Cookie and Local Storage Notice
Versie 2026.10.27-1 — van kracht sinds 27 oktober 2026
Dit document is niet in het Nederlands vertaald: hieronder staat de Engelse vertaling. De Italiaanse versie is juridisch bindend. Lees het Italiaanse origineel
What we store on your device when you use the BGates website or Service: technical tools everywhere and, only on the public website and only if you accept them, Google Analytics statistics.
Courtesy translation. In case of discrepancy, the Italian text prevails.
This notice tells you what is stored on your device — phone, tablet or computer — when you open the BGates website, the BGates Private Area, the BGates app or the activation procedure, and what your browser contacts while you are using them.
It covers the GT PRO 4G model and the related Service. It does not cover earlier models that work by SMS only, or the Bluetooth channel.
You do not have to accept this notice: it is not a contract, and we do not ask you to tick any box. You must be able to read it, and we must have written it truthfully. For how your data is processed in general — purposes, legal bases, rights — see the Privacy Notice. For the retention periods of everything else, see the Retention Policy.
1. In brief
- On your device we store technical tools: the ones needed to keep you logged in and to remember your preferences, including the choice you make about cookies.
- On the public website, and only there, we ask whether you want to turn on statistics (Google Analytics, through Google Tag Manager). If you do not accept, nothing starts: your browser does not load any Google script.
- In the Private Area, in the app and in the activation procedure there are no statistics, pixels or tag managers.
- No profiling or advertising tools, in any area.
- You can change your choice whenever you like from "Cookie preferences" at the bottom of every page of the website, and delete everything from your browser settings (§ 8).
2. When we ask for your consent
The rule that governs this matter is Article 122 of the Italian Personal Data Protection Code (Legislative Decree 196/2003). It is not only about cookies: it talks about "storing information in the terminal equipment", so it applies in the same way to your browser's localStorage and sessionStorage. Technical tools, meaning those strictly necessary to provide the service you asked for, do not require consent: this notice is enough for them. All the others do.
Website statistics are not technical tools. That is why, the first time you open the public website, we show you a banner with two buttons of equal weight, "Accept" and "Decline", as required by the Guidelines on cookies and other tracking tools of the Italian Data Protection Authority (Garante, decision no. 231 of 10 June 2021). Closing the banner with the X counts as declining.
- Until you choose, and if you decline, the website does not load Google Tag Manager or Google Analytics: your browser does not contact Google. We use Google's Consent Mode v2 with every item denied by default.
- If you accept, the website loads Google Tag Manager, which starts Google Analytics 4 (§ 3.1 and § 5).
- Your choice lasts six months, then we ask again. We ask earlier only if something substantial changes in what we are asking.
- You can change it at any time from the "Cookie preferences" link in the footer of every page of the website. If you withdraw consent, we delete the Google Analytics cookies from your browser.
The Private Area, the app and the activation procedure use technical tools only: there is no banner there because there is nothing to ask.
3. What we store on your device
The tables are divided by area, because the areas are technically separate and do not store the same things. Where a duration says ‘until you clear the site data’, it means exactly that: it does not expire by itself, and § 8 explains how to remove it.
3.1 BGates website (the public pages)
Without your consent the website only stores the choice you make on the banner. If you accept statistics, Google Analytics writes the two cookies at the bottom of the table.
| Name | Where it is | What it is for | How long it lasts |
|---|---|---|---|
bgates-consenso-1 | localStorage | Remembers whether you accepted or declined statistics, and when, so that we do not ask you on every page. It is a technical tool | Six months: then the choice expires and the banner reappears |
bgates-avviso-iliad-1 | localStorage | Remembers that you closed the notice strip at the top of the page, so we do not show it again on every visit. It contains only the word "chiusa" (closed) | Until you clear the site data |
_ga | Google Analytics cookie, domain bgates.it | Only if you accept statistics. Tells one browser from another with a random number, to count visitors without counting them twice | 13 months |
_ga_P5LHY1550B | Google Analytics cookie, domain bgates.it | Only if you accept statistics. Keeps track of the current visit | 13 months |
3.2 BGates Private Area
This is the area that Customers, Distributors, Installers and BGates Operators sign in to.
| Name | Where it is stored | What it is for | How long it lasts |
|---|---|---|---|
bg_access | HttpOnly, Secure, SameSite=Lax cookie, domain .bgates.it | Keeps you signed in after you sign in. It is the cookie without which the Service does not work | 7 days |
bg_refresh | HttpOnly, Secure, SameSite=Lax cookie, domain .bgates.it | Renews your sign-in while you work, without asking for your password on every page | 7 days |
bg_dispositivo | HttpOnly, Secure, SameSite=Lax cookie, only on the app's address (not on the other bgates.it addresses) | Recognises the browser you have confirmed with the code sent by email, so that you can open from it without doing so again. It contains only a random identifier. It is a technical security cookie: without it, the web app would not let you open | 365 days from last use. If the device is unlinked it stops being valid immediately, even if it remains in the browser |
sidebar_state | Cookie written by the page, path / | Remembers whether you left the side menu open or closed | 7 days |
bgates.posizione | localStorage | Remembers the section and the Device you were looking at, so that when you come back you are where you left off. It contains the identifier of the last Device you opened: see § 4 | Until you sign out of the Account — when you press ‘Sign out’ we delete it — or until you clear the site data |
pwa-install-dismissed | localStorage | Remembers the date on which you closed the prompt to install the app on your device, so that we do not show it again | Until you clear the site data |
push-ingresso-rinviato-al | localStorage | Remembers that you postponed the request to enable notifications, and until when | Until you clear the site data |
The bg_access and bg_refresh cookies are HttpOnly: pages cannot read them; only our system reads them when your browser sends them back. They are valid across the whole .bgates.it domain, which is why a single sign-in works for both the Private Area and the app.
The Private Area also installs a small browser service program (service worker) dedicated to notifications: it is used to display them when they arrive and does not keep a copy of the pages you have visited.
3.3 BGates app and activation procedure
These are two different addresses served by the same application: what follows applies to both.
| Name | Where it is stored | What it is for | How long it lasts |
|---|---|---|---|
bg_access | HttpOnly, Secure, SameSite=Lax cookie, domain .bgates.it | Keeps you signed in after you sign in | 7 days |
bg_refresh | HttpOnly, Secure, SameSite=Lax cookie, domain .bgates.it | Renews your sign-in without asking for your password | 7 days |
bgates-install-rifiutato | localStorage | Remembers that you closed the prompt to install the app on your phone | Until you clear the site data |
bgates-activation-session | localStorage | A key from an earlier version of the application. It is no longer written today: the application deletes it at start-up if it still finds it on your device | Deleted at first start-up |
bgates:email-ripristino | sessionStorage | Carries the email address you have just typed from the sign-in screen to the password reset screen. We keep it here precisely so that it does not end up in the page address, where it would remain in the browser history and in the server logs | Until the browser tab is closed |
The application installs a service worker only so that it can be installed on your phone: it does not keep pages in memory, because an old page would show the status of an Entrance that is no longer accurate.
There are no push notifications here: notifications exist only in the Private Area (§ 6).
3.4 BGates mobile app
The mobile app does not use cookies and does not use the browser's local storage. It keeps three values in the operating system's encrypted keychain (Keychain on iOS, EncryptedSharedPreferences on Android), which is an area protected by the phone and cannot be read by other apps:
| Name | What it is for | How long it lasts |
|---|---|---|
bg_access | Keeps you signed in | Until you sign out of the Account: pressing ‘Sign out’ deletes it from the keychain |
bg_refresh | Renews your sign-in | Same |
bg_username | Remembers the username you sign in with, which for Customers and Users is your email address | Same |
The mobile app is not published on the app stores: if you have it, we gave it to you.
4. bgates.posizione: why it deserves a separate entry
It is the only item on this list that says something about you and not just about your browser: it contains the identifier of the last Device you opened in the Private Area, as well as the section you were in. It is used to take you back to where you were, and it stays on your device: we do not send it to anyone and we do not use it for anything else.
We delete it when you press ‘Sign out’. If you never sign out, it remains until you clear the site data.
5. Third-party services your browser contacts
This section is separate from the tables above, and not just for the sake of order: when your browser contacts someone else's server nothing is stored on your device, but that party still receives your IP address and your browser's technical information. This is different from cookies and needs to be stated separately.
Fonts. The fonts used on our pages are hosted on our own servers: when you open the website or the Private Area, your browser does not contact any external font provider. This is how it is designed.
Map. In the Private Area the map of Devices does not load by itself: a box appears with a ‘Show map’ button, and only if you tap it does your browser contact the OpenStreetMap Foundation to download the map images. From that moment OpenStreetMap receives your IP address and the geographical area you are looking at. The OpenStreetMap Foundation states that it stores its data in the Netherlands, which is in the European Union, and in the United Kingdom. For the Netherlands there is no transfer outside the Union. For the United Kingdom, the European Commission has adopted an adequacy decision, renewed on 19 December 2025: no further safeguard is needed for that transfer. OpenStreetMap's own privacy policy, however, excludes from that statement precisely the data linked to requests for map images, which are delivered through a distribution network whose name it does not publish: where your data passes is therefore not stated. This is how it is designed.
Payments. When you pay for a Subscription, payment takes place on a Stripe page, not on ours: the data you enter there, including your card details, is collected by Stripe, and Stripe's privacy notice applies on that page. The complete list of our suppliers, with role, country and safeguards, is in the Suppliers document.
Statistics, only if you accept them. If you accept statistics on the public website, your browser downloads Google Tag Manager and Google Analytics 4 from the servers of Google Ireland Limited (Gordon House, Barrow Street, Dublin, Ireland), which receives your IP address, the pages you visit, where you came from and your browser's technical information. We look at this data only in aggregate form, to understand how many people visit the website and which pages are useful. We have turned off Google Signals, so there is no link to the visitor's Google account, if any, and no advertising use; Google Analytics 4 does not log IP addresses; data on individual visits is deleted after two months. Google may also process data in the United States: Google LLC participates in the EU-U.S. Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023. If you do not accept, none of this happens.
6. Browser push notifications
Browser notifications exist only in the BGates Private Area, and only if you enable them: it is the browser that asks for your permission, and nothing starts without your action.
When you enable them, your browser generates a delivery address with the browser's own notification service — Google, Mozilla or Apple, depending on the browser you use — and we keep it so that we can reach you, together with the two technical keys used to protect the message. That address is a stable identifier of your device with that provider.
What this means, stated precisely: your browser's notification service knows that we sent you a notification, when, and how long it was. The technical protocol (RFC 8291) allows the content to be encrypted, so that the provider cannot read it.
You can turn notifications off at any time from the Private Area or from your browser settings. When you turn them off, we delete the delivery address. We also delete it when the notification service tells us it is no longer valid.
7. What is not there
We say it in full, because it is the most useful information on this page:
- no statistical analysis tools without your consent, and none at all in the Private Area, the app and the activation procedure;
- no advertising pixels, no third-party code for marketing or remarketing: on the website, Google Tag Manager contains only Google Analytics;
- no automatic error-collection tools;
- no device-recognition techniques (fingerprinting);
- no profiling cookies, ours or third parties';
- no disclosure of the data held in these keys to anyone.
8. How to delete what is on your device
From the Service. Press ‘Sign out’: the session is closed by our systems and we delete bgates.posizione. In the mobile app, ‘Sign out’ deletes the three values from the phone's keychain.
From your browser. In your browser settings, under the section on privacy and site data, you can delete the cookies and stored data for a single site — look for bgates.it — or for all sites. The same screen lets you block cookies: if you block those of bgates.it, the Service can be used only up to the sign-in, because without bg_access it is not possible to keep you signed in. This is not a penalty: it is how signing in works.
Notifications. They can be removed from the Private Area or from your browser settings, in the site permissions section.
Deleting these items does not delete your data from our systems. For that — a copy of your data, correction, deletion of the Account — there is a dedicated section in the Private Area, and the Privacy Notice explains how it works.
9. The shop
When you buy a Device from the website, payment takes place on the shop at shop.bgates.it, built on a platform other than ours, Shopify, which has its own cookie notice and its own banner, which appear when you visit it. This notice does not cover what that platform stores on your device: for that, the text you find there applies.
10. Whom to contact
The controller is Business Gates S.r.l., Via Ripamonti 44, 20141 Milano, P.IVA 05759280968.
For any question about this page, and to exercise your rights, write to info@bgates.it. We reply within one month.
Version 2026.10.27-1 — in effect from 27 October 2026. When we change something substantial — a new purpose, a new supplier, a longer retention period — we publish the new version here, with its date, and if you have an Account we tell you by email. This document is not accepted: it is read, and we do not ask you to tick any box. Corrections of form do not change the version. Previous versions are available on request from info@bgates.it.
Business Gates S.r.l. · Via Ripamonti 44, 20141 Milano · P.IVA 05759280968 · info@bgates.it