Sergio — Privacy Notice

Version: 1.2
Last updated: 12 October 2026
Effective date: 12 October 2026
Website: https://sergiosommelier.com

Short version. Sergio is operated by Antaris Labs SRL. We use personal data to operate the website and business service, manage business accounts and billing, protect the service, and—where a venue uses Sergio—to provide the venue’s requested tools. A venue normally decides how its own guest-facing QR experience and venue-specific guest insights are used; Antaris processes that venue data on the venue’s documented instructions. We do not sell personal data. We do not use Customer Content or raw guest event data to train Antaris models. We retain data only for the periods described below and use appropriate safeguards when data are processed outside the EEA.

This Privacy Notice explains how Antaris Labs SRL (Antaris, we, us, our) processes personal data in connection with Sergio. It is organised by audience because the purpose, legal role and data differ between website visitors, business contacts, customer users and QR guests.

This Notice does not replace the customer Data Processing Agreement (DPA) where Antaris processes Customer Personal Data for a customer as processor. The DPA and its subprocessor schedule govern that processing.

1. Controller, contact and scope

Antaris has assessed its current processing under Article 37 GDPR and has not appointed a Data Protection Officer. We will review that assessment if the nature, scale or risk of our processing materially changes.

This Notice covers the Sergio website, contact and business-account flows, customer administration, billing, support, security, document-processing tools, QR guest interface and venue-insight functionality. Separate notices or terms may apply to a particular customer order, venue page or integrated third-party service.

2. Roles: who decides why personal data are used

Data-protection roles depend on the particular activity, not simply on a label in a contract.

2.1 Activities for which Antaris is normally controller

Antaris normally determines the purposes and essential means for personal data used to:

• operate and secure the Sergio website;
• respond to a business enquiry or manage a prospective-customer relationship;
• create and administer Antaris’s own business relationship, including contracting, billing, VAT/invoicing and payment administration;
• operate Antaris-controlled platform-wide security, fraud-prevention, legal-compliance and audit functions that Antaris independently determines; and
• comply with legal, accounting and regulatory obligations.

2.2 Activities for which a venue is normally controller and Antaris processor

Where a restaurant, retailer, supermarket or other customer (Venue) uses Sergio’s QR guest experience and venue-specific insights, that Venue normally decides to offer the experience and use the resulting data for its own venue operations. For those operations, the Venue is normally the controller and Antaris acts as processor under the Venue’s documented instructions and the DPA.

This typically includes Customer Content uploaded into that Venue’s workspace; venue-managed user, authentication and permission records used to deliver that workspace; Customer-directed support about that workspace; and QR guest session-level event data used for that Venue’s recommendations and venue-specific insights. Antaris’s independent security, billing and legal-compliance records are not included merely because they relate to a user of that workspace.

The Venue must make its own identity and privacy information available to guests at the relevant QR experience. A guest may also contact Antaris at the address above; we will assist the Venue where required by the DPA and applicable law.

2.3 Antaris’s independent uses and shared wine catalogue

Antaris is not permitted by the DPA to use identifiable Customer Content or raw QR guest event data for unrelated product training, advertising, or cross-customer profiling.

Antaris may maintain a shared wine catalogue containing non-venue-specific wine facts, such as wine name, producer, vintage, region, grape, style profile, general AI-assisted description, rating and a bottle-image reference. Before an entry or reference is shared across Venues, Antaris must prevent the entry from exposing a Venue identity, uploading-account identifier, Customer Content, price, supplier margin or sommelier note. Antaris will use only irreversibly aggregated or anonymised data for any cross-venue operational statistics; until the applicable anonymisation controls are in place, raw guest event data are not used for such a purpose.

If a particular programme means that Antaris and a Venue jointly determine a common purpose and essential means, the parties will document the arrangement required by applicable law and make its essence available to affected people.

3. The personal data we process, why, lawful basis and retention

The table below summarises the principal processing carried out by Antaris as controller. Retention may be extended only where necessary to establish, exercise or defend a legal claim, comply with law, resolve a security incident, or preserve a legally required record. We then restrict access and delete the data when the additional purpose no longer applies.

| Deletion-evidence records | Former customer users / account records | User UUID, deletion reason, counts and timestamp, without email or Customer Content | Evidence of lifecycle compliance and response to accountability or claim questions | Legitimate interests in accountability and defence of claims | 5 years, unless a documented legal hold requires a longer period; then restricted and reviewed | | Privacy and support correspondence | People who contact privacy@ or support | Message content, sender details and handling record | Respond to rights, privacy, security and service requests and preserve a defensible record | Legitimate interests in handling requests and defending claims; legal obligations where applicable | 24 months after closure, unless a documented legal hold, active dispute, breach or regulatory matter requires longer; then restricted and reviewed |

3.1 Whether data must be provided

Providing the account, business-contact, billing and VAT information requested in the relevant sign-up/checkout flow is necessary to create and administer the business account, process payment and meet invoicing/tax obligations. If it is not provided or cannot be verified where verification is needed, Antaris may be unable to create or maintain the account or process the order.

QR preference selection is voluntary. However, Sergio cannot provide a tailored suggestion without the current-session selections needed to generate it. A person may choose not to use the QR experience or not to make a particular selection. Customer Content is voluntary, but a feature that depends on a document, image or text cannot operate without the content supplied for that feature.

3.2 Information received from another source

Antaris may receive business-contact, authorised-user, supplier-contact or other personal data from a Customer, a Venue or another third party rather than directly from the individual. Where Antaris acts as controller for that data and GDPR Article 14 applies, Antaris will provide the required information about the categories of data and source within the required period, at first contact or before first disclosure, unless a documented Article 14(5) exception applies. Where Antaris acts only as the Customer’s processor, the Customer is responsible for the relevant notice and Antaris assists under the DPA.

3.3 Trial and account-deletion schedule

• A trial account that is not upgraded is deleted after 24 months without sign-in, after a warning email sent 30 days before deletion where contact details are available.
• The Service End Date is the system-recorded moment at which the Customer account is deactivated and any related guest-facing QR application is no longer publicly available. For an account with no guest-facing QR application, it is the account deactivation/cancellation time recorded by Sergio.
• A cancelled paid account is normally retained until no later than 90 days after the Service End Date to permit reactivation or a requested export, then deleted unless legal retention applies.
• Where a verified deletion request applies, we delete active account data, files and derived data within 30 days, unless we must retain particular data by law or for a legal claim.
• Antaris does not provide a customer-accessible database backup or restoration feature in the current Service configuration. A provider may retain restricted recovery or resilience copies under its own documented lifecycle; those copies are not used for ordinary service operation.

4. Customer Content, document tools and AI-assisted processing

4.1 What Customer Content can include

A Venue may upload wine lists, menus, supplier margin documents, bottle photographs, logos and related wine, dish or sommelier information. Customer Content can incidentally contain personal data, such as a supplier representative’s details, a chef’s name, a staff member’s name or information relating to a sole trader. It can also contain commercially confidential information, including sales, quantities, revenue and margins.

The Venue remains responsible for ensuring it has a lawful basis and necessary authority to submit Customer Content and for giving any required privacy information to affected people. Customers should not upload unnecessary personal data, identity documents, payment-card information, special-category data, criminal-offence data, or information about a child unless they have first agreed an appropriate documented processing arrangement with Antaris.

4.2 AI-assisted service features

At a Venue’s request and as described in the applicable DPA/service instructions, Sergio may send an uploaded document, image or defined wine/menu text to the Google Gemini API to extract information, create a wine profile, translate text, or help classify content. This can include the full contents of an uploaded PDF or image. QR guest session data are not sent to Google Gemini. Some activated features may use Google Search grounding; Google’s current Gemini API terms state that prompts and grounded results for that feature may be retained for up to 30 days. Sergio may also use a Google preview model for a feature where the service configuration identifies it as such; preview outputs are subject to the same human review requirement and may change or be withdrawn.

Antaris does not train or fine-tune its own models using Customer Content or raw guest event data. Sergio uses the paid Google Gemini API under Google’s applicable Processor Terms and related service terms, with Google Cloud EMEA Limited as the expected contracting entity for this account. Google may process Customer Content for the requested feature, including outside the EEA. Antaris uses the transfer safeguard required by applicable law for the actual processing flow and makes further information available on request.

AI assistance may produce inaccurate or incomplete outputs. The Venue remains responsible for reviewing and confirming information it presents to guests or uses operationally, including wine facts, translations, prices, availability and any information that may affect a guest.

4.3 Content and AI-retention schedule

5. QR guests and venue-specific insights

5.1 What the QR experience does

Sergio’s QR guest experience provides up to three informational wine suggestions from the Venue’s own list. It does not sell alcohol, place an order, transmit an order to the Venue, reserve a bottle, collect a guest payment, deliver alcohol, or serve alcohol. A displayed price is information supplied by the Venue; guests should confirm current availability and price with the Venue’s staff.

The suggestions use the guest’s current selections and available wine/menu information. The interface is not an open-ended chatbot and does not make decisions with legal or similarly significant effects on a guest.

5.2 Session-level event data

For the relevant Venue, the QR experience records limited session-level events to provide the service and venue-specific insights. Depending on the feature used, these may include:

• a random session identifier generated afresh on a page load;
• date/time, event type and the Venue concerned;
• selected language;
• broad food-category, taste, wine-type, serving-format and number-of-choice information;
• recommendation labels and wine identifiers; and
• whether a wine was opened or the guest used the “show your waiter” display.

The application is designed not to collect a guest’s name, email address, payment information, booking, loyalty identifier, table number, persistent device identifier, precise location or free-text profile through this QR flow. The app-level design does not save IP address, browser or device details in the QR event record. However, infrastructure, security and hosting providers can process IP addresses and technical request data in separate logs as described in this Notice and the Cookie & Device Storage Notice.

A random identifier and timestamps can still make a session-level record capable of being singled out or linked in some circumstances. We therefore do not describe raw session event records as anonymous personal data.

5.3 Purpose, access and retention

The Venue normally determines the use of QR guest data for recommendations and its own venue insights. Antaris processes this data as the Venue’s processor. The Venue’s authorised users can see only their own Venue’s insights, subject to their access permissions. Raw venue events are automatically deleted after 90 days.

Antaris may use only irreversibly anonymised, aggregated information for cross-venue operational statistics. We do not use raw guest event data for Antaris model training or for cross-venue analytics while it remains personal data.

If you are a QR guest, the relevant Venue is usually your first contact for questions about the experience. You can also contact Antaris at privacy@sergiosommelier.com. We will route and assist with the request as appropriate to our role and the applicable DPA.

5.4 Food preferences and sensitive information

The QR interface is designed to use broad food categories, not dish names or sensitive personal-profile data. Do not enter information that reveals a health condition, allergy, religion, philosophical belief or other sensitive information unless the relevant Venue has provided a separate lawful and transparent way to process it. Sergio’s recommendations are not health, allergy, dietary, pregnancy or responsible-consumption advice.

6. Cookies, device storage and similar technologies

We use only the technologies described in our Cookie & Device Storage Notice. That notice covers cookies and comparable technologies such as local or session storage, service-worker caches and security/fraud-prevention mechanisms.

We use strictly necessary technologies for core functions such as language choice, authenticated sessions and form security. Where a technology is not strictly necessary, we obtain consent before storing or accessing information on a device where applicable law requires it. Consent is optional, granular and can be withdrawn at any time through the Cookie settings control where it is available. Optional technologies are not enabled unless the corresponding consent and settings controls are live.

We do not use advertising cookies or marketing pixels. We do not deploy non-essential analytics or behavioural tracking unless it is first described in the Cookie & Device Storage Notice and subjected to the required consent controls.

7. Recipients, service providers and international transfers

We share personal data only where necessary for the purpose described above, where instructed by a Venue, where required by law, or where we have another valid legal basis. Recipients can include authorised Venue users, our professional advisers, competent authorities, and the service providers listed below.

Some providers may process data outside the European Economic Area (EEA), including through remote support, global infrastructure or subprocessors. When a GDPR-restricted transfer occurs, we use the mechanism appropriate to the actual transfer, including an adequacy decision, the EU–US Data Privacy Framework where the receiving entity is certified for the relevant processing, or the European Commission’s Standard Contractual Clauses with required supplementary measures and transfer assessment.

You may request further information about the relevant transfer safeguard by contacting privacy@sergiosommelier.com. A customer receives the applicable written processing agreement and subprocessor information through the relevant customer contracting flow. This public Notice does not itself constitute a Data Processing Agreement or authorise a Subprocessor.

8. Your rights and how to use them

Subject to the conditions and limits in applicable law, you may ask for:

• access to personal data we hold about you;
• rectification of inaccurate or incomplete data;
• erasure of data;
• restriction of processing;
• objection to processing based on legitimate interests;
• data portability where applicable; and
• withdrawal of consent at any time where consent is the basis for processing. Withdrawal does not affect processing before withdrawal.

To make a request, email privacy@sergiosommelier.com and describe the context of your request. We may request proportionate information needed to verify identity and locate the relevant data. We normally respond within one month, subject to permitted extensions.

For QR guest data, a Venue is normally the controller. We will help route your request and assist the Venue as required. Because Sergio does not create a persistent guest account, we may be unable to identify a particular guest from a raw event record without additional context. We will not collect unnecessary additional data solely to make a request possible; if you provide information that enables us to locate the session, we will assess the request accordingly.

You also have the right to lodge a complaint with the Belgian Data Protection Authority or the data-protection authority in your habitual residence, workplace or place of the alleged infringement.

9. Security

We use technical and organisational measures designed to protect personal data, including access controls, tenant separation, authentication controls, encryption in transit and at rest where appropriate, logging and supplier controls. No online service can guarantee absolute security. If a personal-data breach occurs, we will investigate, mitigate and notify the relevant controller and authority or affected people when legally required.

10. Changes to this Notice

We may update this Notice when our processing, service, law or provider arrangements change. We will update the version/effective date and, where a change is material, take additional notification steps where required. Archived versions can be requested from privacy@sergiosommelier.com.