Data Processing Addendum

This Data Processing Addendum ("DPA") is entered into between Goodstay, Inc. ("Goodstay", "we", "us") and the Facility Customer identified in the underlying subscription agreement ("Customer", "you"). It supplements and is incorporated into the Terms of Service and Privacy Policy (together, the "Agreement"). This DPA applies to the extent that Goodstay processes personal information on behalf of Customer in the course of providing the Service.

By using the Service, Customer accepts this DPA on behalf of itself and any authorized affiliates that use the Service under Customer's account. Customer does not need to sign or countersign this DPA for it to take effect; if Customer requires a signed copy for procurement records, Goodstay will provide one upon written request to legal@goodstay.pet.

1. Definitions

Capitalized terms not defined in this DPA have the meaning given in the Agreement. In addition:

• "Customer Data" means any personal information that Customer (or its end users, including pet owners using a customer portal) submits to or has processed by the Service.
• "Data Protection Laws" means all U.S. federal and state laws and regulations applicable to the processing of personal information, including the California Consumer Privacy Act ("CCPA") and the comprehensive privacy laws of other U.S. states. Goodstay does not undertake compliance obligations under the EU or UK General Data Protection Regulations or other non-U.S. data protection laws under this DPA, and the Service is not offered to controllers subject to those laws (see Section 8).
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data processed by Goodstay or its sub-processors.
• "Sub-processor" means any third party engaged by Goodstay to process Customer Data on Goodstay's behalf.
• The terms "controller", "processor", "data subject", "process"/"processing", and "personal data" have the meanings given to them in applicable Data Protection Laws.

2. Roles and Scope of Processing

For the purposes of this DPA and Customer Data:

• Customer is the controller (or, where Customer is itself a processor, the processor for its own controller).
• Goodstay is the processor acting on Customer's documented instructions.

2.1 Subject matter and duration

Goodstay will process Customer Data for the duration of the Agreement (and any post-termination period during which Customer has exported, restored, or otherwise instructed Goodstay to retain Customer Data).

2.2 Nature and purpose

Goodstay will process Customer Data only for the purpose of providing, securing, and improving the Service for Customer, and for any other purpose Customer documents in writing or configures through the Service.

2.3 Categories of data subjects

• Pet owners (Customer's clients)
• Customer's employees, contractors, and authorized staff users
• Other individuals whose information Customer or its pet owners enter into the Service

2.4 Categories of personal data

• Identifiers (names, email addresses, phone numbers, postal addresses)
• Account credentials and authentication tokens
• Pet records (species, breed, weight, veterinary and vaccination records, behavioral notes)
• Reservation, occupancy, and feeding/medication schedules
• Billing and payment metadata (Goodstay does not store full payment card numbers; tokenization is handled by Stripe)
• SMS message content and delivery metadata where SMS is enabled
• Customer-uploaded files (pet photos, vaccination proofs, report card images)

2.5 Customer instructions

Customer's use of the features, functionality, and configurable settings within the Service constitutes its documented processing instructions to Goodstay. Goodstay will notify Customer if it believes a Customer instruction violates Data Protection Laws (unless prohibited from doing so by law). Goodstay will not process Customer Data for its own commercial purposes, will not sell Customer Data, and will not share Customer Data with any third party except as permitted by this DPA.

3. Sub-processors

Customer authorizes Goodstay to engage Sub-processors to process Customer Data, provided that Goodstay (a) imposes data protection obligations on each Sub-processor that are no less protective than those in this DPA, and (b) remains responsible to Customer for the acts and omissions of each Sub-processor.

3.1 Current Sub-processors

As of the date above, Goodstay engages the following Sub-processors:

3.2 Notice of new Sub-processors

Goodstay will notify Customer at least 30 days before adding or replacing any Sub-processor. Notice will be sent to the primary email address on file for Customer's account and posted to this DPA. The notice will identify the new Sub-processor and the processing activities involved.

3.3 Right to object

Customer may object to a new Sub-processor on reasonable data-protection grounds within 30 days of the notice by emailing legal@goodstay.pet. Goodstay will work in good faith with Customer to resolve the objection. If the parties cannot agree on a resolution within a reasonable period, Customer may, as its sole and exclusive remedy, terminate the affected portion of the Service for convenience and receive a pro-rata refund of prepaid, unused subscription fees.

4. Security

Goodstay will maintain technical and organizational measures designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Without limiting the foregoing, these measures include:

• Encryption of Customer Data in transit using TLS 1.2 or higher
• Encryption at rest of database storage using the cloud provider's managed encryption
• Bcrypt password hashing and per-session authentication tokens
• Role-based access controls within Customer accounts and within Goodstay's internal infrastructure
• Principle of least privilege for production access by Goodstay personnel
• Logging, error monitoring, and alerting on production systems
• Regular dependency, framework, and operating-system security updates
• Periodic backups, with restoration procedures tested in non-production environments

Goodstay reviews and updates these measures as the Service evolves. Goodstay will not materially diminish the overall protection of Customer Data during the term of the Agreement.

5. Personnel and Confidentiality

Goodstay will ensure that personnel authorized to process Customer Data are subject to confidentiality obligations (whether by contract or by statutory duty) and have received appropriate training on the handling of personal information.

6. Data Subject Requests

Goodstay will, taking into account the nature of the processing, provide reasonable assistance to Customer in responding to requests by data subjects (including requests for access, correction, deletion, portability, opt-out of sale or sharing, and similar rights under Data Protection Laws). Customer can use the in-product tools (such as data export, record edit and delete, and notification preference controls) to fulfill most data-subject requests directly. For requests that cannot be fulfilled through these tools, Customer may contact privacy@goodstay.pet.

If Goodstay receives a request directly from a data subject relating to Customer Data, Goodstay will, where permitted by law, refer the request to Customer rather than respond directly.

7. Personal Data Breach Notification

Goodstay will notify Customer without undue delay, and in any event within 72 hours, after confirming a Personal Data Breach affecting Customer Data. Notification will be sent to the primary email address on file for Customer and will include, to the extent then known: the nature of the breach, the categories and approximate volume of personal data and data subjects affected, the likely consequences, and the measures Goodstay is taking or proposes to take in response. Goodstay will provide reasonable cooperation in connection with any further notifications Customer is required to make under Data Protection Laws.

8. Geographic Scope

The Service is hosted in the United States and is offered to U.S. facilities. Goodstay does not currently make available the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or any other cross-border transfer mechanism, and Goodstay does not act as a "processor" under the EU or UK General Data Protection Regulations or similar non-U.S. data protection laws.

Customer agrees not to use the Service to process personal data of data subjects in the European Economic Area, the United Kingdom, Switzerland, or other jurisdictions whose data protection laws would require such a transfer mechanism or processor commitment from Goodstay. If Customer has obligations to such data subjects, Customer is solely responsible for any required transfer mechanism.

9. Return and Deletion of Customer Data

On termination of the Agreement, Goodstay will, at Customer's option, return or delete Customer Data within the timeframes described in the Privacy Policy (currently: data export available for 30 days, deletion within 90 days), except to the extent retention is required by applicable law. Customer may export its data at any time during the subscription term using the data export tools in the Service.

10. Audits

On Customer's reasonable written request, no more than once per twelve-month period (and more frequently if required by a regulator or following a confirmed Personal Data Breach), Goodstay will provide Customer with the most recent copy of any third-party audit reports or certifications it maintains, summary documentation of its security and privacy controls, and reasonable written responses to a security questionnaire. Where these resources are not sufficient to demonstrate compliance with this DPA, the parties will discuss in good faith additional audit measures, which may include an on-site or remote audit conducted at Customer's expense by a mutually agreed independent auditor under reasonable confidentiality terms and at a mutually agreed time.

11. Liability

Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Agreement. The Agreement, this DPA, and the Privacy Policy together state the entire liability of each party with respect to the subject matter of this DPA.

12. Order of Precedence

If there is any conflict between this DPA and the Agreement, this DPA controls solely with respect to the processing of Customer Data.

13. Updates to this DPA

Goodstay may update this DPA from time to time to reflect changes in the Service, the Sub-processor list, or applicable Data Protection Laws. Material changes will be communicated to Customer by email or in-product notice and reflected by an updated "Last updated" date above. Continued use of the Service after the effective date of an updated DPA constitutes acceptance of the changes, except that Customer's right to object to new Sub-processors under Section 3.3 is preserved.