Data Processing Addendum

1. Scope and precedence

1.1 This Data Processing Addendum (the "DPA") forms part of the agreement between CampOne GmbH, which develops and operates the Grondia platform ("Grondia"), and the customer named in the Order Form ("Customer") under the Grondia Terms of Service for the United States (the "Terms"). It applies whenever Grondia processes Customer Personal Data in providing the Services.

1.2 If this DPA conflicts with the Terms, this DPA controls as to the processing of Customer Personal Data. Capitalized terms not defined here have the meaning given in the Terms.

2. Definitions

"Applicable Data Protection Laws" means all US federal and state laws on privacy and the protection of personal information that apply to the processing of Customer Personal Data under the Agreement, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (the "CCPA"), and the comprehensive consumer privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and the other states that have enacted them, each as amended.

"Customer Personal Data" means personal information, personal data or any equivalent term under Applicable Data Protection Laws, contained in Customer Data and processed by Grondia on behalf of Customer.

"Consumer", "business", "controller", "processor", "service provider", "contractor", "sell", "share", "business purpose" and "commercial purpose" have the meanings given in Applicable Data Protection Laws.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

"Subprocessor" means any third party engaged by Grondia to process Customer Personal Data.

3. Roles of the parties

Customer is the business or controller of Customer Personal Data. Grondia is Customer's service provider, contractor or processor, as applicable, and processes Customer Personal Data only on Customer's behalf. Customer is responsible for complying with Applicable Data Protection Laws in its collection of Customer Personal Data and its instructions to Grondia, including providing any required notices to guests and obtaining any required consents.

4. Details of the processing

Subject matter and business purpose. Providing the Services described in the Agreement: the campground management platform, the Customer Website and booking engine, payments features, guest communications, reporting, onboarding and support.

Duration. The term of the Agreement plus the post-termination period in Section 13 of this DPA.

Nature of the processing. Collection through the Customer Website and the Platform, storage, organization, retrieval, use, transmission to services Customer connects, export and deletion.

Categories of consumers. Customer's guests and prospective guests (including members of their party), Customer's Users, and Customer's business contacts.

Categories of personal information. Identity and contact details (name, email address, phone number, postal address); stay and reservation details (dates, site or unit, party size and composition, vehicle type, license plate, pets, special requests); billing details (amounts, taxes, payment status and tokenized payment references, but not full card numbers); communications between Customer and its guests; identity document details where Customer configures the Services to collect them to meet a legal requirement; and User account and activity data.

Sensitive personal information. None is required by the Services. Customer will not instruct Grondia to process sensitive personal information except where the Services are designed for it or the law requires Customer to collect it.

5. Processing on instructions

Grondia will process Customer Personal Data only on Customer's documented instructions, which consist of the Agreement, this DPA and Customer's configuration and use of the Services, unless the law requires otherwise, in which case Grondia will inform Customer before processing unless the law prohibits it. Grondia will inform Customer if, in its opinion, an instruction violates Applicable Data Protection Laws.

6. Service provider obligations under the CCPA and similar laws

With respect to Customer Personal Data, Grondia will not:
• sell or share Customer Personal Data;
• retain, use or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the business purposes specified in this DPA, or as otherwise permitted for service providers and contractors by Applicable Data Protection Laws;
• retain, use or disclose Customer Personal Data outside the direct business relationship between Grondia and Customer; or
• combine Customer Personal Data with personal information that Grondia receives from or on behalf of another person, or collects from its own interactions with consumers, except as permitted for service providers and contractors by Applicable Data Protection Laws.

Grondia will comply with the obligations that Applicable Data Protection Laws impose on service providers, contractors and processors, and will provide the same level of privacy protection they require. Grondia will notify Customer if it determines that it can no longer meet its obligations under Applicable Data Protection Laws. Customer may take reasonable and appropriate steps to ensure that Grondia uses Customer Personal Data consistently with Customer's obligations, and, upon notice, to stop and remediate any unauthorized use.

Where Grondia receives de-identified data, it will take reasonable measures to ensure the data cannot be associated with a consumer, publicly commit to maintain and use it only in de-identified form, not attempt to re-identify it, and require any recipient to do the same.

Grondia certifies that it understands and will comply with the restrictions in this Section.

7. Confidentiality of personnel

Grondia will ensure that every person it authorizes to process Customer Personal Data is subject to a duty of confidentiality, whether contractual or statutory, and accesses Customer Personal Data only as needed to provide the Services.

8. Security

Grondia will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against Security Incidents, taking into account the nature of the data and the risks of the processing. The measures in place on the date of this DPA are described in Annex A. Grondia may update them, provided that the overall level of protection is not reduced.

9. Subprocessors

9.1 Customer authorizes Grondia to engage Subprocessors to provide the Services. The categories of Subprocessors used on the date of this DPA are described in Annex B, and a current list with names and locations is available from Grondia on request.

9.2 Grondia will notify Customer by email at least 30 days before engaging a new Subprocessor that will process Customer Personal Data. Customer may object on reasonable data protection grounds within that period. The parties will then discuss the objection in good faith; if they cannot resolve it, Customer may terminate the affected Services without penalty by written notice before the change takes effect, and Grondia will refund prepaid Fees for the remainder of the term for those Services.

9.3 Grondia will engage each Subprocessor under a written contract that requires it to protect Customer Personal Data to a standard no less protective than this DPA, and remains responsible for its Subprocessors' performance.

9.4 Third-party services that Customer chooses to connect to the Services, such as online travel agencies, channel managers, accounting software or access-control systems, are not Subprocessors. Customer instructs Grondia to transmit Customer Personal Data to them, and their processing is governed by Customer's agreement with them.

10. Assistance

10.1 Taking into account the nature of the processing, Grondia will assist Customer by appropriate technical and organizational measures, where possible, to respond to requests from consumers exercising their rights under Applicable Data Protection Laws. The Platform allows Customer to access, correct, export and delete guest records itself. If Grondia receives a request directly from a consumer about Customer Personal Data, it will forward it to Customer where it can identify Customer, and will not respond to it except on Customer's instructions or to tell the consumer to contact Customer.

10.2 Grondia will provide Customer with reasonable information and assistance needed for any data protection assessment Customer is required to conduct about the Services.

11. Security Incidents

Grondia will notify Customer without undue delay, and in any case within 72 hours, after confirming a Security Incident affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of consumers and records affected, the likely consequences, and the measures taken or proposed. Grondia will take reasonable steps to contain and remediate the incident and will provide reasonable cooperation to help Customer meet its own notification obligations. Notifying a Security Incident is not an admission of fault or liability.

12. Location of processing

Customer Personal Data in the Platform is hosted in data centers in Switzerland. Grondia and its Subprocessors may access or process Customer Personal Data in other countries to the extent needed to provide the Services, as described in Annex B, in each case subject to the protections of this DPA.

13. Return and deletion

During the term, Customer can export Customer Personal Data at any time using the export functions of the Platform. For 90 days after the Agreement ends, Grondia will keep Customer Personal Data available for export. Grondia will then delete Customer Personal Data within 30 days, including copies held by Subprocessors, except where the law requires it to be retained, in which case this DPA continues to apply to the retained data. Backups are overwritten in the ordinary backup cycle. Grondia will confirm deletion in writing on request.

14. Audits

On Customer's written request, no more than once in any 12-month period (unless required by a regulator or following a Security Incident), Grondia will make available the information reasonably necessary to demonstrate its compliance with this DPA, such as written responses to a reasonable security questionnaire and summaries of relevant policies and third-party certifications of its data center providers. If that information is not sufficient to demonstrate compliance, Customer may, at its own cost and with at least 30 days' notice, have an independent auditor bound by confidentiality conduct an audit during normal business hours, in a way that does not unreasonably disrupt Grondia's operations or compromise the security of other customers' data.

15. Liability and term

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms. This DPA remains in effect for as long as Grondia processes Customer Personal Data on Customer's behalf.

Annex A: Security measures

• Hosting: platform databases, backups and file storage are hosted in ISO 27001-certified data centers in Switzerland.
• Encryption in transit: all traffic to the Platform uses TLS, with HSTS enforced.
• Encryption at rest: databases and backups are encrypted at rest using AES-256.
• Access control: role-based permissions separate front desk, finance and owner access, every account can be individually revoked, and Grondia personnel access Customer Personal Data only as needed to provide and support the Services.
• Logging: access to guest data in the Platform is logged with user, timestamp and action.
• Backups: automated daily encrypted backups with point-in-time recovery and 30-day retention, with tested restores.
• Payment data: card data is tokenized and handled by a PCI DSS Level 1 payment provider, and full card numbers do not touch Grondia servers.
• Personnel: confidentiality obligations for everyone with access to Customer Personal Data.

Annex B: Categories of Subprocessors

• Infrastructure hosting for the Platform, its databases and backups, in Switzerland.
• Hosting and delivery of the Customer Website front end and of the content management system behind it.
• Transactional email delivery for booking confirmations and other guest communications.
• Payment processing (Adyen N.V. and its affiliates, or another provider named in the Order Form), where Customer uses the payment features.
• AI model providers, only where Customer enables an AI feature, as described in the Order Form.

A current list naming each Subprocessor and its location is available on request from hello@grondia.com.