MConnect mobile - Terms and conditions and Privacy Policy

This Mobile Application, hereinafter referred to as the « MConnect Mobile Application » is operated by the State of Monaco, Digital Service Department (DSN), hereinafter referred to as “The Administration”, which has its head office at 2 rue du Gabian, Immeuble "Les Industries", MC 98000 MONACO.
Director of Publication : Julien DEJANOVIC 

Contact :

• Phone : (+377) 98 98 96 97
• Email address: identitenumerique@gouv.mc

The MConnect Mobile Application of the State of Monaco is hosted by the company TELIS, registered in the Trade and Industry Registry under Trade and Industry Registry number 00S03813, with its head office at 14 Avenue de Grande Bretagne 98000 MONACO. 

Purpose of processing

In accordance with the provisions of the Act no. 1.165 of 23 December 1993 on personal data protection, amended, the information gathered via MConnect Mobile is collected by the State of Monaco/Digital Services Department (hereinafter "the Administration"), acting in its capacity as the data controller.

In this context, the Administration uses the processing of personal data for the purpose of "Enabling the use of the digital identity of Monegasques and residents via a dedicated mobile application".
This processing makes it possible, in particular, to: 

• The authentication service, which provides services enabling users to connect to teleservices/service providers with a substantial level of security;
• The derivation service, which provides the means of deriving the digital identity of a card on a mobile phone;
• The notification service, which provides the communication interfaces between the mobile application and the identity provider.

The processing carried out is justified by the reason of public interest for the State of Monaco, in accordance with the provisions of Act No. 1.483 of 17 December 2019 on digital identity and its implementing texts.
The personal data collected in the context of the processing is gathered indirectly and originates from the processing relating to the "Management of the means of use of digital identity" processed by the Digital Services Department of the State of Monaco

The trusted service provider supplying the M-Road system accesses the information, in strict compliance with the provisions of Act No. 1.483 of 17 December 2019 on digital identity.

2. Processed data

The data processed by the MConnect Mobile application is as follows:

2.1 Identification data

The five digital identity pivot fields (NPDHL):

• Surname
• First names
• Date of birth
• Hour of birth
• Place of birth

The following additional fields:

• Preferred name
• Sex at birth

Any change in the User’s circumstances or status must be communicated and proved by the latter to the Civil Status – Nationality Department at Monaco Town Hall (for Monegasque nationals) and the Residents Section of the Police Department (for residents).

2.2 Additional data

• A digital identity “status” field, which can be active, inactive or suspended
• The registration authority, which can be the Police Department or Monaco Town Hall
• The primary key: obtained by hashing the concatenation of the five digital identity fields (irreversible function).

2.3 Additional information

To enable the MConnect Mobile application to function, the personal information processed is:

• the mobile phone number in order to send notification of connection requests on the mobile application;
• the system connection logs for users and administrators;
• the valide pass code for the mobile application: chosen and entered by the user;

3.    Data subjects

The data processing concerns any user wishing to derive their Monegasque digital identity in the MConnect Mobile application.

4.    Recipients of the data

The Personal Data communicated as part of the derivation of the user's digital identity in the MConnect Mobile application are transmitted to the following recipients: 

• Online services that are partners of the MConnect authentication and electronic signature service, provided that the user explicitly agrees to the transfer of his/her personal data during authentication or electronic signature;
• The technical service provider may need to know this information in order to maintain the application in operational conditions.

5. Duration of data retention

The data collected by the MConnect mobile application is kept until:

• deactivation of the digital identity;
• expiry or revocation of electronic certificates (maximum validity of 3 years);
• uninstallation or reinitialisation of the application.
  Traces of creation, consultation, use, revocation and deletion operations (technical logs) are kept for 1 year.

6. Procedure to delete the data from the MConnect Mobile application

Users may delete their data at any time:

• either by choosing to "reset MConnect Mobile" in the "Settings" section;
• or by deleting the MConnect mobile application from their phone.

7.    Data security and confidentiality

The Administration implements the highest security standards to ensure the security of the application. 

The Application is regularly subject to risk analysis, security audits and compliance with current standards.

8. Protection of personal data

In accordance with current data protection legislation, with regard to their personal data in the Principality of Monaco, users have the right of access; the right to object to processing, as well as the right to request that inaccurate, incomplete or outdated data be corrected, updated or deleted.

To exercise these rights or for any questions about how personal data is processed in connection with MConnect/MConnect Mobile, users can submit a written request stating the subject of their request and their surname, first name and date of birth by post to the following address:

DIRECTION DES SERVICES NUMERIQUES

2 rue du Gabian, Immeuble "Les Industries"

MC 98000 Monaco

Users can also contact the Administration here (directly through the contact form on the website gouv.mc “Government and Institutions” section, then “Ministry of State”, then Digital Services Department)
To ensure that the response remains confidential and that we are replying only to the person whose data is involved, those submitting requests may be asked to provide proof of their identity, in black and white. Users who have exercised their rights but feel, after contacting the Government, that their rights have not been respected, can submit a complaint to the Data Protection Authority of Monaco (Commission de Contrôle des Informations Nominatives - CCINN): www.ccin.mc.

Version in force as of: 09/05/2023

The purpose of these Terms of Use is to set out the procedures for using and browsing the MConnect Mobile app.

They apply to all Users who access the application. By continuing to use this application, each User is assumed to have accepted these terms of use unreservedly.

The User confirms that he/she has read and understood these terms of use in their entirety before using any of the Services offered by this mobile application and undertakes to comply with them.

1.Definitions

The following words and phrases, beginning with a capital letter, whether used in the singular or plural, are employed herein with the meanings specified below:

Administration means the Government of Monaco (Digital Services Department)

Mobile Application or Application or MConnect Mobile means the mobile application (which can be downloaded from app stores: Google Play Store et Apple App Store) that allows users to share their digital identity using their smartphone

Card or Permit means a Monegasque identity card or the Monegasque Residence Permit

MConnect means the technical solution offered by the Principality of Monaco to enable users to log into online services using their digital identity

Sharing an Identity with a Mobile Phone means the activation of a digital identity on a smartphone. Having activated their digital identity using their card, users may, if they wish, also activate their digital identity on their mobile phone. There are two ways of Sharing an Identity with a Mobile Phone:

• Activating the digital identity on the mobile phone using near-field communication (NFC), by touching the activated card to the NFC reader on the smartphone;
• Activating the digital identity on the mobile phone by scanning a QR code at an Interactive Terminal.

Identity provider means the approved provider (State of Monaco) of verified data enabling users to prove their identity when using online services. MConnect is the identity provider

Service provider means partner organisations (public and private) offering an online service to Users. An Online Service is a service provider

Online Service means the provider of an online service made available by a private or public organisation

Authentication means the process of verifying a User’s identity, which makes it possible to determine whether a request for access is legitimate

Terms of use means these terms of use

Personal Data means any information relating to an identified or identifiable individual (“person concerned”). An “identifiable individual” is considered to be any individual who may be identified, directly or indirectly, including through reference to an identifying detail such as a name, an identification number, location data, an online username, or one or more attributes specific to his or her identity;

Services or Functions means the services offered by the Application, as follows:

• viewing the terms of use
• activating the digital identity shared to a mobile phone
• authenticating using the digital identity shared to a mobile phone
• displaying the list of Online Services that allow authentication via a digital identity
• changing the Valid Pass Code for the MConnect Mobile app
• activating or deactivating the unlocking of the MConnect Mobile Application with the biometric authentication system chosen by the user on his smartphone
• revoking data in the MConnect Mobile app (deletion of data)

User means any Monegasque national or resident who has an identity card or residence permit, respectively, with an activated digital identity

Interactive Terminal means a platform for activating and managing digital identities once they have been issued. There is an Interactive Terminal at Monaco Town Hall (Civil Status – Nationality Department) and another in the Police Department (Residency Section). Interactive Terminals can also be used to share a digital identity with a mobile phone by scanning a QR code which is displayed once the User has been authenticated at the Interactive Terminal

Activation Code means the code received by text message that allows the digital identity to be activated on the mobile phone. It is a single-use code which is valid for a maximum of 15 minutes

Valid Pass Code means a six-digit code which unlocks the MConnect Mobile app

PIN means the five-digit PIN for the Card or Permit.

2. Purpose of the MConnect Mobile app

The MConnect Mobile app allows Users to take advantage of the Services.

3. Access to the mconnect mobile app

The procedures for accessing the Application are as follows:

Prerequisites:

• Have access to the internet from your smartphone
• Hold a valid Card or Permit issued by Monaco Town Hall or the Police Department Have activated your digital identity: with the official who issued your Card or Permit on collection from Monaco Town Hall (Civil Status – Nationality Department) or the Police Department (Residency Section), or at a dedicated Interactive Terminal available in the two locations where Cards and Permits are issued
• Have to hand the Card or Permit from which the digital identity was activated
• Have to hand your PIN
• Have downloaded the MConnect Mobile app
• Have accepted these Terms of use
• Have selected your preferred method for Sharing an Identity with a Mobile Phone.

3.1 How to install and set up the MConnect Mobile application

The procedures for sharing your identity are as follows:

Sharing an Identity with a Mobile Phone method 1: Sharing an Identity with a Mobile Phone by scanning a QR code at an Interactive Terminal

Prerequisites: Have a smartphone that can scan the QR Code displayed on the interactive terminal after User Authentication on the terminal

Steps:

• Go to an Interactive Terminal
• Log into the Interactive Terminal using your Card and your PIN
• Make sure you have a smartphone capable of scanning the QR code which is displayed once the User has been authenticated at the Interactive Terminal
• Scan the QR code
• Enter your personal (not work) mobile phone number
• Enter the Activation Code you received by text message
• Create the six-digit valid pass code

Sharing an Identity with a Mobile Phone method 2: Sharing an Identity with a Mobile Phone using near-field communication (NFC)

Prerequisites: Make sure you have a smartphone with contactless (NFC) capability
Steps:

• Create the six-digit valid pass code
• Allow unlocking by biometric authentication (Touch ID/Face ID for IOS) if applicable
• Enter your personal (not work) mobile phone number
• Enter the Activation Code you received by text
• Enter the PIN for the Card
• Read the Card with your smartphone using near-field communication (NFC)

3.2 How to unlock the MConnect Mobile Application:

To unlock the MConnect Mobile Application, the User authenticates himself by entering his six-digit valid pass code chosen during the installation.

The MConnect Mobile Application can also be unlocked using the biometric authentication feature (fingerprint recognition or facial recognition by the User's smartphone). To do so, the User's smartphone must have the biometric recognition functionality, and this functionality must be first activated by the User on his/her smartphone.
When the Application is unlocked by biometric authentication, the validation is carried out by the smartphone. No biometric data are processed by the MConnect Mobile Application. In the same way, no personal data are transmitted by the MConnect Mobile Application to the smartphone.
In the event of failed authentication with the biometric authentication functionality, the User still have the possibility of unlocking the MConnect Mobile Application with six-digit valid pass code from the Application.
The User may at any time choose to activate or deactivate the unlocking by biometric authentication feature in the "Settings" menu of the MConnect Mobile Application.

3.3 Use of the MConnect Mobile Application:

Use of the MConnect Mobile app is optional. With the exception of any connection fees, access to the content of the MConnect Mobile app is free.

It is understood that all Users must have access to the internet. This shall not constitute grounds for reimbursement.

The Administration reserves the right to modify and/or temporarily or permanently remove all or part of the MConnect Mobile app at any time.

The Administration cannot be held liable in this respect.

The Administration reserves the right to withdraw, without warning or compensation of any kind, any access to the MConnect Mobile app in the event of unlawful use or infringement of the rights of Persons and, more broadly, of third-party interests.

Users must apply all of the appropriate precautions and security measures to the access and authentication procedures.

Users undertake to assume full responsibility, control and direction for complying with said access and authentication procedures, and agree not to appropriate the identity of a third party.

Users must memorise their PIN and valid pass code, which they will need to access the MConnect Mobile app or any Online Services that they use. These codes must never be kept in plain text or close to the Card or Permit to which they relate.

Users who forget their PIN will need to visit a dedicated Interactive Terminal, where they can unlock or reset their PIN. The procedure for recovering their details will then be explained to them.

Users who forget their valid pass code will need to reactivate their digital identity on their mobile phone via NFC or at an Interactive Terminal by scanning the QR code as described above.

It should be noted that the PIN and valid pass code are personal and confidential and should never be shared with third parties.

Users undertake to change their PIN or valid pass code immediately if they suspect that their Account has been used fraudulently.

Users undertake to inform the Administration straight away of any unauthorised use of this information. The Administration cannot be held liable for any damages caused by the use of the PIN or valid pass code by an unauthorised third party.

Users who wish to inform the Administration of a mistake or correction are asked to send an email to the following address: identitenumerique@gouv.mc.

4. Data retention

4.1 Identification data

The five digital identity pivot fields (NPDHL):

• Surname
• First names
• Date
• Hour
• Place of birth

The following additional fields:

• Preferred name
• Sex at birth

4.2 Additional data

• A digital identity “status” field, which can be active, inactive or suspended
• The registration authority, which can be the Police Department or Monaco Town Hall
• The primary key: obtained by hashing the concatenation of the five digital identity fields (irreversible function).

The identification data of the digital identity (Preferred name, surname, first names, date of birth, place of birth and sex at birth) are stored in the mobile application until the digital identity is deactivated or the application is uninstalled.

5. Commitment relating to use of the application and associated content

The user undertakes not to commit, on this app, any unlawful act or toinfringe human rights or more generally to cause prejudice to third party interests.

These general terms of use prohibit any act which could tarnish the name and/or the image of the State of Monaco, or damage, overload, disable, discredit or compromise the app.

In particular, the following are prohibited: the transmission by email or any other means of content whose purpose is to persecute, harass, defame, discriminate or abuse; or any other dissemination of information or opinion of a personal nature relating to one or more individuals, or infringing human rights.

Correspondence with the Administration must be courteous in nature at all times and comply with the basic rules of politeness.

6. Application security

The Application requires a sufficiently fast internet connection and equipment and resources enabling Users to access and browse the Application at their own expense and responsibility.
The Application can be downloaded from the Apple Store from iOS 13 and up, and on Google Play from Android 6.0 and up.

The Application can be downloaded in any country.

The User is aware of the risks associated with using the internet and accepts the corresponding limitations and risks.

The Administration makes every effort to secure the Application with regard to the risks involved and the nature of the data which is processed.

Users are prohibited from fraudulently accessing or continuing to visit all or part of the Application, deleting or changing the information included on the Application, fraudulently adding information, altering the Application, or interfering with its proper functioning.

Users shall not attempt to make changes to or manipulate the pages of the Application in such a way as to conceal, hijack or modify the latter.

It is strictly prohibited for Users to: (i) reproduce, modify, adapt or alter the Application and/or its contents; (ii) access or seek to access the Application’s source code using decompilation, reverse engineering or any other technique or method; (iii) make accessible or send parts of the Application or content to which access is restricted to third parties; (iv) use or attempt to use Accounts other than those attributed to the User, or to mask his or her identity or to appropriate the identity of a third party; (v) use the Application for an unlawful purpose, to which end Users undertake not to include any false, incomplete or inaccurate information, or any virus, Trojan horse, worm, time bomb or any other program designed to damage, produce a harmful effect, intercept or block any system, data or personal information.

Where necessary, Users must have a secure connection or network and an up-to-date operating system to protect, as far as possible, the Administration from any damage relating to insecure use of the Application. Users shall take all appropriate measures to protect their data and equipment, and they are responsible for the security of their data and network, which they use at their own risk.

In the event that the User is aware of an event that could damage the security of the Application, such as an error, fault, malfunction, hacking, loss of data, vulnerability or irregularities, they are invited to get in touch with the Administration immediately by emailing: identitenumerique@gouv.mc.

7. Intellectual property

7.1 Copyright

All of the rights associated with any content published on this Application belong exclusively to the Administration, except where it is explicitly indicated that the rights belong to a third party. This includes, but is not limited to, all texts, comments, titles, names, photographs, sounds, images, data, drawings, animated sequences with sound, videos, functionality and charts, which are protected by the legislation on copyright protection in force in Monaco.

Any use, representation, transformation, reproduction, adaptation or dissemination, in whole or in part, of any element or content from this Application on any media and via any procedure is prohibited and constitutes a criminal offence that will be punished by the Monaco courts, unless express permission is obtained from the Administration.

7.2 Trademarks

Trademarks and/or logos belonging to the Administration and appearing on this Application are protected trademarks under the legislation that applies in Monaco. Any reproduction of these trademarks and/or logos, in whole or in part, without the permission of the owner, is a criminal offence punishable by the Monaco courts.

8. Liability

The Application must not be used in an abusive or malicious way. Generally speaking, Users undertake to use the Application:

• In compliance with the laws and regulations of Monaco, the rights of third parties, and intellectual property rights
• fairly and in accordance with their intended purpose
• at their own risk

Users acknowledge and accept that, with regard to the Application and Services, the Administration may not be held liable in the event of hacking, alteration or misuse of data, or any use of the network by a third party that is unlawful or harmful to the User or to a third party. Users who wish to inform the Administration of a mistake or correction are asked to send an email to the following address: identitenumerique@gouv.mc.

The Administration gives no guarantee, implicit or explicit, regarding the operation and/or the content of the app and may not under any circumstances be held liable for any damage, whether direct or indirect, commercial or otherwise, or consequences such as the theft of the User’s identity or that may result from an erroneous or obsolete publication that may appear on this Application.

The Administration shall endeavour to ensure that the information published on this Application remains accurate and up to date, but accepts no responsibility for any use made of information featured on the Application.
The Administration does not guarantee the continuity, accessibility or availability of the online service or related services.

Users of the Application are required to comply with these Terms of use and are prohibited from using or attempting to use the Application and its Functions for any purpose other than those provided for under these terms of use.

These terms of use may also be amended at any time, without warning, in accordance with modifications made by the Administration, changes in legislation, or for any other reason deemed necessary. It is the responsibility of the User to read and accept these terms of use when they are published in order to continue to use the Application.

9. Protection of personal data

In accordance with the provisions of the Act no. 1.165 of 23 December 1993 on personal data protection, amended, the information gathered via MConnect is collected by the State of Monaco/Digital Services Department (hereinafter "the Administration"), acting in its capacity as the data controller.

In this context, the Administration uses the processing of personal data for the purpose of " Providing trusted services for digital identity".
This processing makes it possible, in particular, to
•    The authentication service provides services that enable the user to connect to online services/service providers in line with a requested level of security
•    The signature/timestamp service offers services enabling the certified electronic signature of documents
•    The derivation service, which provides a means of deriving the digital identity of a card on a smartphone
•    The notification service, which provides the communication interfaces between the mobile application and the identity provider

The processing carried out is justified by the reason of public interest for the State of Monaco, in accordance with the provisions of Act No. 1.483 of 17 December 2019 on digital identity and its implementing texts.
The personal data collected in the context of the processing is gathered indirectly and originates from the processing relating to the "Management of the means of use of digital identity" processed by the Digital Services Department of the State of Monaco

The trusted service provider supplying the M-Road system accesses the information, in strict compliance with the provisions of Act No. 1.483 of 17 December 2019 on digital identity.
In accordance with current data protection legislation, with regard to their personal data in the Principality of Monaco, users have the right of access; the right to object to processing, as well as the right to request that inaccurate, incomplete or outdated data be corrected, updated or deleted.

To exercise these rights or for any questions about how personal data is processed in connection with MConnect/MConnect Mobile, users can submit a written request stating the subject of their request and their surname, first name and date of birth by post to the following address:

DIRECTION DES SERVICES NUMERIQUES

2 rue du Gabian, Immeuble "Les Industries"

MC 98000 Monaco

Users can also contact the Administration here (directly through the contact form on the website gouv.mc “Government and Institutions” section, then “Ministry of State”, then Digital Services Department)
To ensure that the response remains confidential and that we are replying only to the person whose data is involved, those submitting requests may be asked to provide proof of their identity, in black and white. Users who have exercised their rights but feel, after contacting the Government, that their rights have not been respected, can submit a complaint to the Data Protection Authority of Monaco (Commission de Contrôle des Informations Nominatives - CCINN): www.ccin.mc.

10. Communication of information

Any change in the User’s circumstances or status must be communicated and proved by the latter to the Civil Status – Nationality Department at Monaco Town Hall (for Monegasque nationals) and the Residents Section of the Police Department (for residents).

11. Hyperlinks

The creation of hyperlinks to the Application or the referral to other external or third-party websites via the Application are subject to prior approval from the Administration. The Administration reserves the right to request removal of all existing links which contravene this condition.
The Administration’s MConnect Mobile app may contain hyperlinks to external or third-party websites. The Administration does not control these websites and may not under any circumstances be held liable in any way for the content published on these external or third-party websites.
The Administration may not be held responsible for any damage or losses that may result from or be connected with the use of these external or third-party websites. Users of the Application bear full responsibility for and assume the risks of using these external or third-party websites. The Administration may not be held liable in any way.

All Users of the Application are invited to contact the Administration by email (identitenumerique@gouv.mc) if they encounter a link which does not work.

12. Competent jurisdiction

Any dispute related to use of the MConnect Mobile app shall be subject to Monegasque law, and the Monegasque courts shall have exclusive competence.
In the event of a dispute relating to the interpretation, formation, validity or execution of the Terms of use, or use of the Application, the Administration and Users expressly acknowledge that only Monegasque legislation and regulations are applicable.
If a dispute cannot be resolved amicably, the Administration and Users give express and exclusive competence to the Monegasque courts.