Notice for people authorised to open an entrance
Version 2026.09.22-1, in force since 22 September 2026
Who gave us your number, what is recorded when you open, for how long, and how to have yourself removed.
Courtesy translation. In case of discrepancy, the Italian text prevails.
You have not bought anything and you have no contract with us. Your phone number has been added to a BGates Device by someone else, or you entered it yourself after scanning a QR code displayed near an Entrance. This page tells you, briefly, what happens to your data.
Who gave us your number, and why
Your number was given to us by the person who administers the Entrance: their name and the name of the Entrance were shown to you in the Invite you received, or on the QR code page. They did so to let you in: from that moment, anyone calling from that number opens the Entrance.
If instead you scanned a QR code, you typed in the number and the name yourself. We do not verify them: the person who administers the Entrance decides whether to authorise you. Until they decide, you cannot open.
We have not taken your number from public directories or from any other source.
Who decides, and what our role is
| Who | What they decide | What they are called |
|---|---|---|
| The person who administers the Entrance (the Customer) — their name and contact details are shown to you in the Invite and on the QR code page | whether to authorise you, on which days and at which times, until when, when to revoke your authorisation, and what use to make of the Opening Log | Controller |
| Business Gates S.r.l. — Via Ripamonti 44, 20141 Milano, P.IVA 05759280968, tel. 02 52 20 18 38 | carries out instructions: stores the number, writes it into the Device, delivers the Invite to you, keeps the Opening Log on the Customer's behalf | Processor (Art. 28 of the GDPR (Regulation (EU) 2016/679)) |
There are a few things we decide ourselves, and for those we are the Controller: the technical proof that the Invite was delivered to you, the IP address of whoever fills in the QR code form, the technical logs of our systems, and the security of the Service. For everything else we follow the Customer's instructions.
We have not appointed a Data Protection Officer. For questions about your data, write to info@bgates.it.
Your number is your key
It is not an identifier: it is a key. Keep that in mind.
- Anyone calling from that number opens the Entrance, with no further check.
- The number is written into the Device, which is located at the Customer's premises: the Device needs it to recognise you even when there is no connection.
- Do not lend your phone to anyone who should not get in: for the Device, it is like lending them a key.
- If you change your number or lose your phone, tell the person who authorised you straight away: your old number may be reassigned to someone else, and that person would be able to open in your place.
How you open, and what is recorded
By calling. The Device never answers: it rings and hangs up, and the call costs you nothing. But your number is captured before it hangs up: ‘does not answer’ does not mean ‘does not record’.
From the app. If you create an Account, you can open from the BGates app without calling.
In both cases an entry is recorded in the Entrance's Opening Log:
| What we record | Details |
|---|---|
| When | date and time, to the second |
| Who | your number and the name that the person who authorised you entered next to it, or your Account email |
| What | the command, the outcome (opened, refused, failed) and the channel it came from |
We also record attempts from numbers that are not authorised. If you call an Entrance on which you are not authorised, your number appears in the Opening Log masked, showing only the last three digits.
Who sees these entries
- The person who administers the Entrance: the Customer and anyone acting on the Customer's behalf (for example the Distributor or the Installer who installed it). They can also export the entries to a file and take them outside the Service: from that moment, they are responsible for where the entries end up.
- Business Gates operators, only for support and security purposes, and every access they make leaves a trace in an internal log.
- No other user, unless they too administer that Entrance.
What data we process, why, and on what legal basis
| Data | Why | Legal basis |
|---|---|---|
| Phone number and country code; the name entered by the person who authorised you; days, time slots and expiry date of the authorisation | to let you in through the Entrance and allow the person who administers it to manage access | the Customer's legitimate interest (Art. 6.1.f): protecting the people and property beyond that Entrance, and keeping orderly control of who comes in |
| Opening Log entries, including failed attempts | to verify a disputed access; to detect attempts | the Customer's legitimate interest (Art. 6.1.f), the same interest |
| The Invite: the link, the channel used, the delivery outcome | to deliver the Invite to you and prove that it was delivered | the Customer's legitimate interest for delivery; our legitimate interest (Art. 6.1.f) for the technical proof and to prevent misuse of the channel |
| If you come from a QR code: the name and number you entered | to let the person who administers the Entrance decide | the Customer's legitimate interest (Art. 6.1.f) |
| If you come from a QR code: your IP address | to protect a public form from misuse | our legitimate interest (Art. 6.1.f) |
| If you create an Account: email, credentials, your profile data | to give you access to the app | contract with you (Art. 6.1.b) |
We do not ask for your consent, and it is not needed: none of this processing is based on consent, and nobody can give it on your behalf. We do not carry out profiling and we do not take automated decisions about you: opening when your number is recognised applies a rule set by a person.
Who your data goes to
| To whom | What they receive | Where |
|---|---|---|
| The Device installed at the Customer's premises | your number, the days, the time slots, the expiry date. Not your name: there are no names on board | at the Customer's premises |
| Meta Platforms Ireland Ltd (WhatsApp) | your number and the text of the Invite, if the Invite reaches you on WhatsApp | Ireland, with onward transfers to the United States |
| Commify Italia S.r.l. (Skebby brand) | your number and the text of the Invite, if the Invite reaches you by SMS | Italy |
| netcup GmbH | hosts the systems on which the data is stored | Nuremberg, Germany |
The complete, up-to-date list of suppliers, with the role and country of each, is in the Suppliers document (/fornitori).
The only transfer outside the European Economic Area that concerns you is the onward transfer by Meta, when the Invite is sent via WhatsApp.
How long we keep it
| What | How long | Why |
|---|---|---|
| Your Authorised Number, with name, days and time slots | for as long as you are authorised; after revocation we delete it within 30 days | the 30 days are needed to bring the Device's number list back into line: until the Device has received the revocation, the entry is still needed |
| Opening Log entries | 12 months with your name and number. After that we remove the name and keep only the last three digits of the number; the entry without a name is kept for another 12 months, then we delete it | in apartment buildings and workplaces, disputes about an access come up late; beyond one year, the risk of reconstructing your habits outweighs that need |
| The number of a caller who is not authorised | masked immediately on screen; in full in our records for 30 days, then deleted | the last three digits and a count are enough to detect an attempt |
| The Invite | the link is valid for 30 days; we delete the record 90 days after you used it or after it expired | to reconstruct who authorised whom, if someone disputes an opening |
| The request made via QR code, with your IP address | 90 days from the decision; the IP address goes with the record | once the decision has been taken, it is no longer needed |
| The Single-use QR code you used, with name and number | 12 months from revocation of the QR code | disputes, as for the Opening Log |
| The proof that we showed you this notice (document, version, date, IP address) | 10 years from the end of the relationship | it is the proof that the obligation was fulfilled |
The complete table, for each type of data, is in the Retention Policy (/conservazione). The periods stated above are the same.
How to have yourself removed
The most direct way: ask the person who authorised you to revoke your number. It is their decision, and the revocation takes effect on the Device.
If you do not know who that is, if they do not reply, or if the number was never yours (it happens: a mistyped number, someone with the same name), write to info@bgates.it. We do two things: we pass your request on to the person who administers that Entrance and tell you who they are, and in the meantime we suspend the authorisation if you ask us to.
Your rights, and whom to ask
You can ask:
- to know what data we hold about you, to have it corrected, to have it erased, to restrict its use and to object to the processing;
- to receive it in a machine-readable format, and to have it transmitted to another controller, for the data you gave us yourself when you created an Account (Art. 20).
Objection (Art. 21 of the GDPR) is your main right, because almost everything that concerns you is based on the legitimate interest of the person who administers the Entrance: if you object, that data may be processed only if the person who administers it demonstrates compelling grounds that override yours.
The name you have been given in the list of Authorised Numbers is changed by the person who administers the Entrance, not by us: if it is wrong, write to info@bgates.it and we will pass it on to them.
Whom to write to. For the data for which the Customer is the Controller — your number, the Opening Log, the QR code request — the request goes to the person who administers the Entrance: their contact details are shown to you on the same Invite or QR code page. If you cannot find them, write to info@bgates.it: we forward your request to the Customer within 5 working days and tell you whom we sent it to. For the data for which we are the Controller (the IP address from the QR code form, technical logs, the delivery outcome, and your Account if you created one) we reply to you directly.
If the Controller has not left us any usable contact details, write to info@bgates.it: we are required to put you in touch with them and, in the meantime, to suspend the authorisation if you ask us to.
We reply within one month. If you do not have an Account, we need to be reasonably sure that it is you before we reply: we do not ask you for documents or for data we do not already have, but a check on the number may be necessary.
If you believe your data is being processed incorrectly, you can lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority) (Piazza Venezia 11, 00187 Roma — www.garanteprivacy.it) under Art. 77 of the GDPR, and you may in any case bring proceedings before the courts. If you live in another Member State of the European Union, you can contact the supervisory authority of your State or of the State in which the infringement took place.
The full privacy notice
This page is the short version, written for you. The full version — all processing, all suppliers, all retention periods — is the Privacy Notice: /privacy.
Text to be shown on screen at /i/<token> (Invite page)
It appears before any field, above the form.
Your number has been authorised on this Entrance. Above you will find the name of the person who authorised you and the name of the Entrance. From now on, anyone calling from that number opens it: the number is a key. Every opening is recorded — date, time, your number and the name you have been given — and the person who administers that Entrance can see it. We keep it for 12 months. Your number is processed by the person who administers the Entrance, whose contact details are shown on this page: they decide who comes in, and they are the ones to ask for revocation, correction or erasure. If no contact details are shown, write to info@bgates.it and we will forward your request to the Customer within 5 working days. We, Business Gates S.r.l., store your number and send it to the Device on their behalf. Don't want to be authorised? Ask the person who invited you to revoke it, or write to info@bgates.it: we will pass the request on. Notice for people authorised to open an entrance · Full privacy notice
Below, as a separate line and without a tick box: ‘I've read the notice for people authorised to open an entrance.’ If you open an Account, the Terms of Use are accepted with a separate tick box.
Text to be shown on screen at /q/<token> (QR code displayed at the Entrance)
It appears before any field, on all three paths of the page.
This Entrance is administered by the Customer named on this page, with their contact details. Scanning the code does not let you in: you ask to be authorised. The person who administers the Entrance decides. The number you enter is not verified: enter your own. We record your IP address to protect this form from misuse, and we delete it together with the request, 90 days after the decision. If you are authorised, your number becomes a key and every opening is recorded. Notice for people authorised to open an entrance · Full privacy notice
Short line for the fallback SMS
It goes at the end of the message, only if the message stays within 160 characters. If it does not fit, the rest of the message is not shortened: the Invite page shows the notice in any case before saving anything.
Who gave us your number, and your rights: app.bgates.it/i-infoThe text part is 41 characters, the link 20: 62 in total including the space. app.bgates.it/i-info points to this same document.
If we change this notice
The version in force is always at /informativa-utilizzatori, with its date. If you do not have an Account we do not have your email and cannot notify you: when something substantial changes we tell the person who administers the Entrance, and the page you open from the Invite link or from the QR code always shows the updated version.
Version 2026.09.22-1 — in effect from 22 September 2026. When we change something substantial — a new purpose, a new supplier, a longer retention period — we publish the new version here, with its date, and if you have an Account we tell you by email. This document is not accepted: it is read, and we do not ask you to tick any box. Corrections of form do not change the version. Previous versions are available on request from info@bgates.it.
Business Gates S.r.l. · Via Ripamonti 44, 20141 Milano · P.IVA 05759280968 · info@bgates.it