Privacy Notice

1. Controller, management and DPO

UESE ITALIA S.p.A., registered office at Piazza Trivulziana 4/A, 20126 Milan (MI), Italy, VAT/Tax ID IT04398760274, REA MI 2679515, fully paid-up share capital EUR 1,145,000, Italian e-invoicing recipient code SDI 3ZJY534 is the Controller for account management, security, billing, support, administration, UESE marketing and platform operations. The Chief Executive Officer is Dr Giuseppe Izzo. The DPO identified by the Controller is Dr Giuseppe Izzo, reachable at dpo@uese.it. General privacy contact: privacy@uese.eu.

2. Privacy roles

UESE acts as independent controller for processing necessary to manage its relationship with users and Customers. For documents, signer data and workflows processed solely on a business Customer’s instructions, UESE may act as processor under Article 28 GDPR. Payment providers, QTSPs, KYC providers and authorities may act as independent controllers, joint controllers or processors depending on the service and applicable arrangements.

3. Categories of personal data

Data may include identity and contact details; professional and corporate data; account and authentication data; IP, device, logs and security information; subscription and billing data; payment tokens and references; KYC status and verification data; document, signature and timestamp metadata; support communications; marketing preferences; and personal data contained in documents uploaded by the Customer.

4. Special categories and biometric data

Firmato does not generally require special categories of data under Article 9 GDPR. Identity verification, liveness or facial comparison may involve images and, depending on the technology and purpose, biometric data. Such processing is limited to the relevant workflow and requires an appropriate legal basis, enhanced safeguards and provider-specific information.

5. Purposes and legal bases

• Account creation, trial, quotations and contractual relationship: Article 6(1)(b) GDPR.
• Billing, tax/accounting duties and lawful authority requests: Article 6(1)(c).
• Security, fraud prevention, legal claims, logging and resilience: Article 6(1)(f), subject to balancing where required.
• Electronic marketing: consent under Article 6(1)(a) where required, or another basis expressly permitted by national ePrivacy law.
• Non-essential cookies/trackers: consent where required.
• Special category data: Article 9 GDPR and applicable national law, depending on the specific case.

6. Requirement to provide data

Fields marked as necessary are required to register an account, provide the service, comply with law or protect the platform. Failure to provide them may prevent the relevant function. Marketing and optional feature data are voluntary.

7. Sources

Data is collected from the individual, the Customer inviting a User or Signer, the organisation to which the individual belongs, integrated providers and technical systems during service use. Where data is not collected directly from the individual, the Customer remains responsible for information obligations that fall on it and UESE provides its own information as required.

8. Recipients and subprocessors

Data may be accessed by authorised UESE personnel and, where necessary, hosting/cloud, email, support, payment, KYC, QTSP, archiving, cybersecurity, professional advisers, auditors and competent authorities. The relevant subprocessor list/categories for processing on behalf of a Customer are described in the DPA/Subprocessor Policy.

9. International transfers

UESE favours EEA providers and locations where compatible with the service. Transfers to third countries rely on an adequacy decision or appropriate safeguards, including where necessary the European Commission Standard Contractual Clauses and supplementary measures assessed in light of risk.

10. Retention

Data is kept for periods proportionate to purpose. Contract and tax data follow applicable statutory periods; security and audit logs are retained for protection, accountability and legal defence; documents and evidence follow Customer retention settings and obligations. On termination, deletion, return, anonymisation or restricted retention applies according to the DPA, law and legal hold requirements.

11. Automated decisions and profiling

Firmato may use automated rules to detect fraud, risk, workflow state, priority or commercial segmentation. Unless specifically stated otherwise, UESE does not make decisions based solely on automated processing that produce legal or similarly significant effects under Article 22 GDPR. Any process subject to that Article will include the required safeguards.

12. Security and personal data breaches

UESE applies risk-based technical and organisational measures including role segregation, strong authentication for sensitive functions, secret encryption, logging, backup, upload controls and incident management. Personal data breaches are assessed and, where thresholds are met, notified to authorities and/or individuals within statutory timeframes.

13. Data subject rights

Where applicable, individuals may exercise access, rectification, erasure, restriction, portability, objection and withdrawal of consent, together with rights concerning automated decisions. Requests may be sent to privacy@uese.eu or dpo@uese.it. Identity may be proportionately verified.

14. Complaints and supervisory authorities

Individuals may lodge a complaint with a competent supervisory authority, in particular in the Member State of habitual residence, place of work or alleged infringement, without prejudice to other administrative or judicial remedies.

15. Children

Firmato is primarily intended for adults and organisations. Any use involving minors requires a valid legal basis and application of national rules on digital consent and contractual capacity.

16. Updates

This notice may be updated for legal, technical, organisational or provider changes. Material amendments are highlighted and, where necessary, communicated through the account or other appropriate channels.