Privacy notice

Last updated: 9 October 2026

This notice explains how we process the personal data of visitors to the Easy Sign website, of people who contact us and of customers who use the service, under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”).

1. Data controller

Creative Studio Lab
E-mail: info@creativestudiolab.it

2. Who this notice applies to

Visitors to the website and public pages (presentation, document verification).
People who contact us or ask for access to the service, for example by writing to info@creativestudiolab.it.
Customers who use the Easy Sign management area to send documents for signature.

Signers. When one of our customers sends a document for signature, that customer is the controller of the signer's data; Creative Studio Lab processes it on the customer's behalf as a processor (Article 28 GDPR), under a data processing agreement. Signers receive the sender's privacy notice on the signing page before they accept.

3. What data we process

Browsing data: IP address, browser, date and time, requested pages and outcome, recorded in server logs.
Contact data: name, email, company and the content of your message.
Customer data: identification and billing details, login credentials (passwords are stored only as a hash), service settings.
On behalf of customers: signers' data (name, email and optionally mobile number and PEC address), documents to be signed, audit trail with IP address and browser, one-time codes stored only in hashed form.

4. Purposes and legal bases

Purpose	Legal basis
Running the website and protecting it from abuse and attacks	Legitimate interest (Art. 6(1)(f))
Answering requests and enabling access to the service	Pre-contractual steps at your request (Art. 6(1)(b))
Providing the service, support and invoicing	Performance of a contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c))
Processing signers' data on the customer's instructions	Data processing agreement (Art. 28)
Establishing, exercising or defending legal claims	Legitimate interest (Art. 6(1)(f))

We do not carry out profiling or decisions based solely on automated processing. We do not use data for marketing without specific consent.

5. How long we keep data

Server logs: as long as needed for security, normally no more than 12 months.
Contact requests that do not lead to a contract: up to 24 months after the last contact.
Contract and billing data: 10 years, as required by Italian civil and tax law.
Documents, signed PDFs and signers' audit trails: for the period set by the customer (the controller), who can delete them under the service's retention rules.

6. Who we share data with

Data is processed by authorised staff of Creative Studio Lab and by suppliers who help us provide the service, appointed as processors: hosting and infrastructure providers, email and PEC services, tax and legal advisers. Data may be disclosed to authorities where required by law.

The timestamping services and OpenTimestamps calendars used for Bitcoin anchoring only receive cryptographic fingerprints (hashes) of documents and audit trails, from which neither the content nor any personal data can be derived.

7. Transfers outside the European Union

If a supplier involves a transfer of data outside the European Economic Area, it only takes place with the safeguards set out in Articles 44-49 GDPR, such as an adequacy decision or the standard contractual clauses approved by the European Commission.

8. Your rights

You can ask at any time for access to your data, rectification, erasure, restriction of processing, portability, and you can object to processing based on legitimate interest (Articles 15-22 GDPR), by writing to info@creativestudiolab.it. If your data is processed on behalf of one of our customers (for example as a signer), we will forward your request to that customer.

You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country of residence.

9. Providing your data

Providing contact data is optional, but without it we cannot answer your requests or enable the service.

10. Cookies

The website only uses technical cookies. See the cookie policy for details.