01
What this capsule can contain
The Documents capsule lets you pass on instructions, wishes and practical guidance to people you trust, at a moment you have chosen or one that will come in the future.
- Practical instructions — family procedures, access details, practical information
- Personal wishes — guidance on belongings, objects, family arrangements
- Attached documents — PDFs, text files, scans
- Advance healthcare directives (DAT in Italy) — healthcare wishes
- Third parties’ data — family members, professionals or organisations named in your instructions
- Health or financial data — information you choose to add that the law gives special protection
02
What Erabox does and in what role
Erabox is the controller for the data needed to run the service: registration and account, payments, security, verification of the delivery event, the Guardian’s data and legal obligations.
For the content you add to capsules and for Beneficiaries’ data, Erabox is the processor (Art. 28 GDPR; Art. 9 FADP): it stores and delivers them on your behalf, following your instructions and the Data Processing Agreement, without using them for its own purposes. You decide what to add, who to deliver it to and when, and you are responsible for those choices; Erabox is responsible for keeping it secure and delivering it correctly. If you add content for purely personal or household purposes, your processing falls under the exemption in Art. 2(2)(c) GDPR and Art. 2(2)(a) FADP; the rules of the Agreement still apply as terms of the service.
03
Your advance healthcare directives (DAT)
If you add your advance directives here, first read how the law requires them to be made. Erabox stores and delivers a copy: the copy is not the directive itself.
- public deed — before a notary;
- authenticated private document — with your signature authenticated by a notary or another public official;
- private document that you hand in yourself to the civil registry office of the municipality where you live, which records it in a dedicated register where one exists, or to healthcare facilities in the Regions that have regulated the collection of DAT by their own act under paragraph 7.
04
Data processed by Erabox
| Controller and processor | Erabox SA · Via delle Fornaci 6, 6826 Riva San Vitale (TI), Switzerland. Erabox is the controller for account, payment, security and delivery-event verification data, and for the Guardian’s data. For the content of this capsule and for Beneficiaries’ data, Erabox is the processor and acts on your behalf, following your instructions and the Data Processing Agreement (Art. 28 GDPR; Art. 9 FADP) |
| Data protection officer | Massimiliano Nicotra, attorney · privacy@erabox.ch |
| EU representative | Massimiliano Nicotra, attorney · privacy@erabox.ch |
| Owner’s data | Text content, attached documents, technical metadata (version, checksum, timestamp) |
| Beneficiary’s and Guardian’s data | Name, contact details, date of birth and scheduled delivery date, as you provide them. Erabox processes them on your behalf, as processor. If you choose to let the Beneficiary know, Erabox sends them a privacy notice on your behalf within one month of their designation; if you choose confidential mode, the notice is given to them at the time of delivery. In no case does the notice reveal the content to them before delivery. The Guardian’s data, on the other hand, is processed by Erabox as controller: the invitation they receive contains the link to the privacy notice |
| Role assigned to the designated person | If you state that the designated person is your healthcare representative, that statement is data concerning your health (Art. 4(15) GDPR; Art. 5(c)(2) FADP) and follows the rules for special categories of data. |
| Third parties’ data | Names, roles or contact details of third parties mentioned in your instructions (family members, professionals, organisations). See § 05 |
| Health data and other special categories | Healthcare wishes, advance directives, information on your state of health and other data the law gives special protection, when you add them. Basis: your explicit consent (Art. 9(2)(a) GDPR; Art. 6(7)(a) FADP) |
| Technical session data | IP address, user agent, session ID, UTC timestamp — processed for the security of the service and to keep proof of the operations carried out and the declarations you make |
| Legal basis | Storage, retention and delivery of the capsule: carried out by Erabox on your behalf, as processor, in performance of the contract you have entered into with Erabox and of the Data Processing Agreement (Art. 6(1)(b) GDPR); for Switzerland, processing is governed by Arts. 6 and 31 FADP, being directly related to the performance of the contract. Health data and other special categories: your explicit consent (Art. 9(2)(a) GDPR; Art. 6(7)(a) FADP). Technical session data: legitimate interest in security and in keeping proof of operations (Art. 6(1)(f) GDPR). Invoicing and accounting records: legal obligation (Art. 6(1)(c) GDPR) |
| Purposes | Secure storage; versioning and operations log; delivery to the Beneficiary at the scheduled moment; security of the service; accounting and legal obligations |
| Electronic signature | Ticking the boxes in § 07 is not an electronic signature. If you choose to sign the capsule, the signature is a simple electronic signature within the meaning of Art. 3(10) of Regulation (EU) No 910/2014, provided through the provider Euronovate after verifying your identity. For identity verification and the signature, Erabox is the controller. The signature confirms where the document comes from, but does not give it the form the law requires for advance directives (§ 03) |
| Providing your data | Needed for the service: registration and payment data, the capsule content, the Beneficiary’s data, the delivery rule. Without these, Erabox can neither store nor deliver. Optional: the designated person’s role, health data, the Guardian, attachments. If you don’t provide them, the capsule still works, with the functions that depend on those fields switched off |
| Access to content | Within your account, only you can see the content. The Beneficiary receives it once the moment you have chosen arrives. Content is encrypted at rest with keys managed by Erabox, whose systems access it when needed to store, process and deliver it. Erabox processes the content on your behalf and does not use it for its own purposes. Staff access is limited to maintenance, security and support operations, is allowed only to authorised staff and is logged |
| Automated decisions | Delivery linked to death takes place after the Guardian’s report or, with ‘after a long silence’, after their confirmation. Once the period of silence you have chosen has passed, Erabox sends you a reminder after 14 days and a second one after a further 7; if you do not log in within another 7 days, it contacts the Guardian. A 14-day safety window runs from the notice to the Guardian; logging in to the app before delivery stops the process. Delivery therefore always requires human involvement and is not a decision based solely on automated processing within the meaning of Art. 22 GDPR and Art. 21 FADP |
| Versions and integrity | Every change made after first activation creates a new version, with a separate operations log. Previous versions can be accessed only by the Owner from their authenticated account. For each version, Erabox calculates a check value that makes it possible to verify whether the file has been altered since it was saved, and records the date, time and session. Erabox does not give these records any evidential value: the value of an electronic document in court is set by law — for Italy, Art. 20 of Legislative Decree 82/2005 and Arts. 2702 and 2712 of the Italian Civil Code, in conjunction with Regulation (EU) No 910/2014 — and is assessed by the court |
| Retention | Content: until delivery, for the duration of the subscription. If the subscription expires without renewal, there is a 30-day grace period, then the account is suspended in read-only mode for 12 months, then permanently deleted. If your death has been reported or confirmed by the Guardian, capsules already scheduled are not deleted for non-renewal and remain until delivery, up to a maximum of 10 years. After delivery, the content remains available for the 30 days the link is valid and is then deleted within 30 days. If you delete your account, the content is erased after 30 days. Access and data operation logs: 12 months. Billing data: 10 years under Swiss law |
| Security | AES-256 at rest · TLS 1.3 in transit · operations log with integrity check · additional encryption for advance directives |
| Security breaches | In the event of a breach posing a high risk, Erabox informs the data subjects and notifies the competent authorities under Arts. 33 and 34 GDPR and Art. 24 FADP |
| GDPR / FADP rights | Access, rectification and erasure (Arts. 15, 16 and 17 GDPR; Arts. 25 and 32 FADP); restriction (Art. 18 GDPR); portability (Art. 20 GDPR; Art. 28 FADP); objection to processing (Art. 21 GDPR) — the FADP does not recognise a right to object in the same form, but Art. 30(2)(b) treats processing against your express wishes as a violation of personality. Rectification and erasure also extend to the operations logs, except for what Erabox must keep to establish or defend a legal claim. Write to privacy@erabox.ch. You can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) (Swiss users: edoeb.admin.ch) or with the supervisory authority in your country of residence (EU users). Full Privacy Policy → |
05
The people who appear in your instructions
Your instructions almost always involve someone besides you: the person who will receive them, the people named in them, those who will carry them out. Those people also have rights over their own data.
- The content may concern people other than you and the person who will receive it.
- Those people have the right to know that their data is stored and to request access, rectification and erasure, under Art. 14 GDPR and Art. 19 FADP.
- Erabox makes a public notice available for anyone who believes their data is stored in a capsule, at erabox.ch/en/third-party-privacy-notice, and a reporting channel at privacy@erabox.ch.
- By adding content that concerns other people, you undertake to do so with respect for their dignity and privacy. If one of those people contacts Erabox, Erabox will get in touch with you before taking any decision, unless the law requires otherwise.
The Beneficiary and the Guardian. You are the one who processes the Beneficiary’s data, and Erabox stores it and uses it for delivery on your behalf. If you choose to let them know, Erabox sends them the privacy notice on your behalf within one month of their designation; if you choose confidential mode, it gives it to them at the time of delivery. The Guardian, on the other hand, is informed by Erabox, which is the controller of their data: the invitation they receive contains the link to the privacy notice. They need to know they have been designated, because they are the person Erabox asks to confirm the event. No notice reveals the content of the capsule before delivery. The text of the notice is published at erabox.ch/en/third-party-privacy-notice.
Your healthcare representative. If you state that the designated person is your healthcare representative, that statement says something about your health and is protected as such (§ 04), and at the same time it is data about them that they have not given to Erabox. Under Italian law, the appointment alone is not enough: the representative (fiduciario) accepts it by signing the DAT or by a later document attached to the DAT, and receives a copy of the DAT (Article 4(2) of Law 219/2017); they can withdraw at any time by a written document communicated to you. Erabox does not collect the representative’s acceptance: if you want the appointment to take effect, have them accept it in the forms set out in Law 219/2017.
After your death. The GDPR does not apply to the data of deceased persons and leaves the matter to individual states. For users in Italy, Article 2-terdecies of the Italian Data Protection Code applies: anyone who has an interest of their own, acts to protect the data subject or has family reasons deserving protection can exercise the rights that belong to you. You can prohibit this, in whole or in part, with a written declaration sent to privacy@erabox.ch. The prohibition does not affect the delivery you have scheduled.
Age. The service is reserved for adults. If the Beneficiary you designate is a minor, you also state who exercises parental responsibility, and the privacy notice is given to that person.
06
Limits of the service and liability
Erabox stores your instructions and delivers them to the person you have named. It does not validate them, interpret them or see to their execution. Here you’ll find the limits of what Erabox is responsible for.
- 1Erabox is not a legal, notarial, healthcare or financial service. It does not give your documents any legal form, does not authenticate your signature and does not file them with public registers.
- 2We do not check the completeness or legal correctness of what you write, nor do we check whether your instructions can be carried out.
- 3Documents for which the law requires a specific form — a will, a power of attorney, a notarial deed, an advance healthcare directive — must be drawn up and filed in that form. Erabox does not replace it. The document you store here keeps the value the legal system recognises for an unauthenticated private document.
- 4Your advance directives are governed by § 03 of this document, by Article 4(6) of Law 219/2017 for Italy and by Art. 371 CC for Switzerland. The copy stored on Erabox is not one of the forms required by law and is not registered in the national database.
- 5We are not responsible for how the Beneficiary or others interpret your instructions, nor for whether or not they carry them out. Erabox is responsible for storage and delivery.
- 6If the Beneficiary’s details are wrong or out of date, delivery may not take place. Keep them up to date from your profile.
- 7If there is a technical interruption of the service, Erabox refunds the pro rata share of the fee for the period concerned. The right to compensation for damage in the cases provided for by law remains unaffected.
- 8If a third party brings a claim against Erabox over content you have added in breach of the commitments made in § 05, we ask you to indemnify us for whatever Erabox has to pay them and for the costs incurred. This obligation does not apply in cases of intent or gross negligence on Erabox’s part, nor to failures relating to storage and delivery.
- 9Disputes about the content of the instructions between you, the Beneficiary and third parties are a matter for you. Erabox does not take part in them, while remaining responsible for storage and delivery.
The limitations of liability set out above do not apply in cases of intent or gross negligence on Erabox’s part, nor within the mandatory limits laid down by consumer protection law (Art. 100 of the Swiss Code of Obligations; Italian Legislative Decree 206/2005 for users resident in Italy).
07
Your declaration
I have reached the age of 18 and have full legal capacity.
I am the rightful author of the instructions and have the right to draw them up and pass them on to the designated Beneficiary.
I have read § 02 and understand that Erabox stores and delivers the documents without giving them any legal form, without authenticating my signature and without filing them with public registers.
I have read § 03 and understand that, if I add my advance directives, the copy stored on Erabox is not one of the forms required by Article 4(6) of Law 219/2017, nor the form required by Art. 371 CC, and is not registered in the national database.
I have checked that the Beneficiary’s details are correct, complete and up to date.
The attached documents are mine or I can lawfully share them without infringing the rights of third parties.
I have read § 05 and undertake to add other people’s data with respect for their dignity and privacy.
Consent to health data (optional). I consent to Erabox processing the data concerning my health that I add to this capsule — healthcare wishes, advance directives, the name of my healthcare representative — in order to store it and deliver it to the Beneficiary I have designated, at the moment I have chosen (Art. 9(2)(a) GDPR; Art. 6(7)(a) FADP).
Erabox records this declaration with the session identifier, IP address, UTC timestamp and document version. Any later change creates a new declaration and a new record. Ticking the boxes is not an electronic signature within the meaning of Regulation (EU) No 910/2014.