Privacy notice

In brief

This page explains how your personal data is handled when you use the Quattro Stagioni Hot Pot website, book a table or talk to its assistant. It applies to the whole website and to all of the restaurant’s channels, and it covers cookies and statistics. Last updated: 5 November 2026.

The main points. We use your data to handle requests and bookings. In the chat, replies come from an artificial intelligence, which always says so. We do not sign you up for marketing. Statistics managed by Maiora start only after you press “Accept”.

Who is responsible for your data

The data controller is Impresa di Prova, whose registered office is at Via di Prova 1, Roma, Italia (VAT number 00000000000) and which runs Quattro Stagioni Hot Pot. For any question or request about privacy, including contacting the data protection officer if there is one, write to prova@example.invalid.

Maiora (Not provided, Not provided) provides the restaurant with the website, the booking system and the assistant, and processes the data on the restaurant’s behalf as its data processor.

What data we process

Bookings: name, email address or phone number, date, time, number of guests, booking code, the channel it came through, its status (for example pending, confirmed, seated, cancelled, no-show) and any notes written by the staff.

Website chat and WhatsApp: your messages, voice messages and their transcripts, the conversation identifiers and, on WhatsApp, your phone number.

Browsing: your IP address and technical information about your browser, which are needed to make the website work and to keep it secure, plus the technical cookies and browser data described below.

Usually you give us this data yourself. It can also come from the restaurant’s staff, who record a booking taken by phone or in person, or from someone who books for you. The restaurant’s managers can ask their private assistant to remember useful information about a guest.

Why we use your data and the legal basis

Handling your requests: answering questions, checking availability, recording, confirming, changing or cancelling a booking and running the service. The legal basis is performance of the service you ask for, including steps taken at your request before it, Art. 6(1)(b) GDPR.

Sending you the service email about your booking: its status and the links to change or cancel it. The legal basis is performance of the service you ask for, Art. 6(1)(b) GDPR.

Sending you reminders and other automatic messages, by email or on WhatsApp. The legal basis is your consent, Art. 6(1)(a) GDPR.

Producing visit statistics. The legal basis is your consent, Art. 6(1)(a) GDPR.

Protecting the service: security, limits against abuse, backups and recovery after a failure. The legal basis is our legitimate interest in keeping the service and the data secure, Art. 6(1)(f) GDPR.

Complying with legal obligations and requests from public authorities, Art. 6(1)(c) GDPR. Establishing, exercising or defending legal claims, on the basis of legitimate interest, Art. 6(1)(f) GDPR.

We do not use your data for marketing: the booking form, the chat and your consent to reminders and automatic messages do not extend to marketing.

Health and allergies

Allergies and intolerances are health data. We do not ask for them and we do not collect them systematically.

Please do not mention them in the chat or in voice messages. What you write in the chat or say in a voice message reaches the AI assistant, the model provider and, for voice messages, the transcription provider, like any other message, and is kept for as long as conversations are kept. The assistant only reports the allergens listed on the menu and refers you to the staff: for an allergy, speak to the restaurant directly (phone +390600000000, email prova@example.invalid) or call in at Via di Prova 1, Roma, Italia.

If you ask the staff to take an allergy into account, only what is needed to serve you safely is recorded, with no diagnosis, in a note on the booking. The legal basis is your explicit consent, which you give by making the request and can withdraw at any time, Art. 9(2)(a) GDPR. The note follows the booking retention periods set out below.

The note is visible to authorised staff. It can also pass through the private assistant of the restaurant’s managers, and therefore through the model provider and, if it is sent as a voice message, the transcription provider.

The AI assistant and the staff

Replies in the website chat, and on WhatsApp where the restaurant offers it, come from an assistant based on artificial intelligence, which always says so. It can help you with information and bookings, including changing or cancelling them.

The assistant receives your messages, the transcripts of voice messages, the information published by the restaurant and the details of your booking that it needs in order to reply, including your name. It does not receive other guests’ bookings or contact details. To produce its replies it uses an artificial intelligence model from Scaleway (Paris), Google Cloud Vertex AI (EU region) or OVHcloud: the model in use comes from one of these providers. Please do not send documents, payment details, health information or other people’s data.

The assistant can make mistakes. A booking is confirmed only when the booking summary or its private page shows the status “Confirmed”: a sentence in the chat is not enough.

In the website chat the assistant does not alert the staff and cannot arrange for someone to call you back. To speak to a person, use the restaurant’s contact details (phone +390600000000, email prova@example.invalid): the assistant will give them to you if you ask. On WhatsApp, when needed, the assistant hands the conversation over to the restaurant owner, and from then on a person replies. Authorised staff can read the conversations and reply directly, in which case the reply is labelled “Quattro Stagioni Hot Pot staff”.

Voice messages

Voice messages you send on WhatsApp, and those sent by the restaurant’s managers in the service’s app, are transcribed by an external provider: the audio goes to AssemblyAI, in the European Union, with Deepgram, also in the European Union, as a backup. The audio does not go to the model provider: the assistant receives only the text.

According to their terms, these providers do not keep the audio or the text after transcription and do not use them to train their own models. In our systems the audio file is kept only for the time needed for transcription and is then deleted. WhatsApp keeps its own copy under its own rules.

WhatsApp and service messages

When you choose WhatsApp among the channels the restaurant makes available, your messages and voice messages pass through Meta. If you do not write to the restaurant on WhatsApp, no data is sent to Meta through this service.

If you give an email address when you book, we send you a service email about your booking. It shows the day, time, number of guests and status and, for as long as the booking can still be changed or cancelled, two personal links: one to change it and one to cancel it. The email is sent through AWS. It is part of the service you ask for, so it does not need your consent and it is not marketing. If you give only a phone number, no email is sent.

Reminders and other automatic messages, by email or on WhatsApp, are sent only after your explicit yes, and this yes does not cover marketing. You can withdraw it at any time by telling the assistant (on WhatsApp you can simply write STOP) or by writing to prova@example.invalid. Withdrawing does not cancel the booking.

The links in the email, like the private link you see after booking with the form or the website chat, are personal: anyone who has them can view, change or cancel the booking. Do not share them and do not forward the email. They are valid until the end of the booking. On WhatsApp you manage the booking within the conversation.

Cookies and data in the browser

Booking and chat use two technical cookies, which they need in order to work. The first keeps the visitor’s session and lasts 8 hours. The second protects booking and chat against forged requests and lasts about a year. They do not require consent, because they are strictly necessary for the service you ask for.

The browser also stores your choice about statistics until you change it or clear your browser data. For as long as the tab stays open it stores the chat identifier, a random key and a hash of the requests sent (to avoid duplicates, without saving their text), plus small pieces of data the page needs to work.

Booking and chat do not add any advertising, pixels or third-party trackers. External services used by this site: none. Any external service may receive your IP address and information about your browser, and follows its own rules. A link that leads elsewhere, for example to a map or a social network, opens another website with its own rules.

Visit statistics

Until you press “Accept” in the “Optional statistics” box, statistics managed by Maiora send no data: this is also the case when the box does not appear. Declining does not limit booking or chat.

After “Accept”, the following may be sent: the page visited, the action taken (starting or sending a booking, opening the chat), the referring site and the campaign (only values on an approved list). The values entered in forms are never sent. The statistics service also receives your IP address and browser information. The planned tool is Umami, hosted on the service’s own servers, without cookies.

You can change your mind at any time using the preferences link at the bottom of the page. Withdrawal stops new data being sent straight away, but a send already under way may complete, and events already received are not deleted automatically: to have them deleted, write to prova@example.invalid.

Who receives the data

The restaurant’s authorised staff can access the data, each according to their role: in conversations they also see your name, if you have given it. Maiora’s staff can access the data for support only with the restaurant’s authorisation, for a limited time and with a record of the access. The data may be disclosed to the authorities where the law requires it.

Service providers:

Hetzner: servers that host the website, the bookings and the conversations.

Amazon Web Services (AWS): encrypted backups and sending of emails.

Scaleway (Paris), Google Cloud with Vertex AI (EU region) and OVHcloud: possible providers of the assistant’s artificial intelligence model; the model in use comes from one of them. The provider in use receives the messages, the transcripts of voice messages and the booking details needed to reply. According to their terms, none of them uses this content to train its models.

AssemblyAI, with Deepgram as a backup, both in the European Union: transcription of voice messages. They receive the audio.

Hostinger: domain registration and name (DNS) management; it does not receive bookings or conversations.

Meta: messages and voice messages that pass through WhatsApp.

Telegram: only if the restaurant’s managers use it as a private channel with their own assistant.

Stripe: payments between the restaurant and Maiora. Booking and chat do not ask for payments or card details.

Hetzner, AWS and the model and transcription providers act as sub-processors, appointed to process data on the restaurant’s behalf. Meta and Stripe also process data on their own account, as independent controllers of their services.

Transfers outside the European Union

The service’s servers and backups are located in Germany, in the European Union. This is not true of every provider.

AWS, Meta and Stripe may also process data outside the European Economic Area, for storage, access or support. The transcription providers process the audio in the European Union, but technical data and support may be handled outside it. If the model provider is OVHcloud, it may access the systems remotely, where needed for the service, from the United Kingdom and Canada. For site changes requested by the restaurant’s owner, OpenAI may also process data outside the European Economic Area. In these cases the transfer relies on an adequacy decision of the European Commission (which covers the United Kingdom and, for commercial organisations, Canada) or on standard contractual clauses. You can ask for a copy at prova@example.invalid.

Telegram, only if used as a private channel by the restaurant’s managers, also processes data on its own account and may process it outside the European Economic Area, on the same terms.

How long we keep the data

Voice messages: the audio file is deleted immediately after transcription. Within 7 days of receipt we also delete the reference that allows it to be downloaded again from the channel. The transcribed text becomes part of the conversation and follows its retention period.

Website chat and WhatsApp: 90 days from the last activity in the conversation.

Bookings: name, contact details, consents and staff notes for 12 months after the date of the service. This period does not run for a service that has yet to take place. Afterwards the booking remains without that data, for the restaurant’s diary and statistics.

Service emails: we delete the message text when the sending process ends, and the encrypted address kept for that email 30 days later. Only the outcome of the sending remains.

Information about a guest in the private assistant’s memory: 90 days from last use.

Statistics: detail for 90 days, then only anonymous monthly summaries for 24 months.

Technical logs: 30 days. Security incidents have a separate, justified retention period.

Backups: recovery up to 14 days back, with copies that expire within 35 days. A deletion does not immediately change the copies already made: they expire on their own and, after a recovery, deletions are applied again before the service reopens.

External providers, according to their terms. Voice transcription: neither the audio nor the text is kept after transcription; the provider may keep technical data about use, but not the content. Model: Scaleway does not normally keep content, apart from temporary caching, and may keep it for two weeks in the event of errors or abuse; Google Cloud keeps it in temporary memory for 24 hours and, if it is flagged as suspected abuse, for up to 90 days in the EU region; OVHcloud does not store it or make copies of it.

Legal obligations, the exercise of a right or a dispute may require separate, limited retention. When the Maiora service ends, bookings already confirmed remain valid and the restaurant takes over their management.

Which data is required

To book online we need a name and at least one contact detail, an email address or a phone number. Without them we cannot handle the request online, but you can contact the restaurant directly.

To ask for information in the chat you do not need to give a name or a contact detail. Statistics, reminders and automatic messages, and WhatsApp are optional: declining them does not prevent you from booking. If you give only a phone number, you will not receive the service email.

The “I have read the privacy notice” box confirms that you have received this information; it is not a consent.

Automated decisions

The system checks availability on its own according to the restaurant’s rules and applies limits against abuse, such as a maximum number of active bookings per contact detail and per session. A request can therefore be refused automatically, and you can always contact the restaurant.

We do not take decisions based solely on automated processing that produce legal effects or similarly significantly affect you, and we do not build guest profiles to decide how to treat them.

Your rights

You can ask for access to your data, rectification, erasure, restriction of processing and portability. You can object to processing based on legitimate interest. You can withdraw a consent at any time, without affecting what happened before the withdrawal.

Write to prova@example.invalid. Requests are not handled automatically: a person, the service operator, deals with them on behalf of the restaurant. We verify your identity in a proportionate way and reply within one month, which may be extended by a further two months for complex requests. If you ask for erasure, the operator removes the name, contact details and staff notes from your bookings. The booking remains without that data, for the restaurant’s diary. The operator also removes what the private assistant remembers about you, if it recognises you by your full name, phone number or email address. For other data, such as the text of conversations or the reasons noted on exceptions, the operator assesses the request case by case; whatever is not deleted earlier follows the retention periods given above.

To change or cancel a booking you can use the private link or contact the restaurant. Deleting data in our systems does not recall a message that has already been delivered: for data held in the systems of Meta, or of other providers that process it on their own account, their own tools also apply.

Complaint to the data protection authority

You can lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali), www.garanteprivacy.it, or with the supervisory authority of the European country where you live or work.

Minors

The service is not intended for anyone under 14, who should ask a parent or guardian to book for them. The system does not verify age. To tell us about data provided by a minor, write to prova@example.invalid.

For restaurant staff and owners

For staff and for the restaurant’s managers we process named accounts, roles, logins, actions, commands and messages to the private assistant, in order to run the service, show who did what and protect access. Employees join the app only by invitation from the restaurant’s owner, with their own email address and password, and in the app they can also write to the assistant with voice messages and photos. The restaurant is the data controller, on the basis of the employment or collaboration relationship and of its legitimate interest.

Retention periods: conversations with the private assistant, 180 days from the last activity; the private assistant’s memory, 90 days; login sessions, with IP address and browser, 30 days after they end; security log, 180 days.

If you ask the assistant to change the website, the request goes through an OpenAI Codex session, which receives the text of the request and the website files, but not bookings or conversations with guests. OpenAI may process this data outside the European Economic Area.

For quotations, the contract, invoicing and commercial support the controller is Maiora (Not provided), in order to perform the contract and comply with legal obligations, for the periods set by tax and civil law. Card details are collected directly by Stripe: Maiora receives references and the payment status, not the full card number.

Changes

We may update this notice when the service, the providers or the rules change. The version in force is always on this page, with the date of the last update: 5 November 2026.