Data Processing Agreement

Effective Date: June 1, 2025

Last Updated: April 1, 2026

Parties: Stitch Hospitality, LLC. dba HotelComply ("HotelComply") and Customer

1. ROLES OF THE PARTIES

Customer is the Data Controller (or "Business" under the CCPA/CPRA) with respect to personal information processed in connection with the Service.

HotelComply is the Data Processor (or "Service Provider" under the CCPA/CPRA) with respect to such personal information, processing it solely on behalf of and under the documented instructions of Customer.

2. PROCESSING DETAILS

Purpose

Provision of HotelComply documentation services as described in the Agreement, including DSAR workflow tracking, CCPA/CPRA assessment, Record of Processing Activities documentation, and vendor DPA management.

Categories of Data Subjects

Customer's authorized users and personnel (hotel operators, compliance staff, general managers, and other individuals granted account access by Customer).

Categories of Personal Information

Account credentials, names, and email addresses of Customer's authorized users; compliance documentation created by those users including ROPA entries, assessment responses, and vendor records; DSAR workflow metadata consisting of operational tracking data only (request type, jurisdiction, SLA deadline, status, and cryptographic reference tokens). HotelComply does not receive, store, or process hotel guest personal information. DSAR workflow records contain no guest-identifying information — guest identity is represented solely by a one-way SHA-256 hash of the submitting party's email address, from which the original value cannot be reconstructed by HotelComply. Artifact files uploaded in connection with DSAR fulfillment are stored transiently, delivered once via single-use token, and deleted automatically upon delivery or expiration.

Special Categories

No special categories of personal information (as defined under GDPR Article 9 or CPRA sensitive personal information) are processed by HotelComply. Customer is solely responsible for ensuring that any sensitive personal information entered into free-text fields within the Service is handled in accordance with applicable law. Customer shall not input hotel guest personal information into any field within the Service.

Duration

The term of Customer's subscription, through deletion or return of data following termination as set forth in the Agreement. DSAR artifact files are deleted automatically within 72 hours of delivery or expiration of the delivery token, whichever occurs first.

Processing Operations

Account management, authentication, storage and retrieval of compliance documentation, DSAR workflow tracking via pseudonymous reference tokens, one-time artifact delivery via expiring signed URLs, opt-out management, consent tracking, and data flow documentation.

3. HOTELCOMPLY OBLIGATIONS

HotelComply shall:

3.1 Process personal information only on Customer's documented instructions, including as set forth in this DPA and the Agreement, unless required to do so by applicable law. HotelComply will inform Customer if, in its opinion, an instruction infringes applicable data protection law.

3.2 Implement and maintain appropriate technical and organizational security measures to protect personal information against unauthorized or unlawful processing, accidental loss, destruction, or damage, including data encryption in transit and at rest, access controls, monitoring, and regular backups.

3.3 Ensure that all personnel authorized to process personal information are subject to appropriate confidentiality obligations.

3.4 Notify Customer of a confirmed personal data breach without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach, providing sufficient information to enable Customer to meet its own breach notification obligations under applicable law.

3.5 Assist Customer, by appropriate technical and organizational measures and to the extent reasonably practicable, in fulfilling Customer's obligations to respond to Data Subject Access Requests, opt-out requests, and inquiries from regulatory authorities, within the scope of the Service.

3.6 Upon termination or expiration of the Agreement, at Customer's election, delete or return all personal information processed on Customer's behalf, and delete existing copies, unless retention is required by applicable law.

3.7 Make available to Customer, upon written request, all information reasonably necessary to demonstrate compliance with this DPA.

3.8 Maintain records of processing activities as required under GDPR Article 30 and applicable CPRA regulations.

4. SUBPROCESSORS

4.1 Customer provides general authorization for HotelComply to engage subprocessors in connection with providing the Service, including providers of hosting, analytics, and AI services.

4.2 A current list of HotelComply's subprocessors is available at hotelcomply.com/subprocessors or upon written request to [email protected].

4.3 HotelComply will provide Customer with at least thirty (30) days' prior written notice of any intended addition or replacement of a subprocessor by updating the subprocessor list and notifying Customer via email. Customer may object to such changes on reasonable grounds related to data protection within fourteen (14) days of notice. If the parties cannot resolve a reasonable objection, Customer may terminate the relevant portion of the Service on written notice.

4.4 HotelComply will impose data protection obligations on all subprocessors no less protective than those in this DPA and will remain liable to Customer for the acts and omissions of its subprocessors to the same extent as if HotelComply had performed the processing directly.

5. CUSTOMER OBLIGATIONS

Customer shall:

5.1 Provide personal information to HotelComply only where lawful grounds for processing exist under applicable law, including the CCPA/CPRA, GDPR, and any other applicable data protection regulations.

5.2 Remain solely responsible for its own compliance with applicable privacy and data protection laws, including providing required notices to data subjects and maintaining appropriate records.

5.3 Not instruct HotelComply to process personal information in a manner that would violate applicable law or this DPA.

5.4 Ensure that any sensitive personal information uploaded or processed through the Service has been collected and may be processed in accordance with applicable law, including CPRA requirements governing sensitive personal information.

5.5 Not input hotel guest personal information — including guest names, email addresses, payment information, booking records, or any other guest-identifying data — into any field within the Service. HotelComply is not designed or intended to receive hotel guest personal information. The DSAR workflow is designed to operate using pseudonymous reference tokens only. HotelComply assumes no processing obligations with respect to any guest personal information inadvertently submitted by Customer in violation of this provision, and Customer bears sole responsibility for any such submission.

6. CPRA SERVICE PROVIDER RESTRICTIONS

HotelComply, as a Service Provider under the CCPA/CPRA, will not:

6.1 Sell or share personal information as those terms are defined under the CCPA/CPRA;

6.2 Retain, use, or disclose personal information for any commercial purpose other than providing the Service as specified in the Agreement and this DPA;

6.3 Retain, use, or disclose personal information outside of the direct business relationship between HotelComply and Customer; or

6.4 Combine personal information received from Customer with personal information received from or collected in connection with other sources, except as permitted by CPRA regulations.

7. INTERNATIONAL DATA TRANSFERS

7.1 Standard Contractual Clauses. To the extent that processing of personal information under this DPA involves a transfer of personal data from the European Economic Area ("EEA") to a third country not recognized as providing an adequate level of data protection, the parties agree that the Standard Contractual Clauses adopted by the European Commission under Decision 2021/914 ("SCCs") are incorporated into this DPA by reference, with HotelComply acting as data importer. Module Two (Controller to Processor) applies where Customer is a controller and HotelComply is a processor; Module Three (Processor to Processor) applies where Customer itself acts as a processor. In the event of a conflict between the SCCs and this DPA, the SCCs shall control with respect to EEA transfers.

7.2 UK International Data Transfer Addendum. For transfers of personal data from the United Kingdom, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office ("UK IDTA") is incorporated into this DPA by reference and shall apply in addition to the SCCs where required.

7.3 Customer is responsible for ensuring that the applicable transfer mechanism is appropriate for its specific circumstances and for any supplementary measures required under applicable law.

8. AUDIT RIGHTS

8.1 Upon Customer's written request, HotelComply will provide reasonable documentation demonstrating its compliance with this DPA, subject to confidentiality obligations.

8.2 Customer may conduct an audit of HotelComply's data processing practices no more than once per calendar year, upon at least thirty (30) days' prior written notice, at Customer's expense, and subject to reasonable confidentiality restrictions. Physical on-site audits of HotelComply's facilities are excluded. Audits may be conducted through questionnaires, documentation review, or third-party auditors subject to HotelComply's prior written approval.

9. LIABILITY

Each party's liability arising out of or related to this DPA is subject to the limitation of liability provisions set forth in the Agreement. For the avoidance of doubt, any reference in the Agreement's limitation of liability to "the Service" or "this Agreement" includes this DPA and the processing activities governed herein.

10. GOVERNING LAW AND CONFLICTS

10.1 This DPA is governed by the laws of the State of California, USA, except where mandatory provisions of applicable data protection law (including GDPR) require otherwise.

10.2 In the event of a conflict between this DPA and the Agreement with respect to the processing of personal information, this DPA shall control.

11. CONTACT

Data protection inquiries may be directed to:

Stitch Hospitality, LLC., dba HotelComply

Attn: Privacy

[email protected]

(855) 629-2755

hotelcomply.com/privacy