Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Grey Ridge Holdings LLC ("Grey Ridge Holdings", "we", "us", or "Processor") and the hotel or organization that uses the Travera platform (the "Services") on behalf of its staff ("you" or "Controller"). It reflects the parties' agreement on the processing of personal data under applicable data protection laws.

You are the Controller of the personal data submitted to the Services. Grey Ridge Holdings acts as Processor, processing that personal data only on your documented instructions — to provide the Services as described in the Terms — and as required by law.

The Services process personal data relating to hotel employees and authorized users, such as names, email addresses, mobile numbers, roles, departments, and the operational records they create (room status, handoff notes, maintenance requests, schedules, and reports). The categories of data subjects are your employees and authorized users.

• Process personal data only on your documented instructions, including with regard to transfers, unless required by law.
• Ensure that personnel authorized to process personal data are bound by confidentiality.
• Implement appropriate technical and organizational measures to protect personal data, including encryption in transit and role-based access controls.
• Assist you, where possible, in responding to data subject requests and fulfilling your obligations regarding security, breach notification, and data protection impact assessments.
• Notify you without undue delay after becoming aware of a personal data breach affecting your personal data.
• Delete or return personal data on termination of the Services, as described below.

We may engage sub-processors to deliver parts of the Services, such as hosting, email, and SMS delivery. We impose data protection terms on each sub-processsor at least as protective as those in this DPA. We will give you notice of new or replacement sub-processors, and you may object on reasonable data-protection grounds.

Personal data is stored and processed in the United States. Where personal data is transferred to a country that does not ensure an adequate level of protection, we will put appropriate safeguards in place, such as standard contractual clauses, and comply with any transfer requirements under applicable law.

You are responsible for handling requests from data subjects. We will assist you, to the extent possible, by providing the functionality to access, correct, export, or delete data within the Services.

You may audit our compliance with this DPA, no more than once per year and on reasonable notice, by reviewing our applicable certifications, audit reports, or summaries of our security practices. Any on-site audit must be conducted under confidentiality and in a manner that does not disrupt our operations.

On termination of the Services, and subject to any legal requirement to retain records, we will delete or return your personal data within a reasonable period, after giving you the opportunity to export it through the Services.

Grey Ridge Holdings LLC
8674 County Road 39, Selma, AL 36701
support@greyridgehq.com