Data Processing
Addendum.

1. Definitions

• “Personal Data” means information in Customer Data that identifies, relates to or could reasonably be linked to an individual, such as a guest, a guest’s party member or emergency contact, or a Customer User.
• “Data Protection Laws” means privacy and data security laws of the United States and its states that apply to the processing of Personal Data under the Agreement, including, where applicable, the Oregon Consumer Privacy Act, the California Consumer Privacy Act as amended, and state data breach notification laws.
• “Processing” means any operation on Personal Data, such as collecting, storing, using, disclosing or deleting it.
• “Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data that we process.
• “Subprocessor” means a third party we engage that processes Personal Data for us in providing the Service.

2. Roles

2.1 Customer is the controller. Customer decides the purposes and means of Processing Personal Data of its guests and Users, and is the “controller” or “business” under Data Protection Laws, except for account, billing, sign-in and security information about Users, which we process for our own purposes under our Privacy Policy.

2.2 We are the processor. We process Personal Data only on Customer’s behalf to provide the Service, and are the “processor” or “service provider” under Data Protection Laws.

2.3 Customer’s duties. Customer is responsible for having a lawful basis and giving any notices and obtaining any consents that Data Protection Laws require for the Personal Data it puts into the Service, including for emails and text messages sent to guests through the Service.

3. Our Processing

3.1 Instructions. We process Personal Data only on Customer’s documented instructions. The Agreement, this DPA, the Order Form and Customer’s use and configuration of the Service are Customer’s complete instructions. We will tell Customer if we believe an instruction violates Data Protection Laws.

3.2 Limits. We will not: sell or share Personal Data for cross-context behavioral advertising; retain, use or disclose it for any purpose other than providing the Service and the purposes the Agreement allows; combine it with personal information we receive from other sources, except as Data Protection Laws allow for a service provider; or use it outside our direct business relationship with Customer. We certify that we understand and will comply with these restrictions. We will notify Customer if we determine that we can no longer meet our obligations under Data Protection Laws, and Customer may then take reasonable and appropriate steps to stop and remediate unauthorized Processing.

3.3 De-identified data. We may create de-identified and aggregated data from the Service’s technical and usage information. We will keep it de-identified, will not try to re-identify it, and will require the same of anyone we share it with.

3.4 Personnel. We ensure that everyone authorized to process Personal Data is bound by confidentiality obligations and accesses it only as needed to provide and support the Service.

3.5 Details. Annex 1 describes the Processing.

4. Security

4.1 Measures. We maintain the technical and organizational measures described in Annex 2 and in our Security Overview, which are designed to protect Personal Data. We may update them, but will not materially reduce the overall protection during Customer’s paid term.

4.2 Customer’s part. Customer is responsible for its Users’ sign-in credentials and permissions, for the security of the computers where it installs the office application, and for its own payment processor account.

5. Subprocessors

5.1 Authorization. Customer authorizes us to use the Subprocessors listed in our Subprocessor List. We will have a written agreement with each Subprocessor that requires protections for Personal Data at least as protective as this DPA, to the extent applicable to the Subprocessor’s service. We remain responsible for each Subprocessor’s performance of our obligations.

5.2 Changes. We will give Customer at least 30 days’ notice, by email or in the Service, before adding or replacing a Subprocessor, except that in an emergency affecting the Service’s security or availability we may give notice as soon as practical.

5.3 Objection. Customer may object in writing on reasonable data-protection grounds within that notice period. We will try in good faith to address the objection. If we cannot, Customer may end the affected subscription and receive a refund of prepaid fees for the unused part of the term.

5.4 Customer’s own services. Services Customer connects itself, such as its payment processor, email server or accounting software, are Customer’s own vendors, not our Subprocessors.

6. Assistance

6.1 Individual requests. The Service lets Customer find and correct guest records and limit who on its staff can see them. Guest records are never deleted from the Service. StrataPMS keeps its records in an append-only ledger: a correction is added as a new entry that replaces the earlier one for every screen and report, and the earlier entry stays in the record’s history. Customer can restrict a guest’s contact details, address, vehicle, notes and similar personal fields to the staff roles it chooses; it can merge duplicate records and mark a guest as banned, but it cannot remove one. If we receive a request from an individual about Personal Data we process for Customer, we will pass it to Customer and will not respond to it ourselves, except to tell the individual to contact Customer. Customer decides how to respond, including to a request to delete, and is responsible for any legal basis it relies on to keep a record. We will provide reasonable help for requests Customer cannot handle through the Service.

6.2 Assessments. We will provide reasonable information Customer needs for data protection assessments that Data Protection Laws require, taking into account the nature of the Processing.

7. Security Incidents

7.1 Notice. We will notify Customer without undue delay, and in any case within 72 hours after confirming a Security Incident affecting Customer’s Personal Data, and no later than 10 days after discovering it.

7.2 Content. The notice will describe, to the extent known: what happened; the categories and approximate number of records and individuals affected; the likely consequences; and what we have done and will do to address it. We will update Customer as we learn more.

7.3 Cooperation. We will take reasonable steps to contain and fix the Security Incident and help Customer meet its own notice obligations. Customer decides whether to notify affected individuals and regulators, except where the law requires us to notify them directly.

7.4 No admission. Our notice of a Security Incident is not an admission of fault or liability.

8. Return and Deletion

When the Agreement ends, we will make Customer Data available for export for 30 days on request, and then delete Personal Data from the Service within 60 days. Copies in backups are deleted within 100 days after that and stay protected under this DPA until then. We may keep Personal Data where the law requires, and will keep protecting it. Data held on Customer’s own computers by the office application is under Customer’s control.

9. Audits

On written request no more than once a year, we will answer Customer’s reasonable security questionnaire and provide our current Security Overview and any available third-party assessment summaries. If a regulator requires more, or after a Security Incident, the parties will agree in good faith on a further reasonable review, at Customer’s expense, with reasonable notice, during business hours, and under confidentiality, in a way that does not expose other customers’ data.

10. Location

We process and store Personal Data in the United States. We will not move the primary storage of Customer Data outside the United States without at least 30 days’ notice to Customer.

11. General

11.1 Liability. Each party’s liability under this DPA is subject to the limitations in the Agreement.

11.2 Precedence. If this DPA conflicts with the Agreement about Personal Data, this DPA controls.

11.3 Term. This DPA lasts as long as we process Personal Data for Customer.

Annex 1 — Details of Processing

Annex 2 — Security Measures

1. Encryption in transit: HTTPS with TLS for all connections, with HTTP Strict Transport Security.
2. Separation: each park has its own database, database login, application process and secret key.
3. Encryption of secrets: authenticator secrets, park email passwords and each User’s helper memory are encrypted with AES-256-GCM.
4. Sign-in security: hashed passwords, a password policy, authenticator codes, passkeys, optional remembered computers, sign-in alerts and sign-in throttling.
5. Access control: role-based permissions; AI helper actions require a User’s confirmation and run with that User’s permissions.
6. Integrity: financial records are append-only, and each ledger stream is protected by a hash chain.
7. Card data: card numbers are entered into the payment processor’s hosted fields and never stored by the Service.
8. AI safeguards: card numbers, security codes, passwords, access codes and bank account numbers are blocked from being sent to AI providers.
9. Server hardening: production services run under separate accounts without administrator rights; configuration secrets are readable only by the system administrator; server access is limited to authorized personnel.
10. Backups: database copies are taken every night and before each release. Nightly copies are encrypted and stored off-site for 90 days, and restoring from them is tested. Release copies are stored on the production server with administrator-only access.
11. Personnel: access to Personal Data is limited to people who need it to provide and support the Service and who are bound by confidentiality.

Signatures

For Customers who sign this DPA separately from the Agreement:

CUSTOMER

DCV SYSTEMS, LLC

Related documents

See also our Master Subscription Agreement, Subprocessor List and Security Overview and Service Level and Support Policy.