01
What this capsule can contain
The Instructions capsule is a secure digital archive for documents, family information and content you want to keep safe over time — accessible now or at a moment in the future.
- Personal and family documents — certificates, contracts, important documents
- Photo archives — organised collections of images
- Genealogical and historical data — family trees, family stories, historical research
- Practical information — access details, codes, instructions. Note: Erabox is not a password manager. If you store login details that are still active, please be aware that they are encrypted like all other content, with keys managed by Erabox, and not with a key that only you hold. Some residual risk remains with any archive; you can reduce it by changing the login details you have stored from time to time.
- PDF documents and attachments — files of any type
- Third parties’ data — family members, ancestors, people mentioned or pictured in the documents
02
Data processed by Erabox
| Controller and processor | Erabox SA · Via delle Fornaci 6, 6826 Riva San Vitale (TI), Switzerland. Erabox is the controller for account, payment, security and delivery-event verification data, and for the Guardian’s data. For the content of this capsule and for Beneficiaries’ data, Erabox is the processor and acts on your behalf, following your instructions and the Data Processing Agreement (Art. 28 GDPR; Art. 9 FADP) |
| Data protection officer | Massimiliano Nicotra, attorney · privacy@erabox.ch |
| EU representative | Massimiliano Nicotra, attorney · privacy@erabox.ch |
| Owner’s data | Documents you add, associated metadata (file name, type, size, checksum, date added) |
| Beneficiary’s data | Name, email or phone and date of birth that you provide (only if you have set up a delivery). Not required for personal archives. Erabox processes them on your behalf, as processor. If you choose to let the Beneficiary know, Erabox sends them a privacy notice on your behalf within one month of their designation; if you choose confidential mode, the notice is given to them at the time of delivery. In no case does the notice reveal the content to them before delivery |
| Third parties’ data | Information about family members, ancestors or people mentioned in the documents added by the Owner — including any genealogical, civil-status or historical data. How these people are informed is described in § 03 |
| Technical session data | IP address, user agent, session ID, UTC timestamp — processed for security purposes and as proof of the declarations you make (audit trail) |
| Legal basis |
Storage, safekeeping and delivery of the capsule: carried out by Erabox on your behalf, as processor, in performance of the contract you have entered into with Erabox and of the Data Processing Agreement (Art. 6(1)(b) GDPR; Arts. 6 and 30–31 FADP). Documents containing data on health, religious or philosophical beliefs, trade union membership, sex life, genetic or biometric data: your explicit consent (Art. 9(2)(a) GDPR; Art. 6(7)(a) FADP). Documents relating to criminal convictions, offences and penalties: only the cases permitted by Art. 10 GDPR and, for users in Italy, by Article 2-octies of Italian Legislative Decree 196/2003; for Switzerland, Art. 5(c)(5) FADP. Data of living people mentioned in genealogical or historical documents: your legitimate interest in reconstructing and preserving your family history. You are the controller of that data, and Erabox stores it on your behalf: balancing your interest against the rights of the people mentioned is up to you. Anyone mentioned can object at any time under Art. 21 GDPR by writing to privacy@erabox.ch. If those documents contain health data about living people, your consent does not apply to them: you can only store them if they have consented. The historical research purpose under Art. 9(2)(j) requires a basis in law and the safeguards of Art. 89(1), which are not met here. Data of deceased persons: see § 05. Security, proof of declarations and legal obligations: Erabox’s legitimate interest in protecting the service and legal obligations (Art. 6(1)(c) and (f) GDPR) |
| Purposes | Secure long-term storage; safekeeping of personal and family documents; timed delivery to the Beneficiary (if set up); personal consultation with no delivery |
| Providing your data | Your email address, login details and payment data are needed to open and maintain the account: without them, the service cannot be provided. You provide the capsule content and the Beneficiary’s details freely; without a Beneficiary, the capsule remains a personal archive and is not delivered |
| Access to content | Within your account, only you can see the content. The Beneficiary receives it once the moment you have chosen arrives. Content is encrypted at rest with keys managed by Erabox, whose systems access it when needed to store, process and deliver it. Erabox processes the content on your behalf and does not use it for its own purposes. Staff access is limited to maintenance, security and support operations, is allowed only to authorised staff and is logged |
| Retention | Content: until delivery, for the duration of the subscription. If the subscription expires without renewal, there is a 30-day grace period, then the account is suspended in read-only mode for 12 months, then permanently deleted. If your death has been reported or confirmed by the Guardian, capsules already scheduled are not deleted for non-renewal and remain until delivery, up to a maximum of 10 years. After delivery, the content remains available for the 30 days the link is valid and is then deleted within 30 days. If you delete your account, the content is erased after 30 days. Access and data operation logs: 12 months. Billing data: 10 years under Swiss law |
| Automated decisions | Delivery linked to death takes place after the Guardian’s report or, with ‘after a long silence’, after their confirmation. Once the period of silence you have chosen has passed, Erabox sends you a reminder after 14 days and a second one after a further 7; if you do not log in within another 7 days, it contacts the Guardian. A 14-day safety window runs from the notice to the Guardian; logging in to the app before delivery stops the process. Delivery therefore always requires human involvement and is not a decision based solely on automated processing within the meaning of Art. 22 GDPR and Art. 21 FADP |
| Security | AES-256 at rest · TLS 1.3 in transit · logged access · checksums for document integrity |
| Security breaches | If a breach poses a high risk, Erabox informs the people concerned and notifies the competent authorities, under Arts. 33 and 34 GDPR and Art. 24 FADP |
| GDPR / FADP rights | Access (Art. 15 GDPR; Art. 25 FADP), rectification and erasure (Arts. 16 and 17 GDPR; Art. 32(1) and (2) FADP), restriction of processing (Art. 18 GDPR), portability (Art. 20 GDPR; Art. 28 FADP), objection to processing based on legitimate interest (Art. 21 GDPR). The FADP does not recognise objection in the same form: Swiss users can claim that their data is being processed against their express wishes, under Art. 30(2)(b) FADP. Write to privacy@erabox.ch. You can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) (Swiss users: edoeb.admin.ch) or with the supervisory authority in your country of residence (EU users). Full Privacy Policy → |
03
The people who appear in your documents
A birth certificate names the parents. A family tree names cousins who are still alive. A family photo shows people who don’t know they are in your archive. Those people have rights over their own data, even when you are the one who gathered the documents.
- Anyone who appears in your documents has the right to know that their data is stored and to request access, rectification and erasure, under Art. 14 GDPR and Art. 19 FADP.
- Erabox publishes a notice for anyone who believes their data is stored in a capsule, at erabox.ch/en/third-party-privacy-notice, and keeps a reporting channel open at privacy@erabox.ch, which also serves as a notice mechanism under Art. 16 of Regulation (EU) 2022/2065.
- By adding documents that concern other people, you undertake to do so with respect for their dignity and privacy. If one of those people contacts Erabox, Erabox will get in touch with you before taking any decision, unless the law requires otherwise.
- The Beneficiary and the Guardian. You are the one who processes the Beneficiary’s data, and Erabox stores it and uses it for delivery on your behalf. If you choose to let them know, Erabox sends them the privacy notice on your behalf within one month of their designation; if you choose confidential mode, it gives it to them at the time of delivery. The Guardian, on the other hand, is informed by Erabox, which is the controller of their data: the invitation they receive contains the link to the privacy notice. They need to know they have been designated, because they are the person Erabox asks to confirm the event. No notice reveals the content of the capsule before delivery. The text of the notice is published at erabox.ch/en/third-party-privacy-notice.
- Archive with no Beneficiary. If the capsule stays in your account with no delivery, you are acting for purely personal purposes and fall outside the scope of the GDPR (Art. 2(2)(c) GDPR). Erabox continues to store those documents on your behalf, as processor: the public notice and the reporting channel described above apply, as does the retention period set out in § 02.
04
Erabox’s role
Erabox is the controller for the data needed to run the service: registration and account, payments, security, verification of the delivery event, the Guardian’s data and legal obligations.
For the content you add to capsules and for Beneficiaries’ data, Erabox is the processor (Art. 28 GDPR; Art. 9 FADP): it stores and delivers them on your behalf, following your instructions and the Data Processing Agreement, without using them for its own purposes. You decide what to add, who to deliver it to and when, and you are responsible for those choices; Erabox is responsible for keeping it secure and delivering it correctly. If you add content for purely personal or household purposes, your processing falls under the exemption in Art. 2(2)(c) GDPR and Art. 2(2)(a) FADP; the rules of the Agreement still apply as terms of the service.
With regard to content, Erabox is a hosting service provider within the meaning of Art. 6 of Regulation (EU) 2022/2065. The point of contact for authorities and users is privacy@erabox.ch.
05
After your death
The GDPR does not apply to the data of deceased persons and leaves the matter to individual states. For users in Italy, Article 2-terdecies of the Italian Data Protection Code applies: anyone who has an interest of their own, acts to protect the data subject or has family reasons deserving protection can exercise the rights that belong to you. You can prohibit this, in whole or in part, with a written declaration sent to privacy@erabox.ch. The prohibition does not affect the delivery you have scheduled.
There is a second aspect, which concerns family documents. The data of a deceased person is almost always also data about living people: the cause of an ancestor’s death says something about their descendants, a photo shows those who survive them. For that part, the GDPR applies in full, with the rules in § 03.
06
What Erabox does not do
Erabox stores and delivers the documents you add. It does not check their authenticity, origin or lawfulness. Here you’ll find the limits of what it is responsible for.
- 1We do not check the authenticity, origin or completeness of the documents added to the capsule.
- 2We do not guarantee or certify the legal, historical or civil-status validity of the archived content.
- 3If a person mentioned in your documents brings a claim because you added their data in breach of the commitments made in § 03, you undertake to indemnify Erabox for the resulting consequences. This undertaking does not cover cases of intent or gross negligence on Erabox’s part and does not affect Erabox’s own liability towards that person under Art. 82 GDPR.
- 4We are not responsible for the interpretation of the documents by the Beneficiary or by third parties.
- 5We are not responsible for the consequences for relationships that receiving the content may cause between the people involved.
- 6If you store active login details, access codes or passwords, they are protected as described in § 01. Erabox is responsible for the security of processing under Art. 32 GDPR and Art. 8 FADP; choosing which login details to store and changing them regularly remain your responsibility.
- 7If the Beneficiary details you have entered are wrong, delivery may not take place. Erabox is not able to check them.
- 8If there is a technical interruption of the service, Erabox refunds the fees paid for the period concerned on a pro rata basis. The refund does not replace the compensation due by law.
- 9Erabox is not a notarial, legal or document authentication service. For documents with formal legal value, consult a qualified professional.
The limitations of liability and the indemnity obligations set out in this box and in the declarations in § 07 do not apply in cases of intent or gross negligence on Erabox’s part, nor within the mandatory limits laid down by consumer protection law (Art. 100 of the Swiss Code of Obligations; Italian Legislative Decree 206/2005 for users resident in Italy). Erabox’s liability under Art. 82 GDPR remains unaffected in all cases.
07
Your declaration
I have reached the age of 18 and have full legal capacity. The service is reserved for adults. If the Beneficiary I designate is a minor, I also state who exercises parental responsibility, and the privacy notice is given to that person.
I am lawfully in possession of the documents and information added, or have the right to store and share them.
For the third parties’ data contained in the documents, I am in one of these two situations: the person has consented, or the document serves to reconstruct and preserve my family history and I have assessed that the rights of the people mentioned in it do not override this interest (Art. 6(1)(f) GDPR). I have read § 03 and accept the commitments it contains.
I have checked that the Beneficiary’s details (name, contact details, date of birth), if provided, are correct and up to date.
I have read § 06 and understand that Erabox does not check the authenticity or lawfulness of the documents I add.
Consent to the processing of special categories of data (optional). I consent to Erabox storing and, if I have set up a delivery, delivering documents containing data on health, religious or philosophical beliefs, trade union membership, sex life, genetic or biometric data, under Art. 9(2)(a) GDPR and Art. 6(7)(a) FADP.
Erabox records this declaration with the session identifier, IP address and UTC timestamp in the capsule’s audit log. No handwritten signature is required.