Skip to content

Website Privacy Notice

Version: 2.0 – Last updated: 28 October 2026

Processing of personal data of visitors to the Site www.checksig.com and of people who contact CheckSig, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679.

This Notice describes how CheckSig S.r.l. Società Benefit processes the personal data of people who visit the website www.checksig.com or contact CheckSig (browsing, requests and meetings, events, newsletter, third-party services, Group companies, recipients, transfers and rights).

  • Document type: Privacy notice (Articles 13-14 GDPR)
  • Addressees: Visitors to the Site and people who contact CheckSig through the Site or at events
  • Controller: CheckSig S.r.l. Società Benefit
  • Privacy contact: [email protected]

References: Regulation (EU) 2016/679 (GDPR) Articles 5-7, 12-22, 26, 28, 32-34, 44-46, 77, 79 · Italian Legislative Decree 196/2003 Articles 122 and 130 · Regulation (EU) 2023/1114 (MiCAR) Article 71 · Garante Guidelines on promotional activities and combating spam of 4 July 2013 · Garante Guidelines on cookies and other tracking tools of 10 June 2021 · ISO/IEC 27701 · Cookie Policy · Customer Privacy Notice · Terms of Service · Decision 2000/518/EC (adequacy of Switzerland) · PRO Procedure for drafting and managing privacy notices.

1. Summary

This summary gives a quick overview of how CheckSig processes the data of people who visit the Site or contact CheckSig. Full details are set out in the following chapters.

  • Who processes the data: CheckSig S.r.l. Società Benefit, a crypto-asset service provider authorised under Regulation (EU) 2023/1114 (MiCAR), acting as data controller. Some data may be disclosed to the other companies of the CheckSig Group.
  • What data: Technical browsing data and data provided by the Data Subject when filling in forms, writing to CheckSig, booking a meeting or enrolling in the Academy.
  • Why: To operate and protect the Site, respond to requests received, manage registrations for events and workshops, send the newsletter and promotional communications to those who have consented to them, and comply with legal obligations.
  • Consent: Newsletter, promotional communications and profiling require the Data Subject’s consent, which may be withdrawn at any time without any consequences for the use of the Site.
  • Users and Customers: For those who begin the Registration process and for Customers, the processing of data for the provision of the Services is described in the Customer Privacy Notice, published on the Site and available in the App.
  • Outside the EEA: Some providers (for example cloud and CRM services) may process data in the United States, with the safeguards provided for by the GDPR.
  • Rights: Access, rectification, erasure, restriction, portability, objection, withdrawal of consent and lodging a complaint with the Italian Data Protection Authority (Garante). Requests should be sent to [email protected].

2. Scope

CheckSig S.r.l. Società Benefit (hereinafter, ”CheckSig” or the ”Controller”), pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter, the ”GDPR”) and Italian Legislative Decree 196/2003 (hereinafter, the ”Privacy Code”), informs the people who visit the website www.checksig.com, including its subdomains (*.checksig.com) (hereinafter, the ”Site”, as defined in the Terms of Service), or who contact CheckSig through the Site, through the channels indicated on it or at events (hereinafter, the ”Data Subjects”) about how their personal data are processed.

This notice does not cover:

  • Users and Customers: the processing of data for Registration, customer due diligence and the provision of the Services, including through the App, which is described in the Customer Privacy Notice that the User reads and acknowledges during Registration together with the Terms of Service. Acknowledgement confirms that the User has read the Customer Privacy Notice and does not amount to consent to the processing of personal data;
  • Whistleblowing reports: the processing of data relating to reports of breaches, described in the Whistleblowing Policy published on the Site;
  • Third-party websites: the processing of data by third-party websites reachable through links on the Site, which is governed by the privacy notices of their respective controllers;
  • Swiss website: the website checksig.ch, whose controller is CheckSig Suisse AG and which has its own privacy notice.

The use of cookies and other tracking tools is described in the Cookie Policy, a separate document that supplements this notice.

3. Data controller and contact details

The data controller is CheckSig S.r.l. Società Benefit, tax code and VAT number 11028330964, with registered office at Piazza del Liberty 8, 20121 Milan (MI), Italy, acting through its legal representative.

For any matter relating to the processing of personal data and to exercise their rights, Data Subjects may write to [email protected] or, by certified email (PEC), to [email protected], or send a written communication to the registered office.

CheckSig has not appointed a Data Protection Officer (DPO); requests are handled by the Compliance & Complaints team at the contact details given above.

4. Categories of personal data processed

Browsing data

During browsing, the systems that operate the Site automatically record certain technical data: IP address, date and time of the request, resource requested, method and response code, size of the response, referring page, browser type, operating system and device. This includes the data processed by the services that protect the Site from cyber attacks and unauthorised access.

Data voluntarily provided by the Data Subject

CheckSig processes the data that the Data Subject provides by filling in the forms on the Site or by contacting CheckSig by email, telephone or WhatsApp, or by leaving their contact details at events and trade shows, for example first and last name, email address, telephone number, company and role, language, interests, content of requests and messages, date and format of the booked meeting. The Data Subject is asked not to provide data that are not necessary for the request, in particular special categories of data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR). Where the Data Subject has authorised it, CheckSig may also receive their contact details from the organiser of an event.

Third-party data

If the Data Subject provides data of other people (for example by booking a meeting for a family member as well, or by indicating a company contact person), they warrant that they have informed those people and are entitled to provide their data. CheckSig processes such data only for the purpose for which they were provided and provides the persons concerned with this notice at the latest at the time of the first communication with them (Article 14(3)(b) GDPR).

5. Purposes, legal bases and retention period

a) Operation, security and integrity of the Site: delivery of pages, prevention and detection of cyber attacks, fraud and unauthorised access.

  • Legal basis: legitimate interest of the Controller in the security and proper operation of the Site (Article 6(1)(f) GDPR).
  • Retention period: browsing data: no longer than 12 months from collection, unless further retention is necessary to investigate an incident or an offence.

b) Aggregate statistics on the use of the Site, using tools that do not install cookies and do not identify the Data Subject.

  • Legal basis: legitimate interest of the Controller in understanding how the Site is used in order to improve it (Article 6(1)(f) GDPR).
  • Retention period: data processed in aggregate form, without persistent identifiers of the Data Subject.

c) Responding to requests for information and contact (email, telephone, WhatsApp, Site forms, contact details left at events and trade shows) and booking of information meetings.

  • Legal basis: taking steps at the Data Subject’s request prior to entering into a contract (Article 6(1)(b) GDPR) or, for requests not aimed at entering into a contract, legitimate interest of the Controller in responding to them (Article 6(1)(f) GDPR).
  • Retention period: 6 months from the last communication, if the request is not followed by a contractual relationship; in the event of Registration, the Customer Privacy Notice applies.

d) Registration for and participation in workshops, events and webinars organised or promoted by CheckSig, including the Academy.

  • Legal basis: fulfilment of the participation request (Article 6(1)(b) GDPR).
  • Retention period: 12 months from the date of the event.

e) Sending the newsletter and promotional and informational communications about CheckSig’s services, initiatives and events, including event invitations and market research, by email, telephone, SMS or messaging apps, also to contacts collected at events who have consented to this.

  • Legal basis: consent of the Data Subject (Article 6(1)(a) GDPR; Article 130 Privacy Code).
  • Retention period: until consent is withdrawn and in any case no longer than 24 months from its collection, unless renewed.

f) Profiling: analysis of preferences and of interaction with the communications received (for example opens and clicks), in order to personalise their content.

  • Legal basis: consent of the Data Subject (Article 6(1)(a) GDPR).
  • Retention period: until consent is withdrawn and in any case no longer than 12 months from its collection, unless renewed.

g) Participation in questionnaires, surveys, competitions and referral programmes promoted by CheckSig.

  • Legal basis: performance of the terms and conditions of the initiative the Data Subject joins (Article 6(1)(b) GDPR); consent, where required for further purposes (Article 6(1)(a) GDPR).
  • Retention period: duration of the initiative and 12 months from its end, unless otherwise specified in its rules. In referral programmes the message is sent directly by the Data Subject using their personal link or code: CheckSig does not receive or retain the data of the people invited, unless they start the Registration or contact CheckSig.

h) Handling of complaints submitted through the form available on the Site or the other channels indicated in the Complaints Handling Policy.

  • Legal basis: legal obligation concerning the handling of customer complaints (Article 71 MiCAR; Article 6(1)(c) GDPR); for complaints from non-customers, legitimate interest of the Controller (Article 6(1)(f) GDPR).
  • Retention period: 5 years from the closure of the complaint, as provided for in the Complaints Handling Policy, unless further retained for purpose j).

i) Compliance with legal obligations and responding to requests from the competent authorities.

  • Legal basis: legal obligation (Article 6(1)(c) GDPR).
  • Retention period: for the periods laid down by the provision imposing the obligation.

j) Establishment, exercise or defence of a right of the Controller in judicial or out-of-court proceedings.

  • Legal basis: legitimate interest of the Controller (Article 6(1)(f) GDPR).
  • Retention period: limited to the necessary data, where there is a dispute or a concrete risk of litigation: for the limitation period of the rights (normally 10 years, Article 2946 of the Italian Civil Code) and, in the event of litigation, until it is settled.

Once the retention periods have expired, the data are deleted or irreversibly anonymised. The data are not used for purposes other than those indicated without prior notice and, where necessary, the Data Subject’s consent.

The processing of any photographs or audiovisual recordings taken at events and of webinar recordings is covered by a specific notice, provided at the time of registration or at the entrance to the event.

6. Nature of the provision of data

The provision of browsing data is necessary to browse the Site. The provision of data for purposes c), d), g) and h) is necessary to follow up on the Data Subject’s request: without it, CheckSig cannot respond, record the registration or handle the complaint. The provision of data and consent for purposes e) and f) and for promotional communications from Group companies is optional: refusal or withdrawal has no consequences for browsing the Site, for the ability to contact CheckSig or for any services requested.

7. Processing methods and security

The data are processed mainly by electronic means, only by authorised personnel who need them for their work, with security measures appropriate to the risk (Article 32 GDPR), including encryption of communications (HTTPS), protection of the Site against cyber attacks, access limited to the minimum necessary and multi-factor authentication. CheckSig’s security controls are audited every year by an independent auditor (SOC 1 Type II and SOC 2 Type II attestations).

Requests and contacts are managed in CheckSig’s CRM, accessible only to the teams that need it (for example customer relations, sales and marketing). In the event of a personal data breach, CheckSig complies with the obligations laid down in Articles 33 and 34 GDPR.

8. Cookies

Information on the use of cookies and other tracking tools, including consent management, is set out in the Cookie Policy. Choices can be changed at any time via the “Cookie preferences” link at the bottom of every page of the Site.

9. Social media pages and third-party services embedded in the Site

CheckSig manages pages and profiles on social networks (including LinkedIn, Facebook, Instagram, X and YouTube). For the aggregate page statistics provided by the platforms, CheckSig and the platform operator may act as joint controllers (Article 26 GDPR), in accordance with the arrangements made available by the platforms themselves; for any other processing, the platforms act as independent controllers in accordance with their own privacy notices.

Some pages of the Site embed third-party content or services, which may collect the Data Subject’s data when the Data Subject interacts with them: videos (YouTube, in privacy-enhanced mode), podcasts, event registration (Eventbrite), questionnaire and complaint forms (Google Forms) and the WhatsApp messaging service. Third-party content that uses cookies or other identifiers, including YouTube videos, is enabled only after the Data Subject’s consent, where required by the Cookie Policy. Where these providers process data on behalf of CheckSig, they act as processors; in other cases they act as independent controllers.

10. Recipients of the data

The data may be disclosed, to the extent necessary for the purposes indicated, to the following categories of recipients:

  • providers of hosting, content delivery and Site protection services (for example Amazon Web Services and Cloudflare);
  • providers of CRM, newsletter delivery, form management and meeting booking services (HubSpot);
  • providers of collaboration and online form services (Google);
  • providers of messaging services (WhatsApp, Meta Platforms Ireland Ltd.), for requests received through that channel;
  • providers of analytics and advertising services, limited to data collected with the Data Subject’s consent as set out in the Cookie Policy;
  • event registration platforms (Eventbrite) and providers of services for the organisation of events and webinars;
  • legal advisors, audit firms, the board of statutory auditors and the firm appointed to perform the outsourced internal audit function;
  • competent authorities (including CONSOB and the Bank of Italy), judicial or administrative authorities, where required by law.

Providers that process data on behalf of CheckSig are appointed as processors pursuant to Article 28 GDPR; the other recipients act as independent controllers. The data are not made public. The up-to-date list of processors is available on request at the contact details given in chapter 3.

11. Group companies

CheckSig is the parent company of the CheckSig group (hereinafter, the ”Group”), which includes CheckSig Suisse AG, based in Switzerland. The up-to-date list of Group companies is available on request at the contact details given in chapter 3. The data may be disclosed to the Group companies, which process them as independent controllers or, when acting on behalf of CheckSig, as processors:

  • Group management: for internal administrative and organisational purposes, such as the management and coordination exercised by the parent company, risk control and the management of shared services, on the basis of CheckSig’s legitimate interest (Article 6(1)(f) and Recital 48 GDPR);
  • Requests falling within the remit of another Group company: to follow up on requests concerning services provided by another Group company, for example those from people resident in Switzerland, to whom CheckSig’s Services are not offered, on the basis of the Data Subject’s request (Article 6(1)(b) GDPR);
  • Promotional communications from Group companies: only with specific consent, separate from the consent for purpose e) (Article 6(1)(a) GDPR; Article 130 Privacy Code).

Data disclosed to Group companies are retained for the periods indicated in chapter 5 for the purpose for which they were collected.

12. Transfer of data outside the European Economic Area

Some of the recipients indicated, in particular providers of cloud and CRM services, may process data outside the European Economic Area (EEA), in particular in the United States. In such cases, the transfer is based on an adequacy decision of the European Commission (Article 45 GDPR), including the EU-US Data Privacy Framework for certified recipients, or on standard contractual clauses approved by the Commission (Article 46(2)(c) GDPR), supplemented where necessary by additional measures. Transfers to Switzerland, for example to CheckSig Suisse AG, are based on European Commission adequacy decision 2000/518/EC. A copy of the safeguards adopted may be requested at the contact details given in chapter 3.

13. Automated decision-making and profiling

The data collected through the Site are not subject to decisions based solely on automated processing which produce legal effects concerning the Data Subject or similarly significantly affect them (Article 22 GDPR). The profiling described in purpose f) serves exclusively to personalise communications and advertising content and is carried out only with the Data Subject’s consent.

14. Minors

The Site is intended for adults. CheckSig does not knowingly collect data of minors under 18 through the Site; subscription to the Services on behalf of minors is made by the parent exercising parental responsibility or by another legal representative, in accordance with the Terms of Service and the Customer Privacy Notice. If CheckSig becomes aware of data of a minor collected through the Site, it deletes them without delay.

15. Rights of the Data Subject

The Data Subject may exercise the following rights at any time:

  • Access: obtain confirmation as to whether or not data concerning them are being processed and receive a copy (Article 15 GDPR);
  • Rectification: obtain the correction of inaccurate data and the completion of incomplete data (Article 16 GDPR);
  • Erasure: obtain the erasure of data in the cases provided for (Article 17 GDPR);
  • Restriction: obtain the restriction of processing in the cases provided for (Article 18 GDPR);
  • Portability: receive the data provided in a structured, commonly used and machine-readable format and transmit them to another controller, for processing based on consent or on a contract and carried out by automated means (Article 20 GDPR);
  • Objection: object at any time, on grounds relating to their particular situation, to processing based on legitimate interest (purposes a), b) and j), purposes c) and h) where based on legitimate interest, and disclosures to Group companies for Group management) (Article 21 GDPR) and, without having to give reasons, to processing for direct marketing purposes, including related profiling (Article 21(2) GDPR);
  • Withdrawal of consent: withdraw consent given at any time, without affecting the lawfulness of processing carried out before the withdrawal (Article 7(3) GDPR). For the newsletter, the unsubscribe link in every communication is sufficient; for cookies, the “Cookie preferences” link.

Requests may be sent to [email protected] or by certified email (PEC) to [email protected]. CheckSig responds without undue delay and in any event within one month of receipt; this period may be extended by two further months where requests are complex or numerous, in which case the Data Subject is informed within the first month. Responses are free of charge, except in the case of manifestly unfounded or excessive requests (Article 12(5) GDPR). CheckSig may ask for information needed to verify the identity of the requester and communicates any rectification, erasure or restriction to the recipients to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort (Article 19 GDPR).

16. Right to lodge a complaint

A Data Subject who considers that the processing of their data infringes the GDPR has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Article 77 GDPR), following the procedures indicated at www.garanteprivacy.it, or with the supervisory authority of the Member State of their habitual residence or place of work, and to bring proceedings before the competent courts (Article 79 GDPR).

17. Changes and updates

CheckSig may amend or update this notice, including as a result of changes in legislation or in the services and tools used. The version in force is always published on this page with the date of the last update; in the event of material changes, CheckSig will highlight them on the Site and, where necessary, ask for consent again.

Last updated: 28/10/2026.

18. Version history

  • 2.0 – 28/10/2026: Full revision: scope limited to the Site, with reference to the Customer Privacy Notice; terminology aligned with the Terms of Service; purposes, legal bases and retention periods updated, including contacts collected at events; disclosure to Group companies; transfers outside the EEA; Data Subjects’ rights.
  • 1.0 – 15/02/2022: First issue.