Data Processing Addendum

About This Addendum

This Data Processing Addendum (the "DPA") is part of the agreement between Reflect IQ LLC, a California limited liability company ("ReflectIQ"), and Customer under the ReflectIQ Subscription Terms of Service (the "Terms"). It applies whenever ReflectIQ processes Personal Data on Customer's behalf in providing the Platform. Capitalized terms not defined here have the meanings given in the Terms.

If this DPA conflicts with the Terms on the processing of Personal Data, this DPA controls. Otherwise, the Terms control.

1. Definitions

• "Data Protection Laws" means all U.S. federal and state laws that apply to the processing of Personal Data under the Agreement, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (the "CCPA"), and comparable state privacy laws.

• "Consumer" means an individual whose Personal Data is processed under the Agreement, such as a hotel guest, and includes a "consumer" or "data subject" as defined in Data Protection Laws.

• "Personal Data" means Customer Data that relates to an identified or identifiable individual, and includes "personal information" and "personal data" as defined in Data Protection Laws.

• "Processing" means any operation performed on Personal Data, such as collecting, storing, using, disclosing, or deleting it.

• "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data processed by ReflectIQ or its Subprocessors. Unsuccessful attempts, such as blocked login attempts, pings, and port scans, are not Security Incidents.

• "Subprocessor" means a third party engaged by ReflectIQ that processes Personal Data on ReflectIQ's behalf to help provide the Platform.

2. Roles and Scope

2.1 Roles. Customer is the business (or controller) for Personal Data, and ReflectIQ is its service provider (or processor). Where Customer acts on behalf of a hotel owner or other third party, Customer is responsible for having that party's authority to engage ReflectIQ under this DPA.

2.2 Instructions. ReflectIQ will process Personal Data only on Customer's documented instructions. The Agreement, including Customer's configuration and use of the Platform, is Customer's complete set of instructions. ReflectIQ will tell Customer if it believes an instruction violates Data Protection Laws, and may decline to follow it.

2.3 Customer Responsibilities. Customer is responsible for the lawfulness of the Personal Data it provides, for giving any notices and obtaining any consents required by Data Protection Laws, and for submitting only the Personal Data needed for the Platform to function, as required by Section 6.4 of the Terms.

2.4 Details of Processing. The subject matter, purpose, types of Personal Data, and categories of Consumers are described in Annex A.

3. Processing Restrictions

ReflectIQ will not:

1. sell or share Personal Data, as those terms are defined in the CCPA;

2. retain, use, or disclose Personal Data for any purpose other than providing the Platform under the Agreement, or as Data Protection Laws otherwise permit a service provider to do;

3. retain, use, or disclose Personal Data outside the direct business relationship between ReflectIQ and Customer;

4. combine Personal Data with personal information it receives from other sources, except as Data Protection Laws permit; or

5. use Personal Data to train AI models, other than through Aggregated Data that has been de-identified as required by the Terms and Data Protection Laws.

ReflectIQ certifies that it understands and will comply with these restrictions, will comply with its obligations under the CCPA, and will provide the same level of privacy protection the CCPA requires. ReflectIQ will notify Customer if it determines it can no longer meet these obligations. Customer may then take reasonable steps to stop and remediate any unauthorized processing.

4. Personnel

ReflectIQ will limit access to Personal Data to personnel who need it to provide, support, or secure the Platform. Each person with access must be bound by confidentiality obligations and receive appropriate privacy and security training.

5. Security

ReflectIQ will implement and maintain administrative, technical, and physical safeguards appropriate to the risk of the processing, designed to protect the confidentiality, integrity, and availability of Personal Data. These safeguards will include, at a minimum, the measures described in Annex B, and a process for regularly testing and assessing their effectiveness. ReflectIQ may update its safeguards over time, but will not materially reduce the overall level of protection during the Subscription Term.

6. Subprocessors

6.1 Authorization. Customer authorizes ReflectIQ to engage the Subprocessors listed in Annex C, as updated under Section 6.3.

6.2 Obligations. Before a Subprocessor processes Personal Data, ReflectIQ will enter into a written agreement with it that imposes data protection obligations at least as protective as this DPA. ReflectIQ remains responsible for each Subprocessor's performance.

6.3 Changes. ReflectIQ will give Customer at least 30 days' notice before adding or replacing a Subprocessor, by email or by updating the list at reflectiq.com/subprocessors with a notification option. Customer may object on reasonable data protection grounds within that period. The parties will then work in good faith to resolve the objection. If they cannot, Customer may terminate the affected subscription and receive a refund of prepaid Fees for the remaining period.

7. Security Incidents

7.1 Notice. ReflectIQ will notify Customer without undue delay, and within 72 hours where practicable, after confirming a Security Incident. Notice will go to the contact Customer designates for security matters, or otherwise to its primary account contact.

7.2 Information and Response. ReflectIQ will provide, as it becomes available, a description of the Security Incident, the categories and approximate volume of Personal Data affected, the likely consequences, and the steps taken to contain and remediate it. ReflectIQ will take reasonable steps to contain, investigate, and mitigate the Security Incident.

7.3 Notifications to Others. Customer decides whether to notify affected Consumers, regulators, or others, and ReflectIQ will reasonably assist. ReflectIQ will not notify them about Customer's Personal Data without Customer's approval, unless required by law.

7.4 No Admission. ReflectIQ's notice of a Security Incident is not an admission of fault or liability.

8. Assistance

8.1 Consumer Requests. If ReflectIQ receives a request from a Consumer to exercise privacy rights over Personal Data, such as access, correction, or deletion, it will forward the request to Customer and will not respond directly except to direct the Consumer to Customer. Taking into account the nature of the processing, ReflectIQ will provide reasonable assistance so Customer can respond, including through features of the Platform.

8.2 Compliance Assistance. ReflectIQ will provide information Customer reasonably requests to complete risk assessments or other compliance obligations under Data Protection Laws, to the extent Customer cannot obtain it from the Platform or Documentation.

8.3 Legal Requests. If a government authority requests Personal Data, ReflectIQ will, unless legally prohibited, notify Customer promptly so Customer can seek a protective order or other remedy, and will disclose only what is legally required.

9. Return and Deletion

At the end of the Agreement, Customer may export Personal Data as provided in Section 5.4 of the Terms. ReflectIQ will then delete Personal Data from its active systems within 90 days and from backups on their normal rotation cycle, except where law requires it to keep a copy. Retained copies remain subject to this DPA. On request, ReflectIQ will confirm deletion in writing.

10. Audits

10.1 Security Information. Once a year, on written request, ReflectIQ will provide a summary of its security program and complete a reasonable security questionnaire. Once ReflectIQ obtains a third-party audit report or certification, such as SOC 2 Type II, it will provide the most recent report instead, subject to confidentiality.

10.2 Additional Audits. If the information under Section 10.1 is not enough to show compliance with this DPA, or if required by a regulator or after a Security Incident, Customer may conduct an audit, either itself or through an independent auditor bound by confidentiality. The audit must be on at least 30 days' notice, during business hours, no more than once a year (except after a Security Incident), and at Customer's expense. It must not unreasonably disrupt ReflectIQ's operations or give access to other customers' data.

11. General

11.1 Liability. Each party's liability under this DPA is subject to the exclusions and limitations of liability in the Terms.

11.2 Term. This DPA remains in effect while ReflectIQ processes Personal Data for Customer, including after the Agreement ends until deletion is complete.

11.3 Changes. ReflectIQ may update this DPA as needed to reflect changes in Data Protection Laws or its Subprocessors, on notice to Customer. No update will materially reduce the protection of Personal Data during the Subscription Term without Customer's written agreement.

11.4 Scope of Laws. This DPA is designed for U.S. Data Protection Laws. If Customer needs ReflectIQ to process Personal Data subject to other privacy laws, such as the EU or UK GDPR, the parties will agree any additional terms in writing before that processing begins.

11.5 Privacy Contact. Customer may direct questions about this DPA or ReflectIQ's processing of Personal Data to privacy@reflectiq.com. ReflectIQ may update this contact by notice to Customer.

Annex A — Details of Processing

Annex B — Security Measures

ReflectIQ maintains the following measures, among others:

• Encryption: Personal Data is encrypted at rest (AES-256 or equivalent) and in transit over public networks (TLS 1.2 or higher).

• Access control: role-based, least-privilege access; multi-factor authentication for personnel accessing production systems; prompt removal of access when no longer needed.

• Hosting: Platform infrastructure is hosted with established U.S. cloud providers that maintain their own SOC 2 or ISO 27001 certifications.

• Data separation: each customer's data is stored in its own database, with database-level access controls.

• Monitoring and logging: logging of access to production systems and monitoring for suspicious activity.

• Vulnerability management: regular patching and vulnerability scanning, and independent third-party penetration testing before production launch and annually thereafter.

• Secure development: code review and testing before production release.

• Backup and recovery: regular encrypted backups and a tested process for restoring availability after an incident.

• Incident response: a documented incident response plan.

• Personnel: confidentiality agreements and security training for personnel with access to Personal Data.

Annex C — Subprocessors

The current list is also published at reflectiq.com/subprocessors.

Data sources that ReflectIQ connects to at Customer's direction, such as brand systems (for example, Marriott and Hilton) and rate-shopping providers, are not Subprocessors.