The Company

Customer information on advanced electronic signatures using handwritten biometric or OTP technology

Under Italian law, digital signatures and, more generally, the other types of electronic signature are governed by Legislative Decree No. 82 of 7 March 2005, containing the Digital Administration Code (“CAD”). Following the adoption and entry into force of Regulation (EU) No. 910/2014 (“eIDAS”), significant changes concerning the legal and technical framework for electronic signatures have applied since 1 July 2016.

With the objective of harmonising the CAD with eIDAS, the Italian legislature adopted Legislative Decree No. 179 of 26 August 2016, effective from 14 September 2016. It repealed the electronic-signature definitions in the previous legislation and aligned them with the definitions set out in the European Regulation. The amendments were not limited to updating definitions. In accordance with the eIDAS principle of non-discrimination, they enhanced the evidential value of “simple” electronic signatures, namely signatures that are neither advanced nor qualified, and broadened the mutual recognition of electronic signatures across the European Union.

GENERAL INFORMATION

To respond more effectively to its customers’ needs and eliminate or reduce paper documents, CRIBIS S.r.l. offers an Advanced Electronic Signature for the electronic execution of contracts.

Once the Advanced Electronic Signature service (the “AES Service”) has been requested, customers may execute contracts for CRIBIS products and services using an advanced electronic signature (“AES”), a signing method satisfying the legal and technical requirements under applicable law, including Legislative Decree No. 82/2005 and the Prime Ministerial Decree of 22 February 2013 on technical rules for generating, affixing and verifying advanced, qualified and digital electronic signatures.

For this purpose, CRIBIS S.r.l. has implemented a process that ensures:

1. identification of the signatory by collecting the signatory’s identity document;
2. a unique link between the signature and the signatory;
3. the signatory’s sole control over the signature-creation system, including any biometric data used to create the signature through Namirial’s ESaw system;
4. the ability to verify that the signed electronic document has not been altered after signature through Namirial’s ESaw system;
5. the signatory’s ability to obtain evidence of the signed content by receiving the signed documents in PDF format by e-mail;
6. identification of the service provider referred to in Article 55(2)(a) of the Prime Ministerial Decree; for signature purposes, the customer accesses Namirial’s website directly;
7. the absence, in the subject matter being signed, of any element capable of altering the acts, facts or data represented therein;
8. a unique link between the signature and the signed document through Namirial’s ESaw system.

The AES Service provided by CRIBIS S.r.l. pursuant to Article 55(2)(a) of the Prime Ministerial Decree is implemented by Namirial S.p.A., with registered office at Via Caduti sul Lavoro 4, Senigallia (AN), tax code and VAT No. 02046570426 (“Namirial”), a recognised Certification Authority issuing qualified certificates, through a process satisfying applicable legal requirements.

FEATURES OF THE PROCESS AND THE AES

For handwritten biometric AES, the AES Service involves the processing of behavioural biometric data solely for embedding such data in the signed document. It does not involve storing biometric data for the purpose of recognising the signatory. The data may be made available to judicial authorities in the event of a dispute.

The process comprises the following main stages:

1. A CRIBIS sales account explains how to use the handwritten biometric or OTP AES Service.
2. Before requesting the AES Service and before executing the contract for CRIBIS products and services, the sales account identifies the signatory in order to strengthen the non-repudiation of the signed document.
3. The CRIBIS representative submits the AES Service request document to the customer electronically.
4. The customer reads the document and its annexes and, if agreeing with them, signs after selecting the AES method, OTP or handwritten biometric signature. The selected method also applies to execution of the contract for CRIBIS products and services.
5. The CRIBIS representative then submits the contract for CRIBIS products and services to the customer electronically.
6. The customer reads the contract and its annexes and, if agreeing with them, applies the AES using the previously selected method.
7. At the end of the process, a service electronic certificate is associated with the AES. The certificate is integrated into Namirial’s ESaw platform and issued by qualified trust service provider Namirial. It is included in European stores and PDF-management software and is intended to ensure document integrity and immutability.

Following execution using AES, the original electronic document, namely the contract for CRIBIS products and services, is converted in accordance with the standard formats prescribed by law into an electronically signed document.

When the signed electronic document is viewed, specific data resulting from the AES operation is displayed in designated areas of the document layout, including the signatory’s name, the telephone number to which the OTP was sent, the transaction ID or token uniquely assigned by Namirial, the date and time of signature, the IP address and, where selected, the handwritten biometric signature.

For handwritten biometric signatures, the biometric data encrypted and electronically sealed within the relevant document is exclusively behavioural. It is collected without analysis capable of revealing information concerning the signatory’s health.

HOW TO JOIN THE SERVICE

The customer joins the service by signing the relevant application form and attaching a copy of the customer’s identity document. Requesting the AES Service as a method for executing contracts concerning CRIBIS products and services is optional.

Both the electronic AES Service request and the electronic contract for CRIBIS products and services are retained by CRIBIS S.r.l. Upon a written or oral request, CRIBIS S.r.l. will make them available or provide the customer with a copy free of charge. Both electronic documents will in all cases be sent to the signatory by e-mail in PDF format.

Documents that may be signed using AES

Customers may use AES to execute contracts concerning products and services supplied by CRIBIS S.r.l.

Transmission of documents by e-mail

Documents sent by e-mail in PDF/A format, both the AES Service request and the contract for CRIBIS products and services, will include in summary:

• date and time of signature;
• geolocation, where permitted by the customer at the time of signing;
• for handwritten biometric AES, only the graphic image of the customer’s signature;
• validation of the signatures affixed;
• details of the Accredited Certification Authority’s certificate.

The e-mail account designated by the customer for receipt of signed documents must be accessible only to persons duly authorised to access the documents sent by CRIBIS S.r.l. The customer is directly responsible for the accuracy of both the e-mail and postal addresses provided.

Insurance cover (Article 57(3) of the Prime Ministerial Decree of 22 February 2013)

In accordance with applicable law, CRIBIS S.r.l. has taken out an insurance policy with a leading insurer to cover and protect against any damage arising from or caused by provision of the AES Service.

Consent to use the signature

Applicable law requires the customer’s consent to execute contracts for CRIBIS products and services using AES. For this purpose, the customer must sign the relevant AES Service application form. CRIBIS S.r.l. will offer the AES Service before execution of each contract concerning products or services supplied by CRIBIS S.r.l.

Withdrawal of consent

The adopted process is repeated for each contract. The customer may consent to the use of AES whenever entering into a contract for CRIBIS products and/or services. No separate withdrawal process is therefore required, because AES cannot be used other than in conjunction with the relevant consent. Each contract

is preceded by a request for consent to use AES, and that consent is exhausted upon execution of the contract.

Dispute management

Any disputes, including denial of signature or claims that documents were not signed, will be handled in accordance with CRIBIS S.r.l.’s procedures for disputes concerning handwritten signatures.