Privacy Policy

In accordance with and for the purposes of Article 6 of EU Regulation no. 679/16, Articles 13-14, EU Regulation 2016/679 (hereinafter referred to as GDPR). While using our services, you provide us with your information. This process is sensitive, and that's why we are committed to protecting the management of data. Our blockchain tokenization platform aims to authenticate, store, sign, and share documents securely and efficiently. Our application ensures the existence of your document, certifying the document through a timestamp placed on the blockchain. In the blockchain transaction, "ownership" of the document is attributed through a public and private key generated for you at the time of registration, which guarantees the process. The private key is held by the Controller and stored securely, in encrypted form, using the AWS KMS (Key Management Service) key management service; it is used exclusively for the blockchain operations carried out on the user's behalf and cannot be exported. The registered document thus becomes immutable. Any further modification of the document results in a change of the hash, thus generating a new document (ensuring immutability).

EU Regulation for the protection of personal data no. 679/16 aims to ensure that the processing of your personal data takes place in compliance with the rights to fundamental freedoms and dignity of individuals, with particular reference to privacy and personal identity. Therefore, it is our duty to inform you about our policy regarding the management of data privacy. BLOCKCHAIN ITALIA SRL Via Brembo, 27 – 20139 Milan (MI) VAT No. 10441490967 blockchainitaliasrl@legalmail.it - as Data Controller, in the person of its legal representative, informs you, pursuant to and for the purposes of Articles 13-14 GDPR, that your data will be processed in the following manner and for the following purposes:

BLOCKCHAIN ITALIA Srl undertakes to respect and protect the personal data voluntarily and explicitly provided by you in compliance with legal provisions aimed at ensuring the security, accuracy, updating, and relevance of the data concerning the contractual purposes defined. Personal data provided by customers are used solely for the purpose of executing the signed service contract and are disclosed to third parties only if strictly necessary and functional to that purpose. The data are processed by appointed personnel (and designated sub-processors contractually appointed) for data processing, only when processing is necessary for the performance of the requested service.

1. Subject of the processing

The Controller processes your personal data in terms of application (registry data, documents, signatures, payments). The contents of your documents to be processed have a high degree of inviolability. The application provided by the Controller processes the following categories of personal data:

• identification and contact data: first name, last name and email address provided at registration;
• authentication credentials: the password, stored exclusively in a non-reversible encrypted form (hash);
• profile picture, if uploaded by the user;
• blockchain data: the wallet address generated at registration and the identifier of the digital identity associated with the account (TokID);
• document data: name, description, size, type and fingerprint (hash) of the tokenized files, the signatures applied and, only if the user chooses to store it, the file itself;
• third-party data provided by the user: the email addresses of the people invited to sign a document, which are visible to the other participants in the same document;
• payment and subscription data: payments are handled by Stripe, which processes the card or payment method data; the Controller keeps the Stripe customer identifier and the details of the subscribed plan (period, quotas and usage);
• identity verification data, where the service is available and activated by the user: the verification outcome and the verified phone number, used to send signing OTP codes; the identity documents and images required for the verification are collected directly by the verification service provider;
• technical data: IP address and request information recorded in technical logs and used to protect against abusive access, as well as technical cookies needed for the application to work (session, security and language).

External banking systems are responsible for managing the data we convey. To assert your rights as data subjects, you must directly contact them. We guarantee support in accessing contacts with such providers. The data communicated by you, mandatory for the performance of the service subscribed between the parties, are necessary for the use of the application. The platform is not designed to monitor, classify, and/or store "special data" (Art. 9 GDPR), including race or ethnicity, religious or philosophical beliefs, life and sexual orientation, political opinions, trade union membership, health information.

2. Purpose of the processing

Your personal data are processed:

A) without your express consent (ex art. 6, c.1 GDPR) for the following service purposes:

• collecting data for the formulation of service offers;
• fulfilling pre-contractual, contractual, and tax obligations resulting from existing relationships with you;
• fulfilling obligations required by law, regulations, EU legislation, or orders from authorities;
• exercising the rights of the Controller, such as the right to defend itself in court;

B) only with your specific and distinct consent (ex art. 7 GDPR), for the following marketing purposes:

• sending you via email, mail and/or SMS and/or telephone contacts, newsletters, commercial communications and/or advertising material on products or services offered by the Controller and assessing the satisfaction level regarding the quality of the services;

We inform you that if you are already our customer, we may send you commercial communications related to services and products similar to those you have already used, unless you dissent.

3. Legal basis of the processing

The legal basis for processing lies in the execution of contractual measures specifically requested by the company/professional Concerned who intends to use the application provided by the Controller (Art. 6 EU Reg. 2016/679 lett. B). With regard to the fulfillment of legal obligations (such as those of a fiscal nature), the legal basis for processing concerns precisely the fulfillment of these obligations (Art. 6 EU Reg. 2016/679 lett. C). For statistical analysis and internal management control of the Controller, processing will take place on the legal basis of the legitimate interest of the Controller (Art. 6 EU Reg. 2016/679 lett. F).

4. Processing methods

Pursuant to Art. 5 GDPR, the processing of your data will be based on the principles of fairness, lawfulness, and transparency and may also be carried out through automated means aimed at storing, managing, and transmitting them (by means of the operations referred to in Art. 4 no. 2) GDPR and will be carried out using tools suitable to ensure security and confidentiality through the use of appropriate procedures to prevent the risk of loss, unauthorized access, unlawful use, and dissemination. Your personal data are subject to digital processing. The Controller will process personal data for the time necessary to fulfill the aforementioned purposes and in any case for no more than 10 years from the cessation of the relationship for service purposes and obligations imposed by law.

5. Data communication

Other workers and collaborators of the Controller may become aware of the data as data processors, and they may also be viewed by the external subject supervising our IT system and whom our structure has appointed as an external controller; your data may also be communicated to subcontractors, of primary national and international level, who provide – outsourced - support activities to the Data Controller, within the limits established by law. We inform you that all our suppliers are appointed as subcontractors and are subject to a validation and control process in terms of privacy and quality of the requested services. Without the need for express consent pursuant to Art. 6, c.1 GDPR, the Controller may communicate your data for the purposes referred to in Art. 2.A) to Oversight Bodies, Judicial Authorities, as well as to those subjects to whom communication is mandatory by law for the fulfillment of said purposes. Your data will not be disclosed in any other way.

People invited to sign

When a user invites other people to sign a document, the Controller processes the email addresses provided in order to send the signature request. To sign, the invited person must register and read this privacy policy. The inviting user guarantees that they are entitled to provide those addresses. Participants' email addresses are visible to the other participants in the same document; signers' first and last names are shown in the document certificate.

6. Storage times

Your personal data will be kept for the time necessary to fulfill the existing relationships between the parties and in any case not for more than 10 years from the cessation of the ongoing contractual relationship for service provision as required by law. After this period of storage, the data will be destroyed and/or deleted, subject to future communications from the Controller or decisions by authorities under the law.

Storage of data and rights of the data subject

It is possible to delete or update all data about a user (with verification) from our database and from the files stored in the centralized cloud. However, transactions and data recorded on the blockchain and related to the lifecycle of the tokenization process (registration on the blockchain) of a document will remain permanently on the blockchain.

7. Data transfer

The data collected by Blockchain Italia, namely:

• identity and account information
• information on the purchased service, payment, and price
• files and documents

are not transferred outside the EU/EEA, except as stated below. For the purpose of document storage and building our infrastructure, we use Amazon Web Service (AWS), and we ensure that our data centers are located within European regions (availability zones in Europe: Frankfurt; Dublin; Milan; Paris; Aragon; Stockholm). However, Wallet information, transaction information, document hashes are stored on PPB (Public Permissionless Blockchains), so they are always available worldwide. The data subject can exercise their rights against each subcontractor.

Data published on public networks

For each tokenized document, the Controller publishes the document's metadata on the public IPFS network through the provider Pinata: name, description, fingerprint (hash), whether the file is stored, the wallet address and digital identity (TokID) of whoever created and signed the document, and the related signatures. The metadata of the digital identity (TokID) also contain fingerprints (hashes) of the user's email address and of the identifiers of any identity verification, with its outcome. The content of documents is never published. These data, like the transactions recorded on the Algorand blockchain, are publicly accessible worldwide and, once published, may be replicated by third parties and remain accessible permanently. We therefore recommend not entering personal data in the name and description of documents.

Transfers outside the EU/EEA

Some of the providers listed in point 11 may also process data outside the EU/EEA: Stripe (email address and payment data, to manage payments and subscriptions), Pinata (the document metadata described above) and Sumsub (identity verification data, where the service is activated). In these cases the transfer takes place on the basis of the safeguards provided for in Articles 44 et seq. of the GDPR, such as adequacy decisions of the European Commission or standard contractual clauses.

8. Nature of providing data and consequences of refusing to respond

Providing data for the purposes referred to in point 2.A) is mandatory. In their absence, we will not be able to guarantee the requested Services. Providing data for the purposes referred to in point 2.B) is optional. You can therefore decide not to provide any data or to subsequently deny the possibility of processing data already provided: in this case, you will not receive newsletters, commercial communications, and advertising material related to the services offered by the Controller. You will still be entitled to the Services referred to in point 2.A).

9. Rights of the data subject

You have the right to ask the Controller for access to your data, their correction or deletion, the integration of incomplete data, the limitation of processing (file processed within the scope of registration or tokenization on the blockchain); to receive the data in a structured, commonly used, and machine-readable format; to revoke consent given for the processing of your data at any time and to object in whole or in part, to the use of the data; to lodge a complaint with the Authority, as well as to exercise other rights recognized to you under Articles 15-22 of EU Regulation no. 679/16. Please note that, upon request of the user, it will be possible to delete the data concerning them and the documents processed from our encrypted cloud archive and from our systems; however, all transactions related to the lifecycle of such process will remain permanently on the blockchain due to the nature of the technology itself (e.g., tokenization transaction, user wallet address, signature, document hash). Furthermore, Blockchain Italia relies on an external provider (Stripe, Inc.) to manage user payment data. To delete any data sent to Stripe, the customer can assert their rights directly with the subcontractor. You can consult Stripe's Privacy Policy at the link: https://stripe.com/it/privacy

10. Exercise of rights

You can exercise your rights at any time by sending an email to the email addresses segreteria@blockchainitalia.io for data management and dpo@blockchainitalia.io for complaints. The data subject has the right to lodge a complaint with a supervisory authority. If you are no longer interested in BLOCKCHAIN communications and wish to unsubscribe from the newsletter, you can do so by clicking on the "unsubscribe" link at the bottom of each email sent or by sending an email to: marketing@blockchainitalia.io.

11. Data Controller, processors

BLOCKCHAIN ITALIA SRL Via Brembo, 27 – 20139 Milan (MI) VAT No. 10441490967 blockchainitaliasrl@legalmail.it. The Data Controller uses internal data processors and external sub-processors appointed to achieve the purposes specified in point 2 (technical purposes related to service provision and commercial purposes). Among these, in particular, we highlight:

• Amazon Web Services (AWS): storage of documents and profile pictures (Amazon S3), management of the wallets' cryptographic keys (AWS KMS), sending of service emails (Amazon SES) and of SMS messages with signing OTP codes (Amazon SNS);
• Stripe: management of payments, subscriptions and the related customer portal;
• Pinata: publication of the tokenized documents' metadata on the public IPFS network;
• Sumsub: identity verification, where the service is available and activated by the user.

The Algorand blockchain, on which the transactions relating to documents and signatures are recorded, is a public network and is not a data processor: the data recorded on it are public and permanent, as stated in points 6, 7 and 9.

The updated list of controllers, sub-processors, data processors, and data recipients is kept at the registered office of the Data Controller.

12. Commercial communications

The company's commercial approach is expressly non-invasive and has an informative and promotional nature. Our primary desire is to protect the customer to the maximum from any unwanted communications. From the moment you provide your personal data, they will be used to send you commercial communications and notifications regarding new services offered that we believe may be of interest to you. To deactivate the receipt of promotional emails, please follow the instructions in the emails themselves (unsubscribe) or send a communication to the address marketing@blockchainitalia.io.

13. Changes

This information may be subject to changes. If substantial changes are made to the use of customer data by BLOCKCHAIN, this will notify the user by publishing them prominently on its pages.