Data Processing Agreement (Art. 28 GDPR)

Courtesy translation. In case of discrepancy, the Italian text prevails.

This Agreement governs the processing of personal data that Business Gates S.r.l. carries out on behalf of the Customer in providing the BGates Service, pursuant to Art. 28(3) of Regulation (EU) 2016/679 (hereinafter the ‘GDPR’).

It is the Annex to the Specific Terms for Customers and Administrators (/condizioni-amministratori) and is accepted together with them: it does not require a tick box of its own. It does not replace or repeat the Privacy Notice (/privacy), which is an act of transparency towards Data Subjects and not a contract.

Scope. It concerns the GT PRO 4G, that is the Device connected to the mobile network that controls an Entrance, and the Service that manages it. It does not concern the basic model that works by SMS only, nor Bluetooth pairing.

Defined terms. Words with an initial capital letter — Customer, Administrator, BGates Operator, User, Device, Entrance, Service, Platform, Subscription, Authorised Number, Invite, Permanent QR code, Single-use QR code, Activation QR code, Opening Log, Personal Address Book, On-board Number List, Account, Private Area, Suppliers, Data Subject, Controller, Distributor, Installer — have the meaning established in the Service documents and recalled here where needed.

1. The parties

BGates has not designated a representative under Art. 27 GDPR because it is established in the European Union.

2. How this Agreement is accepted, and from when it applies

This Agreement is concluded when the Customer accepts the Specific Terms for Customers and Administrators in the Private Area or in the BGates app. BGates records the following about the acceptance: the slug of the document, the version, the date and time, the IP address, the browser type, the screen and the channel. The record is kept as evidence for the duration of the relationship and for the following ten years.

If a business customer needs a signed copy, BGates provides one on written request to info@bgates.it, with the same content as this text.

3. What this Agreement governs, and what it does not

It governs the processing that BGates carries out on behalf of the Customer: the management of Authorised Numbers, the delivery of Invites, the Device's On-board Number List for the numbers that pass through the Service, the Entrance's QR codes and the access requests arising from them, the Opening Log of the Customer's Entrance, the Personal Address Book of the Customer's users, the Entrance's environmental data insofar as they concern persons other than the Customer who live or work at the place, and the log on board the Device when it is downloaded for a support intervention.

It does not govern:

• the processing for which BGates is an independent controller, listed exhaustively in section 4.3 (for that processing the Terms and the Privacy Notice apply, not this Agreement);
• the relationship between the Customer and the Data Subjects, to whom the Customer must give its own privacy notice: BGates provides anyone reached by an Invite, a Permanent QR code or a Single-use QR code with the Notice for people authorised to open an entrance (/informativa-utilizzatori), but that notice does not replace the Customer's own notice where the Customer also processes the same data outside the Service;
• the supply of the Device and the Subscription, which are governed by the Terms of Sale.

Data Subjects are not parties to this Agreement and derive no contractual rights from it; the rights that the GDPR grants them directly remain unaffected.

4. The roles

4.1 The Customer is the Controller

The Customer decides who may open its Entrance, from when, on which days and in which time slots, until when, and when to revoke. It decides whether to generate a QR code, whether to approve an access request, and whether to consult and export the Opening Log and for what purpose. These are its decisions: they determine the purpose of the processing, and therefore make it a controller within the meaning of Art. 4(7) GDPR.

The legal basis of this processing is the Customer's legitimate interest (Art. 6(1)(f) GDPR) in the security and management of access to its Entrance. It is not consent: consent belongs to the Data Subject (Art. 4(11)) and no one can give it on behalf of someone else. The Customer carries out and keeps the balancing test between its own interest and the rights of the data subjects; BGates makes available, on request to info@bgates.it (subject ‘privacy’), a usable balancing test template.

4.2 BGates is the Processor

For the processing in section 3, BGates processes the data only on documented instructions from the Customer (Art. 28(3)(a) GDPR), within the limits and in the manner set out in this Agreement.

4.3 The processing for which BGates is an independent controller, even though it touches Customer data

The list is exhaustive: outside it, for the data in section 3, BGates is the Processor.

1. Security of the Service, fraud prevention, detection of and action against misuse.
2. Technical logs of the infrastructure (web server, messaging broker, Device authentication service, application processes) and their retention.
3. Network diagnostics, including the location of the Device derived from the mobile cell.
4. Support provided by BGates Operators, including correspondence on the company WhatsApp channel.
5. Legal, accounting and tax compliance.
6. Technical evidence of delivery of Invites (outcome returned by the SMS gateway, message identifier returned by the messaging provider).
7. Improvement of the Service using pseudonymised data.
8. Log of administrative actions of BGates Operators.

For this processing BGates determines the purposes and means and is directly liable for it, as provided by Art. 28(10) GDPR. The IP address of whoever fills in the public form linked to a Permanent QR code falls under point 1: BGates needs it to protect a form open to the public; the Customer does not see it and has no control over it.

4.4 Why there is no joint controllership

The determinations of the two parties are separate and sequential, not joint: BGates decides the purposes and means of the Platform, and the Customer decides, within the Platform, who gets in through its Entrance and when. The requirement of necessary complementarity laid down by EDPB Guidelines 07/2020 on the concepts of controller and processor is not met. Art. 26 GDPR does not apply and the parties do not enter into a joint controllership arrangement.

4.5 Distributors and Installers

When a Distributor or an Installer enters Authorised Numbers, generates QR codes or creates Accounts on behalf of a Customer, it acts on behalf of that Customer and under its responsibility: the Customer is liable for its conduct as for its own. When it processes the data of its own commercial customers for its own purposes, it is an independent controller and this Agreement does not concern it.

4.6 The Customer who is an individual, and household use

If the Customer is an individual who uses the Device for purely personal or household purposes, the GDPR may not apply to the Customer's processing (Art. 2(2)(c) GDPR). BGates is not able to establish this in advance and applies this Agreement in any event: applying it does not impose on the household Customer obligations from which the exemption would spare it, whereas not applying it would leave the Data Subjects unprotected.

Where the exemption applies, the Customer is not a controller within the meaning of the Regulation and BGates processes that data as Controller, on the basis of its own legitimate interest (Art. 6(1)(f)) in providing the Service requested by the Customer and ensuring its security, with the balancing test documented in the internal data protection impact assessment. In that case BGates gives the Data Subjects the Art. 14 information directly and decides on their requests itself, including objection and erasure, without referring them to the Customer. The same rule is written, in the same words, in the Privacy Notice (/privacy) and in the Notice for people authorised to open an entrance (/informativa-utilizzatori): a Data Subject must never be directed to a controller that is not a controller.

5. Duration

This Agreement applies for the whole duration of the relationship between the parties — from acceptance until the termination of the last Subscription or, if later, until the closure of the Customer's Account — and in any case for as long as BGates processes even a single item of personal data on behalf of the Customer.

The following survive termination, until they are exhausted: the obligations in section 22 (return and erasure), the confidentiality obligation in section 12, the retention obligation required by law and liability for prior events.

6. Nature and purpose of the processing

The same environmental data, insofar as they relate to the Customer as an individual, are processed by BGates as Controller for the performance of the contract (Art. 6(1)(b) GDPR): that aspect is described in the Privacy Notice and not in this Agreement. Only the aspect concerning the other people who live or work at the place is relevant here.

BGates does not use the data in section 3 for purposes of its own other than those in section 4.3, does not transfer them to third parties, does not use them for marketing and does not use them to train artificial intelligence systems.

7. Types of personal data

The processing does not require special categories of data within the meaning of Art. 9 GDPR or data relating to criminal convictions and offences within the meaning of Art. 10.

8. Categories of Data Subjects

• Users: the people whose number has been authorised to open an Entrance of the Customer, with or without an Account. Depending on the Customer's context, they are staff, employees, family members, cohabitants, condominium owners, tenants, guests, suppliers, couriers, maintenance workers.
• Guests: anyone who scans a Permanent QR code or receives a Single-use QR code and asks to be authorised.
• Anyone who phones the Entrance, even if not authorised and even if they dialled the wrong number. The Device does not answer the call — it hangs up immediately, and the call costs the caller nothing — but the number is captured before it hangs up.
• The people listed in the Personal Address Book of the Customer's users, who may have no relationship either with the Customer or with BGates.
• The individuals acting for the Customer: Administrators of the Entrance, contact persons, appointed Distributors and Installers.

9. Data that must not enter the Service

The Service is not designed to process special categories of data. The Customer undertakes not to enter in the free-text fields — label of the Authorised Number, notes in the Personal Address Book, description of the Device, notes in the customer details — data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, data concerning health, sex life or sexual orientation, nor data relating to criminal convictions and offences. If BGates detects their presence, it informs the Customer and may remove them, giving the Customer an account of having done so.

10. Documented instructions

10.1 What the instructions are

The Customer's documented instructions within the meaning of Art. 28(3)(a) GDPR are, in this order:

1. use of the Platform in accordance with the Service documents: the Terms, the Specific Terms for Customers and Administrators, the Acceptable Use Rules, the Security Rules for Accounts, Numbers, QR Codes and Phones, the Retention Policy, this Agreement and the technical documentation of the Device. Every operation that the Customer, or whoever acts for it, performs in the Private Area, in the BGates app or on the Device is an instruction of the Customer, and is recorded by the Service;
2. the settings that the Customer configures: numbers, days, time slots, expiry dates, QR codes, notifications, permissions of the users linked to its Entrance;
3. the written requests sent to info@bgates.it or opened through support, when the Customer requests an operation that the Platform does not allow it to perform on its own (for example an extraction, a bulk rectification or an early erasure).

BGates does not process the data in section 3 for other purposes, including with regard to transfers to third countries, unless required to do so by Union or Member State law: in that case it informs the Customer in advance, unless that law prohibits such information on important grounds of public interest.

Requests involving an activity not covered by the Subscription fee are quoted before they are carried out; those necessary to comply with a legal obligation or to give effect to a data subject's right are never made conditional on payment.

10.2 If an instruction infringes the law

If, in BGates's opinion, an instruction infringes the GDPR or other data protection provisions, BGates immediately informs the Customer (Art. 28(3), last subparagraph) and suspends execution of the disputed part only, until the Customer confirms it in writing or amends it. If the Customer confirms an instruction that BGates considers manifestly unlawful, BGates may refuse to carry it out and, in serious cases, suspend the Service in accordance with the Terms.

10.3 What the instructions do not shift

The Customer's instructions do not transfer to the Customer BGates's liability for the design and security of the Platform (Articles 25 and 32 GDPR). In particular, BGates is liable for the fact that the Service allows a person's number to be authorised without any verification that the person holds it, and for the default settings of the Service; the Customer is liable for the choice of the person, for the privacy notice to that person and for revocation. The representation by which the Administrator confirms having informed the person shifts an obligation of the Customer; it does not cancel an obligation of BGates.

11. Obligations of the Customer as Controller

The Customer:

1. informs the people whose number it authorises, with the information required by Art. 14 GDPR, before or at the latest at the time of first use of the Entrance. With the Invite, BGates delivers a link to the Notice for people authorised to open an entrance: this is an aid, not a fulfilment of the Customer's obligation;
2. verifies that it is entitled to authorise that number, and does not authorise other people's numbers without the person's knowledge;
3. revokes the Authorised Number on the same day that the person should no longer get in. A mobile number can be reassigned by the operator to another person: if it remains authorised, that person opens;
4. decides where to put up the Permanent QR code and to whom to hand Single-use QR codes, and revokes them when they are no longer needed;
5. does not use the Opening Log for the purpose of remote monitoring of workers' activity. If the Entrance gives access to a workplace, the Customer complies on its own account with Art. 4 of Law no. 300 of 20 May 1970 (Statuto dei lavoratori, Italian Workers' Statute), including the information to workers and, where required, the agreement or authorisation procedure;
6. keeps its own users — Administrators, contact persons, Distributors and Installers operating for it — bound by confidentiality and instructed on use;
7. keeps up to date the contact details for the communications provided for by this Agreement, including those concerning breaches;
8. carries out its own assessment of legitimate interest and, where applicable, the data protection impact assessment relating to its own installation.

The Customer warrants to BGates that the data it provides or has processed by BGates have been lawfully collected and that the instructions it gives comply with the law.

12. Confidentiality and authorised persons

BGates ensures that the persons authorised to process the data on behalf of the Customer:

• are designated in writing as authorised persons under Art. 2-quaterdecies of the Codice in materia di protezione dei dati personali (Italian Data Protection Code, Legislative Decree 196/2003), with a precise list of the operations permitted. This is how it is designed, and it is not yet live as of 22 September 2026: as at the date of this version BGates Operators work without an individual written designation and the letters are being prepared.
• have committed themselves to confidentiality or are under an appropriate statutory or contractual obligation of confidentiality (Art. 28(3)(b) GDPR), and the commitment survives the end of the employment or collaboration relationship;
• act only on instructions from the Controller (Art. 29 GDPR);
• access the Customer's data only when necessary to provide the Service or to deal with a support request, and not out of curiosity or for purposes of their own.

What is recorded. Access by BGates Operators to the most sensitive information — reading Personal Address Books, reading the On-board Number List, exporting the Opening Log, downloading Device logs, printing QR codes, reading support correspondence, changing roles, deleting users, exporting data — is recorded in a log of administrative actions kept for 24 months. On written request, the Customer receives an extract of the entries concerning its data, within 30 days.

13. Security measures

BGates adopts the technical and organisational measures required by Art. 32 GDPR, described in Annex B. Annex B distinguishes, without softening anything, what is in operation today, what is being introduced and what is not there today: it is written to be read by someone who has to assess a risk, not to reassure.

No part of this Agreement states that the data are absolutely secure: no measure can ensure that. BGates undertakes not to reduce the overall level of the measures for the whole duration of the Agreement and to update Annex B when it changes.

14. Sub-processors

General authorisation. The Customer authorises BGates, under Art. 28(2) GDPR, to engage the sub-processors listed in the Suppliers document (/fornitori), which forms an integral part of this Agreement by reference. For each sub-processor the list states the full name of the contracting entity, the service performed, the categories of data processed, the country and the basis for the transfer outside the European Economic Area. Annex C sets out the sub-processors that, as at the date of this version, process the Customer's data.

Additions and replacements. BGates notifies the Customer of its intention to add or replace a sub-processor at least 15 days in advance, by email to the Account's address and by updating the Suppliers document. This is the same period as in section 10 of the Suppliers document (/fornitori) and in § 22 of the Specific Terms for Customers and Administrators.

Objection. Within the notice period the Customer may object, in writing and on grounds relating to data protection. In that case the parties seek in good faith an alternative solution within 30 days; if they do not find one, the Customer may terminate the part of the Service concerned, or the Subscription, without penalty, with a refund of the portion paid and not used. Until the notice period expires, and in the event of objection until the disagreement is resolved, BGates does not entrust the Customer's data to that sub-processor. If engaging that sub-processor is indispensable for providing the Service, BGates states this in the notice: in that case the Customer, within thirty days, chooses between accepting the sub-processor and terminating the Subscription without penalty, with a refund of the portion paid and not used, and until the Customer has chosen the Service continues without its data being entrusted to the new sub-processor.

Urgent replacement. If a sub-processor ceases its service or its reliability fails, BGates may replace it with shorter notice, informing the Customer within 5 days of the replacement and stating the reason; the right to object remains, with the same effects.

Conditions. BGates imposes on each sub-processor by contract the same data protection obligations as set out in this Agreement (Art. 28(4) GDPR). BGates is liable to the Customer for the failure of its sub-processors to perform as for its own.

15. Assistance with Data Subjects' rights

BGates assists the Customer, by appropriate technical and organisational measures, in responding to Data Subjects' requests (Art. 28(3)(e) GDPR).

If the request reaches BGates. BGates does not respond on the merits on behalf of the Customer. It takes charge of the request within 24 hours, forwards it to the Customer within 5 working days with everything the Customer needs to respond, tells the Data Subject to whom it has forwarded it, and remains available to the Customer for the extraction of the data. If the Data Subject so requests, BGates may immediately suspend the authorisation of the number pending the Customer's decision: this is a technical precautionary measure, not a decision on the merits of the request.

If the request reaches the Customer. BGates provides, within 10 working days of the written request, the data and information that the Customer cannot obtain by itself from the Private Area.

What the Customer can do by itself. From the Private Area the Customer consults and exports the Authorised Numbers and the Opening Log of its Entrance, revokes a number, revokes a QR code, corrects the label associated with a number, and deletes an entry in the Personal Address Book.

Right to object. Since the legal basis of the processing is the Customer's legitimate interest, the Data Subject may object under Art. 21 GDPR. The decision lies with the Customer, which must give it in writing with reasons; in the absence of compelling legitimate grounds that override, the number must be removed. BGates carries out the decision and keeps a record of it.

16. Assistance with security, breaches and impact assessments

BGates assists the Customer in ensuring compliance with the obligations under Articles 32 to 36 GDPR (Art. 28(3)(f)), taking into account the nature of the processing and the information available to it. In practice: it provides the description of the security measures (Annex B), information on data flows and sub-processors, the data needed for an impact assessment, and the assistance provided for in sections 17 and 18.

BGates also makes available to the Customer, on request, an extract of its record of the categories of processing activities carried out on the Customer's behalf (Art. 30(2) GDPR).

17. Personal data breaches

Who notifies. If the breach concerns data processed on behalf of the Customer, the Controller is the Customer: notification to the Garante and any communication to Data Subjects are the Customer's responsibility. BGates does not notify in its place and does not substitute its own assessment for the Customer's.

What BGates does. It informs the Customer without undue delay and in any case within 24 hours of becoming aware of the breach (Art. 33(2) GDPR). The period is 24 hours because the Customer must be left with at least 48 of the 72 hours that Art. 33(1) gives it to decide and notify.

Time of becoming aware. This is the moment at which BGates has a reasonable degree of certainty that a security incident has affected personal data. The date and time are entered in the internal breach register before any other activity.

Content of the communication to the Customer, as far as known at the time, with subsequent additions without waiting for the full picture:

Assistance. At the Customer's request, BGates assists it with the notification to the Garante and the communication to Data Subjects, and provides it with the information in its possession. Where the only contact detail available for a Data Subject is the telephone number, BGates uses it on behalf of the Customer, with a short, non-promotional message.

Breach register. BGates documents every breach that concerns it, including those not notified, as required by Art. 33(5) GDPR.

A second clock, which is not the GDPR's. If the incident concerns a vulnerability of the Device or of the Service, BGates is also subject to the reporting obligations of Regulation (EU) 2024/2847 on cybersecurity requirements for products with digital elements: early warning within 24 hours, notification within 72 hours, final report, and information to users. These are different periods and recipients from those of Art. 33 GDPR and they run in parallel. The procedure is described in the document Breach and Incident Management (/incidenti).

18. Impact assessment and prior consultation

BGates has carried out, for the processing operations of the Platform, its own data protection impact assessment and keeps it up to date.

The Customer assesses independently whether its own use of the Service requires an impact assessment under Art. 35 GDPR. This is the case, in particular, when the Entrance gives access to a workplace or when the Opening Log concerns a large number of people. BGates provides, on written request and at no additional cost, the information on the operation of the Service, data flows, sub-processors and security measures necessary to complete it, within 20 working days.

If the Customer must consult the Garante in advance under Art. 36 GDPR, BGates provides it with the relevant information within the same period.

19. Audits and inspections

BGates makes available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allows for and contributes to audits, including inspections (Art. 28(3)(h)).

Documentary audit. Once a year the Customer may request: the updated description of the security measures, the list of sub-processors, the extract of the record of processing activities carried out on its behalf, the extract of the log of administrative actions concerning its data, and answers to an audit questionnaire. BGates replies within 30 days of the request.

On-site inspection. The Customer may carry out an inspection at BGates's premises, directly or through an independent auditor who is not a competitor of BGates and is bound by confidentiality, on the following conditions:

1. written notice of at least 30 days, stating the scope and the names of those involved;
2. once a year, unless the inspection is required by the supervisory authority or follows a data breach that affected the Customer: in those cases the frequency limit does not apply and the notice is reduced to 5 working days;
3. during working hours, without interrupting the provision of the Service;
4. without access to other customers' data, trade secrets and credentials, and without copying material containing third parties' data;
5. at the Customer's expense, including the costs of any auditor. BGates bears the cost of its own ordinary response activities; if the inspection establishes a serious breach by BGates, the reasonable costs are borne by BGates.

The inspection report is confidential between the parties, save for the obligation to hand it over to a supervisory authority that requests it.

No clause in this section excludes or limits the powers of the Garante and of the other supervisory authorities.

20. Place of processing and transfers outside the European Economic Area

The data in section 3 are stored on servers located in Nuremberg, Germany, at netcup GmbH.

Some sub-processors process data outside the European Economic Area, and are identified as such in Annex C and in the Suppliers document. For those certified on the Data Privacy Framework list, the transfer is based on adequacy decision (EU) 2023/1795 (Art. 45 GDPR); the decision is in force, was upheld at first instance by the General Court of the European Union on 3 September 2025 (Case T-553/23) and an appeal is pending. For those not certified, the transfer is based on the standard contractual clauses adopted by the Commission (Art. 46(2)(c) GDPR), accompanied by a transfer impact assessment. The clauses remain in force with certified suppliers too.

The Customer may request a copy of the safeguards applicable to a given transfer by writing to info@bgates.it.

BGates does not transfer Customer data outside the European Economic Area for purposes other than the provision of the Service and does not do so on its own initiative without informing the Customer.

21. Retention

For the duration of the relationship BGates keeps the data processed on behalf of the Customer in accordance with the periods in the Retention Policy (/conservazione), which is the document where those periods live. They are reproduced in Annex A for ease of reading: should the two texts diverge, the Retention Policy prevails.

The periods apply while the relationship is ongoing as well: they are not an effect of termination. The Customer may request shorter periods for its own Entrance; it may not request periods longer than those stated.

22. End of the relationship: return and erasure

On termination of the relationship, at the Customer's choice, BGates returns or erases all the personal data processed on its behalf (Art. 28(3)(g) GDPR).

What remains, and why. Only the following remain: the data that BGates must keep by law — in particular accounting and tax data, for 10 years under Art. 2220 of the Codice civile (Italian Civil Code) — and the records of acceptance of the documents, kept for 10 years after the end of the relationship as evidence of what was accepted and when. These data are no longer processed on behalf of the Customer: BGates keeps them as Controller, in blocked form, and uses them only for the compliance purpose they serve.

Anonymous data and aggregate statistics that do not allow an individual to be identified also remain.

23. Decommissioning of the Device

On termination, replacement or resale of the Device, the personal data stored on board — the On-board Number List and the Device logs — are not erased by themselves, and the configuration restart command does not erase the On-board Number List. The Customer and BGates carry out the decommissioning procedure described in the Service documentation: factory reset of the Device, verification that the On-board Number List is empty, deletion of any configuration and log files uploaded to the maintenance server, and erasure of the Opening Log entries in accordance with section 22. A record of the decommissioning is kept.

24. Liability

Each party is liable for compliance with the obligations that the GDPR places on it. Towards data subjects and towards the supervisory authority, Articles 82 and 83 GDPR apply: in particular, the processor is liable for the damage caused by processing only where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller (Art. 82(2)).

Where a party has paid full compensation to a Data Subject, it may claim back from the other party that part of the compensation corresponding to the other party's share of responsibility (Art. 82(5)).

What is not limited. The limitations of liability provided for in the Terms do not apply to the obligations of this Agreement: the protection of personal data is a matter of public policy, and Art. 1229(2) of the Italian Civil Code renders void any agreement that limits liability for it in advance. Liability for wilful misconduct or gross negligence is not limited in any case (Art. 1229(1)).

No indemnity for personal data. The parties do not grant each other indemnities for breaches of personal data protection law: each is liable for its own failure to perform. The warranties that the Customer gives BGates as to the lawfulness of its instructions (section 11), and the contractual consequences of breaching them, remain unaffected.

25. Relationship with the other documents, governing law, jurisdiction

In case of conflict between this Agreement and the other Service documents on matters of personal data protection, this Agreement prevails. On every other matter the applicable Terms and Conditions prevail.

This Agreement is governed by Italian law. Disputes are subject to the jurisdiction of the court agreed in the Terms; if the Customer is a Consumer, the court of the Consumer's residence or elected domicile retains jurisdiction. The powers of the Garante per la protezione dei dati personali (Italian Data Protection Authority) and the right of Data Subjects to lodge a complaint under Art. 77 GDPR remain unaffected.

If a clause proves void or ineffective, the other clauses remain valid and the clause is replaced by the lawful clause closest to the parties' intention.

Annex A — Processing, data, Data Subjects and duration

Annex B — Technical and organisational measures (Art. 32 GDPR)

This annex describes the actual state of the measures as at the date of the version. It is updated at every substantial change.

B.1 What is in operation today

B.2 What is being introduced

B.3 What is not there today, and must be known

This part is not omitted. A Customer who has to assess a risk is entitled to know it, and a document that kept silent about it would be a false statement.

1. The connection between the Device and the Service is not encrypted on installed Devices: telephone numbers and commands travel in clear text on the messaging channel. The channel is reachable from the Internet.
2. The Device maintenance channel is not encrypted: the configuration and log files that the Device uploads — which contain the entire On-board Number List — travel in clear text.
3. There is no encryption of data at rest: neither at column, nor volume, nor disk level. Backup copies, on the other hand, are encrypted.
4. There is no two-step verification, not even for administrative accounts, and there is no account lockout after a number of failed attempts: the defence is the per-address rate limit.
5. There is no separation of data at database level: separation between customers is enforced by the Service, not by the database engine.
6. There is no off-site backup copy: loss of the machine would also mean loss of the copies.
7. Authorising a number does not verify that the number belongs to the person authorised. This is a known design limitation, for which BGates is liable (section 10.3), and whose correction is planned.
8. The Device password has four digits, and the product has a default value: changing it on handover is an obligation of the Customer, set out in the Security Rules for Accounts, Numbers, QR Codes and Phones.

Annex C — Sub-processors that process Customer data

As at the date of this version. The complete and updated list, with the date of the last check, is in the Suppliers document (/fornitori), which prevails over this annex.

Two clarifications that avoid a misunderstanding. The payment provider and the SIM operator process data for purposes for which BGates is the Controller (invoicing, connectivity): they are not sub-processors under this Agreement and are listed in the Privacy Notice. The services that convert the cell identifier into an approximate location concern the Device's network diagnostics, for which BGates is also the Controller.

Changes to this Agreement

BGates may amend this Agreement to bring it into line with a change in the law, a decision of the supervisory authority, a change to the Service or the engagement of a sub-processor. The change is notified to the Customer at the Account's email address with at least 30 days' notice, stating what changes; for sub-processors only, the shorter notice period in section 14 applies, which is 15 days, with the right to object provided for there.

If the change reduces the protection of the Customer or of the Data Subjects, the Customer may terminate the Subscription without penalty within 30 days of the notification, with a refund of the portion paid and not used. Changes that merely implement a legal obligation or add a safeguard take effect on the date stated, with no right of termination.

Previous versions are available on request.

Version 2026.09.22-1 — in effect from 22 September 2026. When we change something substantial — a new purpose, a new supplier, a longer retention period — we publish the new version here, with its date, and if you have an Account we tell you by email. This document is not accepted: it is read, and we do not ask you to tick any box. Corrections of form do not change the version. Previous versions are available on request from info@bgates.it.