Election Day: secret-ballot online voting in three steps | METIS Italia Skip to content

Election Day

Online voting with a secret ballot, ready in three steps

Board elections, representatives, members' meetings: you set up the election in minutes, voters vote from their phone with a personal link and nobody can link a name to its ballot.

Create a free account See prices

How to organise an election

Create the election

Title, description, opening and closing date and time, how many preferences each voter can give.
Candidates and voters

Add them one by one or import them from a CSV file (a sample is available). Candidates can have a photo and a presentation.
Invitation and sending

Write the invitation text, check the ballot preview and send: each voter receives a personal link, valid only once.

What the voter sees

Opens the personal link received by email, on a computer or phone: no account and no password.
Sees the ballot with names, photos and presentations and picks up to the allowed number of preferences.
Confirms the vote and gets a receipt code to check, on the results page, that their ballot is in the box.
Voting twice with the same link is not possible.

What you see, during and after voting

Live progress: invitations sent, emails opened, links opened, who has already voted (never how).
You can add voters while voting is open and send the invitation only to those who have not received it yet.
At closing the results are calculated automatically, with an integrity check between totals and ballots.
The ballot box is public and anonymous: anyone can recount the ballots and compare them with the results.

Ballot secrecy, guaranteed by the blind signature

The server authorises the ballot without being able to see it: the ballot reaches the box with no data linking it to the voter. We explain it step by step, without jargon.

How the blind signature works

Who it is for

Schools and universities

Class and school representatives, councils and boards.

Professional bodies

Council renewals and members' votes, even across several offices.

Companies and condominiums

Workers' representatives, resolutions and appointments by secret ballot.

Associations and non-profits

Members' meetings, board of directors, auditors.

Try it free with your next election

With the free version you set up a complete election with a few candidates and voters; for larger numbers choose the right license.

Create a free account

Last updated: 29 October 2026

This policy explains which personal data METIS Italia (the website www.metisitalia.it and the Election Day and Poll services) processes, why, how long it keeps them and what your rights are, under Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003.

1. Who processes the data

Data controller: Silvia Baudrino, Corso Magenta 1/10a, tax code BDRSLV63S45L219J, certified email (PEC) silvia.baudrino@pec.it, email info@metisitalia.it ("METIS Italia").

METIS Italia is the controller of the data of website visitors, of people who create an account to organise elections, of payments, of messages sent through the contact form or support tickets, and of Poll surveys.

Election Day elections. Candidates' and voters' data are entered by the organiser of the election (association, school, professional body, company, condominium...), who is their controller: the organiser decides who votes and why. METIS Italia processes these data on the organiser's behalf as a processor (art. 28 GDPR), only to run the election. If you are a voter or a candidate, please contact the organiser first to exercise your rights; if you write to METIS Italia, we will forward your request to the organiser and help them answer.

Support. To solve problems and answer organisers' requests, METIS Italia's authorised support staff can view an organiser's private area in read-only mode (elections, candidates, voters, results). Every access is logged with date, time and the name of who did it. Not even support staff can know who voted for what.

Elections overview. To run and improve the service (support, platform capacity, sending pace, compliance with plans and abuse prevention) METIS Italia super-administrators see an overview of all elections with service data only: title, organiser, status, dates, number of candidates, voters, invitations, openings and voters who voted, turnout, settings and plan. The overview does not show names and emails of voters and candidates, and nobody, not even METIS Italia, can know who voted for what. Every consultation is logged with date, time and the name of who made it.

2. Which data we process

Website visits

Technical browsing data: IP address, browser type, page visited, referring page, date and time, and any code of one of our messages contained in the link. The website stores them in its access log; the hosting provider also records them in its technical logs.
Cookies and browser storage: technical session cookie (needed to log in and to protect forms) and a cookie that remembers your choices on the cookie banner. Details are in the Cookie Policy.

Organiser account (reserved area)

First and last name, email, password (stored only as a non-reversible hash), language; optional: company name, address, town, province, postcode, country, phone, VAT number or tax code.
Access to the reserved area (access log as above); failed login attempts (hash of the email and IP address, to block repeated attempts).
Support tickets written to the team (name and message text).
Consent to receive news and offers (optional, asked at sign-up with a separate box that is not pre-ticked): if you give it we store the consent and its date. You can withdraw it at any time by writing to info@metisitalia.it.
Organisation logo, if you upload it for the counting report (with an unlock or a licence).
Use of the free services: we record events such as "election created", "limit reached", "unlock purchased", "report downloaded", linked to your account and the election but without any voter data, to count the free elections of the month and improve the service.

License and unlock payments

First and last name given in the payment, license type, amount, currency, transaction codes, validity period. Payment takes place on PayPal: METIS Italia does not receive or store card or account details.
Unlock of a single election: unlocked election, tier purchased, amount, PayPal transaction code, payer email provided by PayPal, date and any refund.

Election Day elections (data entered by the organiser)

Candidates: first and last name, email (encrypted), optional photo and presentation. Name, photo and presentation are shown to voters on the ballot and, once voting has closed, in the results.
Voters: first and last name, email (stored encrypted), personal voting link.
Invitation progress, visible to the organiser: date the email was sent; date the email was opened, detected through a small image in the email (if the mail program downloads images); date the voting link was opened; date of the last reminder sent; day of the vote (date only, no time). The organiser knows who voted, never how.
Ballot box: ballots are stored in a separate table without the voter's name, email, personal link, time or IP address: they contain only the choices, a random key, the day and the fingerprint (hash) of the receipt code. Only the voter knows the receipt code.
Blind signature (normally active in new elections): voting takes place in two separate requests. In the first one, with the personal link, the server checks the right to vote and signs a "token" without being able to see it; in the second one, anonymous and a few seconds later, the browser submits the ballot with the signed token. The server only keeps the fingerprint of tokens already used (to prevent double voting), with no link to the voter. Not even whoever runs the server can link a ballot to a name.
Voter's browser storage: in elections with blind signature, until the ballot is submitted the browser keeps the token, signature and choices locally (localStorage), to complete the vote if the page closes or the connection drops. These data stay on the device, are never sent together with the personal link and are deleted automatically after submission.
In elections with blind signature we send voters a participation confirmation email: it contains only the election title and the link to the results, never the choices or the receipt code.
Counting report: names of the chair and of the secretary / scrutineer, if the organiser enters them, printed on the PDF. The report never contains the list of voters or the choices.
Rows waiting for the unlock: if the organiser imports more voters or candidates than the free plan allows, the extra ones (first and last name, encrypted email) are kept aside until the election is unlocked, for at most 30 days.
Public receipt check: the code entered is used only to check that the ballot is in the box; we store neither the code nor the result.

Public demo ("Try voting")

We ask for no name or email: we create an anonymous test voter with a one-off link. Demo choices and ballots are reset every day.

Find a date (date poll without sign-up)

Poll creator: title, description, place, proposed dates and, if entered, name and email (used only to send the links and kept as long as the poll exists). The management link is stored only as a fingerprint. If linked to the creator's account, the poll is associated with that account.
Participants: the name they type and their answers (yes / if need be / no), visible to all participants; a technical cookie and a personal link let them change their answer (the code is stored only as a fingerprint). We store neither email nor IP address.

Usage limits per IP address

To prevent abuse of the free services (sign-up, receipt check, demo, Find a date, Poll, counting report and meeting minutes) we count attempts per IP address. The address is not stored: we keep only a fingerprint encrypted with a secret key, together with the counter, and delete it at the end of the time window (at most 24 hours).

Meeting tools (quorum calculator and meeting minutes)

The calculator works only in the browser: the figures entered are not sent to or stored by METIS Italia.
In the minutes generator the data entered (body, attendees, proxies, votes, texts) stay in the browser storage of the device (localStorage) until you clear them with «New minutes» or by clearing the site data. When you request the PDF the data go through the server only while the file is created; the file is handed to you and not kept.
Whoever uses the generator is the controller of the data of the people they enter in the minutes.

Poll surveys

Survey creator: title, description, options and optional images, deadline, language, theme and, if entered, name and email (used only to send the links); IP address. The management link is stored only as a fingerprint. If linked to an account, the survey is associated with that account.
Participants: the name they type, their choices and the optional reaction (an emoticon next to the name), visible to all participants; the IP address, stored with the choices to prevent abuse; a technical cookie and a personal link let you change your answer (the code is stored only as a fingerprint). The Poll is meant for informal decisions and does not offer the secrecy guarantees of Election Day.
Abuse checks (Poll and Find a date): METIS Italia super-administrators can see the contents of surveys (texts, options, images, participants' names) to check that they are not used for illegal purposes, and can suspend or delete them. Every suspension or deletion is logged with date and author. A suspended survey is kept until a super-administrator deletes it, even beyond the periods indicated below, if it may be needed as evidence.

Contact form

Name, email, subject and message text.

3. Why we process them and on what legal basis

Purpose	Legal basis
Creating and managing the account, providing the reserved area and support (tickets)	Performance of a contract (art. 6.1.b)
Running elections on behalf of the organiser: invitations, ballot, counting, results, results email and PDF counting report for the organiser, receipt check	Contract with the organiser and their instructions (art. 28); for the organiser, the basis of their own relationship with voters
Showing the organiser the invitation progress (emails opened, links opened, vote cast)	Organiser's legitimate interest in checking that the notice arrived and in sending an email reminder (at most one every 12 hours) to those who have not voted yet (art. 6.1.f)
Handling payments and accounting and tax obligations	Contract and legal obligation (art. 6.1.b and 6.1.c)
Answering contact form messages	Pre-contractual measures / request of the data subject (art. 6.1.b)
Providing the Poll service and preventing double votes	Performance of the requested service (art. 6.1.b)
Checking that Poll and Find a date are not used for illegal purposes, suspending or deleting surveys that breach the terms of use or the law	Legitimate interest in preventing illegal use of the service and protecting participants; legal obligation when the authorities request it (art. 6.1.f and 6.1.c)
Providing the free services: Free plan, single unlock, PDF report, demo, Find a date, public receipt check	Performance of the requested service (art. 6.1.b)
Sending news and offers from METIS Italia by email	Optional consent, withdrawable at any time (art. 6.1.a)
Counting the use of the free services (events without voter data) and preventing abuse (limits per IP address, reCAPTCHA, refusal of disposable emails)	Legitimate interest in offering the free service in a sustainable and secure way (art. 6.1.f)
Elections overview for super-administrators (service data only, without voter and candidate data)	Legitimate interest in running, sizing and protecting the service; for election data within the organiser's instructions as processor (art. 6.1.f and art. 28)
Security: blocking repeated login attempts, anti-bot protection of forms (reCAPTCHA), access log, backups	Legitimate interest in the security of the service (art. 6.1.f)
Visit statistics of the Poll voting page (Google Analytics)	Consent, given through the cookie banner (art. 6.1.a)
Defending our rights in case of disputes	Legitimate interest (art. 6.1.f)

We do not use the data for advertising, profiling, remarketing or newsletters, we do not sell them and we make no automated decisions producing legal effects on people. Mandatory form fields are needed to provide the service: without them it is not possible, for example, to create the account or send the invitations.

4. How we protect the data

Encrypted connection (HTTPS); passwords stored only as a non-reversible hash; candidates' and voters' emails encrypted in the database.
Separation between voter register and ballot box, blind signature, receipt code kept only as a hash; ballot box published after closing only if it contains at least 5 ballots, so that a few ballots cannot reveal anyone's vote.
Each organiser sees only their own elections; protection of forms against forged requests; automatic logout after 30 minutes of inactivity; lock after failed login attempts.
Access to the data limited to those who need to run the service, under a confidentiality obligation.

5. Who we share the data with

Data are not disclosed to the public. Only as far as necessary, they may be received by these providers, acting as processors or as independent controllers for their own services:

Aruba S.p.A. (Italy): website and database hosting, sending emails. Policy
PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): license payments. Policy
Google (Google Ireland Ltd / Google LLC): reCAPTCHA on the contact, Poll, sign-up, Find a date and receipt-check forms, Google Fonts typefaces, Google Analytics on the Poll voting page only. Policy
Library delivery services (jsDelivr, cdnjs/Cloudflare, code.jquery.com, cdn.datatables.net) and, in the reserved area only, the TinyMCE text editor (Tiny Technologies): when pages load they receive the IP address and technical browser data, as happens with any resource downloaded from the internet.
Public authorities, when required by law.

Voters' email addresses are used only to send the invitations, any reminders and the confirmations of the election for which the organiser entered them.

6. Transfers outside the European Union

The database and the website are hosted in Italy. Some providers (Google, library delivery services, TinyMCE) may process technical data also in the United States or other countries; in these cases the transfer is based on the European Commission adequacy decision for companies certified under the EU-U.S. Data Privacy Framework or on standard contractual clauses. You can ask for more information at info@metisitalia.it.

7. How long we keep the data

We keep data only for as long as needed for the purposes described; then we delete or anonymise them.

Data	Retention period
Organiser account (profile data)	As long as the account is active. With "Delete profile" and the confirmation from the link received by email they are deleted immediately, together with all elections (candidates with photos, voters, ballot box, blind-signature tokens) and support tickets.
Elections: candidates, voters, invitation progress, anonymous ballot box, token fingerprints	On behalf of the organiser, until they delete the election (possible before it starts or from 7 days after closing, a period during which results and receipts remain available) or their profile. We recommend organisers delete finished elections when no longer needed.
Vote resume data in the voter's browser (blind signature)	Until the ballot is submitted, then deleted automatically. If the vote is not completed they remain only on that device and can be removed by clearing the site data in the browser.
License and unlock payments	10 years, as required by accounting and tax rules (art. 2220 Italian Civil Code), also after the account has been deleted.
Consent to news and offers	Until you withdraw it or delete the account.
Organisation logo and free-service usage events	As long as the account is active; deleted with the profile (the logo also when you replace or remove it).
Imported rows waiting for the unlock	At most 30 days; earlier if the election is unlocked (they become voters or candidates) or deleted.
Public demo (test voters and ballots)	At most 24 hours.
Find a date (poll, names, answers, creator email)	Deleted automatically 90 days after the last proposed date; earlier if the creator deletes it.
IP address fingerprints for usage limits	Until the end of the check window, at most 24 hours.
Support tickets	As long as the account is active; deleted with the profile.
Contact form messages	24 months from sending.
Poll surveys (contents, preferences, IP addresses)	12 months after the survey deadline; earlier at the creator's request.
Access log of the website and reserved area (IP, browser, pages)	12 months.
Failed login attempts (email hash, IP)	At most 24 hours; deleted right after a successful login.
Session cookie	Until the browser is closed; reserved-area access expires after 30 minutes of inactivity.
Poll technical cookie (to change your answer) and cookie-banner choices cookie	120 days the former; up to 12 months the latter.
Meeting minutes draft and calculator figures (browser only)	Until you delete them; the minutes PDF is not kept.
Find a date technical cookie (to change your own answer)	120 days.
Google Analytics statistics (Poll voting page)	According to the Google service settings, only with your consent.
Hosting provider technical logs	According to the periods set by Aruba for the security of the service.
Database backups	Kept for a limited period and then replaced by newer copies: deleted data may remain in backups until they are overwritten, without being used for any other purpose.

Data may be kept longer only if required by law or by an authority, or to defend a right in a dispute already started, limited to the data needed.

8. Your rights

You can ask at any time to access your data, correct them, delete them, restrict processing, receive them in a machine-readable format (portability) and object to processing based on legitimate interest. If you gave consent (for example to statistics cookies or to receive news and offers) you can withdraw it at any time, without affecting processing already carried out.

Organisers can edit and delete their profile themselves in the reserved area. For other requests write to info@metisitalia.it or to the PEC address silvia.baudrino@pec.it: we answer free of charge within 30 days.

To protect ballot secrecy, a ballot already in the box cannot be returned or deleted at the request of an individual voter: it is not linked to their name and therefore cannot be identified.

If you believe the processing breaches the law you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of your country, or apply to the courts.

9. Changes to this policy

We will update this policy when the service or the law changes; the date at the top shows the latest version. In case of significant changes we will inform registered users by email or in the reserved area.