Privacy Notice

Effective Date: October __, 2025

1. I. INTRODUCTION

This Privacy Notice describes the Personal Information ESA Management, LLC and its affiliates  (collectively, “ESH,” “we,” “us,” or “our”) collect about you, how it is used and shared, and your rights and choices with regard to your Personal Information. This Privacy Notice applies to Personal Information collected by or on behalf of ESH, including information collected at our hotels, our website at ______________and other websites offered by us (collectively, the “Site”), our mobile application (“App”) and other software applications that we offer (each an “App”), by email, by phone or other offline method, or from publicly available sources (collectively, the “Services”).

For purposes of this Privacy Notice, “Personal Information” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular associate or vendor. Personal information does not include information that has been aggregated, de-identified, anonymized, or, in some cases, made publicly available in accordance with applicable law.

1. HOW WE COLLECT, USE AND SHARE PERSONAL INFORMATION
2. Information Collection

When accessing our Services, we may collect information about you, including your name, contact information, role, ID info, visit timestamp, credentials, vehicle information,  vendor infromation, Driver’s license, government ID, purpose of visit,, and any other information you choose to provide.

We (or our third-party partners) may automatically collect Personal Information from you through your interactions with the Services, including IP address, browser type, language preferences, device operating system, pages viewed on the Site or App, Site and App usage statistics, and other information we collect through the use of cookies and similar technology. We may use location data to analyze certain information. We may also use your general location information to enable us to better focus our operations  efforts. See the “Digital Analytics & Advertising” section of this Privacy Notice to learn more about the use of this information and the choices available to you.

We limit the use of Sensitive Personal Information to only what is necessary to provide  services or as required by law.

1. Source of Information

We collect Personal Information from a number of sources, including the following:

• Associate :
• Vendors; and
• Other visitors,

1. Information Use

We may use information collected about you for our business and commercial purposes, including to:

• Confirm hotel guest readiness;
• Manage site access;
• Contact you regarding your visit or safety incidents;
• Comply with operational, contractual and insurance requests;
• Perform internal recordkeeping and incident investigation;
• Maintain the security and integrity of our Services and assets and to debug, identify, and repair errors that impair existing intended functionality in the Services; and
• Comply with applicable laws and regulatory requirements, or as requested by government or regulatory authorities or law enforcement, including in response to a court order, subpoena, or other lawful request.

1. Information Sharing

We may share information we collect with third parties, including the following:

• Our affiliates and site owners/operators;
• Contracted service providers;
• Parties involved in safety investigations or incident reporting; and
• Law enforcement or other authorities pursuant to a subpoena, warrant, or other legal process as necessary to comply with law or to protect our rights and interests or the safety of you or others.

We may share aggregated or deidentified information without limitation. We never sell or share Sensitive Personal Information or knowingly sell or share Personal Information of children. We do not share phone numbers, text messaging originator opt-in data, and consents with third parties.

1. Information Retention

We retain personal information that we collect for as long as we need to use it in connection with our business and in accordance with our standard practices or in compliance with applicable laws. When we no longer need the personal information, we will deidentify, aggregate, or delete this information where required by law.

III. DIGITAL ANALYTICS

We partner with certain third-party service providers to collect information about your use of the Site and App and other sites and apps over time for non-advertising purposes, such as analytics, auditing, research, and reporting. We use Adobe Analytics to help us understand how our customers use the Site and App across devices (e.g., mobile phone, computer). You can read more about how Adobe Analytics collects and uses data when you visit our Site and App, and opt out of the use of cookies in web browsers by Adobe Analytics by clicking here. We also use Google Analytics to help us to improve and personalize the overall the experience of our Site and App, identify and address search results for your local area, and understand usage of our Services. For more information about how Google Analytics collects and uses data when you use our Site, visit www.google.com/policies/privacy/partners, and to opt out of Google Analytics, visit tools.google.com/dlpage/gaoptout.  Additionally, your browser may offer tools to limit the use of cookies or to delete cookies; however, disabling some or all cookies could mean you will be unable to access certain content on the Site or use all features.

1. EEA, SWISS, AND UK RESIDENTS

This section applies to residents of the European Economic Area (“EEA”), Switzerland, or the United Kingdom (“UK”).

1. Lawful Basis for Processing

We may collect and process personal data about you where the laws of your jurisdiction permit it. We may rely on the following legal bases to process personal data about you:

• Contract: It is necessary to process your personal data to perform a contract with you or because you have requested we do something before creating a contract with you that requires we process your personal data. For example, we process your name and payment data to fulfill your reservation.
• Legitimate Interest: There is a commercial or business interest that is important to us or others which we’ve balanced against your privacy rights. For example, we may use your picture collected through a security camera to maintain the security of our physical locations.
• Consent: We have asked for your permission to use your personal data. For example, we may ask for your permission to use your phone’s geolocation data to provide you better rates on our services.
• Legal Obligation: It is necessary to use your personal data so that we can fulfil our legal and regulatory obligations. For example, some recordkeeping laws require we collect and retain certain information about our guests.

1. Transfers outside of the EEA, Switzerland, or UK

Personal Information may be transferred to the United States and to service providers in countries outside the EEA, Switzerland, or UK and may be stored and processed manually and electronically through global systems and tools for the purposes outlined above.

When transferring personal information to countries outside the EEA, Switzerland, and the UK, we are required to ensure personal information about you is adequately protected in the country where it is transferred. We transfer personal information to these countries only when it is subject to safeguards that assure the protection of personal information, such as entering contracts with transferee companies called the “standard contractual clauses,” Swiss “standard contractual clauses,” and the “UK addendum,” which require companies outside the EEA, Switzerland, or UK to protect your personal information to the same extent as if it had remained in the EEA, Switzerland, or UK.

1. Your Rights

See Section VI (“Your Rights and Choices”) of this Privacy Notice below for more information regarding rights that may be available to you.

1. STATE PRIVACY NOTICE

Residents of certain states have certain rights with regard to their Personal Information. See Section VI (“Your Rights and Choices”) below for more information about the rights that may be available to you.

1. Collection, Use, and Disclosure of Personal Information

In the preceding 12 months, we collected and disclosed the following categories of Personal Information for the purposes and with the parties described below.

We collect Personal Information from all categories of sources described in Section II.B (“Sources of Information”) of this Privacy Notice.

We do not sell or share the Personal Information of minors we know are under 16 years old.

1. YOUR RIGHTS AND CHOICES
2. Your Rights:

Residents of certain jurisdictions, including the EEA, Switzerland, U.K., California, Colorado, Connecticut, Virginia, and Utah, and other states have rights with respect to the Personal Information collected and processed by us under certain jurisdiction specific laws. You may be able exercise the following rights, subject to certain exceptions and limitations.

• Rights to Confirm and to Know: The right to confirm whether we are processing Personal Information about you and to request that we disclose the categories of Personal Information we collected about you individually, the categories of sources from which the information was collected, the business or commercial purposes for which we collected or sold that information, and the categories of third parties to whom the information was sold or disclosed for a business purpose in the last 12 months..
• Rights to Access and Portability: The right to request access to the Personal Information we maintain about you and to request a portable copy. You may have the right to request we transmit a copy of Personal Information about you to another business.
• Right to Obtain a List of Third Parties: If you are an Oregon resident, you may exercise the right to obtain a list of the nonaffiliated third parties (other than our processors) to which we have disclosed personal information.
• Right to Correct Inaccuracies: You may have the right to correct inaccuracies in the Personal Information we have collected about you.
• Right to Delete: You may have the right to request we delete Personal Information that we have collected or maintain about you.
• Right to Opt-Out of Sale or Sharing: You may have the right to opt out or ask us not to sell or share your Personal Information. To exercise this right, click the “Do not sell or share my Personal Information” link located on the home page of the Site or App or use one of the methods listed below under “Your Privacy Rights – Submitting Requests.”
• Rights to Restrict or Object to Processing: Depending on your jurisdiction, you may have the right to limit or object to our processing of Personal Information in certain circumstances.
• Right to Limit Processing of Sensitive Personal Information: Depending on your jurisdiction, you may have the right to limit our processing of certain “sensitive” Personal Information (or to withdraw consent for such processing if you previously gave it).
• Right to Withdraw Consent: The right to withdraw consent you previously provided to processing your Personal Information.
• Right Not to Receive Discriminatory Treatment: You have the right not to be discriminated against for the exercise of the above privacy rights.

Your Privacy Rights – Submitting Requests

If applicable in your jurisdiction, you may exercise your privacy rights by:

• submitting a request through Privily.io at https://portal.privily.io/dataSubject?cStartId=a80cf585c61490a1d0dce42d25198db4,
• calling 877.651.2124 to speak to an ESH representative, or
• writing our Privacy Officer at 13024 Ballantyne Corporate Place, Suite 1000, Charlotte, NC 28277 or dataprivacy@extendedstay.com.

For requests to correct your Personal Information, please contact us directly via by phone or email.

You may exercise these rights yourself or, depending on your jurisdiction, you may have the option to designate an authorized agent to submit a request on your behalf. Note that we may need to request additional information from you to verify your identity or understand the scope of your request, although you will not be required to create an account with us to submit a request or have it fulfilled. We will require you to provide, at a minimum, your name and sufficient additional information to verify your identity, such as your email address.

If you would like an authorized agent to submit a request on your behalf, please contact us using the methods above for instructions and details on proof and information required for use of an authorized agent. We may also need to contact you directly to verify the request.

Opt-out preference signals, global privacy controls (“GPCs”), or universal opt-out mechanisms (“UOOMs”)

Certain mechanisms or technologies may be used to indicate your opt-out preferences to entities that process personal information. To the extent that we are able to recognize these signals and are legally required to honor them, we will treat these signals as requests to opt out of processing or sharing for the purposes of targeted advertising or the sale of personal information. Depending on the signal you select, the opt-out may apply only to certain interactions, such as a specific browser or device. 

Appeals and Complaints

If you are unhappy with our response to your request, we hope you will reach out to us first at dataprivacy@extendedstay.com. For residents of the EEA and the UK, if you are still unhappy, you have the right to complain to your data protection authority.

Additionally, for Colorado, Connecticut, Oregon, Texas or Virginia residents, if you have submitted a request that you believe we have not reasonably fulfilled, you may contact us to appeal our decision by sending an email with the subject line “Appeal” to dataprivacy@extendedstay.com.

VII. AUTOMATED LICENSE PLATE RECOGNITION USAGE AND PRIVACY POLICY

In some locations, ESH has permitted local law enforcement to place automated license plate readers (ALPR) on ESH properties. ESH does not have access to any information from these ALPRs and is not an “end user” of such information. ALPRs are installed and maintained by Flock. You can read Flock’s privacy notice at: https://www.flocksafety.com/privacy-policy as well as additional privacy FAQs at: https://www.flocksafety.com/faq/privacy-and-access.

VIII. UPDATES TO THIS PRIVACY NOTICE

We may modify this Privacy Notice from time to time. When we make changes to this Privacy Notice, we will post a link to the revised Privacy Notice on the homepage of our site. You can tell when this Privacy Notice was last updated by looking at the date at the top of the Privacy Notice. We encourage you to visit this page periodically to learn of any updates.

1. CONTACT US

For questions or comments regarding this Privacy Notice, including to exercise your rights, please contact Guest Services at 877.651.2124 or you may write our Privacy Officer at 13024 Ballantyne Corporate Place, Suite 1000, Charlotte, NC 28277 or dataprivacy@extendedstay.com.