Pricey Standard Service Schedules

Customer determines the purposes and means of guest and staff data processing and is the controller or business where those terms apply. Vary acts as processor or service provider for that data. Customer instructs Vary to process data to deliver the signed services, manage reservations and payments, issue confirmations, provide support and maintain security. Additional instructions must be documented and lawful. Vary will promptly identify an instruction it reasonably believes unlawful and may pause that processing while the parties resolve it.

Customer is responsible for its notices, lawful basis, consents where required, authority to share data with the connected booking systems, and instructions to Vary. Each party remains responsible for its own legal compliance. Vary may separately process limited business contact and billing information for its own contract administration under applicable law.

Payments will use processor-hosted or tokenized payment functionality. Vary will not intentionally store full card numbers or card security codes in Pricey. If a proposed workflow requires additional sensitive data, the parties must agree the need, lawful basis and safeguards before enabling it.

Vary will use Customer personal data only for documented service purposes or legal requirements, not sell or share it for cross-context behavioral advertising or use it for unrelated marketing. It will not retain, use or disclose that data outside the direct business relationship with Customer, or combine it with data from other clients except as permitted for a service provider by applicable law. Where the California Consumer Privacy Act or a similar law applies, Vary will comply with its applicable service-provider or processor obligations, provide the level of privacy protection that law requires, notify Customer if it determines it can no longer meet those obligations, and allow Customer to take reasonable and appropriate steps to stop and remediate unauthorized use. Personnel and contractors with access must be bound to confidentiality and granted access only as needed. Guest data may not be used in a testimonial or case study without separate authorization and a lawful basis.

Vary will maintain measures appropriate to the processing risk, including encrypted transmission, encryption of stored production data where supported by the hosting service, restricted privileged access with multifactor authentication, secure secret management, access revocation, relevant logging, vulnerability and patch management, and backup and recovery procedures. Before production processing, Vary will document its actual hosting, data locations, retention, backup frequency and recovery arrangements and provide Customer with a reasonable summary. No audit certification or specific recovery time is represented unless expressly stated in the Order Form.

Customer authorizes only the subprocessors disclosed in the dated subprocessor register identified in the Order Form and replacements or additions handled under this section. Vary will bind subprocessors to protections appropriate to their work and remains responsible for their performance of Vary's processing obligations. Before a new subprocessor receives data, Vary will provide at least 15 days' notice where practicable. Customer may reasonably object on data-protection grounds during that period; the parties will seek an alternative, and if none is practical, Customer may terminate the affected service without penalty.

Connected booking and payment providers are identified in the applicable Order Form and SOW. Their roles and applicable agreements must be documented before production access. A provider processing on Vary's behalf must also be listed as a subprocessor; naming it as a connected provider does not exempt it from this schedule. Restricted international transfers require a valid legal mechanism and any required separate transfer terms before they occur.

Vary will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer data, and in any event within 48 hours of awareness. Notice will include known facts, affected data, likely consequences, mitigation and a contact, with updates as investigation progresses. Incomplete information will not delay initial notice. Vary will contain and remediate the incident and reasonably assist Customer's legal notifications. Customer controls notices to guests and authorities unless law requires Vary to notify directly.

Vary will promptly forward data-subject requests and reasonably assist with access, correction, export, deletion, regulatory inquiries and legally required impact assessments. It will not independently respond to a request about Customer data except on instruction or as legally required. Routine assistance is included; exceptional additional work requires prior agreement, except that Vary will not charge Customer to remedy Vary's breach or condition mandatory assistance on a new fee.

Within 30 days after service ends, Vary will provide Customer's requested standard export and then delete active copies within a further 30 days, unless law requires retention. Backup copies will be isolated from ordinary use and expire within 90 days after active deletion. Legally retained data remains protected, is used only for that purpose and is deleted when no longer required. Vary will confirm deletion on request and identify any lawful retention exception.

Vary will provide information reasonably needed to demonstrate compliance. Customer may conduct a proportionate audit through an independent confidential reviewer, normally once per year with 30 days' notice during business hours. Additional review is allowed after a material incident or when law requires. Audits must protect other clients and security information. Each party bears its costs unless a material Vary breach is found, when Vary bears reasonable audit costs. Schedule A governs liability, without limiting mandatory rights or either party's statutory responsibilities.