Last updated: 7 November 2026
This policy explains which personal data METIS Italia (the website www.metisitalia.it and the Election Day and Poll services) processes, why, how long it keeps them and what your rights are, under Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003.
1. Who processes the data
Data controller: Silvia Baudrino, Corso Magenta 1/10a, tax code BDRSLV63S45L219J, certified email (PEC) silvia.baudrino@pec.it, email info@metisitalia.it ("METIS Italia").
METIS Italia is the controller of the data of website visitors, of people who create an account to organise elections, of payments, of messages sent through the contact form or support tickets, and of Poll surveys.
Election Day elections. Candidates' and voters' data are entered by the organiser of the election (association, school, professional body, company, condominium...), who is their controller: the organiser decides who votes and why. METIS Italia processes these data on the organiser's behalf as a processor (art. 28 GDPR), only to run the election. If you are a voter or a candidate, please contact the organiser first to exercise your rights; if you write to METIS Italia, we will forward your request to the organiser and help them answer.
Support. To solve problems and answer organisers' requests, METIS Italia's authorised support staff can view an organiser's private area in read-only mode (elections, candidates, voters, results). Every access is logged with date, time and the name of who did it. Not even support staff can know who voted for what.
Elections overview. To run and improve the service (support, platform capacity, sending pace, compliance with plans and abuse prevention) METIS Italia super-administrators see an overview of all elections with service data only: title, organiser, status, dates, number of candidates, voters, invitations, openings and voters who voted, turnout, settings and plan. The overview does not show names and emails of voters and candidates, and nobody, not even METIS Italia, can know who voted for what. Every consultation is logged with date, time and the name of who made it.
Monitoring dashboard. To notice malfunctions, abuse and requests to follow up at once, METIS Italia super-administrators use a read-only app that checks the site every 10 minutes and shows data the site already processes: new organiser accounts (name, email, organisation), contact form messages, sender and subject of emails received in the info@ mailbox, polls created and number of answers, payments, tickets, service data of elections (never voters, candidates or choices; votes are counted by day only) and visit totals; since 06/11/2026, for the security of the site (abuse, attacks, bots), also the list of visitors with IP address, country, pages viewed and browser, visible to super-administrators only. The news found are kept for 90 days, the results of the technical checks for 30 days. Access is only through a link by email tied to the device and, if switched on, Face ID or fingerprint: the site keeps only a hash of the device code and the public key of the unlock (face and fingerprint stay on the phone). Since 06/11/2026 the app also shows organiser logins to the reserved area, new password requests and newly authorised devices; it lets super-administrators read in full the emails of the info@ mailbox (which stay on the mail server) and move them to the mailbox Trash. For each super-administrator it keeps which news they have read or moved to the trash (logical deletion only, with the same retention as the news) and, for each device, date and outcome of the last notification. Phone notifications go, encrypted, through the browser maker's service; by default they contain only the category and counts, names and subjects only if the super-administrator chooses so on their own device.
2. Which data we process
Website visits
- Technical browsing data: IP address, browser type, page visited, referring page, date and time, and any code of one of our messages contained in the link. The website stores them in its access log; the hosting provider also records them in its technical logs. From the IP address the website works out the country only, using a database kept on its own server (DB-IP IP to Country Lite): the address is not sent to any external service. Of the referring page we keep only the site and page name, without the link parameters (personal codes such as the voting link code are never recorded).
- Cookies and browser storage: technical session cookie (needed to log in and to protect forms) and a cookie that remembers your choices on the cookie banner. Details are in the Cookie Policy.
Organiser account (reserved area)
- First and last name, email, password (stored only as a non-reversible hash), language; optional: company name, address, town, province, postcode, country, phone, VAT number or tax code.
- Access to the reserved area (access log as above); failed login attempts (hash of the email and IP address, to block repeated attempts).
- Support requests written to the team (name, subject and message text, the team's replies).
- Consent to receive news and offers (optional, asked at sign-up with a separate box that is not pre-ticked): if you give it we store the consent and its date. You can withdraw it at any time by writing to info@metisitalia.it.
- Organisation logo, if you upload it for the counting report (with an unlock or a licence).
- Use of the free services: we record events such as "election created", "limit reached", "unlock purchased", "report downloaded", linked to your account and the election but without any voter data, to count the free elections of the month and improve the service.
License and unlock payments
- First and last name given in the payment, license type, amount, currency, transaction codes, validity period. Payment takes place on PayPal: METIS Italia does not receive or store card or account details.
- Unlock of a single election: unlocked election, tier purchased, amount, PayPal transaction code, payer email provided by PayPal, date and any refund.
Election Day elections (data entered by the organiser)
- Candidates: first and last name, email (encrypted), optional photo and presentation. Name, photo and presentation are shown to voters on the ballot and, once voting has closed, in the results.
- Voters: first and last name, email (stored encrypted, plus a non-reversible fingerprint computed with a secret key, used only to avoid duplicates and to search for an address), personal voting link.
- Invitation progress, visible to the organiser: date the email was sent; date the email was opened, detected through a small image in the email (if the mail program downloads images); date the voting link was opened; date of the last reminder sent; day of the vote (date only, no time). The organiser knows who voted, never how.
- Ballot box: ballots are stored in a separate table without the voter's name, email, personal link, time or IP address: they contain only the choices, a random key, the day and the fingerprint (hash) of the receipt code. Only the voter knows the receipt code.
- Blind signature (normally active in new elections): voting takes place in two separate requests. In the first one, with the personal link, the server checks the right to vote and signs a "token" without being able to see it; in the second one, anonymous and a few seconds later, the browser submits the ballot with the signed token. The server only keeps the fingerprint of tokens already used (to prevent double voting), with no link to the voter. Not even whoever runs the server can link a ballot to a name.
- Proxy voting (from 07/11/2026, only if the organiser allows it): who grants the proxy and who receives it (both voters in the same election), status of the proxy (to approve, active, used, revoked, declined), who entered it (organiser or voter), any notes by the organiser (for example the reference of the written proxy), date of entry and activation and only the day of use, revocation or refusal. To grant a proxy the voter enters the proxy holder's email, which we look up only through its fingerprint, without decrypting the list. Proxies are visible to the organiser; the person granting the proxy sees the proxy holder's name and the proxy holder sees the name of the person who appointed them. We send notification emails to the person granting the proxy, to the proxy holder and, for proxies to approve, to the organiser. A ballot cast by proxy reaches the ballot box anonymously like all the others and the proxy is not linked to the ballot in any way; as with a paper proxy, the proxy holder knows the vote they cast on behalf of the other person.
- Check on the first click (from 07/11/2026, if the organiser chooses it): with the code by email we store only a fingerprint (HMAC) of the 6-digit code, its expiry (15 minutes), the number of attempts and of codes requested, and we send the code to the invitation email; with the personal detail (e.g. membership number) the detail is uploaded by the organiser and stored encrypted like the email. The outcome is valid only for the browser session and is not linked in any way to the ballot.
- In-person voting (from 07/11/2026, if the organiser chooses it): who voted in the room, marked by the organiser (only the day, as for online voting), and the anonymous totals of the paper ballots (ballots, blank, invalid, votes per candidate).
- Automatic reminders (from 07/11/2026): if the organiser chooses them, reminder emails to those who have not voted yet are sent automatically (at most one every 12 hours per person); in the election we store only the date of the last round.
- Voter's browser storage: in elections with blind signature, until the ballot is submitted the browser keeps the token, signature and choices locally (localStorage), to complete the vote if the page closes or the connection drops. These data stay on the device, are never sent together with the personal link and are deleted automatically after submission.
- In elections with blind signature we send voters a participation confirmation email: it contains only the election title and the link to the results, never the choices or the receipt code.
- Counting report: names of the chair and of the secretary / scrutineer, if the organiser enters them, printed on the PDF. The report never contains the list of voters or the choices; if the election allows proxies it lists the valid proxies (who appointed whom and whether the proxy was used), as in the minutes of a meeting.
- Rows waiting for the unlock: if the organiser imports more voters or candidates than the free plan allows, the extra ones (first and last name, encrypted email) are kept aside until the election is unlocked, for at most 30 days.
- Public receipt check: the code entered is used only to check that the ballot is in the box; we store neither the code nor the result.
Public demo ("Try voting")
- We ask for no name or email: we create an anonymous test voter with a one-off link. Demo choices and ballots are reset every day.
Find a date (date poll without sign-up)
- Poll creator: title, description, place, proposed dates and, if entered, name and email (used only to send the links and kept as long as the poll exists). The management link is stored only as a fingerprint. If linked to the creator's account, the poll is associated with that account.
- Participants: the name they type and their answers (yes / if need be / no), visible to all participants; a technical cookie and a personal link let them change their answer (the code is stored only as a fingerprint). We store neither email nor IP address.
To-do list (to-do without sign-up)
- Whoever creates a list: the list name and, if entered, the email (used only to send the personal link or to resend it if lost). If logged in to their account, the list is linked to the account.
- The content they write: projects, tasks, tags, deadlines, priorities, names of the people set as assignees, notes on completed tasks and any attached files (up to 50 MB per list). Whoever uses the list is the controller of the data of the people they enter in it.
- The personal link opens the list: it is stored only as a fingerprint and in a technical browser cookie. Whoever has the link can see and change the list. We do not store the IP address with the list.
Usage limits per IP address
- To prevent abuse of the free services (sign-up, receipt check, demo, Find a date, To-do list, Poll, counting report and meeting minutes) we count attempts per IP address. The address is not stored: we keep only a fingerprint encrypted with a secret key, together with the counter, and delete it at the end of the time window (at most 24 hours).
Meeting tools (quorum calculator and meeting minutes)
- The calculator works only in the browser: the figures entered are not sent to or stored by METIS Italia.
- In the minutes generator the data entered (body, attendees, proxies, votes, texts) stay in the browser storage of the device (localStorage) until you clear them with «New minutes» or by clearing the site data. When you request the PDF the data go through the server only while the file is created; the file is handed to you and not kept.
- Whoever uses the generator is the controller of the data of the people they enter in the minutes.
Poll surveys
- Survey creator: title, description, options and optional images, deadline, language, theme and, if entered, name and email (used only to send the links); IP address. The management link is stored only as a fingerprint. If linked to an account, the survey is associated with that account.
- Participants: the name they type, their choices and the optional reaction (an emoticon next to the name), visible to all participants; the IP address, stored with the choices to prevent abuse; a technical cookie and a personal link let you change your answer (the code is stored only as a fingerprint). The Poll is meant for informal decisions and does not offer the secrecy guarantees of Election Day.
- Abuse checks (Poll and Find a date): METIS Italia super-administrators can see the contents of surveys (texts, options, images, participants' names) to check that they are not used for illegal purposes, and can suspend or delete them. Every suspension or deletion is logged with date and author. A suspended survey is kept until a super-administrator deletes it, even beyond the periods indicated below, if it may be needed as evidence.
Contact form and support requests
- Name, email, subject and message text.
- Every contact-form message, every request from the reserved area and the emails to info@ that the team decides to follow become a support request (ticket) with a code: only super-administrators and the team members who handle support read it, and they can add internal notes. Replies arrive by email with the code in the subject; if you reply to that email, your message is added to the request.
3. Why we process them and on what legal basis
| Purpose | Legal basis |
|---|
| Creating and managing the account, providing the reserved area and support (tickets) | Performance of a contract (art. 6.1.b) |
| Running elections on behalf of the organiser: invitations, ballot, counting, results, results email and PDF counting report for the organiser, receipt check | Contract with the organiser and their instructions (art. 28); for the organiser, the basis of their own relationship with voters |
| Showing the organiser the invitation progress (emails opened, links opened, vote cast) | Organiser's legitimate interest in checking that the notice arrived and in sending an email reminder (at most one every 12 hours) to those who have not voted yet (art. 6.1.f) |
| Handling payments and accounting and tax obligations | Contract and legal obligation (art. 6.1.b and 6.1.c) |
| Answering contact form messages | Pre-contractual measures / request of the data subject (art. 6.1.b) |
| Providing the Poll service and preventing double votes | Performance of the requested service (art. 6.1.b) |
| Checking that Poll and Find a date are not used for illegal purposes, suspending or deleting surveys that breach the terms of use or the law | Legitimate interest in preventing illegal use of the service and protecting participants; legal obligation when the authorities request it (art. 6.1.f and 6.1.c) |
| Providing the free services: Free plan, single unlock, PDF report, demo, Find a date, To-do list, public receipt check | Performance of the requested service (art. 6.1.b) |
| Sending news and offers from METIS Italia by email | Optional consent, withdrawable at any time (art. 6.1.a) |
| Counting the use of the free services (events without voter data) and preventing abuse (limits per IP address, reCAPTCHA, refusal of disposable emails) | Legitimate interest in offering the free service in a sustainable and secure way (art. 6.1.f) |
| Elections overview for super-administrators (service data only, without voter and candidate data) | Legitimate interest in running, sizing and protecting the service; for election data within the organiser's instructions as processor (art. 6.1.f and art. 28) |
| Monitoring dashboard of the super-administrators (alerts on new sign-ups, contacts, emails, polls, payments, errors and unreachable services) | Legitimate interest in running the service, answering requests quickly and preventing abuse and malfunctions; for election data within the organiser's instructions as processor (art. 6.1.f and art. 28) |
| Security: blocking repeated login attempts, anti-bot protection of forms (reCAPTCHA), access log, backups | Legitimate interest in the security of the service (art. 6.1.f) |
| Visit statistics of the Poll voting page (Google Analytics) | Consent, given through the cookie banner (art. 6.1.a) |
| Defending our rights in case of disputes | Legitimate interest (art. 6.1.f) |
We do not use the data for advertising, profiling, remarketing or newsletters, we do not sell them and we make no automated decisions producing legal effects on people. Mandatory form fields are needed to provide the service: without them it is not possible, for example, to create the account or send the invitations.
4. How we protect the data
- Encrypted connection (HTTPS); passwords stored only as a non-reversible hash; candidates' and voters' emails encrypted in the database.
- Separation between voter register and ballot box, blind signature, receipt code kept only as a hash; ballot box published after closing only if it contains at least 5 ballots, so that a few ballots cannot reveal anyone's vote.
- Each organiser sees only their own elections; protection of forms against forged requests; automatic logout after 30 minutes of inactivity; lock after failed login attempts.
- Access to the data limited to those who need to run the service, under a confidentiality obligation.
5. Who we share the data with
Data are not disclosed to the public. Only as far as necessary, they may be received by these providers, acting as processors or as independent controllers for their own services:
- Aruba S.p.A. (Italy): website and database hosting, sending emails. Policy
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): license payments. Policy
- Google (Google Ireland Ltd / Google LLC): reCAPTCHA on the contact, Poll, sign-up, Find a date and receipt-check forms, Google Fonts typefaces, Google Analytics on the Poll voting page only. Policy
- Library delivery services (jsDelivr, cdnjs/Cloudflare, code.jquery.com, cdn.datatables.net) and, in the reserved area only, the TinyMCE text editor (Tiny Technologies): when pages load they receive the IP address and technical browser data, as happens with any resource downloaded from the internet.
- Push notification services of the browser maker used by the super-administrators (Apple, Google, Mozilla or Microsoft): they deliver the notifications of the monitoring dashboard, end-to-end encrypted; by default with counts and categories only.
- Public authorities, when required by law.
Voters' email addresses are used only to send the invitations, any reminders, the confirmations and the proxy notifications of the election for which the organiser entered them.
6. Transfers outside the European Union
The database and the website are hosted in Italy. Some providers (Google, library delivery services, TinyMCE) may process technical data also in the United States or other countries; in these cases the transfer is based on the European Commission adequacy decision for companies certified under the EU-U.S. Data Privacy Framework or on standard contractual clauses. You can ask for more information at info@metisitalia.it.
7. How long we keep the data
We keep data only for as long as needed for the purposes described; then we delete or anonymise them.
| Data | Retention period |
|---|
| Organiser account (profile data) | As long as the account is active. With "Delete profile" and the confirmation from the link received by email they are deleted immediately, together with all elections (candidates with photos, voters, ballot box, blind-signature tokens) and support tickets. |
| Elections: candidates, voters, proxies, invitation progress, anonymous ballot box, token fingerprints | On behalf of the organiser, until they delete the election (possible before it starts or from 7 days after closing, a period during which results and receipts remain available) or their profile. We recommend organisers delete finished elections when no longer needed. |
| Vote resume data in the voter's browser (blind signature) | Until the ballot is submitted, then deleted automatically. If the vote is not completed they remain only on that device and can be removed by clearing the site data in the browser. |
| License and unlock payments | 10 years, as required by accounting and tax rules (art. 2220 Italian Civil Code), also after the account has been deleted. |
| Consent to news and offers | Until you withdraw it or delete the account. |
| Organisation logo and free-service usage events | As long as the account is active; deleted with the profile (the logo also when you replace or remove it). |
| Imported rows waiting for the unlock | At most 30 days; earlier if the election is unlocked (they become voters or candidates) or deleted. |
| Public demo (test voters and ballots) | At most 24 hours. |
| Find a date (poll, names, answers, creator email) | Deleted automatically 90 days after the last proposed date; earlier if the creator deletes it. |
| To-do list (projects, tasks, people, notes, attachments, creator email) | Deleted automatically with its files after 12 months without use; earlier if the user deletes it. |
| IP address fingerprints for usage limits | Until the end of the check window, at most 24 hours. |
| Support requests (tickets: messages, replies, internal notes) | 24 months after closing, then deleted automatically; those of an account are deleted with the profile. |
| Contact form messages | 24 months from sending. |
| Poll surveys (contents, preferences, IP addresses) | 12 months after the survey deadline; earlier at the creator's request. |
| Access log of the website and reserved area (IP, browser, pages) | 12 months. |
| Email confirmation link codes (hash only) | Valid for 48 hours and once only; deleted within 7 days after expiry. |
| Failed login attempts (email hash, IP) | At most 24 hours; deleted right after a successful login. |
| Session cookie | Until the browser is closed; reserved-area access expires after 30 minutes of inactivity. |
| Poll technical cookie (to change your answer) and cookie-banner choices cookie | 120 days the former; up to 12 months the latter. |
| Meeting minutes draft and calculator figures (browser only) | Until you delete them; the minutes PDF is not kept. |
| Find a date technical cookie (to change your own answer) | 120 days. |
| Language technical cookie (MI_lingua: the language chosen in the menu or «Default Browser») | 12 months; it changes when you choose another item in the menu. |
| To-do list technical cookie (personal link to the list) | 400 days, or until you press «Exit» or delete the list. |
| Google Analytics statistics (Poll voting page) | According to the Google service settings, only with your consent. |
| Monitoring dashboard: news found by the checks | 90 days, then deleted automatically. |
| Monitoring dashboard: results of the technical checks and site error log (no personal data) | 30 days for the checks; the error log is replaced when it exceeds 5 MB. |
| Devices authorised for the dashboard (hash of the code, device name, Face ID public key, notification subscription) and access links | Until the super-administrator revokes the device or loses the role (the device code expires after 180 days); access links are valid for 15 minutes and deleted within 24 hours. |
| Hosting provider technical logs | According to the periods set by Aruba for the security of the service. |
| Database copies made by super-administrators from the dashboard (protected server folder) | Only the last 5 are kept: each new copy deletes the oldest one. |
| Database backups | Kept for a limited period and then replaced by newer copies: deleted data may remain in backups until they are overwritten, without being used for any other purpose. |
Data may be kept longer only if required by law or by an authority, or to defend a right in a dispute already started, limited to the data needed.
8. Your rights
You can ask at any time to access your data, correct them, delete them, restrict processing, receive them in a machine-readable format (portability) and object to processing based on legitimate interest. If you gave consent (for example to statistics cookies or to receive news and offers) you can withdraw it at any time, without affecting processing already carried out.
Organisers can edit and delete their profile themselves in the reserved area. For other requests write to info@metisitalia.it or to the PEC address silvia.baudrino@pec.it: we answer free of charge within 30 days.
To protect ballot secrecy, a ballot already in the box cannot be returned or deleted at the request of an individual voter: it is not linked to their name and therefore cannot be identified.
If you believe the processing breaches the law you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of your country, or apply to the courts.
9. Changes to this policy
We will update this policy when the service or the law changes; the date at the top shows the latest version. In case of significant changes we will inform registered users by email or in the reserved area.
