Acceptable Use Rules

Courtesy translation. In case of discrepancy, the Italian text prevails.

The BGates Service opens an Entrance: a gate, a door, a barrier, a garage door. It does not move information; it moves a heavy object in the physical world, and it decides who passes through. That is why the rules below are not a list of good manners: they are the boundaries within which the Service may be used.

These Rules form part of the Terms and Conditions of Use of the Service (/termini): by accepting the Terms you also accept these Rules. We do not ask you to tick an extra box: a tick box for a document that is not accepted on its own would be one box too many.

These Rules cover the GT PRO 4G, that is the Device connected to the mobile network, and the Service that controls it. They do not cover the basic model that works by SMS only, or Bluetooth pairing: for those, the instructions supplied with the product apply.

1. Who they apply to

If you administer an Entrance on someone else's behalf, these Rules apply in addition to the Terms for Customers and Administrators, which contain the specific obligations on the entitlement to administer the Entrance, on informing the people authorised and on the Data Processing Agreement. Where the two overlap, the prohibitions are here and the obligations are there.

2. The principle, in three lines

You may use the Service only to control an Entrance you are entitled to control and to manage who has access to it. Any other use is prohibited.

Everything else follows from this principle, and it is worth bearing in mind three facts about how the Service works, because they are the reason certain things are prohibited:

1. An Authorised Number is a key. Anyone calling from an Authorised Number opens the Entrance, on the days and in the time slots set. Nothing else is needed: no password, no app, no second factor. Authorising a number means handing over a key.
2. Every opening is recorded. The Opening Log keeps the date, time, outcome and — when the Device recognises the calling number — who opened. The Device also records the number of anyone who calls without being authorised: it does not answer the call and the call costs the caller nothing, but the number is captured before the Device hangs up.
3. Authorisations do not expire by themselves. If you do not set an expiry date and do not revoke it, a number remains authorised. A mobile number can be reassigned by the network operator to another person: if it remains authorised, that other person can open.

The periods for which we keep each category of data are in the Retention Policy (/conservazione); what we process, on what legal basis and what rights you have is in the Privacy Notice (/privacy).

3. What you may do

So that the list of prohibitions does not stand without context, here is what the Service is designed to do, and which is always permitted:

• open your Entrance from the BGates app or the Private Area, and by calling from an Authorised Number;
• authorise and revoke the numbers of people who are entitled to come in, with the days, time slots and expiry date you decide;
• send Invites to the people you authorise;
• display a Permanent QR code at the Entrance and give Single-use QR codes to specific people;
• consult and export your Entrance's Opening Log to verify an access, reconstruct a disputed event or respond to a request from an authority;
• manage your Personal Address Book, notifications, Subscription and Account data;
• have the Entrance administered by a Distributor, an Installer or a person you trust, while remaining responsible for what they do on your behalf.

4. Unauthorised access: opening what is not yours

It is prohibited to:

• open, or attempt to open, an Entrance you are not authorised to open;
• have an Entrance opened by a person you know is not authorised, or provide them with the means to do so;
• use another person's Account, credentials, phone or Authorised Number without their consent and without entitlement;
• remain authorised or continue to access the Private Area after your entitlement has ended — for example after the end of an employment, tenancy or service relationship — when you know it has ended;
• access other Customers' data, records, Opening Logs or Entrances by exploiting a configuration error, a defect or a link that reached you by mistake. If you notice that you can see something you should not see, stop and report it to us (section 15);
• use an Activation QR code, an Invite link or a Private Area address that is not intended for you.

Unauthorised access to a computer system protected by security measures, or remaining in it against the will of whoever has the right to exclude access, is a criminal offence (Art. 615-ter of the Codice penale (Italian Criminal Code)). Obtaining, holding or disseminating codes and means of access to protected computer systems, in order to obtain an advantage for oneself or others or to cause damage, is also a criminal offence (Art. 615-quater of the Italian Criminal Code).

5. Surveillance: the Opening Log is not a tool for keeping watch on people

The Opening Log is there for you to know what happened at your Entrance: to verify a disputed access, to check whether a revocation has been carried out, to reconstruct an event. It is not for, and may not be used for, observing a person's habits.

It is prohibited to use the Service, the Opening Log, notifications or the Device's presence indicator to:

• reconstruct a person's timetable, movements or habits — what time they come home, how often they go out, on which days they are away;
• keep watch on a spouse, partner, family member or former partner. The fact that you hold the Entrance does not entitle you to monitor who lives or used to live there;
• keep watch on an employee or a collaborator outside the conditions and safeguards laid down by law (section 5.1);
• keep watch on a tenant, a guest or anyone lawfully occupying the property: someone who pays you rent or stays with you has not authorised you to keep a diary of when they come home;
• keep watch on a fellow resident of the building, or derive from the Opening Log information about the movements of other residents of the building;
• consult or export the Opening Log without a reason related to managing the Entrance;
• disclose to third parties, publish or disseminate Opening Log data — including the numbers and names that appear in it — except where the law requires or permits you to do so;
• use the Service for stalking or harassment of a person. Repeated conduct that causes someone a persistent and serious state of anxiety or fear is a criminal offence (Art. 612-bis of the Italian Criminal Code).

Processing personal data in breach of data protection law may result in administrative fines and, in the cases provided for by Art. 167 of the Codice in materia di protezione dei dati personali (Italian Data Protection Code), criminal consequences.

5.1 If the Entrance gives access to a workplace

An Entrance that records who opens and at what time, in a workplace, engages Art. 4 of the Statuto dei lavoratori (Italian Workers' Statute) (Law no. 300 of 20 May 1970). Tools for recording access and attendance do not require a trade union agreement or authorisation from the local Labour Inspectorate, but:

• paragraph 3 continues to apply in full: the information collected may be used for purposes connected with the employment relationship only if you have given workers adequate prior information on how the system is used and how checks are carried out, and in compliance with data protection law;
• the exemption covers the recording of access, not analysis: if you use the Opening Log to derive people's attendance, punctuality or habits, you are using a tool that makes remote monitoring possible, and you fall back under paragraph 1;
• you may not use the Opening Log for disciplinary purposes outside the conditions laid down by law.

The corresponding obligations, together with the declaration that the Entrance gives access to a workplace, are in the Terms for Customers and Administrators (/condizioni-amministratori).

6. Numbers: do not enter a number you are not entitled to enter

When you authorise another person's number, you process their personal data and hand them a key. It is prohibited to:

• authorise numbers taken from directories, other people's contact lists, collected business cards or purchased lists, or otherwise obtained without a relationship with that person;
• authorise the number of a person you do not know you are entitled to authorise, or who does not know they have been authorised;
• authorise a number knowing that you cannot send the Invite on WhatsApp, that is when the person is not willing to receive it. The WhatsApp channel is provided by Meta Platforms Ireland Limited, and its rules require the recipient of the message to have agreed to receive it: only someone who has a relationship with that person, namely you, can have that agreement;
• bulk import contacts into the Personal Address Book in order to authorise them indiscriminately: the Personal Address Book is for finding the numbers you need, not for building an archive of other people's numbers;
• approve a request received via a QR code without knowing who the person is. The number shown in that request is self-declared and not verified: anyone can enter someone else's number;
• leave authorised the number of a person who should no longer get in. Revocation is an obligation, not an option, and must be carried out on the day the entitlement ends.

The positive obligations that go with these prohibitions — informing the person, giving them the Notice for people authorised to open an entrance (/informativa-utilizzatori), setting an expiry date, checking what you type — are in the Terms for Customers and Administrators and in the Account Security Rules (/sicurezza-account).

7. QR codes: where they are displayed, whom they are given to

The Service uses three different codes, and it is worth not confusing them.

It is prohibited to:

• publish the Permanent QR code on a website, on social media, in an advertisement or in a messaging group: it is meant to be on an Entrance, not online;
• forward, photograph for others, duplicate or give a Single-use QR code to more than one person. A photograph of a QR code works just like the QR code;
• give a Single-use QR code to a person other than the one for whom it was generated;
• use a QR code that was not given to you, or a QR code for which you know the entitlement has ended;
• fill in a request from a QR code with another person's number, or with a false name;
• send repeated or automated requests from the form of a Permanent QR code.

Two things stated clearly, because we do not promise the opposite. First: a QR code displayed at an Entrance is public by its very purpose; it can be photographed, forwarded and printed, and no technical measure prevents this. Second: when someone fills in the form of a Permanent QR code, we record their IP address to protect that form from misuse, and we delete it together with the request.

A Single-use QR code does not expire after a set time: it is valid for a single scan and remains valid until it is used or revoked. That is why, if it is not used, it must be revoked.

8. Account and credentials

The Account is personal and non-transferable.

It is prohibited to:

• share your Account credentials with other people, even members of the same family, the same business or the same apartment building. Anyone who shares an Account makes it impossible to attribute openings to the person who made them, and destroys the value of the Opening Log at exactly the moment it would be needed;
• use an Account registered to another person, even with their permission;
• create Accounts with false data, or registered to people who have not asked to have one;
• continue to use an Account you know has been compromised, without changing the password and without notifying us.

At present you sign in with a username and password: two-step verification is not available. We take this into account when it comes to allocating responsibility, and that is why we insist on a password you do not use elsewhere.

If you lose a phone on which the Account is open, or a phone whose number is authorised on an Entrance, tell the person who administers that Entrance straight away and write to us at info@bgates.it, with ‘sicurezza’ (security) in the subject line.

9. Circumventing the security of the Device and the Platform

It is prohibited to:

• leave the Device with its factory password. The Device is supplied with a default numeric password, which at present is also printed on the cover of the manual: it must be changed when the Device is first switched on. As long as it remains unchanged, anyone who has the manual and the SIM number can control the Device;
• disclose the Device password to third parties, other than to someone entitled to configure it;
• send the Device service commands not documented in the manual, or use the documented commands for purposes other than those for which they exist — for example to read the configuration, the On-board Number List or the logs of a Device that is not yours;
• attempt to circumvent authentication, request rate limits, the limits of a Plan, or the time slots or expiry dates set on an Authorised Number;
• spoof caller ID in order to be recognised as an Authorised Number;
• introduce malicious code into the Service or the Device, or use them to attack third-party systems;
• subject the Service to load tests, scans or penetration tests without a written agreement with us;
• access the technical channels through which the Device communicates with our systems, or attempt to observe, alter or replay their traffic.

9.1 Firmware and software: the boundary, and the rights you keep

You may not decompile, disassemble or analyse the Device firmware or the Service software in order to extract keys, secrets, authentication mechanisms or service commands from them, or to build tools that use them.

This prohibition does not affect the rights the law gives you and which you cannot waive: the right to observe, study and test the functioning of the program in order to determine the ideas and principles underlying it, while performing acts you are entitled to perform (Art. 64-ter(3) of Law no. 633 of 22 April 1941 (Italian Copyright Law)), and the reproduction and translation of the code indispensable to achieve interoperability with other programs, on the conditions of Art. 64-quater. Agreements contrary to these provisions are void, and this document contains none.

If you need interoperability, write to us at info@bgates.it: in most cases it is quicker for us to give you what you need.

9.2 Security research: what we accept

Someone who finds a weakness is not an enemy. If you came across a flaw without forcing anything and want to report it to us, we do not consider it a breach of these Rules where the person:

1. writes to us at info@bgates.it before talking about it with anyone else;
2. stopped as soon as they realised they had access to something they should not see, and did not download, keep, modify or disseminate other people's data;
3. did not interrupt the Service, did not open third parties' Entrances and did not ask for payment to keep quiet;
4. gives us a reasonable time to fix it before making public what they found.

We reply within 5 working days, stating what we have understood and what we intend to do.

10. Invites: no bulk sending

Invites are for telling a person that their number has been authorised on an Entrance. They are not a communication channel, still less an advertising channel.

It is prohibited to:

• generate Invites to numbers you have not just authorised, or send them again to a person who has not asked for it;
• use Invites to deliver your own messages, promotions, marketing communications or content unrelated to the authorisation;
• send in bulk or automatically: upload lists of numbers and send Invites in batches, or use automated tools to generate them;
• use the Service as a tool for sending SMS or WhatsApp messages to third parties.

This is not a prohibition for form's sake. Invites are sent on WhatsApp, a channel of Meta Platforms Ireland Limited, and failing that by SMS, through Commify Italia S.r.l. (Skebby brand), Italy. Bulk sending to numbers that have not agreed to receive it exposes the business number to quality restrictions, the messages to reclassification that prevents their delivery and, in the worst cases, the whole channel to suspension: the damage does not fall on whoever caused it, it falls on all the Customers waiting for an Invite.

The link contained in an Invite is valid for 30 days.

11. Interfaces and data: no systematic extraction

It is prohibited to:

• access the Service's application programming interfaces (APIs) with automated tools, outside the BGates apps and an integration agreed in writing with us;
• systematically extract data from the Service — lists of Devices, people, numbers, events — even when that data is visible to you;
• circumvent, alter or disguise request rate limits, for example by changing address or distributing calls;
• reproduce, resell or make available to third parties the Service or parts of it without a written agreement with us;
• use data obtained from the Service to build a competing product or an archive of numbers.

Your right to obtain a copy of your Entrance's data and of your personal data remains unaffected and is not in question: it is exercised from the Private Area and through the channels indicated in the Privacy Notice (/privacy), not by scraping the interfaces. No clause of this document limits the Customer's access to the data of their own Device or the possibility of obtaining a copy of it on termination of the relationship.

For BGates Operators a stricter constraint applies, which does not arise from this document but from the written designation each of them has received: a Customer's data may be accessed only for a support request in progress or for a legal obligation, and every access leaves a trace.

12. The Service is not a safety device or an emergency system

This is not a limitation of liability: it is a description of what the Service does.

The Service sends a command pulse to an automation system that we do not manufacture or install. It does not replace the safety devices of the automation, it does not check that they work, and it requires the Device to have power and mobile network coverage.

It is prohibited to use the Service as the sole means of opening or closing in settings where opening is a condition of people's safety, and in particular:

• as the sole safeguard on an escape or evacuation route;
• as the sole means of access for emergency vehicles, fire services or ambulances;
• as the sole means of clearing a passage in situations where a person could be trapped inside or outside;
• to circumvent or disable the safety devices of the Entrance's automation, or to trigger opening when the safety devices are not working;
• in installations where the applicable rules require an independent release device, unless that device is installed and working.

You must always keep an alternative means of access to the Entrance — a key, a manual release, a remote control — that works without the Service. This also applies when the Service is suspended: when we suspend, the Entrance can still be opened with the physical means available to you.

The technical references are the standards on power-operated gates (EN 12453, EN 13241) and, from 20 January 2027, the Machinery Regulation (EU) 2023/1230. The allocation of responsibilities is in /responsabilita.

13. Third-party rights and unlawful uses

It is prohibited to use the Service:

• to commit a criminal offence or to facilitate one;
• in breach of an order of an authority — a protection order, an exclusion order, a court order on the use of a property;
• to infringe third-party rights: their property, their home, their privacy, their image, their trade marks or their content;
• to prevent people who are entitled to access a property, a garage or a common area from doing so — for example by revoking or altering authorisations to exclude a fellow resident, a co-owner or a tenant;
• in breach of the building regulations, resolutions of the residents' meeting or the agreements governing the use of that Entrance;
• to reproduce, alter or use our trade marks, our texts, our documents or the look of our apps in such a way as to suggest that a product or service is ours.

And it also works the other way round: if an authority asks us for data or for action, we check the request, comply with it within the limits of the law and keep a record of it. We do not do so at the request of a private individual, not even the Customer.

14. What happens if these Rules are breached

The criterion. The response is proportionate to the breach, and the first response is almost always a request to put things right. An excessive configuration can be corrected: it does not justify deactivating an Entrance.

What suspension does not do. Suspension concerns the features provided under the Subscription. When we suspend, we tell you in writing, we state the reason, we state what is needed to lift the suspension and we repeat something that matters: the Entrance can still be opened with the physical means available to you. Suspending a service that opens a gate is not like suspending a newsletter.

What remains yours. Even during a suspension and after termination, your right to obtain a copy of your Entrance's data and of your personal data remains unaffected, on the terms of the Terms of Use and the Privacy Notice.

Reporting to the authorities. Where a breach constitutes a criminal offence, or where we receive a request or order from an authority, we may report the facts and send the necessary data to the competent authority, within the limits of the law and keeping a record of it. We do so for facts concerning the Service: we do not take your place in matters between you and the people you authorise.

If you are a Consumer. Suspension always requires the notice in the first row of the table, except in cases of real risk or breach of the law, and it is proportionate. No provision of this document deprives you of the rights the law gives you on a mandatory basis, or limits our liability for wilful misconduct or gross negligence, for personal injury or for obligations relating to personal data protection.

15. How to report misuse

What we need in order to be able to do something: what you saw, when, on which Entrance or which Device, and how we can contact you again. Do not send us passwords, codes or files containing other people's data.

What we do: we take charge of the report, we tell you what we have understood within 5 working days, and if the report concerns another Customer's Entrance we route it to the person who administers it, because it is they who decide who has access. If the report concerns a request about your data and the controller of that processing is the Customer, we tell you so and help you reach them.

If you report in good faith, the report does not expose you to any consequences on our part.

16. What is recorded when we apply these Rules

To be able to say what happened and why we decided as we did, we keep:

• the report and the correspondence that follows, according to the support retention periods;
• the record of administrative actions taken by our Operators — who read, exported, suspended, reactivated, and when — for 24 months;
• technical events documenting anomalous use, for the periods in the Retention Policy;
• the acceptance of documents — which document, which version, when, from which screen, with the IP address — for 10 years from the end of the relationship, as evidence.

All other periods, category by category, are in the Retention Policy (/conservazione). We do not use, in any document, the formula ‘for as long as necessary’: where there is a period, there is a number.

17. If we change these Rules

We may change these Rules for a valid reason: a new feature, a form of misuse we had not foreseen, a legal obligation, a correction required by an authority.

• We notify you by email at least 30 days before the new version takes effect, telling you what is changing.
• Since these Rules form part of the Terms of Use, when the substance changes we ask you to accept the new version of the Terms the next time you sign in.
• If you do not accept, you can terminate at no cost before the new version takes effect, in accordance with the Terms of Use.
• Corrections of form — typos, reordering of paragraphs, updated links — do not change the version.

Version 2026.09.22-1 — in effect from 22 September 2026. When we change something substantial — a new purpose, a new supplier, a longer retention period — we publish the new version here, with its date, and if you have an Account we tell you by email. This document is not accepted: it is read, and we do not ask you to tick any box. Corrections of form do not change the version. Previous versions are available on request from info@bgates.it.