Data Retention Policy

Courtesy translation. In case of discrepancy, the Italian text prevails.

This is the document in which all the retention periods of the BGates Service live. The other documents — the Privacy Notice, the Notice for people authorised to open an entrance, the Data Processing Agreement, the Terms — refer to them and reproduce some of them for ease of reading. If another document should state a figure different from the one written here, the one written here prevails.

We do not use, anywhere, the formula ‘for as long as necessary’. Where there is a period there is a figure, and next to the figure there is the reason.

Controller: Business Gates S.r.l., Via Ripamonti 44, 20141 Milano, P.IVA 05759280968. For any request about this document: info@bgates.it.

1. How to read this document

The tables always have the same six columns.

• Category — which data we are talking about, with the name we use in all documents.
• Why we keep it — the purpose. It is not a list of good intentions: it is what authorises the period in the next column.
• For how long — the figure.
• Why exactly that long — the justification for the figure. A period without a reason is a period that cannot be defended.
• What happens afterwards — the method: erasure, anonymisation or masking. These are three different things and in this document they are never confused (section 2).
• Where the technical rule is — the point in the Service that actually carries out the rule. Almost all the rules are carried out by a nightly job (section 8); some are carried out by the rotation of the system logs; one is carried out by the factory reset of the Device.

The tables are divided in two, because not all the data are ours: section 4 contains the Entrance data, for which the Customer is the controller and we are the processor on its behalf; section 5 contains those for which we are the controller. The distinction is not a formality: it changes who can decide a shorter period and to whom requests should be addressed.

2. The three words we use, and never confuse

Erasure. The entry or field disappears from the live systems. It remains in the backup copies for the rotation period (section 7), and then disappears from there too.

Anonymisation. The entry remains, but loses the data that make it possible to trace it back to a person: the name is removed, and only the last three digits of the telephone number remain. What remains is an event — ‘at 18:42 on 3 March someone opened’ — which is no longer personal data and cannot be reversed.

Masking. The data is still in our records, but on screen only the last three digits can be seen. It is a measure that protects against whoever is looking, not against whoever has access to the database: that is why, wherever there is masking, there is always also an erasure or anonymisation period next to it. Masking on its own is not a retention policy.

When this document says ‘technical entry’ it means the event stripped of name and number, that is, what remains after anonymisation.

3. Two things that apply to all the tables

No period depends on consent. We do not ask your permission to keep the data, and we do not ask it because consent is not the legal basis of this processing: the legal bases are the contract, a legal obligation or a legitimate interest, and they are written one by one in the Privacy Notice (/privacy). Consequently there is no box to tick to lengthen a period, and no box to untick to shorten it: to request early erasure, see section 11.

The periods apply while the relationship is ongoing as well. They are not an effect of termination. The Opening Log of an active Entrance is anonymised at 12 months exactly like that of a decommissioned Entrance.

4. Entrance data: the Customer decides, we keep them on its behalf

For these data the Customer is the controller and BGates is the processor under Art. 28 of the GDPR (Regulation (EU) 2016/679). The Customer may ask us for shorter periods for its own Entrance; it may not ask us for periods longer than those stated here.

5. The data for which we are the controller

6. What it means that the periods run from today

These periods apply from this version of the document, and from the same date the automatic erasures that carry them out are in operation: the nightly job in section 8, the clean-up of session tokens, and the rotation of the logs and of the backup copies.

It must be said precisely, because the difference between a rule that is written and a rule that is in operation is exactly what matters: before this version the Service kept application data without a stated period. This is not a nuance, and it is the reason why this document exists. Data already present on the date of entry into force follow the same periods, calculated from the moment they were collected.

The only rule in this document not yet in operation is the deletion of the files that the Device uploads to the maintenance server: it is written in section 14 and nowhere else.

7. Backup copies

Every night we make a copy of the databases and of the configuration files. The copy is encrypted with GPG AES-256, is accompanied by a checksum that verifies its integrity, and is kept in a folder readable only by the system user that produces it. Retention is 14 days, by automatic rotation.

What this means for you: when data is erased from the live systems, it may remain in the backup copies for up to 14 days, and then it disappears from there too. We do not restore a copy to recover data erased at someone's request.

Two facts that we state because they are true, not because they suit us:

• the copies are on the same machine that provides the Service. There is no off-site copy today: losing the machine would also mean losing the copies. This is a measure that has been decided and is not yet in operation, and it is recorded as such in our impact assessment;
• the copies do not include the attachments and voice messages of support correspondence, nor the archives of the internal test areas.

8. Where the technical rule is: the nightly job

Almost all the rules in the tables are carried out by a single nightly job of the management system, which starts every night at 04:40 and writes, at each run, an entry with a count of what it has anonymised and erased. Each period is a configuration key, expressed in days, and can only be shortened: lengthening it beyond the value stated in this document would make the document false.

Outside this job are the following, and we say so that you know that not everything is in the same place:

• the clean-up of session tokens, which runs every night at 04:17 and was the only automatic erasure of data already in operation before this document;
• the reduction of raw payment event data and the erasure of the technical records of calls to the SIM operator, carried out by the activation system;
• the on-screen masking of the number of anyone who calls without being authorised, which is not a job: it happens at the moment the entry is displayed, from the outset;
• the rotation of system logs (14 and 60 days) and of backup copies (14 days), which are rules of the operating system and not of the management system;
• the erasure of the On-board Number List, which is carried out on the Device and not on our servers.

9. What happens when you delete your Account

Deletion of the Account from one's own Private Area, and the complete erasure that follows, are in operation from the date of entry into force of this version.

You can delete your Account from your Private Area: in the dashboard, from the profile menu under ‘Legal documents and your data’, or at https://app.bgates.it/profilo. Confirmation is by means of a code sent to your email address. If you prefer, you can always ask us to do it by writing to info@bgates.it.

When you do so:

• we erase your customer details, your Personal Address Book, your notifications, your notification preferences and your push notification subscriptions;
• we replace your number with only its last three digits in the Invites that concern you;
• we revoke the Authorised Numbers that correspond to your number: final erasure takes place after the 30 days needed to resynchronise the On-board Number List;
• we anonymise your name and your number in the Opening Log: the entries remain as events, without you;
• we keep accounting and tax data for the 10 years required by Art. 2220 of the Italian Civil Code, and the records of acceptances for 10 years from the end of the relationship, because they are the evidence of what you accepted;
• we burn your username: it is not reassigned to anyone. This is not done to spite you; it is a security measure — without it, a new Account with the same name would inherit the sessions of the previous one.

Copies of your data remain in the backup copies for up to 14 days (section 7).

What remains is not hidden: it is exactly this list, and the screen asking you to confirm must say the same thing. If you read on screen a statement stronger than this one, report it to us at info@bgates.it: it is the statement on screen that is wrong, not this document.

10. End of the relationship and decommissioning of the Device

On termination of the Subscription, the Customer chooses between return and erasure of the data processed on its behalf. The time limits for that choice — 30 days to communicate it, 15 days to make the export available, 30 days for erasure, 14 days for the rotation of the backup copies, 10 days for the written certification — are in the Data Processing Agreement (/dpa), section ‘End of the relationship’.

When a Device is decommissioned, resold or changes owner, its decommissioning includes: the factory reset with verification that the On-board Number List is actually empty; deletion of any files downloaded from the Device for support; revocation of the QR codes and of the activation links; disassociation of the SIM; and a written record of all this.

11. Requesting erasure before the period expires

You can ask us to erase data before the expiry stated in these tables. Write to info@bgates.it: we will reply within one month.

What we can do, and what we cannot:

• we can erase earlier the data for which we are the controller, when we no longer have a reason to keep them;
• we cannot erase accounting and tax data before the ten years: it is a legal obligation and not within our discretion;
• we cannot decide by ourselves about Entrance data (section 4), because the controller is the Customer: in that case we forward the request to the Customer without delay and tell you that we have done so. If you need to know to whom it was forwarded, ask us;
• we cannot erase selectively from a backup copy: we wait for the 14-day rotation.

You can also object to processing based on a legitimate interest (Art. 21 GDPR). If you object, we must stop unless there are compelling legitimate grounds that override: we carry out the check case by case and write to you to tell you the outcome.

12. A period can be suspended, and we say when

In three cases data is kept beyond the period written in the tables. There are three, they are these, and there are no others:

1. a legal obligation requires us to keep it longer;
2. an ongoing dispute, in court or out of court, concerns that very data: in that case we keep it for the duration of the dispute and for the time allowed for appeal, and no longer;
3. a request from an authority asks us to keep it: we verify the request, record it and keep only what we are asked to keep.

Outside these three cases, a period that has been exceeded means data that should no longer be there.

13. What the suppliers keep, and for how long

Some data pass through suppliers that have their own retention periods, which we do not decide. We write them here because they are part of the honest answer to the question ‘how long does my data remain’. The complete list of suppliers, with their role and country, is in the Suppliers document (/fornitori).

14. What does not yet have a period

This section exists because a document on retention that kept silent about its own gaps would be the most useless of documents. Today the following still have no written rule:

• the files downloaded from the Device for support, stored on the service server (section 4, last row): the period is 90 days, but automatic deletion of those files is not yet in operation and today it is done by hand at the close of the intervention;
• the incoming service mailbox, which today keeps received messages indefinitely, including unsolicited ones sent by third parties: the Service reads them in order to process them, but does not delete them and does not even mark them as read. On the email supplier's side the period is the one stated in section 13; on our side there is not yet any period.
• the machine's security alert log, which today has no rotation. It contains aggregate counts and not personal data, but it grows without limit and must be governed in any case;
• the archives of the internal test areas, which contain sample data.

For each of these points the rule will be written in this document, and the document will change version.

15. Changes to this policy

This policy changes when a period changes or when one of the points in section 14 is closed. Each version has a number and a date of entry into force, at the bottom of the page.

A clarification that applies only to this document: a longer period is always a substantial change, and does not come into force silently. A shorter period comes into force immediately, because it is in your favour and there is nothing to accept.

Version 2026.10.20-1 — in effect from 20 October 2026. When we change something substantial — a new purpose, a new supplier, a longer retention period — we publish the new version here, with its date, and if you have an Account we tell you by email. This document is not accepted: it is read, and we do not ask you to tick any box. Corrections of form do not change the version. Previous versions are available on request from info@bgates.it.