Legal

Data Access Management Policy

Last updated July 20, 2026

2raywall Solutions Inc. (“Company,” “we,” “us” or “our”) is committed to ensuring that access to all data—whether customer, internal or system—is granted, monitored and revoked in a secure, auditable manner. This Data Access Management Policy describes who may access what data, under which conditions, and how those privileges are maintained.

Where we process personal data on behalf of a business customer (for example, employee or candidate data), that access is also governed by the applicable Master Software as a Service Agreement, Order Form, and any Data Processing Addendum between us and that customer, which control to the extent of any conflict with this policy.

TABLE OF CONTENTS

1. PURPOSE

To establish consistent controls for granting, reviewing, and revoking user and system access to all data repositories in order to protect confidentiality, integrity and availability.

2. SCOPE

Applies to all employees, contractors, vendors and automated services that access Company data stores (databases, file systems, analytics platforms, backups, logs, etc.) across our cloud hosting environments and other systems used to deliver the Service.

3. DEFINITIONS

  • Least Privilege: Users/services receive only the minimal privileges required.
  • RBAC: Role‐Based Access Control. Permissions grouped by role.
  • Data Owner: Business or technical lead responsible for classification and approval.
  • Requestor: Individual or system initiating an access request.

4. ROLES & RESPONSIBILITIES

  • Data Owners define classification levels and approve access.
  • Access Administrators implement approved requests in our access-management systems.
  • Managers recertify their team’s access on a periodic basis.
  • Security Team monitors access activity and enforces this policy.

5. DATA CLASSIFICATION

All data is classified as Public, Internal, Confidential or Restricted in accordance with our Privacy Policy. Classification determines approval workflows and technical controls.

6. ACCESS REQUEST & PROVISIONING

  • Request: Requestors submit access through our internal request process, specifying the data asset and desired level.
  • Approval: The relevant Data Owner reviews and approves or rejects the request.
  • Implementation: Access Administrators configure role‐ or attribute‐based entitlements and issue appropriately scoped credentials.

7. ACCESS REVIEW & RECERTIFICATION

  • Periodic Reviews: Managers receive recertification tasks to approve, modify or revoke each direct report’s access.
  • Audits: The Security Team conducts periodic audits of privileged accounts and system/service credentials.

8. ACCESS REVOCATION

  • Offboarding: Terminated employees and expired vendor engagements trigger prompt de‐provisioning through our onboarding/offboarding process.
  • On demand: Data Owners may request emergency revocation through our internal request process.

9. MONITORING & AUDITING

  • Logging: Authentication, authorization decisions and privilege escalations are logged to a centralized logging and monitoring solution.
  • Alerts: Anomalous access patterns (such as unusual or off‐hours access) may generate alerts for review.
  • Retention: Access logs are retained for a minimum of one year.

10. EXCEPTIONS

Any exceptions must be documented, approved by our security leadership, and tracked. Temporary exceptions are time‐limited and expire automatically.

11. POLICY MAINTENANCE

This policy is reviewed periodically (and after any major incident or relevant regulatory change) by our security function. Changes are version‐controlled and published to our site.

12. CONTACT INFORMATION

If you have questions or comments about this policy, you may email us at contact@cruisecontrolapp.com or by post to:

2raywall Solutions Inc.
18117 Biscayne Blvd Suite 201
Miami, FL 33160
United States