Privacy Policy & Cookie Policy

The data controller is Informatica in Azienda, represented by Dott. Emanuel Celano, registered address Via Vaccaro 5, 40132 Bologna, Italy, VAT IT02137271207.

Email: info@informaticainazienda.it - Phone: +393771151946

This policy applies to the EVIDE platform at app.certifywebcontent.com, to the EVIDE API, to the EVIDE Mobile app and to the EVIDE public registry. It applies to users of the platform, to other persons whose personal data are contained in deposited content and to persons whose data are recorded for the Linked Responses function (for example persons designated to decide on revocations, verifiers and holders of the organization's contact addresses). The EVIDE Governance Lab (lab.certifywebcontent.com) has its own privacy notice. The terms of the service are set out in the Service Conditions.

Account and identity data: first name, last name, email address, DAPI number and DAPI certificate reference, preferred language, organization and role within it, account status (active, deactivated or closed), dates of registration, verification and last sign-in. DAPI data come from the DAPI identity certification, which is also operated by Informatica in Azienda.

Authentication data: one-time sign-in codes (stored only in hashed form), the session cookie, mobile access tokens (stored only in hashed form) with device name, platform, app version, last IP address and revocation status, API keys (stored only in hashed form) with their plan, usage and the record of acceptance of the Service Conditions (date, IP address, version and digest of the accepted text).

Intake data: the canonical intake record (submitted payload or structured data, declarations, names and roles entered by the user, the evidentiary profile computed by the platform, the intake hash, the UTC timestamp and the evide_id), uploaded content (files, ZIP archives, URLs or texts stored as files) and its metadata (name, size, type and hash).

EAR and ESB records: Evidentiary Artifact Record versions and their hashes; Epistemic Stabilization Buffer observations, declarations, events and closure records.

Certification data: FEDIS requests, quotes and decisions, the status history of the request, messages exchanged with the certifier and the platform records referenced by an issued FEDIS (FEDIS code, certified hash, EAR reference). For FEDIS-LINKED documents: the technical emission record, its number in the series, the link to the intake, the fingerprint of the snapshot and the outcome of the checks performed when the document was generated.

Linked Responses data: the data in this block and in the register of access changes are processed when the related functions are active on the platform.

• invitations: the inviting user; the record the invitation refers to and the organization that holds it; first name, last name and DAPI number of the recipient as entered by the inviting user; the visibility chosen; dates of creation, expiry and revocation. The invitation link is stored only in hashed form;
• declarations of the inviting user (sharing and authorization) and the FAST REVIEW representation of the record made available to the recipient, with their digests. The recipient does not receive the full record or the external documents the record cites;
• responses: the position declared by the recipient on the representation of the record, not on the whole record; any motivation and reservation written by the recipient (a motivation is required in order to dispute) and the relation to an earlier response of the recipient, which remains preserved; name and DAPI number at the time of the deposit; any declared role; declaration of having taken note of the summary; date and digests. EAR-LINKED is the EAR document that documents the response;
• invitation events observed by the server: requests to open the link that the server receives, including with an account other than the recipient's or on a suspended invitation; representations produced by the server; declarations of having taken note of the notices. These events do not prove that a page was displayed on the device, read or understood;
• revocation of invitations: direct revocations by the inviting user or by an owner or admin of the organization, with the reason given; revocation requests (requester, observed role, reason, description, urgency); suspensions; decisions, with the decider and the elements on which they are based; notifications sent and their delivery attempts;
• review authority: metadata of title documents received (type, declared sender and role, channel, date of receipt, digest and reference to the place where the document is kept, not the document itself); name and DAPI number of the designated person, with the period of the designation; who recorded these data; verifications (verifier, method, source examined, declared outcome, digest and reference of the evidence); the organization's email or PEC contact addresses used for alerts;
• FEDIS-LINKED (when the function is active):
  • the immutable snapshot of the relevant records, formed when the depositor of an intake requests a FEDIS-LINKED. For includable responses it contains the response data listed above: name and DAPI number at the time of deposit, any declared role, positions, motivations, reservations, visibility, dates and fingerprints, and the date of any later revocation of the invitation. For non-includable responses and for invitations it contains only identifiers, the recipient's DAPI number, dates, status and fingerprints, without names or content. It also contains the descriptive counts reported in the document;
  • the notices sent to respondents when a document including their response is issued: recipient, response, emission, delivery outcome;
  • suspensions of new emissions while an objection is assessed: response concerned, case reference, opening and closing dates, no content of the objection.
  Before the free-text fields (motivation, reservation, role), respondents are warned not to enter health data or other special categories of data, unnecessary data about other people, or confidential information that is not relevant. The platform is not designed to process special categories of data; the warning is not a legal basis for processing them.
• technical registers: technical observations of requests (user, mobile session, function called, channel, result, declared app version; no IP address and no free text); registers that prevent the same action from being recorded twice; deposit preparations that were not used.

Register of access changes: every request to add or remove an organization membership, to close or reactivate an account, to deactivate or reactivate a DAPI identity on EVIDE or to suspend or reactivate an organization is recorded with its time, outcome (executed, refused or without effect), the person concerned (identifier and DAPI number), organization, role before and after, who acted and under which authorization, and the originating function. The resulting alerts to the EVIDE administrator contain only counts and internal identifiers.

Public registry data: for published entries only, the data described in Section 8.

Logs and security data: API request logs (API key, endpoint, IP address, request hash, result, error and processing time), application logs, web server logs, counters used to limit sign-in attempts and API requests.

API idempotency records: when an API request is sent with an idempotency key, the platform records the API key used, the key chosen by the client system, the endpoint, a SHA-256 fingerprint of the request, the status and times of processing, the internal reference to the intake or buffer concerned and a copy of the response returned. For a deposit, that copy contains the data returned by the API, which may include declarations and other intake data described above. These records are used only to recognise a repeated request and return the same outcome; they are not part of the evidentiary record and are not included in hashes, EAR versions or FEDIS documents.

Billing data: billing details provided by the user or the organization (for example name, company, address and tax identifiers), plans and packages purchased, usage, billing events and invoices.

Communications: emails and requests sent to Informatica in Azienda, including support requests and requests to exercise rights or to delete data.

Personal data of third parties: deposited content may contain personal data of persons other than the user (for example persons named in a document, a screenshot or a declaration). Informatica in Azienda does not select these data: they are chosen by the user who makes the deposit.

Account and authentication data are necessary to use the platform; without them the service cannot be provided. The platform is not designed to process special categories of personal data: users should not deposit them unless they have a specific legal basis to do so.

Providing the service (account, sign-in, intakes, EAR, ESB, FEDIS, API, mobile app, support and, where the user requests it, publication in the public registry): performance of a contract or of pre-contractual steps requested by the user (Article 6(1)(b) GDPR). This includes recognising API requests repeated with an idempotency key, so that the same request takes effect only once.

Linked Responses:

• creating invitations, making available the FAST REVIEW representation generated from the record indicated by the inviting user, according to the applicable template, recording responses and EAR-LINKED, revocation requests, suspensions and decisions: performance of the contract with the inviting user, with the responding user and with the users who request or decide a revocation (Article 6(1)(b) GDPR);
• forming the snapshot, documenting responses in a FEDIS-LINKED requested by the depositor of the intake, and notifying respondents:
  • for the data of the requester: performance of the contract (Article 6(1)(b) GDPR);
  • for the data of respondents and of the other invitation recipients: the legitimate interest of the depositor in documenting the responses received in a verifiable way and of Informatica in Azienda in providing that documentation (Article 6(1)(f) GDPR).
  Only responses deposited after the recipient was shown a notice describing FEDIS-LINKED are documented with their content; for the other responses and for invitations without a deposit, only counts are reported. Acknowledging the notice is not consent;
• processing the recipient data entered by the inviting user and the data of designated persons, verifiers and the organization's contact addresses, and documenting who was admitted to decide on revocations and on which elements: legitimate interest of Informatica in Azienda, of the organizations and of the users involved in controlled sharing and documented revocation decisions (Article 6(1)(f) GDPR);
• register of access changes and technical registers: legitimate interest in a secure service and in documenting who could act for an organization at a given time (Article 6(1)(f) GDPR); the technical registers also prevent duplicate deposits (Article 6(1)(b) GDPR).

Accounting, tax and other legal obligations, including responses to orders of competent authorities: compliance with a legal obligation (Article 6(1)(c) GDPR).

Security of the platform and prevention of abuse (authentication, logs, request limits): legitimate interest of Informatica in Azienda and of users in a secure service (Article 6(1)(f) GDPR).

Retention of evidentiary records after the service has ended, so that deposits, FEDIS documents and linked responses can still be verified, and the establishment, exercise or defence of legal claims: legitimate interest of Informatica in Azienda and of users (Article 6(1)(f) GDPR), within the limits and periods described in Section 9 and without prejudice to the right to object and to request erasure.

Service communications, including notices of changes to the Service Conditions and to this policy: performance of the contract and legitimate interest (Article 6(1)(b) and (f) GDPR).

Personal data are not used for marketing or profiling. The evidentiary profile computed by the platform describes a deposited record; it is not a decision about a person producing legal effects within the meaning of Article 22 GDPR. Users who deposit personal data of third parties are responsible for having a legal basis to do so.

Informatica in Azienda does not sell, trade, rent or license deposit contents to third parties for their own purposes, and does not reuse them for advertising, other commercial purposes, unrelated research or third-party purposes. Deposit contents are not used to train, fine-tune or evaluate AI models, either its own or those of third parties. The platform does not transmit deposit contents to external AI services; Informatica in Azienda does not provide them to external AI services that it uses manually unless they have been anonymised or the user has authorized it in writing for a specific purpose. Access to deposit contents is limited to the persons who need it to provide the service. These commitments are set out in Section 7 of the Service Conditions and do not prevent processing by the providers listed in Section 7 below or disclosures required by law.

Informatica in Azienda acts as controller for account, authentication, security, log, billing and communication data, for the public registry and for the evidentiary records it keeps, including Linked Responses records and FEDIS-LINKED snapshots, in order to provide the service and to allow the later verification of deposits and FEDIS documents.

For personal data of third parties contained in content deposited by a customer, the role of Informatica in Azienda depends on the relationship with that customer. Where a customer, such as an organization, deposits content for its own purposes and Informatica in Azienda processes it only on that customer's behalf, Informatica in Azienda acts as processor (Article 28 GDPR) and the processing must be governed by a data processing agreement. Customers who need such an agreement should contact info@informaticainazienda.it before depositing personal data of third parties.

Organizations and former members. Intakes deposited for an organization are accessible to its current members. A member who leaves the organization keeps read-only access to the intakes he or she personally deposited for it, limited to the intake, its EAR versions, the evidence still stored and the current status of the request; that member has no access to messages, status history, quotes or other economic details, nor to other intakes of the organization. Former members who did not make the deposit have no access to it. This limited access is based on the legitimate interest of the depositor, who is identified in those records, and of Informatica in Azienda in allowing the depositor to verify the deposits attributed to him or her (Article 6(1)(f) GDPR); it does not allow any new operation on behalf of the organization (Service Conditions, Section 7.6).

Personal data may be processed by:

• Hosting provider: Aruba S.p.A., on servers located in Italy, acting as processor for hosting and backup.
• Email: emails are sent through the mail server of Informatica in Azienda, which runs on the same hosting infrastructure.
• Qualified trust service providers: when a FEDIS is issued, the certifier applies a qualified electronic signature and a qualified electronic time stamp through a qualified trust service provider, which processes the document or its digest in accordance with its own role under Regulation (EU) 910/2014 (eIDAS).
• Recipients chosen by the user: persons to whom the user delivers a FEDIS or other records. A FEDIS-LINKED is delivered to the requester, who may hand it to third parties and is responsible for the uses and communications made of it (Service Conditions, Section 7.8). The document reports the data of the included responses regardless of the visibility chosen for the response on the platform.
• Linked Responses participants: the recipient of an invitation sees the FAST REVIEW representation generated from the record indicated by the inviting user, according to the applicable template, and the invitation information. The response, with the name, DAPI number and any declared role of the responding user, is visible to the inviting user only while that user has access to the record under the applicable rules (for an organization record, while he or she is a current member) and, where the inviting user has chosen this visibility, to the current members of the organization that holds the record; former members do not see it. The other members of the organization do not receive the FEDIS-LINKED or the snapshot through the platform, and do not see the summary of responses, which is shown only to the depositor of the record. Current owners and admins of the organization also see the invitations still usable that were created on its records by persons who are no longer members. Revocation requests are visible to the current owners and admins of the organization, to persons designated to decide and to the EVIDE administrator. Review-authority data are visible to the EVIDE administrator and to the verifiers appointed by Informatica in Azienda; when a designated person decides, the basis of the decision (designation, title date, verification and declared outcome) is shown together with the decision. If no one can decide within the review period, an alert containing only the identifiers of the request may be sent to the organization's verified contact addresses.
• The public: for entries published in the public registry, the data described in Section 8.
• Professional advisers bound by confidentiality, and authorities where required by law.

The EVIDE Mobile app is distributed through app stores, which process data in accordance with their own policies. One page of the site, Evidentiary Questions, includes a translation widget provided by a third party (see Section 14).

Informatica in Azienda does not transfer personal data outside the European Economic Area, except where required by law. The translation widget described in Section 14 is loaded from a third-party provider: that provider and the translation services it uses may process visitors' technical data, such as the IP address, outside the European Economic Area, under their own terms.

An entry is published in the EVIDE public registry only at the depositor's request and only for intakes for which a FEDIS has been issued; publication is carried out by the certifier. A published entry shows the reference ID, the FEDIS code, the status, the intake hash, the intake timestamp and the publication date. The registry may also show other published entries with the same hash and, for intakes that belong to an evidentiary chain, the position of the entry in the chain and the existence of other unpublished intakes in the same chain, without their content or identifiers. Published entries are publicly accessible and may be indexed by search engines.

Identifiers and hashes can be personal data where they can be linked to a person. The user may request removal of an entry at any time by writing to app@certifywebcontent.com or, alternatively, to info@informaticainazienda.it. Removal deletes the public listing; it does not delete the underlying records, which are handled as described in Sections 9 and 11. Copies of public listings made by third parties before removal are outside the control of Informatica in Azienda.

The hosting environment keeps backup copies for disaster recovery. Data deleted from active systems may remain in backup copies until those copies are overwritten in accordance with the backup rotation. Backup copies are not used for any other purpose; if a backup has to be restored, data deleted in the meantime are deleted again. Occasional exports made for maintenance or testing are kept only for the time needed for that activity and are then deleted.

Deletion from EVIDE's systems cannot reach copies outside the control of Informatica in Azienda, such as FEDIS documents and other records already delivered to the user or to third parties, files downloaded by the user and copies of public listings made by third parties.

Deactivation suspends access to the account; it does not delete account data or evidentiary records.

Account closure and deletion can be requested in writing to app@certifywebcontent.com or, alternatively, to info@informaticainazienda.it. The platform does not currently offer users a self-service function to delete intakes or the account: each request is assessed individually, on the basis of the identity and documented authority of the requester and of applicable law. Where deletion is authorized, it may include the account, the canonical intake records, EAR versions, ESB records, public-registry entries and the FEDIS-related records kept on the platform, which are removed from active systems. Deletion of an intake to which Linked Responses invitations or responses are linked is not carried out through the ordinary procedure: it is assessed separately, also taking into account the rights of the other users over their own declarations and the related revocation records.

When an account is closed, the user's personal intakes that can be deleted are deleted together with their dependent records, sessions and API keys are permanently revoked and organization memberships are removed. If nothing has to be retained, the account and the enrolment of the user's DAPI identity on EVIDE are deleted; otherwise the account is kept in a closed state, linked only to the records that must be retained (see Section 9), and the user is informed of what has been retained and why. Closing an EVIDE account does not revoke the DAPI certification, which is governed by its own terms. A closed account is not reopened automatically: access can be restored only on request, after verification of the requester's identity, and deleted records, revoked credentials and former organization memberships are not restored.

Some data may be kept after an authorized deletion only where a documented legal basis justifies it, for example accounting records that must be kept by law or data needed for a pending dispute. Where a deletion cannot be carried out for technical reasons, processing is restricted until it can be carried out; a technical constraint is not in itself a legal ground for refusing erasure. Deleted data may remain in backup copies as described in Section 10. Once the relevant platform records have been deleted, a FEDIS already delivered may no longer be verifiable against EVIDE's records.

Under Articles 15 to 22 GDPR you have the right to:

• access your personal data;
• request their rectification;
• request their erasure, which is assessed case by case and may be limited where an exception under Article 17(3) GDPR applies in the specific case, for example where the data are necessary for the establishment, exercise or defence of legal claims;
• request the restriction of processing, which may also apply instead of erasure;
• receive the data you have provided in a structured, commonly used and machine-readable format, where processing is based on the contract and carried out by automated means;
• object to processing based on legitimate interest;
• lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where you live or work.

A respondent may object to the documentation of their response in new FEDIS-LINKED documents. While the objection is assessed, Informatica in Azienda may suspend new requests and issuances that would include it; the suspension does not modify or delete any record and does not reach documents already delivered (Section 10).

Requests should be sent to app@certifywebcontent.com or, alternatively, to info@informaticainazienda.it. Informatica in Azienda may ask for information needed to verify the identity of the requester. A request received through another channel is not disregarded for that reason alone; the address from which a request is sent is not, in itself, sufficient proof of identity. A reply is given without undue delay and in any case within one month of receipt; this period may be extended by two further months where necessary, taking into account the complexity and number of requests, and the requester is informed of any extension within the first month. Requests are free of charge, unless they are manifestly unfounded or excessive. Informatica in Azienda informs the recipients to whom data have been disclosed of any rectification, erasure or restriction, unless this proves impossible or involves disproportionate effort.

Persons whose data are contained in content deposited by a user may also exercise these rights. Where Informatica in Azienda acts as processor for a customer, it forwards the request to that customer and assists it in responding.

The platform is accessible only over encrypted connections (HTTPS). Session cookies are protected (Secure, HttpOnly, SameSite=Strict); sign-in codes, mobile access tokens and API keys are stored only in hashed form. Access to accounts can be suspended immediately, and sign-in attempts and API requests are rate-limited. Integrity hashes allow any alteration of deposited records to be detected against a reference hash.

This policy may be updated. Material changes are communicated by email to registered users at least 30 days before they take effect; the notice indicates the new version and the date from which it applies. The current version is always available at this address, and earlier versions are available on request. Each version of this policy, together with the Service Conditions in force from the same date, is also published as a PDF document bearing a qualified electronic signature, which can be downloaded from this page with its SHA-256 fingerprint; once published, a signed copy is never replaced.