Privacy notice

1. Controller and contacts

The controller is Blockchain Italia S.r.l. (“we”).

Controller

Blockchain Italia S.r.l.

Registered office

Via Brembo 27, 20139 Milano (MI), Italia

VAT number

10441490967

Registration

Registro delle imprese di Milano Monza Brianza Lodi n. 10441490967, REA MI-2532140

Share capital

€10,000, fully paid up, sole shareholder

Privacy email

segreteria@blockchainitalia.io

Certified email (PEC)

blockchainitaliasrl@legalmail.it

Other contacts

info@proofora.it

Complaints about personal data

dpo@blockchainitalia.io

To exercise your rights or for questions about personal data, write to the privacy email. For anything else, use the other contacts.

2. Who this notice is for and who decides

This notice concerns three groups of people:

• people who request access with the form on the website (section 3);
• users of customer organizations, that is people invited to use the application (section 4);
• visitors of the website and of the public passport pages (section 6).

For this data we are the controller. The data organizations enter in passports follows different rules: the organization is the controller and we act on its behalf (section 5).

Proofora is a service for businesses and professionals. It is not meant for consumers or minors.

3. Access requests from the website

With the “Request access” form we collect:

• your full name, email and company;
• the sector, chosen from the list or written by you if you choose “Other”;
• the message, if you write one: it is optional;
• the language of the page, the date and time of the request;
• the tick of the privacy checkbox and the version of this notice you read (currently 2026-10-28).

What happens to the data:

• We store it in our database and send it by email to the internal inbox of our team, which can reply to you directly.
• We send you a confirmation email with a fixed text that repeats nothing of what you wrote. At most one a day for the same address.
• Our team reviews the request in an internal console. It closes it as handled or rejected, or creates your organization and sends you the invitation. We record who handled it and when.
• We write the event in the audit log: type of request, sector, date and time, a technical identifier of the request and a cryptographic fingerprint of your IP address, computed with a secret key (HMAC). The IP address itself is not stored.
• To stop abuse we count the requests of each IP address (for IPv6, of each /64 network) in the server memory, in one-minute windows. The count is not stored and resets when the server restarts.

• Reviewing the request, getting back to you and, if accepted, inviting you

  Legal basis

  Your consent, given with the checkbox of the form (GDPR art. 6(1)(a)). You can withdraw it at any time: we stop contacting you and delete the request.

  Retention

  12 months from the request, then we delete it. The same applies to the notification emails in the team inbox.

• Protecting the form from abuse and reconstructing what happened

  Legal basis

  Our legitimate interest in the security of the service (GDPR art. 6(1)(f)).

  Retention

  Audit log: 12 months from the event. Count per IP address: in memory only.

4. Users of customer organizations

The application is by invitation only. Our team invites the owner of each organization; the owner and the administrators can invite other people.

We process this data:

• Invitation: email of the invited person, organization, role, who invited them, status and expiry (7 days). The address comes from whoever invites you: an administrator of your organization, or our team, which uses the address of the access request or the one given by your organization. The invitation email contains a personal link with a verification code and a link to this notice.
• Account: full name, email (verified by the invitation link), password, date and version of the accepted terms of service. The password is never stored in clear: we only keep a fingerprint computed with the scrypt algorithm and a random salt.
• Organization and role: the organization you belong to and your role (owner, administrator, editor, read-only). At the first access the owner confirms the organization name, country, VAT number (optional) and main sector; in the settings the owner and the administrators can add the legal name and the registered address. For a sole trader this can be personal data.
• Sessions: when you sign in we create a session. Access lasts 7 days from sign-in, then you sign in again; if in the meantime you change your name or password, the 7 days start again from then. For each session we store, for security, the browser (user agent) and a cryptographic fingerprint of the IP address, computed with a secret key (HMAC): the IP address itself is not stored. When you sign out the session is deleted; when you reset your password we close all sessions.
• Links by email: sign-in links without a password (valid for 10 minutes) and password reset links (valid for 1 hour). We delete each link when you use it, and expired ones at the next check.
• Audit log: for important actions (for example creating and saving a passport, uploading a photo, invitations, first access) we record who acted, the organization, the action, date and time, a technical identifier of the request and the HMAC fingerprint of the IP address. The log does not contain passport content.
• Author: in passports we record which user issued a version or uploaded a photo.
• Requests for new sectors: if you ask for a sector that does not exist yet, we store the request (organization, your name and email, sector, message) and email it to our team.
• Preferences: language and theme of the application, if you choose them (section 9).

If the account is closed we delete or anonymize name, email and password, also in invitations and in requests for new sectors. Issued versions and the audit log keep a technical identifier, without name or email. We keep the proof of acceptance of the terms (name, email, date and version) separately, for the period stated below.

• Creating and managing accounts, access and roles, providing the service to the organization and handling requests for new sectors

  Legal basis

  The contract with your organization (GDPR art. 6(1)(b)). If you are not the party to the contract, the legitimate interest of your organization and ours in running the service it asked for (GDPR art. 6(1)(f)).

  Retention

  For the whole relationship. After the user is removed or the contract ends: 90 days. The same applies to the notification emails of requests for new sectors in the team inbox.

• Protecting accounts and data: sessions, limits on sign-in attempts, audit log

  Legal basis

  Our legitimate interest in the security of the service and in reconstructing who did what (GDPR art. 6(1)(f)).

  Retention

  Sessions: up to 7 days after the last use, or until you sign out. Expired invitations and sessions: sessions until the account is closed, invitations until the contract with the organization ends. Links by email: until used or expired. Audit log: 10 years from each event. Count per IP address: in memory only.

• Proving the acceptance of the terms of service

  Legal basis

  Our legitimate interest in proving the contract and defending ourselves in court (GDPR art. 6(1)(f)).

  Retention

  With the account and, after it is closed, for 10 years from the end of the contract.

• Complying with legal obligations and requests from authorities

  Legal basis

  Legal obligation (GDPR art. 6(1)(c)).

  Retention

  For the time required by law.

5. Data entered in passports

Organizations use Proofora to create the digital passports of their products. They enter product data following the model of their sector: for example description, materials, origin, producer and its contacts, certifications, instructions, photos. It is mostly business data, but it can contain personal data: for example the details of a producer who is a sole trader, or the name of a contact person.

Who decides and who processes

For this data the controller is the organization. We process it on its behalf, as a processor (GDPR art. 28), under the data processing agreement: a separate contract, concluded with each customer organization before it enters personal data in passports. To exercise your rights on this data, contact the organization. If you write to us, we forward the request and help the organization to answer.

What becomes public

While a passport is a draft, only the users of the organization see its data; the photo is the exception (see “Photos” below). When the organization issues a version:

• the fields that the sector model marks as public, the product name and the photo are visible to anyone on the public page reached by the QR code, also as a downloadable technical document and in the token metadata;
• the other fields are not shown: in the version document they appear only as salted cryptographic commitments, which do not reveal the value;
• on a public blockchain we write only cryptographic fingerprints (hashes) and technical data: the fingerprint of the product identifier, the fingerprint of the version document, the version number, the status, the passport type (model, batch or single item), the sector code and, for a batch, the fingerprint of the list of its items. For each organization we create a collection with a technical name and symbol, without the name of the organization, and with the address of the metadata on the domain of our application. During the pilot we use the public test network Ethereum Sepolia.

Organizations must not enter personal data in public fields. The exception is data that product legislation requires to be published, such as the details of the manufacturer: in that case publishing it is an obligation of the organization.

What can be deleted and what cannot

• Writes on the blockchain are permanent: nobody, including us, can change or delete them. This is why they contain neither personal data nor the values of the passport fields in clear.
• The data stays in our systems, off the blockchain, and can be deleted. The values of non-public fields and their salts are stored separately: once they are deleted, the fingerprint on the blockchain remains but can no longer be linked to the data.
• To keep verification possible, issued versions are kept in an archive that the application does not change: public fields, photo, commitments of the non-public fields, signature, fingerprints and a technical identifier of the author. After the end of the contract we keep it for 10 years, on the instruction the organization gives with the terms of service (clause 10). If personal data ends up in a public field, we remove it on request with an extraordinary procedure; the version stays on the blockchain only as a fingerprint.
• After the end of the contract, on the same instruction of the organization, the public pages of the issued versions, with their photos and the token metadata, also stay online, read-only, for 10 years, so that the QR codes printed on the products keep working. Then we delete pages, photos, metadata, version documents and archive. The organization can ask us in writing to take pages, photos and metadata offline earlier: we do so within 90 days of the request or, if later, of the end of the contract.
• Whoever read the public data, for example a search engine or a blockchain explorer, may have kept a copy, which we do not control.

Photos

Before storing a photo we resize it and remove all metadata: GPS position, camera model, dates, author. The photo is public as soon as it is uploaded: we store it in a public area of the storage, and anyone who has its address, which is long and cannot be guessed, can open it, even while the passport is still a draft. Browsers and content delivery networks may keep a copy for up to a year. A replaced photo stays stored and reachable, even if no issued version has shown it. After the end of the contract we keep only the photos of the issued versions, with the public pages and the archive; we delete the others within 90 days. Organizations must not upload photos in which people can be recognized without a legal basis.

• On behalf of the organization: drafts, issuing, public page and registration on the blockchain

  Legal basis

  The one chosen by the organization, which is the controller: we follow its instructions (GDPR art. 28).

  Retention

  For the duration of the contract; afterwards, 90 days. Verification archive of the issued versions: 10 years from the end of the contract. Public pages of the issued versions, with their photos and the token metadata: online for the same period, unless the organization asks us to take them offline earlier. Fingerprints on the blockchain are never deleted.

6. Browsing the website and the public pages

When you visit the website or the public page of a passport, your browser sends technical data to the servers: IP address, date and time, requested page, browser and operating system. We use it to show you the pages and to protect them.

• The hosting provider of the website records these requests in its access logs. The application server does not record the requests, but its technical logs of errors and events may contain some of this data.
• On some public interfaces, such as sending the form, we count the requests of each IP address in the server memory, to stop abuse. The count is not stored.
• Product photos reach your browser directly from the storage service (Amazon S3 by Amazon Web Services EMEA SARL, Luxembourg, in the AWS eu-west-1 region, in Ireland), which therefore sees your IP address.
• Our server performs the blockchain verification: the blockchain access provider does not receive your IP address.
• The public page may link to a blockchain explorer, for example Etherscan. If you open it, the privacy notice of that site applies.

We use no analytics or profiling tools and build no profiles of visitors.

• Showing the pages and protecting them from abuse and attacks

  Legal basis

  Our legitimate interest in offering working and secure pages (GDPR art. 6(1)(f)).

  Retention

  Technical logs: 30 days for the logs of the application server; AWS Amplify keeps the access logs of the website, with the IP address, until we delete the app that publishes it. Count per IP address: in memory only.

7. Who receives the data

The data is processed by our authorized staff, bound to confidentiality, and by the providers that help us run the service. Providers process the data on our behalf as processors (GDPR art. 28), under a binding contract:

• sending emails (invitations, sign-in links, confirmations, team notifications): Amazon Simple Email Service (SES) by Amazon Web Services EMEA SARL, Luxembourg, from the AWS eu-west-1 region, in Ireland. If a message cannot be delivered or is reported as spam, the provider keeps the address in a list that blocks further sending: we remove it within 12 months;
• hosting of the application, the database and the website: Amazon Web Services EMEA SARL, Luxembourg, with Amazon EC2 for the application and the database and Amazon S3 for the database backups, in the AWS eu-west-1 region, in Ireland, and with AWS Amplify Hosting for the website, delivered by the AWS CloudFront network from points of presence worldwide;
• storage of photos and documents: Amazon S3 by Amazon Web Services EMEA SARL, Luxembourg, in the AWS eu-west-1 region, in Ireland;
• blockchain access (RPC node), which only receives transactions and queries with fingerprints and technical data: Alchemy Insights, Inc., United States;
• the team inboxes, which receive request notifications, technical alerts and privacy requests: Google Workspace by Google Ireland Limited, Ireland.

Our advisors, for example lawyers and accountants, bound by professional secrecy, and public authorities when the law requires it may also receive data. For passport data, the same providers are our sub-processors towards the customer organizations.

The public fields of issued passports are visible to anyone; the fingerprints written on the blockchain can be read by anyone. We do not sell personal data and do not use it for advertising.

8. Transfers outside the European Economic Area

Some providers may process data outside the European Economic Area (EEA). Currently: Amazon Web Services EMEA SARL stores the data of the application, the database, the photos and the emails in the AWS eu-west-1 region, in Ireland, and moves it out of that region only when needed to provide the service or to comply with the law; if it has the data processed outside the EEA by other Amazon group companies, for example in the United States, the safeguards of its data processing agreement apply: the standard contractual clauses or, for Amazon Web Services, Inc., the EU–US Data Privacy Framework, in which it participates; the website is delivered by the AWS CloudFront network, so each visit, with your IP address, goes through the point of presence closest to you, which may be outside the EEA; Google may process the emails of the team inboxes outside the EEA too, under the standard contractual clauses of its data processing terms and, for Google LLC in the United States, the EU–US Data Privacy Framework; Alchemy Insights, Inc., in the United States, only receives transactions and queries with cryptographic fingerprints and technical data, which contain no personal data in clear, and processes them under the standard contractual clauses of its data processing agreement.

In these cases the transfer only takes place with the safeguards of Articles 44–49 of the GDPR: an adequacy decision of the European Commission (for the United States, the EU–US Data Privacy Framework, for participating companies) or the standard contractual clauses approved by the Commission. You can ask for a copy at the privacy email.

The fingerprints written on the public blockchain are copied to the nodes of the network, all over the world. They contain no personal data in clear.

9. Cookies and browser storage

We use no profiling cookies, no analytics or advertising tools, and load no third-party scripts. Even the fonts are served by our servers.

We only use technical cookies, needed for features you ask for. They do not require consent (art. 122 of the Italian Privacy Code, Legislative Decree 196/2003, and the cookie guidelines of the Italian Data Protection Authority of 10 June 2021): this is why we show no banner.

• NEXT_LOCALE

  Where

  Website

  Purpose

  Remembers the language you chose with the IT · EN links.

  Duration

  Until you close the browser.

• proofora.session_token

  Where

  Application

  Purpose

  Keeps you signed in. It contains a signed code that the scripts of the page cannot read (HttpOnly). On secure connections its name starts with __Secure-.

  Duration

  7 days from sign-in; they start again if you change your name or password. Deleted when you sign out.

• proofora_locale

  Where

  Application and public passport pages

  Purpose

  Remembers the language you chose.

  Duration

  1 year.

• theme (browser local storage)

  Where

  Application

  Purpose

  Remembers the light or dark theme, if you choose it from the menu or in the settings. It stays in your browser and never reaches our servers.

  Duration

  Until you delete it from the browser.

On the website the theme follows the setting of your device and nothing is stored. You can delete or block cookies in your browser settings: the website still works, while signing in to the application needs the session cookie.

10. Whether providing data is required

No law requires you to give us your data. Some data is necessary, though:

• in the “Request access” form, name, email, company, sector and the privacy checkbox are needed to review the request: without them we cannot answer. The message is optional;
• to create the account we need your name, a password and the acceptance of the terms (the email is the one of the invitation): without them you cannot use the application. At the first access the VAT number is optional;
• technical browsing data is needed for the pages to work.

11. Automated decisions and other uses

We take no decisions based solely on automated processing, including profiling, that produce legal effects on you or similarly affect you (GDPR art. 22 and art. 13(2)(f)). A member of our team reviews access requests.

If we want to use the data for a purpose other than those listed here, we will inform you beforehand (GDPR art. 13(3)).

12. Your rights

You can ask us at any time to:

• access your data and receive a copy (art. 15);
• correct or complete it (art. 16);
• delete it (art. 17);
• restrict its processing (art. 18);
• receive it in a structured, machine-readable format, or have it sent to another controller (art. 20);
• object to processing based on legitimate interest (art. 21, see below);
• withdraw your consent, without affecting processing carried out before (art. 7(3)).

Write to segreteria@blockchainitalia.io or to the certified email blockchainitaliasrl@legalmail.it. We answer within one month; for complex requests we can extend this by two more months, letting you know (art. 12(3)). We may ask you to confirm your identity.

Some limits come from how the service works. Fingerprints on the blockchain cannot be deleted, but they contain no personal data in clear. We keep the audit log and the proof of acceptance of the terms for the periods above, to defend ourselves in court (art. 17(3)(e)). Deleted data stays in the database backups until they rotate: 30 days. For passport data, contact the organization that entered it (section 5).

13. Complaint to the supervisory authority

If you believe we process your data in breach of the GDPR, you can lodge a complaint with the Italian supervisory authority, Garante per la protezione dei dati personali, or with the supervisory authority of the EU country where you live, work or where the breach took place (art. 77). You can also go to court (art. 79).

14. Changes and versions

This is version 2026-10-28 of the notice, effective from the date shown at the top. Each version has a code (year, month and day). When you send the “Request access” form, we record the code of the version you read.

If we change the notice, we publish the new version on this page with a new code and a new date. If the changes are significant, we tell the users of the application beforehand, by email or in the application. Previous versions are available on request.

The rules for using the service are in the terms of service.