Sergio — Data Processing Agreement

Version: 1.0
Last updated: 12 October 2026
Effective date: 15 October 2026

This Data Processing Agreement (DPA) forms part of the B2B Terms of Service or other written agreement (Agreement) between the Customer named in the Agreement (Controller or Customer) and Antaris Labs SRL, Avenue de Tervueren 242, box 005, 1150 Woluwe-Saint-Pierre, Brussels, Belgium, CBE/KBO 1036.755.202, VAT BE 1036.755.202 (Processor, Antaris).

Purpose. This DPA applies only when Antaris processes Customer Personal Data on Customer’s documented instructions. It does not purport to make Antaris a processor for activities for which Antaris independently determines the purposes and essential means, such as Antaris’s own contracting, billing/tax, website, fraud/security and legal-compliance activities. The factual role for each processing activity prevails over a label.

1. Definitions and interpretation

1.1 Applicable Data Protection Law means Regulation (EU) 2016/679 (GDPR) and any directly applicable or implementing data-protection law that applies to the processing under this DPA.

1.2 Customer Personal Data means personal data processed by Antaris on behalf of Customer under the Agreement. It excludes data processed by Antaris as an independent controller under clause 2.4.

1.3 Subprocessor means a processor appointed by Antaris to process Customer Personal Data on Customer’s behalf under this DPA.

1.4 Terms such as controller, processor, personal data, data subject, processing, personal data breach and supervisory authority have the meanings given in Applicable Data Protection Law.

1.5 This DPA prevails over the Agreement only to the extent of a conflict about processing Customer Personal Data. The Agreement otherwise remains in force.

2. Scope, role and documented instructions

2.1 Processing particulars. The subject matter, duration, nature, purposes, data types, data-subject categories and Controller rights/obligations are described in Annex I.

2.2 Processor role. Antaris shall process Customer Personal Data only on Customer’s documented instructions, unless Union or Member State law requires processing; in that case, Antaris shall inform Customer of that legal requirement before processing unless law prohibits that information on important grounds of public interest.

2.3 Service instructions. Customer’s documented instructions consist of: (a) this DPA and the Agreement; (b) Customer’s configuration and use of the service by its authorised users; (c) Customer’s written support requests submitted through Antaris’s authorised channels; and (d) any other documented instruction agreed by the parties. Antaris shall immediately inform Customer if, in Antaris’s opinion, an instruction infringes Applicable Data Protection Law, without being required to provide legal advice.

2.4 Independent-controller activities. Antaris acts as an independent controller—not Customer’s processor—for its own business-contact, contract administration, billing/tax, payment-administration, platform-wide fraud/security and legal-compliance processing that Antaris independently determines. Venue-managed workspace user, authentication and support records remain Customer Personal Data where Antaris handles them solely to provide the Customer’s workspace under documented instructions. Antaris’s Privacy Notice governs its independent-controller activities. Antaris will keep the two categories distinct to the extent reasonably practicable.

2.5 No unauthorised reuse. Antaris shall not use Customer Personal Data for advertising, unrelated product training, cross-customer profiling, or other independently determined purpose. If Antaris proposes a new independent purpose, it shall first document the role/purpose and obtain any required lawful basis, transparency and agreement; this DPA alone does not authorise it.

3. Customer responsibilities

3.1 Customer is responsible for determining that its instructions are lawful and for providing any required privacy information to data subjects, including its guests, staff, supplier contacts and other persons whose data Customer submits or instructs Antaris to process.

3.2 Customer shall ensure it has a lawful basis, and where applicable an Article 9 or other special condition, to process Customer Personal Data and to instruct Antaris. Customer shall not instruct Antaris to process personal data in breach of Applicable Data Protection Law.

3.3 Customer shall minimise Customer Personal Data and shall not upload unnecessary identity documents, payment-card data, special-category data, criminal-offence data or data about children unless the parties have documented the need, instruction and safeguards in writing before the processing.

3.4 Customer shall identify an authorised privacy/security contact and keep its instructions, data categories, retention settings and user permissions accurate.

4. Confidentiality and authorised personnel

4.1 Antaris shall ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory duty of confidentiality.

4.2 Antaris shall limit access to Customer Personal Data to personnel and approved Subprocessors with a need to know for the processing in Annex I and shall apply access controls described in Annex II.

5. Security of processing

5.1 Taking account of the state of the art, implementation costs and the nature, scope, context and purposes of processing, as well as the risk to rights and freedoms, Antaris shall implement and maintain the technical and organisational measures (TOMs) described in Annex II.

5.2 Antaris may update the TOMs where the update does not materially reduce the overall security of Customer Personal Data. If a material reduction is necessary, Antaris shall give reasonable prior notice unless prohibited by law or immediate change is necessary for security or legal compliance.

5.3 Customer acknowledges that no security measure eliminates all risk. Customer is responsible for its own account permissions, authorised users, endpoint security, information uploaded to the service and configuration choices within Customer’s control.

6. Subprocessors

6.1 General authorisation. Customer grants Antaris general written authorisation to appoint and replace Subprocessors listed in Annex III for the specified functions.

6.2 Change notice and objection. Before appointing or replacing a Subprocessor that will process Customer Personal Data, Antaris shall give Customer at least 30 days’ advance written notice by email to Customer’s nominated privacy/contract contact or by a customer-portal alert sent to that nominated contact, except where a shorter period is reasonably necessary to address a security, legal or urgent service-continuity issue. Updating the public Subprocessor List alone is not notice. Antaris shall retain dispatch evidence. The notice shall identify the proposed change, function, relevant processing location/transfer information and effective date.

Customer may object in writing on reasonable data-protection grounds before the change takes effect. The parties will work in good faith on a reasonable solution. If no reasonable solution is available and the proposed Subprocessor is necessary for the affected service, Customer may terminate the affected service before the change takes effect and receive a pro-rata refund of prepaid fees for the unused paid period. An objection does not require Antaris to continue an insecure, unlawful or technically infeasible arrangement.

6.3 Subprocessor contract and responsibility. Antaris shall impose on each Subprocessor, by contract or other legal act, substantially the same data-protection obligations as those imposed on Antaris by this DPA, including appropriate security, confidentiality, assistance, deletion/return and transfer obligations. Antaris remains fully responsible to Customer for its Subprocessors’ performance of those obligations.

7. International transfers

7.1 Antaris shall not transfer Customer Personal Data outside the European Economic Area (EEA) except on Customer’s documented instructions and where the transfer is permitted by Applicable Data Protection Law.

7.2 Where a restricted transfer occurs, Antaris shall use the appropriate transfer mechanism for the actual flow, such as a European Commission adequacy decision, the EU–US Data Privacy Framework where the receiving entity is validly certified for the relevant processing, or the European Commission’s Standard Contractual Clauses (SCCs) with appropriate supplementary measures.

7.3 Where SCCs are used, the parties shall complete and maintain the applicable SCC annexes accurately. Antaris shall provide reasonable information in its control to assist Customer with a documented transfer-impact assessment and shall notify Customer, where legally permitted, if Antaris becomes unable to comply with an applicable transfer safeguard.

7.4 The Article 28 controller-processor clauses in Commission Implementing Decision (EU) 2021/915 do not themselves replace the SCCs required for a Chapter V GDPR transfer.

8. Assistance with data-subject rights and compliance

8.1 Taking account of the nature of the processing, Antaris shall assist Customer by appropriate technical and organisational measures, insofar as possible, to fulfil Customer’s obligation to respond to data-subject requests under Chapter III GDPR.

8.2 If Antaris receives a request directly from a data subject relating to Customer Personal Data, Antaris shall, where permitted, promptly forward it to Customer and shall not respond substantively except on Customer’s documented instructions, where legally required, or where necessary to identify Antaris’s independent-controller role.

8.3 Taking account of the nature of processing and information available, Antaris shall assist Customer with Customer’s obligations under GDPR Articles 32–36, including security, personal-data-breach assessment/notification/communication, data-protection impact assessments (DPIAs) and prior consultation.

8.4 Customer remains responsible for deciding whether a data-subject request, breach notification, DPIA or prior consultation is legally required.

9. Personal-data breaches

9.1 Antaris shall notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

9.2 Initial notice may be phased where all information is not yet available. Antaris shall provide the information reasonably available to it about the nature of the breach, affected data/categories, likely consequences, containment/mitigation and an appropriate contact point, then provide updates as material facts become available.

9.3 Antaris shall preserve relevant evidence and reasonably cooperate with Customer’s investigation and required notification/communication. Nothing in this DPA changes Customer’s responsibility to assess whether notification is required and, where applicable, to meet the GDPR’s supervisory-authority deadline.

10. Compliance information and audit

10.1 Antaris shall make available to Customer information reasonably necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer.

10.2 To make audits effective and proportionate, Customer shall normally give at least 30 days’ written notice, conduct no more than one ordinary audit in a 12-month period, use an independent auditor bound by confidentiality, and avoid unreasonable disruption to Antaris and other customers. These limits do not apply where a breach, material non-compliance, regulatory request or other credible urgent risk reasonably requires a different approach.

10.3 Antaris may satisfy ordinary audit requests through current third-party certifications, independent audit reports, security documentation, questionnaires and remote evidence where these reasonably demonstrate compliance. This does not prevent an effective audit or inspection where the evidence is inadequate for the risk or circumstances.

10.4 Customer bears its own audit costs, except where an audit establishes Antaris’s material breach of this DPA.

11. Return, deletion and retention

11.1 The Service End Date is the system-recorded time at which Customer’s account is deactivated and any related guest-facing application is no longer publicly available. For an account with no guest-facing application, it is the account cancellation/deactivation time recorded by Sergio. During the Agreement and until the date falling 90 days after the Service End Date, Customer may request a reasonable available export of Customer Personal Data, including a manual CSV export of available menu, inventory and settings data, subject to technical feasibility, data segregation and applicable law.

11.2 No later than the date falling 90 days after the Service End Date, Antaris shall, at Customer’s choice expressed before deletion, return or delete Customer Personal Data and delete existing production copies, unless Union or Member State law requires storage. Customer acknowledges that some data may be irreversibly anonymised and no longer constitute personal data before that date.

11.3 Antaris’s standard deletion/retention schedule is described in Annex I. A validated deletion request made before the Service End Date is actioned within 30 days unless law requires retention. The Service End Date does not extend the maximum 90-day production-deletion deadline in clause 11.2.

11.4 Antaris does not provide a customer-accessible database backup or restoration feature in the current Service configuration. A Subprocessor may retain restricted recovery or resilience copies under its applicable data-processing terms. Antaris will ensure that such copies remain protected and are not restored to ordinary production processing except for disaster recovery or a security investigation.

11.5 Antaris may retain limited information required for its independent-controller billing, tax, security, legal-claim and legal-compliance purposes, subject to the Privacy Notice and Applicable Data Protection Law.

12. Liability and term

12.1 This DPA takes effect when Antaris begins processing Customer Personal Data for Customer and remains in effect until all Customer Personal Data are deleted or returned as required by clause 11.

12.2 The liability provisions of the Agreement apply to this DPA, except to the extent Applicable Data Protection Law requires otherwise. Nothing in the Agreement or this DPA limits liability that cannot lawfully be limited, including liability for fraud, wilful misconduct or gross fault where applicable.

13. Contact

Customer may contact Antaris regarding this DPA at privacy@sergiosommelier.com.

Annex I — Processing particulars

A. Subject matter and duration

Item	Processing detail
Subject matter	Provision of Sergio’s venue-management, document-processing, guest QR-recommendation, venue-insight, account-administration and support features, as configured and instructed by Customer.
Duration	For the subscription/order term, plus the applicable retention/export/deletion period in this DPA.
Nature of processing	Collection from Customer or QR guest interaction; recording; organisation; storage; consultation; extraction; classification; translation; AI-assisted profiling of wines; retrieval; display; transmission to approved Subprocessors; restriction; deletion; anonymisation/aggregation where authorised; support and security operations.
Purpose	Provide the Customer-requested service; maintain and secure it; provide support; meet documented Customer instructions; and comply with applicable law. Antaris does not use Customer Personal Data for independent advertising, unrelated model training, or cross-customer profiling under this DPA.
Place of processing	Primary Supabase project data are configured for West EU (Ireland) processing. Server functions, support, backups and onward subprocessors may involve other locations; the actual flow and safeguard are described in Annex III and the applicable provider terms.

B. Categories of data subjects

Customer’s authorised representatives, administrators, employees and other authorised users;
the Customer’s supplier, producer and business-contact representatives whose data occur incidentally in Customer Content;
QR guests and other individuals whose data appear in venue-specific event data or Customer Content; and
any other natural person incidentally identified in an uploaded document, image, note or support request.

C. Categories of Customer Personal Data

business identifiers and contact details, role and organisation information;
account, authentication, authorisation and security/activity information;
document, image and text content uploaded by Customer, including personal data incidentally contained in menu, wine-list, supplier-margin or other business documents;
venue-created wine/menu data, description and configuration information;
QR session-level event data, including random session identifier, timestamp, event type, language, broad food/taste/wine/format selections, recommendation/wine identifiers and limited interaction events;
venue-specific insights derived from the above; and
relevant support and service-administration information.

Customer should not intentionally submit special-category data, criminal-offence data, payment-card data or identity-document data. If such data are incidentally present or a particular use requires them, Customer must notify Antaris and agree appropriate documented safeguards before the processing continues.

D. Controller rights and obligations

Customer has the rights and obligations set out in Applicable Data Protection Law and this DPA, including the right to give documented instructions, receive assistance/information, authorise/object to Subprocessors as stated, request return/deletion, conduct effective audits and determine the lawful basis, transparency, retention and data-subject response for Customer’s processing.

E. Standard retention schedule

Data set	Standard treatment
Source wine lists, menus and associated import PDFs/photos	Deleted 30 days after import, unless Customer deletes earlier or a specific documented feature requires a shorter period
Supplier margin PDFs	Customer-controlled while the account is active; deleted when Customer deletes them or at account deletion
Bottle photographs/logos	Life of the account or until replaced/deleted; then deletion under the account lifecycle
Extracted menu, wine list and service settings	Life of account; normally deleted after the 90-day post-cancellation period
QR event data	Automatically deleted after 90 days
AI operational metadata without prompt/response content	Deleted after 180 days
Account and workspace data after cancellation	Export available until the date falling 90 days after the Service End Date; production data deleted no later than that date
Provider recovery or resilience copies	Where maintained by a Subprocessor, protected and handled under that Subprocessor’s applicable data-processing and recovery lifecycle; not restored to ordinary production processing except for disaster recovery or a security investigation

Annex II — Technical and organisational measures

Antaris applies the following measures as deployed on the effective date. The measures are risk-based and may be supplemented by provider controls identified in Annex III. Where a measure is identified as partial or provider-dependent, Antaris does not represent that the stronger measure is deployed.

Tenant segregation and access control. Supabase row-level security, tenant-scoped RPCs, role-based permissions and least-privilege access are used for production data. Privileged access is restricted to the operators recorded in the internal access register. Public bucket objects are intended only for public bottle images and logos; Customer must not upload personal or confidential material to a public bucket.
Authentication. Supabase Auth is used for customer authentication, password reset and invitations. Privileged /ops access uses TOTP/factor controls and idle-session controls. Supabase Auth enforces a server-side password policy: at least 8 characters, including a lowercase letter, an uppercase letter, a digit and a symbol. Venue-user MFA is not promised.
Encryption and secrets. HTTPS/TLS is used in transit. Provider encryption at rest is relied on where stated by the provider. Service-role, Gemini and Stripe secrets are stored as server-side function secrets and are not placed in frontend code.
Production access and logging. /ops reads are audited in the Antaris audit log and operational health checks inspect key grants and scheduled jobs. Vendor dashboards and SQL-editor activity may be logged by the provider rather than by Antaris. Vendor consoles are accessed only by the founder, with two-factor authentication.
Development and deployment. The repository is private, production dependencies are pinned and local tests and smoke checks are run before deployment. There is no separate staging project and no promise of a formal code-review or automated vulnerability-alerting programme. Changes are tested locally and then deployed to production.
Availability and recovery. The current Service has no Customer-accessible database restore feature and Antaris has no independently tested full restore procedure. Provider recovery copies and retention are governed by the applicable provider lifecycle. Antaris does not promise customer restoration under this Annex.
Incident management. Antaris maintains written procedures for containment, evidence preservation, breach assessment, customer notification, regulatory notification where required, access changes and subprocessor incidents. The incident contact is privacy@sergiosommelier.com; continuous 24/7 monitoring is not promised.
Personnel and confidentiality. Access is limited to the founder, as recorded in the internal access register, who is bound by an equivalent statutory duty of confidentiality. Before anyone else is given access, they receive their own vendor logins with two-factor authentication and sign a written confidentiality undertaking. When a person's access ends, their logins are removed and the service secrets they could read are rotated.
Minimisation and lifecycle. QR events are designed around a random per-page-load session identifier, no guest account and 90-day deletion. Source import files are deleted under the service schedule; AI operational logs contain metadata rather than prompt/response content. Deletion and export are performed under the Service schedule and the Customer’s documented instructions, subject to law and provider-copy limitations.
Supplier management and transfers. Antaris keeps provider terms, subprocessors, transfer assessments and change notices in its internal evidence pack. The actual provider entity, location and transfer safeguard govern the relevant flow; public list wording does not substitute for the DPA’s direct notice and objection process.
Rights assistance. Antaris provides reasonable search, export, correction, restriction and deletion assistance within the actual data model. QR events based only on a random identifier may not be attributable to a guest without additional information.
Testing and review. Antaris runs code tests, smoke checks and operational health checks and reviews the measures periodically. Recovery testing, password-policy testing, vendor-account attribution and provider-copy deletion evidence remain separate internal evidence items and are not promised by this Annex unless completed and recorded.

Customer acknowledges that the measures may evolve with technology and service changes. Antaris will not materially reduce the overall security of the service without following clause 5.2.

Annex III — Approved Subprocessors and transfer information

Subprocessor / legal entity	Service function	Customer Personal Data that may be processed	Primary location / transfer note	Safeguard / authorisation status
Supabase Pte. Ltd. (Singapore) and its subprocessors	Database, authentication, storage and server functions	Account/workspace data, Customer Content, QR events, derived venue insights and service metadata	Sergio’s primary project region is West EU (Ireland). Supabase or its subprocessors may process data where they maintain facilities.	Supabase Data Processing Addendum, Version 1 (1 August 2026). Where a GDPR-restricted transfer occurs, the relevant SCC module applies: Module 2 for controller-to-processor and Module 3 for processor-to-subprocessor transfers; the DPA also includes applicable UK and Swiss addenda.
Google Cloud EMEA Limited (Dublin, Ireland) and subprocessors (Gemini API)	AI-assisted extraction, classification, wine profiling and translation only when Customer activates the relevant feature	Submitted document/image/text content and feature prompts/responses; no QR guest session data. Google Search grounding may retain prompts and grounded results for up to 30 days under applicable service terms. A configured feature may use a Google preview model.	Google or its subprocessors may process data where they maintain facilities, including outside the EEA.	Google’s applicable Processor Terms and related service terms. Where a GDPR-restricted transfer occurs, the applicable transfer route is determined under those terms, including the applicable Standard Contractual Clauses where required.
Google Cloud EMEA Limited (Dublin, Ireland) — Google Workspace, Gmail SMTP	Transactional account, password and support email	Customer account/contact email and relevant message content	Google or its subprocessors may process data where they maintain facilities, including outside the EEA.	Google Workspace data-processing terms. Where a GDPR-restricted transfer occurs, the applicable transfer route is determined under those terms, including the applicable Standard Contractual Clauses where required.
Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus	Static website hosting, DNS and technical request logging for public Sergio pages, including QR page requests	IP address, User-Agent, request URL, timestamp, status and related technical log data; a QR request URL may identify the Venue	Server in France (EU). Server logs kept seven days. Weekly backups of the website files, kept six weeks. The onward chain is governed by the Hostinger DPA.	Hostinger DPA and applicable SCCs where a restricted transfer occurs. Hostinger is authorised only for this limited hosting/logging function.

The following are generally independent-controller or separate-service processing and are not automatically included as Subprocessors for Customer Personal Data: Stripe’s payment processing, Antaris’s own billing/tax records, public website code/font CDN delivery that does not process Customer Personal Data, and any professional adviser/authority processing under an independent legal duty. Antaris will assess the actual role for each activity rather than rely solely on this statement.