Data protection Aareal Authenticator
Information on Data Processing
At Aareal Bank AG, we take the protection of personal data seriously and process such data only in accordance with applicable laws, in particular the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).
Below, we provide you with information in accordance with Articles 13 and 14 of the GDPR regarding the processing of personal data in connection with the use of the “Aareal Authenticator” app on mobile devices running iOS or Android. This privacy notice supplements the general data protection information of Aareal Bank AG.
1. Data Controller
The controller as defined in the GDPR is:
Aareal Bank AG
Paulinenstr. 15
65189 Wiesbaden
datenschutz(at)aareal-bank.com
2. Data Protection Officer
Our data protection officer can be contacted as follows:
Data Protection Officer
c/o Aareal Bank AG
Paulinenstr. 15
D-65189 Wiesbaden
3. Nature, Scope, Purpose of and Legal Basis for Processing
We can only make our app available if, when you use it, we collect certain personal data about you that is necessary for the app to function.
To this end, the app processes data for various purposes, including the activation, authentication and authorisation of transactions on the mobile device, and transmits the data required for the respective transaction to the back-end systems operated by Aareal Bank AG. Individual processing operations vary depending on the operating system and the app functions that are activated.
We process your data for the following purposes on the legal basis indicated for each purpose:
(a) Provision of the authentication process: In particular, we process activation and registration data, user IDs, domain, device and app information, serial and sequence numbers, one-off passwords, cryptographic signatures, and challenge, request and transaction identifiers. No unencrypted PINs are transmitted. The processing serves to activate the app, authenticate the user and authorise the requested operations.
The processing of your personal data is based on Article 6(1)(b) of the GDPR, to the extent that it is necessary for the provision and execution of the authentication process.
(b) Security and technical error analysis: To ensure the integrity, functionality and stability of the app, technical security checks are carried out and technical error and crash information is processed. This may include, in particular, device and hardware information, operating system information, app version and build number, language and region settings, time zone information, timestamps, and information on errors that have occurred and the app events immediately preceding them. The data are processed exclusively for the purpose of analysing, rectifying and preventing technical faults, as well as ensuring the secure and trouble-free operation of the app. The processed data are treated as pseudonymous personal data.
The technical error analysis is carried out by a selected service provider.
The processing of your personal data is based on Article 6(1)(f) of the GDPR. Our legitimate interest is to provide a secure, stable and trouble-free authentication application.
Local storage and device functions
Activation and authentication data are stored in encrypted form on the mobile device. On iOS, storage takes place primarily within the protected app container and, in some cases, in the iOS Keychain or the Secure Enclave. On Android, the data are secured via a protected application storage area and the Android Keystore.
The camera is used to scan QR codes during activation. Biometric features such as Face ID, Touch ID or fingerprint recognition can be used optionally to protect the PIN. The biometric data are processed by the operating system and are not transmitted to Aareal Bank AG. Location, microphone, contacts, photo library and Bluetooth are not used for this purpose.
App security and protection mechanisms
The app employs technical protection mechanisms to secure the authentication process. These mechanisms verify the integrity of the application and detect signs of tampering with the operating system or unauthorised interference with the runtime environment, for example on jailbroken devices or where programme libraries have been injected. If security-related tampering is detected, the app may terminate its execution or prevent the use of individual functions.
To protect confidential authentication information, the app can detect, restrict or prevent screen captures, screen recordings and playback on external screens.
The app shielding functions are executed entirely locally on the mobile device. Apart from the error and crash analysis described, there are no further connections to external systems. In particular, no licence, update, analytics, telemetry or other diagnostic requests are made.
Push Notifications
If push notifications are enabled, the Apple Push Notification Service is used on iOS and Firebase Cloud Messaging is used on Android. Device tokens are in each case converted into a notification identifier on the device. Only this identifier is transmitted to the configured backend. Push notifications are used to deliver authentication and signature requests.
4. Rights of the data subject
With respect to the processing of your data, you have the right, subject to the relevant legal requirements,
· according to Article 15 of the GDPR, to request information from us about your data that we process as well as other specific information;
· according to Article 16 of the GDPR, to request the immediate rectification of incorrect data and the completion of incomplete data stored by us;
· according to Article 17 of the GDPR, to request the deletion of data stored by us if there are grounds for deletion and we do not have a right or obligation to retain the data;
· according to Article 18 of the GDPR, to request the restriction of processing of your data;
· according to Article 20 of the GDPR, to receive your data that you have provided to us in a structured, commonly used and machine-readable format or to request the transmission of the data to another controller (data portability).
Right to withdraw consent
If your data is processed in accordance with Article 6(1)(a) GDPR (consent), you may, pursuant to Article 7(3) GDPR, withdraw your consent at any time. Please note that withdrawal of consent will not affect the lawfulness of processing performed based on consent prior to withdrawal.
Right to object
If your data are processed based on Article 6(1)(e) of the GDPR (public interest) or Article 6(1)(f) of the GDPR (protection of legitimate interest), you have the right, pursuant to Article 21(1) GDPR, to object, on grounds relating to your particular situation, at any time to the processing of personal data. If you object, we will no longer process your data, unless we can provide compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves to establish, exercise or defend legal claims.
You can assert any of the rights outlined in this section 4 – including the right to object – in any format. To do so, please contact us by post at
Aareal Bank AG
Paulinenstrasse 15
D - 65189 Wiesbaden
or by e-mail at
datenschutz(at)aareal-bank.com
5. Right to Lodge Complaint with Supervisory Authority
If you believe that we have not processed your data in accordance with applicable law, you also have the right to lodge a complaint with the relevant supervisory authority. The authority responsible for our company is:
Hesse Commissioner for Data Protection
and Freedom of Information
Wilhelmstrasse 7
65185 Wiesbaden
6. Disclosure of Data
Within Aareal Bank AG, your data can be accessed by the departments that need this data for the aforementioned purposes or to perform their other duties and obligations.
Your data can also be accessed by the following providers whose services we use:
| Recipient | Category |
| Service providers for technical fault and stability analysis | Analysis and resolution of technical errors and system crashes |
| Apple Push Notification Service | Optional delivery of push notifications to iOS devices |
| Firebase Cloud Messaging | Optional delivery of push notifications to Android devices |
| Technical service providers of Aareal Bank AG | Operation and integration of the backend systems required for activation, authentication and authorisation |
Where service providers process personal data on behalf of Aareal Bank AG, this is done on the basis of the applicable data protection agreements.
In all other cases, we will share your personal data only if we are required to do so by law or to comply with regulatory obligations. Subject to these requirements, public bodies and institutions, such as Deutsche Bundesbank, the German Federal Financial Supervisory Authority (BaFin), the European Banking Authority (EBA) and the European Central Bank (ECB), may receive your personal data.
7. Third-Country Transfers
In connection with technical error and stability analysis, as well as the optional use of Apple and Google’s push services, the processing of personal data may take place in the United States of America. Where personal data are transferred to the United States, this is done on the basis of the European Commission’s adequacy decision pursuant to Article 45 of the GDPR. Further information on the safeguards employed by us can be requested using the contact details provided above.
8. Duration of storage
We will delete your data as soon as they are no longer required for the purposes for which they were processed or for retention purposes in the event of any enquiries, and provided there are no longer any statutory retention obligations or legal grounds for processing.
The specific storage duration is as follows:
Type of data | Duration of storage |
| App, user and activation data in the protected application storage | Until the account is deleted or the app is uninstalled. On Android, any remaining app data are removed upon complete uninstallation. |
| iOS Keychain and Secure Enclave entries | Certain technical entries may persist after uninstallation. Legacy data from previous app versions are deleted following successful migration. |
| Technical error and crash data | Data are stored for 90 days for analysis and to resolve technical errors, and are then automatically deleted. |
| Notification identifiers | For as long as the push function is enabled and the identifier is required for the delivery of authentication or signature requests. |
9. Obligation to provide data
The data required for activation, authentication and authorisation must be processed so that the app can be used as intended. Without this data, it is not possible to use the authentication process.
The activation, registration and device information required to activate the authentication process must be provided so that the app can be set up and used.
The use of biometric features is voluntary and can be enabled or disabled by the user.
10. Automated Decision-Making
We do not process your data for the purposes of automated decision-making or to evaluate personal aspects (profiling).
Last revised: October 2026