Privacy
Controller
Aloaha Limited
„Helgoland“
45, Triq Gio Felice Inglott
Pembroke PBK1131
Malta
E-mail: info@aloaha.com · Phone: +49 541 3859 4554
Please write “GDPR request” in the subject line for data-protection matters. We answer within one month (Art. 12(3) GDPR).
What this website does not do
No cookies – neither our own nor third-party cookies.
No analytics or statistics services, no advertising or tracking pixels, no fingerprinting, no session recordings.
No external fonts or CDNs – fonts, scripts and images are delivered only by this website.
No forms and no user accounts.
Server logs
Like every web server, our server records technical access data: IP address, date and time, requested address, status code, amount of data transferred, referrer and browser identification (user agent). We need this data to deliver the website securely and to fend off attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). The logs are deleted automatically after 14 days; they are not used for advertising or profiling, not combined with other data and not passed on to third parties. The website is hosted in the European Union.
Storage in your browser
If you switch the colour scheme or the language, your browser remembers the choice in its local storage (keys codeb-theme and codeb-lang). The values stay on your device and are not sent to us. You can delete them at any time in your browser settings. This storage is strictly necessary for the function you requested.
Contact by e-mail or phone
If you write to us or call us, we process the details you provide (for example name, e-mail address, phone number and the content of your message) to answer your enquiry. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request) and Art. 6(1)(f) GDPR. We keep this correspondence only as long as needed for the enquiry and for statutory retention obligations.
The CodeB Wallet app
Credentials in CodeB Wallet are stored on your device, protected by the Android hardware-backed keystore and your PIN or biometrics. Data from a credential is shared with a service only when you approve the request in the app.
To work, the app connects to the issuers and services you choose, to EU trust lists, and to the wallet-provider service that confirms the app’s integrity to issuers. Aloaha Limited receives credential data only if you choose an issuer or service operated by Aloaha Limited – for example the CodeB issuer.
Permissions. Camera: only to scan QR codes; images are processed on the device and not stored or sent. Bluetooth (and, on older Android versions, location – Android requires this permission for Bluetooth scanning): only to exchange documents phone-to-phone when you show or check an ID in person; your location is not determined or collected. NFC: to start an in-person exchange with a tap. Biometrics: unlocking is done by Android; your fingerprint never reaches the app. Files: only the PDF documents you choose to sign.
Address lookups. The app looks up server addresses with your phone’s normal settings. Only if that fails does it ask the encrypted DNS services of Cloudflare (1.1.1.1) or Google (8.8.8.8) for the address of that server name; they receive the name and your IP address, nothing else. The last addresses that worked are kept on your phone so that a short network problem does not stop the app. Connections stay encrypted and are checked against the server’s certificate in every case.
Remote signing. When you sign a PDF with a signing service, only a cryptographic fingerprint (hash) of the document is sent to that service; the document itself stays on your phone. If you use the CodeB signing service (phone.codeb.io), Aloaha Limited processes your account, your signing certificate and a record of each signature to provide and document the service.
History and logs. The list of what you shared, added or signed is kept only on your phone. The app collects no analytics, shows no advertising and does not track you. A technical log file is created only when you tap “Retrieve logs” and leaves the phone only if you decide to send it to us.
Checking someone else’s ID. Details received with “Verify” are shown once and deleted when you close the result.
Deleting your data. You can delete single documents in the app or remove everything by uninstalling CodeB Wallet. Data held by an issuer or signing service is governed by that provider; for services of Aloaha Limited write to info@aloaha.com.
The app uses a wallet-provider service (currently the EU reference wallet provider, wallet-provider.eudiw.dev) to confirm to issuers that the app is genuine; it receives technical information about the app instance, not your documents.
Your rights
Under Articles 15 to 22 GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, and to withdraw consent at any time. To exercise these rights, write to info@aloaha.com with “GDPR request” in the subject line.
Right to lodge a complaint
You have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR). As the controller is established in Malta, the lead supervisory authority is the Office of the Information and Data Protection Commissioner (IDPC), Malta.