Privacy Policy

1. Information We Collect

1.1 Personal Information You Provide

When you interact with GSX Hospitality through our website, contact forms, email, telephone, or in-person consultations, we may collect the following categories of personal information that you voluntarily provide:

• Identity and Contact Data: Full name, job title, company name, email address, telephone number, physical mailing address, and professional affiliations.
• Business Information: Company size, property portfolio details, current technology stack descriptions, project requirements, budget ranges, and implementation timelines.
• Communication Records: Contents of emails, contact form submissions, support tickets, consultation notes, telephone call summaries, and any attachments you send to us.
• Payment Information: Billing address, purchase order details, and transaction records. We do not store full credit card numbers or CVV codes on our systems. Payment processing is handled by PCI DSS compliant third-party payment processors.
• Account Credentials: If we provide you with access to a client portal or support dashboard, we collect usernames, hashed passwords, and access logs.

1.2 Information Collected Automatically

When you visit www.gsxhospitality.lol, our systems automatically collect certain technical and usage information through server logs, cookies, and similar technologies:

• Device and Browser Data: IP address, browser type and version, operating system, device type, screen resolution, language preferences, and time zone settings.
• Usage Data: Pages visited, time spent on each page, referring and exit URLs, click patterns, scroll depth, form interaction events, and files downloaded.
• Network Data: Internet service provider name, connection type, geographic region derived from IP address, and network latency metrics.
• Session Data: Session duration, session identifiers, and interaction timestamps.

1.3 Information from Third Parties

We may receive information about you from third-party sources to supplement our records and improve our services:

• Business Partners and Resellers: Referral information, joint project details, and co-marketing lead data from authorized partners in the hospitality technology ecosystem.
• Publicly Available Sources: Professional networking platforms, industry directories, corporate websites, and public business registries to verify business credentials and contact information.
• Technology Vendors: Integration partners may share system compatibility data and API usage metrics to facilitate interoperability assessments.
• Analytics Providers: Aggregated demographic and interest data from analytics services to understand our audience composition.

2. How We Collect Information

We employ multiple collection methods to gather the information described above. Each method serves a distinct purpose in our business operations and service delivery framework.

2.1 Direct Collection

You provide information directly when you complete our contact forms, subscribe to newsletters, request a consultation, respond to surveys, participate in webinars, download whitepapers or case studies, apply for partnership opportunities, or communicate with our team via email or telephone. All direct collection points include clear disclosure of the intended use of the information being collected.

2.2 Automated Collection

Our website infrastructure automatically records server access logs containing IP addresses, request timestamps, HTTP status codes, data transfer volumes, and user agent strings. We deploy cookies, web beacons, and JavaScript-based analytics scripts to measure engagement and optimize site performance. Detailed information about our cookie practices is provided in Section 8 of this policy.

2.3 Business Engagement Collection

During the course of providing computer systems design and integrated IT services, we collect technical data about your existing infrastructure, network topology, software configurations, and system performance metrics. This collection occurs through authorized remote diagnostics, on-site assessments, and integration testing procedures conducted with your explicit consent and knowledge.

3. How We Use Your Information

GSX Hospitality uses collected information for the following business and operational purposes. Each use is grounded in a specific legal basis including contractual necessity, legitimate business interest, legal obligation, or your explicit consent where required by applicable law.

3.1 Service Delivery and Fulfillment

• Designing, proposing, and delivering computer systems integration projects tailored to your specifications
• Configuring, deploying, and maintaining IT infrastructure, software systems, and network solutions
• Providing technical support, troubleshooting assistance, and managed IT services
• Processing payments, issuing invoices, and managing billing relationships
• Creating and maintaining client accounts, access credentials, and support portals

3.2 Business Operations

• Conducting internal business analysis, capacity planning, and resource allocation
• Evaluating service performance, system reliability, and client satisfaction metrics
• Training our technical staff and improving our service methodologies
• Managing vendor relationships, procurement processes, and supply chain logistics
• Maintaining corporate records, audit trails, and regulatory compliance documentation

3.3 Communications and Marketing

• Responding to inquiries, consultation requests, and support tickets in a timely manner
• Sending service-related notifications including project status updates, maintenance windows, and security advisories
• Distributing newsletters, industry insights, product announcements, and event invitations to subscribers who have opted in
• Personalizing website content and recommendations based on expressed interests and browsing behavior
• Conducting satisfaction surveys and gathering feedback to improve our service offerings

3.4 Legal and Security

• Detecting, preventing, and responding to fraud, unauthorized access, security incidents, and terms of service violations
• Complying with applicable laws, regulations, court orders, and government requests
• Enforcing our contractual rights, terms of service, and acceptable use policies
• Protecting the rights, property, and safety of GSX Hospitality, our clients, employees, and the public
• Maintaining business continuity and disaster recovery capabilities

4. Information Sharing and Disclosure

GSX Hospitality does not sell, rent, or trade your personal information to third parties for monetary compensation. We share information only in the limited circumstances described below and always subject to appropriate confidentiality and data protection safeguards.

4.1 Service Providers and Subprocessors

We engage trusted third-party companies and individuals to perform functions on our behalf. These service providers receive access only to the information necessary to perform their specific functions and are contractually bound to process such information solely in accordance with our instructions. Categories of service providers include:

• Cloud hosting and infrastructure providers for website and application hosting
• Payment processors for secure transaction handling
• Email delivery and marketing automation platforms
• Customer relationship management and project management system vendors
• Analytics and performance monitoring services
• Professional service firms including legal counsel and accounting firms

4.2 Business Partners and Integrators

With your consent, we may share technical specifications, system requirements, and project details with third-party technology vendors whose products we are integrating into your environment. Such sharing is strictly limited to the scope necessary for successful system integration and is governed by non-disclosure agreements and data processing addenda.

4.3 Legal and Regulatory Disclosures

We may disclose information when we believe in good faith that such disclosure is necessary to comply with a legal obligation, protect against legal liability, respond to verified governmental requests, investigate potential violations of our terms, or protect the security and integrity of our systems and services.

4.4 Corporate Transactions

In the event of a merger, acquisition, reorganization, sale of assets, bankruptcy, or similar corporate transaction, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on our website of any change in ownership or material changes to how your information is handled.

5. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, and regulatory reporting requirements. Our retention periods are determined based on the following criteria:

• Active Client Relationships: Information is retained for the duration of the active business relationship plus a period of ten years following project completion to address warranty claims, support obligations, and potential legal claims.
• Prospective Client Inquiries: Contact information and inquiry details are retained for twenty-four months from the date of last communication, after which they are anonymized or securely deleted unless a business relationship has been established.
• Website Analytics Data: Aggregated and anonymized analytics data may be retained indefinitely for trend analysis. Personally identifiable analytics data is retained for a maximum of twenty-six months.
• Financial and Transaction Records: Retained for a minimum of seven years to comply with tax, accounting, and financial regulations applicable in the United States.
• Security Logs and Audit Trails: Retained for a minimum of twelve months and up to three years depending on the sensitivity and regulatory requirements applicable to the systems being monitored.

6. Data Security

GSX Hospitality implements and maintains comprehensive technical, administrative, and physical security measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Our security framework is built on industry standards including the NIST Cybersecurity Framework and ISO 27001 principles.

6.1 Technical Safeguards

• Encryption of data in transit using TLS 1.3 with strong cipher suites across all web endpoints, email communications, and API interfaces
• Encryption of data at rest using AES-256 for stored data, including database files, backup archives, and configuration repositories
• Multi-factor authentication enforced for all administrative access to production systems, client portals, and internal tools
• Network segmentation isolating client-facing services from internal administrative networks through firewalls, VLANs, and zero-trust access controls
• Continuous vulnerability scanning and automated patch management across all infrastructure components
• Intrusion detection and prevention systems monitoring network traffic for anomalous patterns and known attack signatures
• Secure software development lifecycle practices including code review, static analysis, dependency scanning, and penetration testing

6.2 Administrative Safeguards

• Role-based access controls ensuring employees access only the information necessary for their job functions
• Mandatory annual security awareness and data privacy training for all personnel
• Background checks conducted on employees and contractors with access to sensitive systems
• Documented incident response procedures with defined escalation paths and notification timelines
• Regular third-party security assessments and compliance audits of our infrastructure and processes
• Vendor risk management program evaluating the security posture of all third-party service providers

6.3 Physical Safeguards

• Data center facilities protected by biometric access controls, 24/7 security personnel, and video surveillance
• Environmental controls including fire suppression, climate management, and redundant power systems
• Secure disposal procedures for decommissioned hardware and media containing client data

While we implement robust security measures, no method of electronic storage or transmission over the Internet is absolutely secure. We encourage you to use strong passwords, enable multi-factor authentication where available, and promptly report any suspected security incidents to our security team.

7. Your Rights and Choices

Depending on your jurisdiction, you may have certain rights regarding your personal information. GSX Hospitality is committed to honoring these rights to the extent required by applicable law.

7.1 Access and Data Portability

You have the right to request confirmation of whether we process your personal information and to receive a copy of that information in a structured, commonly used, and machine-readable format. Upon verified request, we will provide an export of your data within thirty calendar days.

7.2 Correction and Rectification

If you believe any personal information we hold about you is inaccurate, incomplete, or outdated, you may request correction. We will promptly investigate and, where appropriate, update our records accordingly.

7.3 Deletion

You may request deletion of your personal information, subject to certain exceptions such as our need to retain information to comply with legal obligations, resolve disputes, enforce agreements, or for other legitimate business purposes permitted by law.

7.4 Marketing Opt-Out

You may unsubscribe from marketing communications at any time by clicking the unsubscribe link included in every marketing email, by adjusting your communication preferences in your client portal, or by contacting us directly at the email address provided in Section 13. Please note that even if you opt out of marketing communications, we will continue to send transactional and service-related messages necessary for ongoing business relationships.

7.5 Cookie Preferences

Most web browsers allow you to control cookie settings through browser preferences. You can typically configure your browser to reject all cookies, accept only certain types of cookies, or notify you when a cookie is being set. Please note that disabling certain cookies may affect the functionality of our website. Detailed instructions for managing cookie preferences in popular browsers are available at the browser developer's support pages.

7.6 Exercising Your Rights

To exercise any of the rights described above, please contact us using the information provided in Section 13. We may need to verify your identity before processing your request, which may require you to provide additional information or documentation. We will respond to verified requests within the timeframes required by applicable law, generally within thirty to forty-five calendar days.

8. Cookies and Tracking Technologies

Our website uses cookies, web beacons, pixels, tags, and similar tracking technologies to enhance user experience, analyze website performance, and deliver relevant content. The following table describes the categories of cookies deployed on our site and their purposes.

8.1 Essential Cookies

These cookies are strictly necessary for the operation of our website. They enable core functionality such as session management, security enforcement, load balancing, and accessibility features. Disabling these cookies would prevent the website from functioning properly. Essential cookies do not require your consent under most applicable privacy laws.

8.2 Analytics and Performance Cookies

We use analytics cookies to collect aggregated information about how visitors interact with our website. These cookies help us understand which pages are most frequently visited, how users navigate through the site, and whether they encounter errors. We use this data to improve site architecture, content organization, and overall user experience. Our analytics platform is configured to anonymize IP addresses before storage.

8.3 Functional Cookies

Functional cookies enable enhanced features and personalization such as remembering your language preferences, form field pre-population, and customized content displays. These cookies may be set by us or by third-party providers whose services we have integrated into our pages.

8.4 Third-Party Cookies

Some content on our website may be served by third-party providers including embedded videos, social media sharing buttons, and interactive maps. These third parties may set their own cookies on your device when you interact with their embedded content. We do not control the operation of these third-party cookies, and we encourage you to review the privacy policies of these providers for information about their data practices.

8.5 Managing Your Preferences

Upon your first visit to our website, a cookie consent banner will be presented allowing you to accept or decline non-essential cookies. You may change your preferences at any time by clearing your browser cookies and revisiting the site, or by adjusting your browser settings. For detailed instructions on managing cookies, please refer to your browser's help documentation:

• Google Chrome: Settings > Privacy and Security > Cookies and Other Site Data
• Mozilla Firefox: Options > Privacy and Security > Cookies and Site Data
• Apple Safari: Preferences > Privacy > Cookies and Website Data
• Microsoft Edge: Settings > Cookies and Site Permissions > Manage and Delete Cookies and Site Data

9. International Data Transfers

GSX Hospitality is headquartered in the United States, and our primary data processing facilities are located within the United States. If you are accessing our website or services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers and central database are located.

The data protection laws of the United States may differ from the laws of your country of residence. By using our website or services, you acknowledge that your information may be transferred to our facilities and those third parties with whom we share it as described in this Privacy Policy.

When we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to the United States, we implement appropriate safeguards in accordance with applicable data protection laws. These safeguards may include:

• Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner's Office
• Data Processing Agreements incorporating mandatory data protection terms required by applicable law
• Technical measures including encryption, pseudonymization, and access controls to protect data during transit and at rest
• Regular transfer impact assessments to evaluate the adequacy of protection in the destination jurisdiction

10. Children's Privacy

Our website and services are not directed to individuals under the age of eighteen. We do not knowingly collect, use, or disclose personal information from children under eighteen. If we become aware that a child under eighteen has provided us with personal information without verifiable parental consent, we will take immediate steps to delete such information from our systems.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately using the information in Section 13. We will promptly investigate and, upon verification, remove the information from our records.

11. Third-Party Services and Links

Our website may contain links to third-party websites, platforms, and services that are not owned or controlled by GSX Hospitality. Additionally, our computer systems design and integration services may involve the use of third-party software, hardware, and cloud platforms that have their own privacy practices.

This Privacy Policy does not apply to the practices of third parties. We are not responsible for the privacy practices, content, or security of any third-party websites, services, or applications. We encourage you to carefully review the privacy policies and terms of service of any third-party services before providing them with your personal information or integrating them into your technology infrastructure.

When we recommend or implement third-party solutions as part of our service delivery, we conduct due diligence on the vendor's security and privacy practices. However, the ultimate responsibility for understanding and accepting a third party's data handling practices rests with you as the data controller for your organization's information assets.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will notify you through one or more of the following methods:

• Posting a prominent notice on our website for a period of at least thirty days
• Sending an email notification to the address associated with your account or inquiry
• Displaying an in-application notification within our client portal or support dashboard
• Updating the Last Updated date at the top of this page

We encourage you to review this Privacy Policy periodically to stay informed about our data practices. Your continued use of our website or services after the effective date of any revised policy constitutes your acknowledgment and acceptance of the changes. If you do not agree with the revised policy, you should discontinue use of our website and services and contact us to discuss the handling of your information.

Material changes include, but are not limited to: changes in the categories of personal information we collect, new purposes for which we use personal information, changes in third-party sharing practices, or changes in the legal basis for our data processing activities.

13. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through any of the following channels:

We take privacy seriously and will respond to all legitimate inquiries within a reasonable timeframe. If you believe we have not adequately addressed your concerns, you may have the right to lodge a complaint with the data protection supervisory authority in your jurisdiction.

Effective Date: July 13, 2026