Privacy Notice

Courtesy translation. In case of discrepancy, the Italian text prevails.

This notice explains what happens to the personal data that passes through the BGates Service: what data we process, why, whom we share it with, how long we keep it and what you can ask for. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the ‘GDPR’).

It covers the GT PRO 4G model and the related Service. It does not cover earlier models that work by SMS only, or the Bluetooth channel: if you use one of those, write to info@bgates.it with ‘privacy’ in the subject line and we will give you the information you are entitled to.

You do not have to accept this notice: it is not a contract. You must be able to read it, and we must have written it truthfully. If anything here does not match what the Service actually does, please tell us: it is our mistake and we will correct it.

1. Who processes your data

Business Gates S.r.l. (hereinafter BGates) Via Ripamonti 44, 20141 Milano — P.IVA 05759280968 Telephone 02 52 20 18 38 — Fax 02 52 20 18 20 — Email info@bgates.it

For anything to do with your data, write to info@bgates.it. It is the right address to request access, rectification or erasure, to object to processing and to obtain a copy of the safeguards for transfers outside Europe. We reply within one month.

To report a security problem — a vulnerability, an access you did not expect, a QR code circulating where it should not — write to info@bgates.it with ‘sicurezza’ (security) in the subject line.

We have not appointed a Data Protection Officer (DPO). We consider that we do not fall within the cases in which the GDPR makes this mandatory, and the reasons are set out in our internal impact assessment.

2. Who this notice is for

Not all the people we deal with are in the same position, and not all of them have a relationship with us. Find the row that matches you: it tells you which sections concern you and, above all, who decides about your data — because in many cases it is not us.

2.1 When it is not us who decide

For part of the data that passes through our systems it is not us who decide: the Customer who holds the Entrance decides. The Customer chooses who can open, on which days and in which time slots, until when, and consults the Opening Log of their Entrance. In those cases:

• the Customer is the Controller and is responsible for the choice, for informing the people they authorise and for revoking a person's authorisation when that person should no longer get in;
• BGates is a Processor under Article 28 GDPR: we store the data, send it to the Device and deliver the Invite, but we do not decide who is authorised. The contract between us and the Customer is the Data Processing Agreement attached to the Terms for Administrators;
• if you ask us to erase data that the Customer decides about, we pass your request on to the Customer and tell you whom we passed it to. We explain this in section 10.

There are, however, activities we carry out for ourselves, even when they involve Customer data, and for those we are the Controller. They form a closed list, always the same: security of the Service and prevention of misuse; technical logs of the infrastructure; network diagnostics, including the cell-based location of the Device; support provided by our operators; legal, accounting and tax obligations; technical proof of delivery of Invites; improvement of the Service on pseudonymised data; the log of our operators' actions.

This list is identical, item by item and in the same order, to the one in the Data Processing Agreement (section 4.3) and in the Terms for Administrators (section 3.3): it is the list that marks where we stop acting on the Customer's behalf. ‘Pseudonymised data’ means what section 4.5 describes: a copy without the name and without the full number, on which we process the same events as Controller.

We are not joint controllers with the Customer. We decide how the Platform works; the Customer decides who comes in through their Entrance: these are two separate decisions, not one decision taken together.

3. The Opening Log: it exists, and you need to know about it

It is the most sensitive data in the Service, and we put it before everything else because it is what people do not expect.

Every command and every opening of the Entrance leaves a written entry. The entry contains:

• date and time to the second;
• what happened: opening, command sent, outcome, and the channel used (phone call, app, Private Area);
• who, when the Device recognises the calling number or the Account sending the command: the name the Customer has associated with that number, the phone number, or the email address of the Account;
• attempts by people who are not authorised as well: if you phone an Entrance and your number is not authorised, a record remains that someone called and when (section 4.6). This is how it is designed, and it is not yet live as of 22 September 2026: on screen only the last three digits of the number will be visible, and the full number will be deleted after 30 days. Today the full number is shown to the person who administers the Entrance.

Who sees it. The Customer who holds the Entrance and anyone who administers it on the Customer's behalf; our BGates Operators for support. This is how it is designed, and it is not yet live as of 22 September 2026: every access by one of our Operators will leave a trace in a log of administrative actions (section 4.17). Until then, our Operators' actions remain only in the technical process logs, for 60 days, which do not make it possible to attribute an operation to a specific person.

The person who administers the Entrance can export it to a file and take it outside the Service: from that moment, they are responsible for where that file ends up. This is how it is designed, and it is not yet live as of 22 September 2026: the export will leave a server-side trace; today the file is put together by the program running in the browser and the operation leaves no trace.

For how long. 12 months from the event. After 12 months we remove the name and reduce the number to its last three digits: the event remains, the person does not. The reduced technical entry is deleted after 24 months in total.

Why we keep it. It allows whoever manages the Entrance to verify a disputed access. In an apartment building or a business, disputes come up late, sometimes months afterwards. It is not for measuring people's attendance, and using it for that purpose is prohibited by the rules the Customer accepts.

Part of the log is stored inside the Device. The Device records internally the date, time, outcome and number of every call it receives, in two rotating files containing the most recent few hundred events. Anyone who knows the Device password can access them, and our support service can download them at the Customer's request or for an agreed intervention: in that case the periods in the Retention Policy apply, and the channel through which the Device uploads them is not encrypted (section 11). When the Device is decommissioned, that log must be deleted.

4. What we process, why, and on what legal basis

4.1 Your Account and access to the Private Area

What. Username (normally your email), password stored in encrypted form, first name and surname, email, mobile number, telephone, address, town or city, postcode, province; for those operating as a business, also company name, tax code, VAT number and SDI recipient code.

Why. To give you personal access, to know who is commanding what, and to let you use the Private Area and the app.

Legal basis. Article 6(1)(b) GDPR: it is necessary to perform the contract you have with us. For the security aspects (limits on login attempts, prevention of misuse) the legal basis is Article 6(1)(f): our legitimate interest in protecting the Service.

One thing to be aware of first. The mobile number you enter when you register or when you activate the Device becomes an Authorised Number on your Entrance: from that moment, anyone calling from that number opens it. This is not a side effect, it is how the product works — but you should know it while you are typing it, not afterwards.

If your Account was created by someone else — your Customer, an Installer, one of our Operators — we did not obtain the data from you: see section 5.

4.2 Subscription, payments and invoices

What. The plan you chose, the status of the Subscription, the serial number of the Device and the SIM identifier, the identifiers that Stripe returns to us, and billing data.

We do not see or store your card details: Stripe collects them on its own payment page. Stripe returns to us, among other things, your name, email, telephone, billing address and the link to the invoice.

Legal basis. Article 6(1)(b) for the performance of the Subscription; Article 6(1)(c) for issuing and keeping tax documents (Article 2220 of the Codice civile (Italian Civil Code); electronic invoicing under Legislative Decree 127/2015, Art. 1(3)).

4.3 Authorising a number to open an Entrance

What. The phone number, the international dialling code, the name the person authorising you has entered next to the number, the days and time slots in which the number opens, and the start and end dates. The number is also written inside the Device, in the On-board Number List, so that the Device can recognise you even when there is no connection to our systems. Your name is not in the On-board Number List: only the number.

Why. So that you can open that Entrance by phoning it.

Legal basis. The Customer's legitimate interest (Article 6(1)(f)) in the security of, and the management of access to, their Entrance. It is not consent, and it cannot be: consent belongs to the data subject and nobody can give it on someone else's behalf (Article 4(11) GDPR). The person who authorises you is pursuing their own interest; you have the right to object (section 10).

Who decides. The Customer. BGates stores and transmits the data on the Customer's behalf.

An uncomfortable fact, stated as it is. Today the system allows the person who administers an Entrance to authorise a number without verifying that it really belongs to the person in whose name it is entered. Whoever does so must declare that they have informed that person, and the Terms they accept oblige them to do so, but the declaration is no substitute for verification. We are introducing automatic revocation of numbers whose Invite is never opened. This is how it is designed, and it is not yet live as of 22 September 2026: until then, if the number is never used, it is up to the person who administers the Entrance to revoke it.

Retention. For as long as the number is authorised. On revocation the number is deleted after 30 days: the delay is needed to bring the Device's On-board Number List back into line, which has to be queried and corrected, and it is not a convenience margin.

4.4 The Invite on WhatsApp and, failing that, by SMS

What. Your number, the message we send you, a personal link valid for 30 days, and the technical delivery outcome (delivered, read, not delivered) with the identifier returned to us by the channel provider.

Why. To tell you that your number has been authorised on an Entrance, and by whom, and to give you the means to read the notice that concerns you and, if you wish, to create an Account.

Legal basis. The Customer's legitimate interest for delivery; our legitimate interest in keeping proof that the message was sent and arrived, and in protecting ourselves against misuse of the channel.

It is not an advertising message and we do not ask for your marketing consent to send it: it serves to carry out a decision of the Customer and to give you a notice you are entitled to. If you no longer want to receive Invites, tell the person who administers that Entrance, or write to info@bgates.it and we will pass the request on.

Recipients. Meta Platforms Ireland Limited (WhatsApp Cloud API) when the channel is WhatsApp; Commify Italia S.r.l. (Skebby brand) when it is an SMS.

Retention. The link is valid for 30 days; the Invite record is deleted 90 days after the link was used or expired. It allows us to reconstruct who authorised whom, if someone disputes an opening.

4.5 The Opening Log

See section 3, which describes it in full: content, who sees it, duration. Here the two legal points are enough.

Legal basis. The Customer's legitimate interest (Article 6(1)(f)) in the security of their Entrance and in handling disputes, with a balancing test that we make available to the Customer. On a copy without the name and without the full number we process the same events as Controller, for the security of the Service: it is used to detect misuse and anomalies, not to know who enters whose home.

Recipients. Nobody outside BGates and the Customer: the Opening Log stays on our systems.

Retention. 12 months, then the reduction described in section 3, then deletion at 24 months.

4.6 If you call an Entrance and are not authorised

What happens. The Device never answers the call: it hangs up immediately, and it costs you nothing. But your number was captured before it hung up, and a record remains that someone called and when.

What the person who administers the Entrance sees. Only the last three digits of your number. The full number stays in our systems for 30 days and is then deleted: it is used to tell whether someone is repeatedly trying to open, and thirty days are enough for that.

Legal basis. The Customer's legitimate interest in detecting attempts. There is no way of asking for your consent — we do not know who you are, and we do not write to you — and it would make no sense to ask for it.

Masking on screen and deletion of the full number after 30 days are the rule that applies from this version of the notice.

4.7 Permanent QR code, Single-use QR code and access requests

The Permanent QR code is the code displayed at the Entrance. Scanning it does not let anyone in: the person asks to be authorised, leaving a name and a number. The person who administers the Entrance decides. The Single-use QR code is a personal pass that is valid only once; a record remains of who used it and when.

What we process when someone fills in the request. The name and number that the person declares — and which we do not verify: anyone can enter someone else's number — the outcome of the decision, who decided and when, and the IP address from which the request came.

Legal basis. Name and number: the Customer's legitimate interest, as the Customer must be able to decide who comes in. IP address: our legitimate interest in protecting from misuse a form open to anyone. The person who administers the Entrance does not see the IP address: we do, and it goes with the record.

Retention. Requests are deleted 90 days after the decision, together with the IP address. Revoked QR codes are deleted 12 months after revocation, together with the name and number of whoever used them.

Something we cannot prevent. A photograph of a QR code works just like the QR code. Whoever puts it up decides where to put it.

4.8 The Device's Activation QR code

It is the code printed on the Device label and it is used to put the Device into service the first time. It does not authorise anyone to open. It resolves to the serial number and the technical data of the SIM.

Legal basis. Article 6(1)(b) for activation of the Service; Article 6(1)(f) for the prevention of fraudulent activations.

A known limitation, stated because it concerns you. Today this code does not expire, is not single-use and cannot be revoked, and the page that resolves it can be reached without signing in: anyone who scans it obtains the serial number, the Device identifier and the SIM number. This is how it is designed, and it is not yet live as of 22 September 2026: revocation of the code after activation, logging of every use of it, and masking of the Device identifier and SIM number in the public response. Until then, the Device label must be treated as a credential.

4.9 The Personal Address Book

What. The contacts you save in your Private Area: name, number, a note, and where the contact came from. You can enter them manually, or import them from your phone's contacts or from a contacts file.

Be aware. When you import your phone's contacts, the numbers of dozens of unrelated people, who have no relationship with us, enter the Service. Import only what you need.

Legal basis. If you are an individual and use the Personal Address Book for yourself, the GDPR does not apply to your use (household exemption, Article 2(2)(c) GDPR). It does apply to ours: those contacts are stored on our systems and we are their Controller, on the basis of our legitimate interest (Article 6(1)(f) GDPR) in providing you with the feature you asked for. We do not contact the people you have saved, we do not use them for anything else and we do not cross-reference them with anything else; we do not give them an individual notice because we have no way of reaching them without using, for that very purpose, the number you gave us, and this section is the information made publicly available in place of individual notice (Article 14(5)(b) GDPR). If one of those people writes to us, we reply ourselves and delete the entry concerning them. If you use the Personal Address Book for your business, you are the Controller and we are a Processor on your behalf.

Who sees it. You. And our BGates Operators when needed for support: that access is limited to persons designated in writing. This is how it is designed, and it is not yet live as of 22 September 2026: the recording of each of their accesses in the log of administrative actions (section 4.17).

Retention. For as long as your Account exists; it is deleted with the Account.

4.10 Notifications and push notifications

What. The notifications we send you about the Service (an access request to approve, the outcome of a command) and, if you enable them in your browser, push notifications: in that case we store the technical address at which your browser receives notifications and the two keys needed to send them.

Legal basis. Article 6(1)(b): they are service notifications concerning your Entrance that you asked for.

What leaves our systems. The title and text of the notification pass through your browser's notification service: Google, Mozilla or Apple, depending on the browser you use. This is why we remove the phone number of the person requesting access from the text of notifications: the notification says there is a request, and you read the number in the app. This is how it is designed.

Retention. Notifications are kept for 90 days. The push notification subscription remains for as long as it is valid and is deleted when you revoke it, when you sign out of the Account, when you delete the Account or when the notification service tells us it is no longer valid.

4.11 Support: email and WhatsApp

What. If you write to us, we process your number or email address, the name you give and the content of what you write to us, including attachments, photographs and voice messages. If you call us on WhatsApp, the technical data of the call is also kept.

Who sees it. Only BGates Operators designated in writing. This is how it is designed, and it is not yet live as of 22 September 2026: the recording of every reading and every reply in the log of administrative actions (section 4.17).

Legal basis. Article 6(1)(b) if you are a Customer: support is part of the Service. Article 6(1)(f) if you write to us without being a Customer: our interest in replying to people who contact us.

Retention. 24 months from the last message in the conversation, attachments included.

When you write to us on WhatsApp, the automatic message you receive tells you so: the conversation is kept. The channel is operated by Meta, and what you write passes through it.

4.12 The Device's location derived from the mobile network cell

What. The Device tells us which mobile network cell it is connected to. From those identifiers we derive an approximate location, normally with a radius of several hundred metres. The system requests it automatically, at every reconnection and every six hours.

Why. To understand, when something is not working, how and where the installation is connected to the network. It is diagnostics, not a feature we sell.

What it is not. It is not the location of a person and it is not geolocation of workers: the Device is fixed, mounted on a wall. But the Device is normally at the Customer's home or business premises, so that location reveals where the installation is: that is why we treat it with the same care as location data.

Legal basis. Article 6(1)(f). You can ask us to switch it off for your Device by writing to info@bgates.it: we switch it off, and the Device keeps working. Only persons designated in writing can consult the map of installations.

Recipients. To convert cell identifiers into coordinates we rely on beaconDB. The cell identifier leaves our systems; the Device identifier and your name do not.

Retention. We keep only the latest value, which is overwritten at every update, and we delete it when the Device is decommissioned. The Opening Log, however, keeps the record of the queries: it is covered by the 12-month reduction described in section 3.

4.13 The address where the Device is installed

What. Address, town or city, postcode, province and a description of the installation. It is usually a person's home address.

Legal basis. Article 6(1)(b): it is needed to support you and to identify the installation.

Retention. For the duration of the relationship.

4.14 Temperature, time slots and status of the Entrance

What. The temperature measured by the Device, the time slots set, the relay status, the timers, and whether the Device is connected.

Why. These are the features the Service sells: seeing them is the reason the app exists.

Legal basis. Article 6(1)(b) in relation to the Customer. In relation to other people who live or work at that location, the Customer's legitimate interest.

Retention. We keep the latest value.

4.15 SIM and connectivity

What. The identifiers of the SIM fitted in the Device and its status with the network operator. They are technical data, but when the SIM is assigned to a Customer they become data relating to that Customer.

Legal basis. Article 6(1)(b) and (c) for the assigned SIM; Article 6(1)(f) for inventory management.

Recipients. Vodafone Italia for activation and management of connectivity: the SIM and Device identifiers leave our systems, your name does not.

Retention. For the duration of the relationship. Technical records of calls to the operator's systems are deleted after 90 days.

4.16 Security of the Service, IP addresses and technical logs

What. When you open one of our pages, the server records the IP address, date and time, the page requested, the outcome and the type of browser. When a Device connects, we record its identifier and the outcome of the connection. We count login attempts to limit misuse.

Legal basis. Article 6(1)(f): protecting the Service and the people who use it.

Retention. Web server logs 14 days; messaging channel and application process logs 60 days; encrypted backups 14 days; sessions and access tokens 7 days, deleted every night.

Device confirmation (the Users' web app). If you open an Entrance from the web app, the first time you do so from a new phone or browser we send you a six-digit code by email: it is there to make sure that it is you, and not someone who has obtained your password. For each confirmed device we keep a random identifier, held in our system exclusively in the form of a cryptographic fingerprint, the description that the browser gives of itself (for example ‘iPhone, Safari’), the date of confirmation, whether confirmation took place with the code or through an unlock by the person who administers the Entrance, and the date of last use. We do not keep the IP address or the location. After each confirmation we send you an email with the description of the device connected. If the person who administers the Entrance unlocks you because the code does not reach you, they see the description of the pending device and the date of the request, nothing else.

Legal basis for device confirmation. Article 6(1)(f): protecting you and the Entrance from the use of a password that has been lent or stolen.

Retention for device confirmation. The device is kept for as long as it remains confirmed; when it is unlinked (because you confirm another one, because you change your password, or because the person who administers the Entrance resets your devices) we delete it immediately. Of the code we keep the fingerprint only while it is valid: we delete it as soon as it is used or expires, after 10 minutes. The request (description of the device, times and attempts) is kept for 24 hours, to apply the limits against misuse and to allow unlocking.

4.17 The log of our operators' actions

What. When a BGates Operator reads a Personal Address Book, opens support correspondence, consults an Account's billing, exports the Opening Log, prints a QR code, downloads a Device's on-board log, deletes an Account or changes a role, a record is kept of who, what, on what, when and from which IP address.

Why. Because ‘the operator sees everything’ is not an acceptable set-up: if an access leaves no trace, it is impossible to prove either that it was improper or that it was not.

Legal basis. Article 6(1)(c) and (f), implementing Article 5(2) GDPR and Article 2-quaterdecies of the Codice privacy (Italian Data Protection Code).

Retention. 24 months.

If you are a business Customer you can ask us for an extract of the entries concerning your data. This is how it is designed: the log of administrative actions is being introduced. Until then, our operators' actions remain only in the technical process logs, for 60 days.

4.18 The website and the quote request form

On the website we process what section 4.16 describes (IP address and technical data) and, if you fill in the form to request a quote, the data you leave so that we can reply: legal basis, Article 6(1)(b), because these are pre-contractual steps taken at your request. If you choose to write to us on WhatsApp from the website, we tell you beforehand: the message passes through Meta.

Website statistics, only with your consent. On the public pages of the website, and only there, we ask you with a banner whether you want to enable Google Analytics, through Google Tag Manager, to count visits and understand which pages are useful. Legal basis: your consent (Article 6(1)(a) GDPR and Article 122 of the Codice privacy), which you can withdraw whenever you like from "Cookie preferences" at the bottom of every page, as easily as you gave it. If you decline, the website works just the same and your browser does not contact Google. We look at the data only in aggregate form; Google Signals is turned off, so there is no link to your Google account, if any, and no advertising use. The details are in the Cookie and Local Storage Notice.

The shop, at shop.bgates.it, is run on a different platform, Shopify, with its own privacy notice and its own cookie notice.

4.19 Marketing communications

We do not send marketing communications at present. If one day we do, we will ask you with a separate tick box that is not pre-ticked and not required to use the Service: the legal basis will be your consent (Article 6(1)(a) GDPR and Article 130 of the Codice privacy), and you will be able to withdraw it as easily as you gave it, from your profile.

4.20 Acceptances and acknowledgements

What. When you accept a contractual document or declare that you have read a notice, we record which document, which version, when, from which screen, from which IP address and with which browser.

Why. So that both we and you can prove, later on, what was written when you accepted.

Legal basis. Article 6(1)(c) and (f), implementing the obligation to be able to demonstrate compliance (Article 5(2) GDPR).

Retention. For as long as the relationship lasts and for 10 years after it ends.

4.21 What data you must give us, and what happens if you do not

Some data we ask for because without it we cannot perform the contract: username, email, password and mobile number (which becomes an Authorised Number on your Entrance, as section 4.1 explains). If you do not provide it, we cannot open an Account for you or activate the Device.

Other data is required by law: for invoicing, personal and tax details (tax code, VAT number, SDI recipient code or PEC for business customers); if you do not provide it, we cannot issue the invoice and cannot conclude the Subscription.

Everything else is optional: the landline number, the installation address when it is not needed for support, the name you associate with an Authorised Number, the note in the Personal Address Book, push notifications. Not providing it has no consequence for the Service, except for the specific feature that depends on it.

This section responds to Article 13(2)(e) GDPR.

5. Data you did not give us yourself

Some of the people reading this notice have never given us anything. Article 14 GDPR applies to them, and the right question is: where does my data come from?

When we tell you. If your number has been authorised and we have a channel to reach you, you receive an Invite containing the link to the notice that concerns you: that is the moment at which we inform you, as provided for by Article 14(3)(b) GDPR. If the number was written directly into the Device's On-board Number List without going through our systems, we do not know it: in that case it is the person who entered it who must inform you, and this is an obligation that the Terms they accepted impose on them in writing.

We will tell you who entered you. If you write to info@bgates.it giving your number, we tell you on which Entrance it is authorised and who administers it, and we pass any objection of yours on to them.

6. Whom we disclose data to

We do not sell data and we do not hand it to anyone for third parties' own purposes. We disclose it only to the suppliers we need to provide the Service, and each one receives only what it needs. They are, named in full:

We also disclose data, where required, to authorities that request it in the cases provided for by law: each request is checked and recorded before it is complied with.

The up-to-date list, with the date of the last review, is in the Suppliers document. If we change a supplier that processes your data, we record it there and, where the change is substantial, we tell you.

7. Transfers outside the European Economic Area

Our servers are in Germany. Some suppliers, however, process data in the United States: Meta for onward delivery, Stripe, the push notification services and, only if you accept the website statistics, Google for Google Analytics. The fonts used on our pages are hosted on our own servers: when you open the website or the Private Area, your browser does not contact any external font provider, and no IP address leaves our systems for that reason.

On what basis. For US suppliers certified under the Data Privacy Framework list, the transfer is based on the European Commission's adequacy decision (EU) 2023/1795 (Article 45 GDPR). The decision is in force; it was upheld at first instance by the General Court of the European Union on 3 September 2025 (Case T-553/23) and an appeal is pending. For suppliers that are not certified, the transfer is based on the standard contractual clauses adopted by the Commission (Article 46(2)(c) GDPR), together with a transfer assessment. The clauses also remain in force with certified suppliers.

You can ask us for a copy of the safeguards that apply to a particular transfer by writing to info@bgates.it.

8. How long we keep data

All the retention periods are here, with the reason for each. The same figures are in the Retention Policy, which is the document where they belong: if the two texts were ever to differ, the Retention Policy prevails.

Something that needs saying, and that concerns the moment you are reading this. These periods are the ones that apply from this version of the notice. The automatic deletions that implement them are in operation from the date this version comes into effect: before that, the Service kept data without a stated period. Data already held on that date follows the same periods, calculated from the time it was collected.

9. Automated decisions and profiling

We do not take automated decisions that produce legal effects concerning you, and we do not carry out profiling (Articles 13(2)(f) and 14(2)(g) GDPR).

When the Device opens because it recognises the calling number, it is not an algorithm that decides: it is the execution of a rule that a person — the person who administers the Entrance — has set.

10. Your rights

You can ask us, at any time:

• to know what data we hold about you and to have a copy of it (Article 15);
• to correct it, if it is wrong or incomplete (Article 16);
• to erase it (Article 17);
• to restrict its use, while we verify something (Article 18);
• to receive it in a machine-readable format, for data you gave us yourself on the basis of the contract or of consent (Article 20);
• to object to processing based on a legitimate interest (Article 21). This is the right that matters most if your number was authorised by someone else: you can object, and the authorisation is removed unless the person who manages the Entrance demonstrates compelling legitimate grounds that override yours.

How to do it. Write to info@bgates.it. We reply within one month; if the request is complex we may take two further months, and in that case we tell you within the first month. We do not ask you for documents we do not already have: to identify you we use what you have written to us and the data we already process.

If you have an Account, you can download your data and delete the Account yourself from your Private Area, without going through support: in the dashboard, from the profile menu under ‘Legal documents and your data’, or at https://app.bgates.it/profilo. Both features are active from the date this version comes into effect.

10.1 When the request concerns data the Customer decides about

For Authorised Numbers, the Opening Log, QR code requests and Personal Address Books used for a professional activity, the Controller is the Customer who holds the Entrance, not us. (For the Personal Address Book of someone who uses it for themselves, we are the Controller, for the reason given in section 4.9: we reply to that request directly.) In the other cases:

1. we reply to you, telling you that the request concerns data of another Controller;
2. we pass the request on to the Customer without delay, and assist the Customer in replying to you, as Article 28(3)(e) GDPR requires us to;
3. we tell you whom we passed it to, so that you can contact them directly.

What we can do straight away, and do, is suspend the authorisation of the number while the matter is being clarified, if you ask us to.

10.2 Complaint

If you think we are processing your data incorrectly, you can lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority) (Piazza Venezia 11, 00187 Roma — www.garanteprivacy.it) under Article 77 GDPR, or bring proceedings before the courts. If you live in another Member State of the European Union, you can contact the supervisory authority of your State.

11. Security: what we do, and what we do not promise

We do not say that your data is ‘safe’: nobody can say that. We say what is in place.

What is in operation today. Pages and apps travel over encrypted connections (TLS), with browser protections enabled. Passwords are stored in encrypted, non-reversible form. Login attempts are rate-limited. The server is protected by a traffic filter and by a system that blocks addresses that persist. Each role sees only the part of the data it is entitled to, and that boundary is enforced by the Service on every request.

What is not yet as we would like it to be, and what we are closing. The connection between the Device and our systems is not encrypted: the encrypted channel exists, but none of the installed Devices has migrated to it yet, and migration is proceeding Device by Device. The channel through which the Device uploads its configuration and log files for support is not encrypted either. The data in our databases is not encrypted at rest; backups are, and they are stored on the same machine that hosts the Service. Two-step sign-in for administrative accounts is not available.

If something happens. If a personal data breach is likely to result in a high risk to your rights, we will tell you, as Article 34 GDPR requires, and we will notify the Garante within the time limits of Article 33. The procedure is described in the Breach and Incident Management document.

Two things that depend on you. The Account is personal: anyone who shares it makes it impossible to know who opened. And the phone number alone is a weak key: if you want stronger protection, use the app with your Account.

12. Minors

The Service is not aimed at minors and we do not ask people who register for their age. A minor's number may be authorised to open an Entrance by the Customer — for example by a parent or a school: in that case it is the person who authorises it who must inform whoever has parental responsibility. If you find that a minor's number has been authorised without your knowledge, write to info@bgates.it.

13. Cookies and storage on your device

In the Private Area, in the app and in the activation procedure we use only technical cookies: those that keep your session open and those that remember small preferences of your browser. There is no banner there, because technical cookies do not require consent (Article 122 of the Codice privacy).

On the public pages of the website, instead, there is a banner, because there we ask you whether you want to enable Google Analytics statistics (section 4.18). Until you choose, and if you decline, nothing from Google is loaded. We do not use profiling cookies and there are no advertising pixels, in any area. The fonts used on our pages are hosted on our own servers (section 7) and the map in the Private Area loads only if you ask for it.

The complete list, key by key, with duration and purpose, is in the Cookie and Local Storage Notice.

14. What we do not do

We set this out because these are the questions we are asked most often.

• We do not sell your data and we do not hand it over for third parties' purposes.
• We do not listen to or record the calls you make to the Entrance: the Device hangs up without answering. A record remains that you called, not of what you said.
• We do not know where you are: the location we process is the approximate location of the Device, which is fixed, not that of your phone.
• We do not profile you and we do not take automated decisions about you.
• We do not use the Opening Log to keep watch on people, and anyone who administers an Entrance agrees by contract not to do so.

15. Changes to this notice

This notice may change: because the Service changes, because a supplier changes, because we change a retention period, or because we correct something that was not well written.

Each version has a number and an effective date, at the bottom of the page. When the change is substantial we tell you; when we correct a comma, we do not.

Version 2026.10.27-1 — in effect from 27 October 2026. When we change something substantial — a new purpose, a new supplier, a longer retention period — we publish the new version here, with its date, and if you have an Account we tell you by email. This document is not accepted: it is read, and we do not ask you to tick any box. Corrections of form do not change the version. Previous versions are available on request from info@bgates.it.