ENABLYS LLC PRIVACY POLICY

Last Updated: October 21, 2026

Effective Date: October 20, 2026

Enablys LLC (“Enablys,” “we,” “us,” or “our”) provides software, applications, and services designed to help organizations manage event operations, personnel, travel, and related operational workflows.

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you access or use Enablys websites, applications, software tools, customer portals, and related services (collectively, the “Services”).

This Privacy Policy applies to individuals who interact with or use Enablys, including event personnel, staff, travelers, event organizers, organization administrators, travel managers, and other authorized users.

This Privacy Policy describes Enablys’ practices regarding personal information and is made available alongside our Terms of Service and applicable customer agreements. It is not incorporated into, and does not modify, those agreements as a contractual obligation except to the extent required by applicable law.

If you have questions about this Privacy Policy or our privacy practices, you may contact us at:

Enablys LLC

Attn: Data Privacy Team

Email: websupport@enablys.com

Travel & Customer Support: travel@enablys.com

1. Our Role as Data Processor, Service Provider, or Data Controller

Depending on how you interact with Enablys and the applicable law, we may process personal information in different capacities.

When Acting on Behalf of a Customer Organization

When an organization, such as an employer, event organizer, sanctioning body, team, program, association, or other customer, uses Enablys to manage its personnel, events, assignments, travel, or related activities, that organization generally determines why and how personal information is used.

In those circumstances, Enablys generally acts as a service provider, processor, or similar regulated service provider on behalf of the customer organization and processes personal information according to the organization’s instructions, our agreement with that organization, and applicable law.

When Enablys Determines the Purpose of Processing

Enablys may act as a controller, business, or similar responsible entity for activities where we determine the purposes and means of processing, including:

• Establishing and maintaining direct user accounts;
• Operating and securing the Services;
• Administering subscriptions and customer relationships;
• Providing technical and customer support;
• Detecting and preventing fraud, abuse, and security incidents;
• Enforcing our agreements and policies;
• Maintaining business, transaction, and security records;
• Administering, analyzing, and improving the Services; and
• Complying with applicable legal obligations.

If your personal information is primarily managed by an organization that invited you to use Enablys, you may wish to contact that organization directly regarding its privacy practices or your privacy rights.

2. Personal Information We Collect

The categories of personal information we collect depend on how you use Enablys, your interactions with us, and the features enabled by your organization.

A. Account and Identity Information

We may collect information necessary to establish, authenticate, and manage user accounts, including:

• Full name;
• Email address;
• Telephone number;
• Username and account identifiers;
• Authentication and account-security information;
• Organization affiliation;
• Job title, organizational role, and permission levels;
• Profile information; and
• Account and application preferences.

Where passwords are used, Enablys and its authentication providers are designed to protect them using cryptographic security measures rather than storing them as readable plain text.

B. Event and Operational Information

Organizations using Enablys may upload, generate, or manage information such as:

• Event assignments;
• Schedules;
• Rosters;
• Availability;
• Staffing roles;
• Organizational memberships;
• Credentials or qualifications;
• Invitations and responses;
• Attendance or participation status;
• Event locations;
• Task assignments; and
• Operational notes.

C. Traveler and Travel Management Information

When travel features are enabled, we may collect and process information necessary to coordinate, request, search for, book, ticket, or manage travel, including:

• Traveler name and contact information;
• Origin and destination;
• Travel dates;
• Flight or transportation selections;
• Itineraries;
• Booking-request status;
• Booking and ticketing status;
• Seat, meal, or travel preferences where supported;
• Provider booking references;
• Airline or supplier confirmation information;
• Fare and price information;
• Travel assignments;
• Traveler readiness information; and
• Documentation status.

Where required to provide travel services, and only when collected or needed for the applicable feature or travel supplier, we may also process information such as:

• Date of birth;
• Gender marker or similar traveler information required by a travel supplier;
• Passport number, issuing country, and expiration date;
• Citizenship or nationality;
• TSA Known Traveler Number (KTN);
• Redress Number;
• Frequent-flyer or loyalty-program numbers;
• Emergency-contact information; and
• Accessibility, mobility, or special-assistance requests.

Not every Enablys user or organization provides all of these categories of information.

D. Booking, Transaction, and Financial Information

When booking or transaction functionality is used, we may process information such as:

• Selected itineraries;
• Submitted fares;
• Updated or revalidated fares;
• Booking-request history;
• Booking-review activity;
• Approval or attended-processing activity;
• Provider order identifiers;
• Confirmation references;
• Payment status;
• Ticketing status;
• Ticket identifiers;
• Cancellation or expiration records; and
• Transaction and audit records.

Payment Card Information: Enablys works with payment processors, travel providers, airlines, and other fulfillment partners to facilitate payments. Enablys is designed to minimize the amount of payment-card information stored directly within the Enablys application and database. Payment-card information may instead be collected, tokenized, stored, or processed by the applicable payment or travel provider. Enablys does not retain card verification values, such as CVV or CVC, after authorization.

E. Communications, Support, and User-Submitted Content

We may collect information you provide when you:

• Submit a support request;
• Send us an email;
• Provide feedback;
• Submit an incident report;
• Communicate through the Services;
• Provide operational updates;
• Respond to alerts or notifications; or
• Interact with AI-assisted or other interactive features within the Services.

If an AI-assisted feature is used, information submitted to that feature may be processed as necessary to provide the requested functionality and to operate, secure, and maintain that feature, subject to our agreements and applicable law.

F. Technical, Device, and Usage Information

We may automatically collect technical and usage information when you access or interact with the Services, including:

• Internet Protocol (IP) address;
• Browser type;
• Device type;
• Operating system;
• Authentication events;
• Access timestamps;
• Navigation information;
• Application activity;
• Feature usage;
• Error reports;
• Diagnostic logs;
• Security events; and
• System performance information.

G. Information Received from Third Parties

We may receive personal information from third parties, including:

• Organizations that invite you to or manage you within the Services;
• Travel suppliers;
• Airlines;
• Booking or travel-management providers;
• Payment providers;
• Authentication or Single Sign-On providers;
• Infrastructure and hosting providers; and
• Third-party applications or integrations authorized by you or your organization.

3. How We Use Personal Information

We may use personal information to:

• Provide, operate, maintain, and support the Services;
• Create and manage accounts;
• Authenticate users;
• Manage roles, permissions, and organization access;
• Facilitate event planning, scheduling, assignments, staffing, and operational workflows;
• Manage invitations, availability, and participation;
• Maintain traveler profiles and travel-readiness information;
• Search for and display travel options;
• Create and manage booking requests;
• Coordinate attended or otherwise authorized travel-booking workflows;
• Facilitate bookings, orders, payments, confirmations, and ticketing;
• Maintain booking and ticketing status;
• Communicate travel, event, schedule, and operational updates;
• Provide alerts and notifications;
• Provide customer and technical support;
• Diagnose and resolve errors;
• Maintain audit histories and transaction records;
• Prevent duplicate, fraudulent, unauthorized, or erroneous bookings or transactions;
• Secure the Services;
• Detect and respond to fraud, abuse, or security incidents;
• Monitor performance and reliability;
• Analyze and improve the Services;
• Enforce our Terms of Service, customer agreements, and policies; and
• Comply with applicable laws, regulations, legal processes, and lawful requests.

We may also create and use aggregated, anonymized, or de-identified information for analytics, product development, performance measurement, planning, and similar lawful purposes, provided the information cannot reasonably be used to identify an individual.

4. Travel Providers, Airlines, and Other Travel Suppliers

To search for, request, book, ticket, modify, or service travel, Enablys may transmit relevant traveler and booking information to third-party travel providers and suppliers.

Depending on the Services used, these recipients may include:

• Airlines;
• Travel technology providers;
• Travel agencies or booking intermediaries;
• Global distribution systems;
• Lodging providers;
• Vehicle-rental providers;
• Ground-transportation providers; and
• Other travel suppliers.

Travel searches may initially use limited information, such as routes, travel dates, passenger counts, and search preferences. Additional traveler information may be transmitted when necessary to create, process, ticket, manage, or service a booking.

Once personal information is provided to an airline or other independent travel supplier, that supplier may process the information according to its own privacy policy, terms, legal obligations, and transportation requirements.

Before a booking is completed, users may also be presented with applicable:

• Fare rules and restrictions;
• Airline conditions of carriage;
• Supplier terms;
• Privacy notices; and
• Data-protection notices.

Enablys does not control the independent privacy practices of airlines or other independent travel suppliers.

5. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients as necessary to provide the Services, operate our business, fulfill requested transactions, or comply with law:

• Customer Organizations and Authorized Users: Information managed within an organizational account may be accessible to that organization and to authorized administrators, managers, travel personnel, or other users based on their assigned roles and permissions.
• Service Providers and Subprocessors: We may use service providers and subprocessors that assist with functions such as cloud and application hosting, database infrastructure, authentication, security, communications, customer support, monitoring, error reporting, analytics, software infrastructure, and related operational services. These providers process personal information subject to applicable contractual or legal obligations.
• Travel Suppliers and Fulfillment Partners: We may disclose traveler and booking information to airlines, booking systems, travel providers, lodging providers, transportation providers, and other suppliers as necessary to provide requested travel services.
• Payment and Transaction Providers: Where payment functionality is used, information may be disclosed to payment processors, travel providers, financial institutions, fraud-prevention providers, and other entities involved in processing, authorizing, reconciling, or securing a transaction.
• Legal, Regulatory, and Safety Disclosures: We may disclose personal information if we reasonably believe disclosure is necessary to comply with law, regulation, legal process, or lawful government request; enforce agreements or policies; investigate fraud, abuse, or security incidents; protect the rights, property, or safety of Enablys, our customers, users, or others; or establish, exercise, or defend legal claims.
• Corporate Transactions: If Enablys is involved in a merger, acquisition, financing, reorganization, bankruptcy, asset sale, or similar business transaction, personal information may be disclosed or transferred as part of that transaction, subject to applicable law.

6. Sales, Sharing, and Targeted Advertising

Enablys does not currently sell personal information as “sale” is defined under applicable privacy laws, and does not currently share personal information for cross-context behavioral advertising or use personal information for targeted advertising.

However, Enablys reserves the right to use personal information—including name, email address, and state of residence—for advertising or promotional purposes in the future. If we choose to do so, we will update this Privacy Policy and provide any notices, choices, or opt-out mechanisms required by applicable law, such as a “Do Not Sell or Share My Personal Information” link, and honor opt-out requests as required by law.

7. Cookies and Similar Technologies

We use cookies, local storage, and similar technologies to operate, secure, and provide the Services. These technologies may be used for:

• Authentication and session management;
• Account security, fraud, and abuse prevention;
• Tenant and organization context;
• Application functionality and user preferences;
• Diagnostic monitoring;
• Performance measurement; and
• Reliability.

Where required by applicable law, we will obtain consent before using non-essential cookies or similar technologies. Additional information about our cookie practices is available upon request to websupport@enablys.com. Users may also manage cookies through their browser settings, though disabling necessary cookies may prevent portions of the Services from functioning correctly.

8. Data Retention and Deletion

We retain personal information for as long as reasonably necessary to:

• Provide the Services and maintain accounts;
• Fulfill customer contracts;
• Maintain booking, transaction, ticketing, and audit records;
• Satisfy legal, regulatory, tax, accounting, and contractual obligations;
• Prevent fraud and secure the Services;
• Investigate or resolve disputes;
• Enforce agreements; and
• Support business continuity and recovery.

Retention periods may vary depending on the type of information, the applicable feature, customer instructions, contractual requirements, legal requirements, and legitimate operational, security, fraud-prevention, or recordkeeping needs.

When information is no longer required, we may securely delete, anonymize, de-identify, or otherwise dispose of it in accordance with applicable requirements. Certain records may remain in backups, audit records, security logs, or legally required archives for a limited period after deletion from active systems.

9. Data Security

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, misuse, or destruction.

Depending on the applicable system or information, these safeguards may include:

• Encryption of information in transit and at rest;
• Authentication controls;
• Role-based and least-privilege access controls;
• Tenant and database isolation controls;
• Database security policies;
• Audit logging;
• Security and operational monitoring;
• Security testing and vulnerability management practices;
• Backup and recovery capabilities; and
• Restricted access to production systems.

In the event of a confirmed data breach, Enablys will notify affected individuals and applicable regulatory authorities as and to the extent required by applicable law.

No method of electronic transmission, processing, or storage can be guaranteed to be completely secure. Users are responsible for protecting their account credentials and should promptly report suspected unauthorized access to websupport@enablys.com.

10. Individual Privacy Rights

Depending on where you live and subject to applicable law and exceptions, you may have rights concerning your personal information, including the right to:

• Request confirmation that your personal information is being processed;
• Request access to certain personal information;
• Request correction of inaccurate personal information;
• Request deletion of certain personal information;
• Obtain a portable copy of certain personal information;
• Object to or request restriction of certain processing;
• Withdraw consent where processing is based on consent; and
• Appeal certain privacy-rights decisions where applicable.

To exercise a privacy right, contact websupport@enablys.com. We may take reasonable steps to verify your identity, residency, and authority before fulfilling a request. We will acknowledge and respond to verified privacy-rights requests within the timeframes required by applicable law, generally within forty-five (45) days of receipt, subject to one extension of an additional forty-five (45) days where permitted by law.

Customer-Controlled Information: If your request concerns personal information controlled by an organization using Enablys, we may refer the request to that organization, notify the organization of the request, or assist the organization in responding as required by applicable law or contract. We will not discriminate against an individual for exercising privacy rights provided by applicable law.

11. U.S. State Privacy Rights

Residents of U.S. states with comprehensive privacy laws may have additional rights, depending on applicable law and whether the relevant law applies to Enablys or the applicable customer organization. These rights may include:

• Knowing whether personal information is processed;
• Accessing, correcting, deleting, or obtaining portable copies of certain personal information;
• Opting out of certain sales of personal information;
• Opting out of certain targeted advertising;
• Opting out of certain profiling used to make decisions that produce legal or similarly significant effects; and
• Appealing decisions concerning privacy-rights requests.

Enablys does not currently sell personal information or share it for cross-context behavioral advertising. Enablys reserves the right to use personal information, including name, email address, and state of residence, for advertising or promotional purposes in the future. If we do so, we will provide notices, choices, and opt-out mechanisms required by applicable law. Requests may be submitted to websupport@enablys.com. Where applicable, an authorized agent may submit a request on your behalf, subject to appropriate verification of the request and the agent’s authority.

12. Sensitive Personal Information

Certain information processed through travel or event-management services may be considered sensitive under applicable law. Depending on the features used, this may include:

• Passport or government-identification information;
• Date of birth;
• Account-authentication information;
• Travel-security identifiers, such as TSA Known Traveler Numbers or Redress Numbers;
• Citizenship or nationality information;
• Payment or financial information where applicable; and
• Accessibility, health-related accommodation, or special-assistance information.

We process sensitive personal information only as reasonably necessary to provide requested Services, facilitate event or travel operations, process or secure authorized transactions, protect accounts and the Services, prevent fraud or security incidents, comply with applicable legal obligations, or perform other activities permitted by law. We do not use sensitive personal information to infer characteristics about individuals for advertising purposes.

13. Children’s Privacy and Information About Minors

Enablys is designed primarily for organizations and authorized users managing events, operations, personnel, travel, and related workflows.

Some customer organizations, including youth sports organizations, educational programs, performing groups, and similar organizations, may use Enablys in connection with events or travel involving individuals under the age of 18.

When an organization provides information concerning a minor to Enablys, the organization represents, warrants, and covenants that it has obtained all required authority, verifiable parental consent, and legal permissions necessary under applicable data protection laws—including, without limitation, the Children’s Online Privacy Protection Act (“COPPA”)—to provide that information to Enablys. Enablys may rely upon this representation without independent verification, and the organization assumes all legal and financial liability arising from any failure to obtain required consent, notice, or authorization. Where Enablys processes information about minors on behalf of a customer organization, we process that information according to the organization’s instructions, our agreement with that organization, and applicable law.

Enablys does not intend for children under 13 to independently create and operate Enablys accounts without appropriate organizational, parental, or legal authorization. If you believe a child under 13 has directly provided personal information to Enablys without appropriate authorization, contact websupport@enablys.com so we may review the matter and take appropriate action consistent with applicable law.

14. International Data Transfers

Enablys is based in the United States. Personal information may be processed in the United States and in other jurisdictions where Enablys, its service providers, or travel providers operate.

If personal information is transferred internationally, we will use safeguards required by applicable law where such safeguards are required. Users accessing the Services from outside the United States should understand that their information may be processed in jurisdictions with privacy laws that differ from those in their home jurisdiction.

15. Third-Party Websites and Integrated Services

The Services may contain links to or integrations with third-party applications, websites, travel providers, booking systems, payment services, or other services.

Those third parties may independently collect or process personal information according to their own privacy policies and terms. Enablys is not responsible for the independent privacy practices, security controls, or content of third-party services. We encourage users to review applicable third-party privacy policies and terms.

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our Services, privacy practices, technology, legal requirements, or operational needs.

When we update this Privacy Policy, we will revise the “Last Updated” date. If changes are material, we may provide additional notice through the Services, by email, or through another reasonable method where required or appropriate.

17. Contact Us

If you have questions, concerns, or requests concerning this Privacy Policy or our privacy practices, contact:

Enablys LLC

Attn: Data Privacy Team

Privacy Rights Requests: websupport@enablys.com

Customer & Travel Support: travel@enablys.com