Privacy Policy informs about the personal data that may be processed through Wallet. idCAT, the purposes of these treatments, the people or entities that can access them and the rights that correspond to users.

The processing of personal data is carried out in accordance with the Regulation (EU) 2016/679, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation or GDPR), the Organic Law 3/2018, of December 5, on the protection of personal data and guarantee of digital rights (LOPDGDD) and the rest of the applicable regulations.

Where applicable, Portfolio idCAT is developed taking into account the principles and requirements of the European digital identity framework established by the Regulation (EU) 2024 / 1183, which amends Regulation (EU) No. 910/2014 (eIDAS Regulation).

1. Developer information and contact point

Name: Open Administration of Catalonia Consortium (AOC)

Website: https://www.aoc.cat

Contact email: info@aoc.cat

Address: C/Salvador Espriu 45-51 08908 L'Hospitalet de Llobregat

The Open Administration Consortium of Catalonia (AOC) has its genesis in the Agreement for the promotion and development of the Information Society in the Catalan public administrations, signed in the Parliament of Catalonia on July 23, 2001, between the presidents of all parliamentary groups, the Government of the Generalitat of Catalonia and the local governments representats by Localret.

The mission of the AOC is to drive the digital transformation of Catalan administrations, to promote agile, logical and collaborative governments. And our vision is to ensure that people enjoy quality public services and live in an open society.

According to Law 29/2010, of 3 August, on the use of electronic media in the public sector of Catalonia, the strategic objectives of the AOC Consortium are, fundamentally, to collaborate with the Administration of the Generalitat, local bodies and, where appropriate, other public bodies, by:

1. To promote the interoperability of Catalan information systems with other administrations.
2. Create and provide common e-government services.
3. Reuse the e-government applications and services that are developed.
4. Guarantee the identity and accredit the will in the actions of citizens and public sector personnel, as well as confidentiality and non-rejection in electronic communications.

Through the AOC Consortium, measures of cooperation and promotion of the Administration of the Generalitat with local bodies in the use of electronic media are also developed and implemented.

2. Who is responsible for processing the user's data?

The person responsible for the processing of personal data carried out by the AOC Consortium in relation to Portfolio idCAT is:

Identity: Director / Managing Director of the AOC Consortium

Postal address: C/Salvador Espriu 45-51 08908 L'Hospitalet de Llobregat

phone: 932722500

Contact of the controller: rpd@aoc.cat

Contact of the Data Protection Delegate: dpd@aoc.cat

Wallet idCAT It is part of an ecosystem in which different entities can intervene, such as credential issuers and entities that request data or attributes from the user.

These entities may be responsible for the data processing they carry out within the framework of their own functions and services.

3. What personal data is processed?

The personal data processed may vary depending on the functionalities used by the user and the credentials they include in the Wallet.

3.1. Identification data

Depending on the available functionalities, data such as:

• name and surnames;
• date of birth;
• person identifiers;
• nationality;
• contact details;
• other identifying data included in the digital credentials.

3.2. Digital credentials and attributes

Wallet idCAT It allows you to receive, store, manage and present digital credentials that may contain identity data or other personal attributes.

The specific content of these credentials will depend on the entity that issues them and the purpose for which they are used.

Credentials stored in Wallet idCAT They are generally kept under the control of the user and are stored on the device in accordance with the Wallet's security mechanisms.

3.3. Identifiers and cryptographic material

The Wallet may use digital identifiers and cryptographic material necessary to protect credentials and enable digital identity operations.

The private keys used by the Wallet are intended to remain under the control of the user and are not communicated to the AOC Consortium.

3.4. Technical data of the device

To guarantee the operation, security and maintenance of the application, certain technical data may be processed, such as:

• device model and manufacturer;
• operating system and version;
• Wallet version idCAT;
• technical identifiers;
• information relating to errors or incidents;
• information necessary to ensure the security of the application.

3.5. Data relating to operations

Transactions carried out through Wallet idCAT they can generate technical information necessary to execute them, guarantee their security or resolve incidents.

The AOC Consortium will apply the principle of minimization and limit the processing of this type of information to what is necessary for the corresponding purposes.

4. How is the data obtained and where does it come from?

The data processed within the framework of Portfolio idCAT they can come from different sources, depending on the functionality used.

Among these sources can be found:

• the same user person;
• The authentication system Vàlid, specifically using the credential idCAT Phone.
• credential issuing entities;

When the AOC Consortium acts as the issuer of a specific credential, the data necessary to issue it may be processed by the AOC Consortium systems in accordance with the corresponding purpose.

When a credential is issued by another entity, that entity will be responsible for the processing it carries out in relation to the issuance of the credential, in accordance with its own responsibilities.

5. What is Wallet? idCAT and how does it work with respect to data?

Wallet idCAT It is designed as a digital wallet in which the user can manage their credentials and decide when and with whom they use them.

The operating model differentiates between:

Issuer: entity that issues a digital credential.

Owner: person who has the credential in their Wallet.

User or verifier party: entity that requests and verifies data or attributes submitted through the Wallet.

The AOC Consortium may assume one or more of these roles depending on the specific service.

The fact that a credential is managed through Wallet idCAT does not imply that the AOC Consortium has access to the content of the credential or to all the data that the user subsequently presents to third parties.

6. What do we use the data for?

Personal data may be processed for the following purposes:

• provide Wallet functionalities idCAT;
• activate and manage the Wallet;
• allow the reception and management of digital credentials;
• allow electronic identification and authentication;
• allow the presentation of credentials and attributes to third parties;
• facilitate selective disclosure of data where possible;
• ensure the security of the Wallet;
• prevent, detect and manage fraudulent uses or security incidents;
• manage incidents and provide support to users;
• maintain and update the application;
• comply with applicable legal obligations;
• carry out the functions that correspond to the AOC Consortium.

Personal data will not be processed for purposes incompatible with those for which they were obtained.

7. Who receives the data I share through Wallet? idCAT?

When a user presents a credential or attribute through Wallet idCAT, the selected data may be communicated to the entity that requests it.

This entity can be, among others:

• a public administration;
• a public sector entity;
• a company;
• another organization that provides a service to the user.

The user must be able to know, in accordance with the functionalities of the Wallet, which entity is requesting the information and what data is intended to be shared before authorizing the operation.

The AOC Consortium will not be the recipient of the data simply by providing Portfolio idCAT.

The subsequent processing of the data by the entity that receives it will correspond to this entity, which must inform about the processing of the data and comply with the obligations that correspond to it in terms of data protection.

8. User control and selective disclosure

Wallet idCAT It is designed to make it easier for the user to maintain control over the credentials and data they present.

Before authorizing an operation involving the submission of data, the Wallet may display:

• the identity of the entity requesting the data;
• the requested data or attributes;
• the purpose of the request, when this information is available;
• the data that will be shared.

The user can authorize or reject the operation.

When the credential and protocols used allow it, Wallet idCAT may apply mechanisms of selective disclosure.

These mechanisms allow sharing only the information necessary for a given operation.

For example, when a service needs to prove that a person is of legal age, it may be possible to prove this condition without revealing the exact date of birth.

9. Privacy and non-tracking of operations

Privacy protection is a fundamental principle of Portfolio idCAT.

The AOC Consortium will apply technical and organizational measures aimed at avoiding the collection of information about the activities of users that is not necessary to provide, protect and maintain the Portfolio services.

In particular, the design of Wallet idCAT aims to prevent the AOC Consortium from unnecessarily knowing the details of the operations that the user carries out with third parties, such as:

• what services do you use;
• with which entities it shares data;
• what credentials does he present;
• what attributes does it share;
• what specific information is presented in each operation.

The AOC Consortium will not use the personal data stored in the Wallet or the data derived from its use to create profiles of users or track their activities with third parties.

This limitation does not prevent the processing of data that is strictly necessary to guarantee security, prevent fraud, resolve incidents, provide a specific functionality or comply with a legal obligation, provided that the corresponding legal basis exists.

10. Data stored on the device

Wallet idCAT can be stored locally on the user's device:

• digital credentials;
• data contained in the credentials;
• Wallet identifiers;
• cryptographic material;
• application settings;
• other information necessary for the operation of the Portfolio.

This information is intended to remain under the control of the user.

Data stored locally is protected by the security and encryption mechanisms implemented by the Wallet and the device's operating system.

The AOC Consortium does not have access to the user's private keys.

11. Authentication and protection of access to the Wallet

Wallet idCAT can use the device's security mechanisms to protect access to the data and cryptographic material in the Wallet.

These mechanisms may include:

• PIN;
• password;
• pattern;
• fingerprint;
• facial recognition;
• other authentication mechanisms provided by the operating system.

When using a biometric mechanism provided by the operating system, Wallet idCAT It will not access the user's biometric pattern.

Biometric verification is performed using the device's security mechanisms.

12. App permissions

Wallet idCAT It will only request the device permissions necessary to provide its functionalities.

Depending on the available functionalities, these permissions may include:

• camera access;
• notifications;

Permissions will only be used for the purposes associated with the corresponding functionality.

The user can consult and manage the permissions granted in Wallet idCAT from the device settings.

13. Notifications

Wallet idCAT can use notification services to inform the user of certain events related to the Wallet, such as the receipt of a new authentication request initiated by the user themselves from a browser.

To make the delivery of these notifications possible, technical identifiers associated with the device may be processed.

Notifications will be designed to avoid, whenever possible, including personal information or credential data that is not necessary to be displayed in the notification.

14. What is the legal basis for the processing?

The legal basis for the processing is the consent of the person concernederesset when obtaining and presenting electronic attribute credentials.

The user may withdraw this consent at any time. The withdrawal of consent does not affect the legality of the processing carried out previously. 

15. How long is the data kept?

Personal data will be kept for the time necessary to fulfill the purposes for which they were processed.

Different types of information may be subject to different retention periods.

In particular, different periods may be established for:

• data necessary for the provision of the service;
• data associated with the issuance of credentials;
• supporting data;
• technical records;
• security records;
• information necessary to comply with legal obligations.

Data stored locally in Wallet idCAT they can be deleted using the functionalities available in the application itself or through the mechanisms provided for managing the Portfolio.

Once the applicable retention periods have ended, the data will be deleted or, where applicable, blocked.

16. Who can access the data?

Access to personal data will be limited to the people and entities that need it for the corresponding purposes.

They can access the data:

• the user person;
• the AOC Consortium, when necessary to provide the functionalities of its responsibility;
• the providers who act as data processors;
• the issuing entities or user parties, when applicable and in accordance with the authorized operation;
• public authorities and bodies that have the right to access it in accordance with applicable regulations.

The AOC Consortium's access to information related to the Portfolio's operations will be limited to what is strictly necessary for the corresponding legitimate purposes.

17. Technology providers

To provide, maintain, protect and evolve Portfolio idCAT, the AOC Consortium can count on technological suppliers.

When these providers process personal data on behalf of the AOC Consortium, they will be consideredthose in charge of the treatment when appropriate in accordance with data protection regulations.

The AOC Consortium will select suppliers by applying the necessary guarantees and will formalize the corresponding contracts when required.

18. International transfers

The international transfer of data is not foreseen by the services that the AOC Consortium offers to citizens and all of the Catalan Public Administrations.

19. What security measures are applied?

The AOC Consortium applies the necessary technical and organizational measures to guarantee a level of security appropriate to the risk of the processing.

Wallet idCAT It incorporates security measures designed to protect credentials, personal data and cryptographic material from unauthorized access, loss, alteration, disclosure or destruction.

These measures may include:

• communications encryption;
• encryption of stored information;
• protection of cryptographic keys;
• use of the device's security mechanisms;
• user authentication;
• integrity checks;
• protection against application manipulations;
• incident detection and response mechanisms;
• protection measures against fraud and impersonation.

Security measures are reviewed periodically and adapted to technological developments and identified risks.

20. Security incidents

In the event of a security incident that may affect personal data, the AOC Consortium will apply the established procedures to detect, contain, investigate and resolve the incident.

When required, the AOC Consortium will notify security breaches to the competent authorities and the affected individuals in accordance with applicable regulations.

21. What are the rights of users?

Users have the right to access their personal data as well as to rectify inaccurate data or, where appropriate, request its deletion, among other reasons when the data is no longer necessary for the purpose for which it was collected.

The right of deletion will not proceed, among other cases provided for in the case that the treatment is necessary for the fulfillment of a legal obligation or the fulfillment of a mission performed in the public interest or in the exercise of powers conferred on the AOC Consortium . When these cases occur, it will be stated in the section on legitimation.

The right to object to the processing of personal data for reasons related to the particular situation of the person will apply, except in the cases provided for in the GDPR (European Regulation EU 2016/679).

You can also request the limitation of processing, in the cases provided for in article 18 of the GDPR (European Regulation EU 2016/679). In this case, the data will only be kept to exercise or defend claims.

How can these rights be exercised?

By writing to Consorci AOC C/Salvador Espriu 45-51 08908 L’Hospitalet de Llobregat or by electronic form.

What are the avenues of complaint?

If it is considered that the rights have not been adequately met, users have the right to file a complaint with the Catalan Data Protection Authority.

22. How can I control or delete my Wallet data?

The user can manage credentials and locally stored information using the functionalities available in Wallet. idCAT.

In particular, you can:

• check available credentials;
• submit or reject a data request;
• delete credentials;
• manage the Wallet settings;
• manage access to the Wallet.

Removing a Wallet credential idCAT does not necessarily imply its revocation by the entity that issued it.

Similarly, deleting the application from the device does not necessarily imply the deletion of data that other controllers may retain in their systems.

23. Principle of minimization of data

Wallet idCAT applies the principle of data minimization.

The user should only share the data necessary for the provision of the corresponding service.

When technical mechanisms allow, the Portfolio will facilitate the selective disclosure of attributes to avoid the communication of data that is not necessary.

The AOC Consortium will not use personal data stored or derived from the use of the Wallet for purposes other than the provision of the Wallet services. idCAT, except when there is a specific legal basis that allows it.

24. Changes to this Privacy Policy

The AOC Consortium may modify this Privacy Policy when necessary to adapt it to regulatory, technical, organizational or functional changes.

When the changes are relevant, users will be informed through the application itself or through other appropriate means.

25. Update date

Last update: 31/08/2026

Version: 1.0