1
Who Erabox is and why you are receiving this document
Erabox SA, Via delle Fornaci 6 — 6826 Riva San Vitale (TI), Switzerland, processes your data in one of two roles, depending on your position:
- if you are a Guardian, Erabox is the controller: Erabox uses your data to verify the event that starts the delivery;
- if you are a Beneficiary, the representative of a Beneficiary who is a minor, or a person who appears in the content of a capsule, the controller is the Owner, who decided what content to keep and who to deliver it to; Erabox keeps it and delivers it on the Owner’s behalf as processor (Art. 28 GDPR; Art. 9 FADP).
In either case, you can contact Erabox. If your request concerns data that Erabox processes on the Owner’s behalf, Erabox forwards it to the Owner and helps them respond; if the Owner has passed away or does not respond, Erabox handles it directly.
Data Protection Officer (DPO): Massimiliano Nicotra, lawyer — privacy@erabox.ch.
EU representative: Massimiliano Nicotra, lawyer.
Erabox is a platform for memories and messages for the future: it lets people create personal messages and content to be delivered — automatically and securely — to the people they love, at the moment in life that matters most. The Owner chooses the recipient, the moment and the content. Erabox takes care of the delivery.
2
What data of yours we process
Your data was provided by the Owner: Erabox did not collect it directly from you. The categories of data depend on the role you have been given:
- First name and surname
- Email address
- Phone number (optional)
- Date of birth (if provided)
- Relationship to the Owner (e.g. child, partner)
- First name and surname
- Email address
- Phone number
- Type of relationship with the Owner
First name, surname, email, phone number and your capacity as parent or legal representative. We process only the data strictly necessary for your role as representative.
Content added by the Owner (texts, photos, recordings) may also concern you. Erabox keeps it on the Owner’s behalf and does not check what it contains. If you think a piece of content concerns you or breaks the law, you can report it to privacy@erabox.ch: Erabox reviews the report, tells you the outcome and gives reasons for any action taken (Art. 16 of Regulation (EU) 2022/2065).
3
Why we process your data and on what legal basis
| Purpose | Legal basis (GDPR) | Legal basis (FADP) |
|---|---|---|
| Guardian — sending you the invitation, this notice and requests for confirmation; verifying the event that starts the delivery (Erabox as controller) | Art. 6(1)(f) Legitimate interest of Erabox and the Owner in reliable verification of the event | Art. 6 FADP; Art. 31(1) FADP |
| Beneficiary — keeping your contact details and delivering the content to you at the time chosen by the Owner (Erabox as processor) | Processing carried out on the Owner’s behalf, on their instructions (Art. 28 GDPR). An Owner acting for personal or household purposes falls within the exemption in Art. 2(2)(c) GDPR | Art. 9 FADP; Art. 2(2)(a) FADP |
| Beneficiary — letting you access the content you received and verifying your identity on delivery, if required (Erabox as processor) | Processing carried out on the Owner’s behalf, on their instructions (Art. 28 GDPR) | Art. 9 FADP |
| Everyone — security, abuse prevention and access logs (Erabox as controller) | Art. 6(1)(f) Legitimate interest in the security of the service | Art. 31(1) FADP; Art. 4 Data Protection Ordinance |
Your data is never used for marketing, commercial profiling, sale to third parties or to contact you with promotional messages. Your contact details are in our system only so that the Owner can keep you reachable.
4
How long we keep your data
| Situation | Retention period |
|---|---|
| The Owner is active and keeps you as a recipient | For as long as the Owner’s account exists |
| The Owner removes you from their list | Deletion within 30 days |
| The content has been delivered | For the 30 days the delivery link is valid, then deletion within 30 days |
| The Owner’s subscription expires without renewal | 30-day grace period and 12 months of read-only suspension, then deletion. If the Owner’s passing has been reported or confirmed by the Guardian, the data is kept until delivery, up to a maximum of 10 years. |
| The Owner’s account is closed | Deletion within 30 days of closure |
| You ask for deletion | Within 30 days of your request |
In all cases, Erabox keeps the technical logs needed for security for 12 months, as required by Art. 4(5) of the Swiss Data Protection Ordinance.
5
Who we share your data with
Your data is not sold or passed on to third parties for commercial purposes. It may be shared only with:
Providers of hosting, databases and email and notification sending, which act as processors or sub-processors under a written contract. The up-to-date list, with their location and the safeguards for transfers, is in section 05 of the Privacy Policy.
Only where required by law — a request from a Swiss or European judicial or police authority — and only to the extent strictly necessary.
The Owner can see your name and the fact that you have been named, but never has access to your login details, your bank details or any other private information beyond what they entered themselves.
6
Your rights
Even if you are not directly one of our users, you have all the rights provided by the GDPR (Arts. 15–22) and the FADP (Arts. 25–32):
You can ask us to confirm whether we process data about you and get a copy of it.
You can ask us to correct inaccurate or incomplete data about you.
You can ask for your data to be erased. In that case, we will tell you if removing it means you will not be able to receive the content intended for you.
You can object to processing based on legitimate interest. We will consider your request and reply within 30 days.
You can receive your data in a structured, machine-readable format.
In certain circumstances, you can ask us to suspend processing while we look into your request.
7
How to exercise your rights
To verify your identity before replying, we may ask you for a copy of an identity document with everything except your first name, surname and date of birth blacked out. This is not mandatory, but it helps us protect your data from unauthorised requests.
If your request is complex, this period can be extended by a further 60 days — we’ll let you know within the first 30 days.
You can contact us at privacy@erabox.ch — we’re here to help, even if you just want to understand. You don’t need an account to do so.
8
Complaints to a supervisory authority
If you believe the processing of your data breaches the applicable law, you have the right to lodge a complaint with a supervisory authority:
Federal Data Protection and Information Commissioner (FDPIC)
You can contact the data protection authority of the EU country where you live.
We’re happy to help sort out any question or problem directly: privacy@erabox.ch. We care about getting this right.