Suppliers and sub-processors

Courtesy translation. In case of discrepancy, the Italian text prevails.

This document lists the Suppliers that Business Gates S.r.l. (hereinafter BGates) uses to provide the BGates Service: what each one does, what personal data it receives, where it is located, in what role it processes the data and — when the data leave the European Economic Area — on which safeguard the transfer is based.

It concerns the GT PRO 4G model and the related Service. It does not concern the earlier models that work by SMS messages only, nor the Bluetooth channel.

It is an information document: it is read, not accepted. But in the relationship with the Customer it is not only informative: it forms an integral part of the Data Processing Agreement (/dpa) by reference, under Art. 28(2) of Regulation (EU) 2016/679 (‘GDPR’). The general authorisation for sub-processors that the Customer gives with that Agreement refers to the list you find here, in the version in force.

If you want to know for what purposes we process the data and what you can ask for, read the Privacy Notice (/privacy). If you want to know how long we keep them, read the Data Retention Policy (/conservazione).

1. How to read this list

Role. A Supplier can be in three different positions, and the difference is not a formality:

• processor (Art. 28 GDPR): it processes data on our behalf, only on our instructions, and cannot use them for itself. When the data are those for which the Customer is the Controller — the Authorised Numbers, the On-board Number List, the Opening Log of its Entrance — that Supplier is a sub-processor under the Data Processing Agreement;
• processor for processing for which BGates is the Controller: it processes on our behalf data that we decide about (security, Device diagnostics, invoicing). It is not a sub-processor of the Customer, and does not appear as such in the Data Processing Agreement;
• independent controller: it decides the purposes and means of its own processing itself, for its own obligations or purposes. We cannot give it instructions on that part.

Safeguard for the transfer. This applies only to those who process data outside the European Economic Area. It can be: an adequacy decision — for the United States, listing on the Data Privacy Framework list (Art. 45 GDPR); standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR), accompanied by a transfer impact assessment; or none, and in that case we say so. Section 7 explains how we are completing this column.

Updated on. This is the date on which we checked the row. A row that has not been checked is not left without a date: we write what is missing.

When an item of information is missing, we say so. Where a row has not yet been established, the table says so in its own words — ‘not established’, ‘none in place’ — instead of leaving a blank that might look like a confirmation. Section 11 brings together all the points still open.

2. Suppliers that process data on behalf of the Customer (sub-processors)

These are the ones that touch the data for which the Customer is the Controller: the Authorised Numbers, the names and numbers that pass through the Invites, the content of support conversations, and the Opening Log to the extent that it resides on their systems.

Two facts that concern these rows and do not fit in a cell.

The text of some push notifications today contains the telephone number of the person who asked to be authorised from a Permanent QR code. That number passes through the notification service. The decision taken is to remove it from the text: a notification that says ‘Nuova richiesta di accesso — apri l'app’ (New access request — open the app) gives you the same information without a third party's number leaving our systems.

Sending fallback SMS messages today uses an unencrypted connection to the supplier's gateway. It is a fact, and we say so: moving to an encrypted connection is among the open points in section 11.

3. Suppliers for processing for which BGates is the Controller

They are not sub-processors of the Customer: they process data for purposes that we decide (invoicing, Device connectivity, network diagnostics, website statistics). We list them here because readers have a right to know where their data end up, not because the Art. 28 chain includes them.

About beaconDB. It receives only the cell identifiers, never the Device identifier, the serial number or personal details.

You can ask us to switch off cell-based location for your Device: write to info@bgates.it. Network diagnostics lose precision; the Service continues to work.

4. Third parties that your browser contacts directly

This row is different from the others: no data passes through us. It is your browser that connects to the third party, and what reaches the third party is your IP address with the technical data of the request.

The map must sit behind a tap. This is how it is designed: the map does not load by itself; a box appears with the ‘Show map’ button, and only if you tap it does your browser contact OpenStreetMap.

6. Suppliers that do not appear in this list, and why

We also disclose data, where required, to authorities that request it in the cases provided for by law. Authorities are not Suppliers: every request is verified and recorded before it is dealt with.

We do not sell data, we do not transfer it to anyone for third parties' own purposes, and there is no tool for measuring user behaviour on our pages: no third-party analytics, no advertising counters, no error collection service.

7. Transfers outside the European Economic Area

Our servers are in Germany. Some Suppliers, however, process data in the United States: the WhatsApp channel downstream of delivery, the payment provider, the push notification services and, only for those who accept the website statistics, Google Analytics.

On what basis. To a US organisation listed on the Department of Commerce's Data Privacy Framework list, the transfer is based on European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (Art. 45 GDPR), and does not require the tools of Art. 46. The decision is in force: it was upheld at first instance by the General Court of the European Union on 3 September 2025 (Case T-553/23), and an appeal is pending. To an organisation that is not listed, the transfer is based on the standard contractual clauses adopted by the Commission (Art. 46(2)(c) GDPR), accompanied by a transfer impact assessment.

The standard contractual clauses remain in force with listed Suppliers too: they are not terminated on the grounds that ‘there is the adequacy decision anyway’. If the decision were annulled, the transfer would remain covered without interruption.

How we check the safeguards. Listing on the Data Privacy Framework list is checked entity by entity on the official list; the last check was on 22 September 2026. The standard contractual clauses remain in force in any case, so the transfer remains covered even if the listing were to lapse.

You can ask us for a copy of the safeguards that apply to a given transfer by writing to info@bgates.it: we will reply within one month.

8. Agreements with Suppliers

With each Supplier that processes data on our behalf there must be a data processing agreement under Art. 28 GDPR, and on each sub-processor we impose by contract the same obligations that the Data Processing Agreement imposes on us towards the Customer (Art. 28(4)). We are liable to the Customer for the failure of our sub-processors to perform as for our own.

netcup GmbH. netcup's data processing agreement (Auftragsverarbeitungsvertrag, AVV) is available in the supplier's customer panel and must be signed there. The servers hosting the Service are in Nuremberg, Germany: for hosting there is no transfer outside the European Economic Area, and no Art. 46 safeguard is needed for this row.

9. How long the data remain

All the retention periods are in the Data Retention Policy (/conservazione), which prevails over any figure stated elsewhere. Here are only those concerning what passes through a Supplier, because that is the question that arises when reading this list.

How long the data remain with the Supplier is determined by the contract with that Supplier.

10. How this list changes, and how you are notified

Adding or replacing a Supplier that processes data on behalf of the Customer is a substantial change. The procedure is as follows, and it also applies when only the country in which an existing Supplier processes the data changes:

1. 15 days' notice. We write to the Customer at the Account's email address, saying who is joining or changing, what it will process, where and with which safeguard for the transfer. At the same time we publish the new version of this document, with the new date.
2. Objection. Within those 15 days the Customer may object in writing, on grounds relating to data protection. We seek in good faith an alternative solution within 30 days; if we do not find one, the Customer may terminate the part of the Service concerned or the Subscription without penalty, with a refund of the portion paid and not used.
3. Until the notice period expires we do not entrust the Customer's data to that Supplier, unless this makes it impossible to provide the Service: in that case we state it in the notice, so that the choice is an informed one.
4. Urgent replacement. If a Supplier ceases its service or its reliability fails, we may replace it with shorter notice: we inform the Customer within 5 days of the replacement, explaining the reason. The right to object remains, with the same effects.
5. Those who are not Customers — the User, the visitor — do not receive an individual notification, because we have no contractual relationship with them and often have no contact details for them other than the number someone else gave us. For them, publication here, with the date, and the notification to those who have an Account apply.

Corrections of form — a typo, a name written better, a row made clearer — update the date on which the row was checked but do not trigger the notice period and do not change the version.

Removing a Supplier does not require notice: we record it here and in the next communication.

These periods coincide with those in section 14 of the Data Processing Agreement (/dpa). Should the two texts diverge, this document prevails, as it is the updated list referred to by that Agreement.

11. What has not yet been established, as of 22 September 2026

We say it here rather than leaving it to be inferred from the tables. These are the points open on the date of this version, and each of them will be closed with a new version of this document:

• the data processing agreements with each Supplier: existence, date, content (section 8);
• the name-by-name check on the Data Privacy Framework list, with the categories covered and the date (section 7);
• the contracting entity and the country of beaconDB, the service that converts the cell identifier into a location;
• moving SMS sending to an encrypted connection;
• the retention periods applied by each Supplier to the data it receives;
• the contractual qualification of the SIM operator: controller, processor, or both for different parts.

A clarification about the name of the SMS supplier. The supplier that delivers fallback SMS messages is Commify Italia S.r.l.; Skebby is merely the brand under which it operates. In a list of sub-processors referred to by Art. 28(2), and in a privacy notice under Articles 13-14, the full name of the contracting entity is the very content of the obligation, not a formality: that is why the table shows the company name and not the brand.

Changes to this document

This document changes when a Supplier changes, when the safeguard covering a transfer changes or when one of the checks in section 11 is completed. Changes concerning sub-processors follow the procedure in section 10, with the 15-day notice period and the right to object provided for there.

Version 2026.10.27-1 — in effect from 27 October 2026. When we change something substantial — a new purpose, a new supplier, a longer retention period — we publish the new version here, with its date, and if you have an Account we tell you by email. This document is not accepted: it is read, and we do not ask you to tick any box. Corrections of form do not change the version. Previous versions are available on request from info@bgates.it.