4. NOTICE TO MAINLAND CHINA RESIDENTS

HOW DO WE COLLECT AND USE YOUR PERSONAL INFORMATION?

In general, we may collect and process your personal information in the following scenarios:

• When you browse and interact with our website and/or use any mobile apps that we may make available, we may collect your account or membership details, social media details, profile, password details and other information relating to your use and interaction with our website/mobile apps. If you sign up for newsletter subscription or make brochure requests, we may collect your name and email address to provide you the newsletter or brochure.
• When you make a booking on our online reservation systems or other channels, we may collect your name, passport and visa information, contact details (such as addresses, emails and telephone numbers), payment details (such as bank information or credit card information), or such information of the guests for who you make the reservation to complete your reservations and send the reservation confirmation to you or the guests.
• When you purchase our goods or services, we may collect your name, contact details (such as addresses, emails and telephone numbers), payment details (such as bank information or credit card information,) and other information relevant to us supplying you the goods and services.

• When you stay as a guest or visit the hotels, restaurants, spa or facilities managed by us, we may collect your name, passport and visa information, contact details (such as addresses, emails and telephone numbers), payment details (such as bank information or credit card information), your guest stay information and lifestyle information (such as hotels where you will or have stayed, arrival and departure date, room preferences, leisure activities, names and age of children, observation of your services preference), your review and feedback on our property and/or services, other information necessary to fulfil special requests, and other information relevant to supply you the services and keep proper records of your transactions with us. We may also collect information from our security systems such as from our closed circuit television system, card key, internet login and firewalls to maintain your safety and security as well as that of other guests and personnel (such as to make proper identification and verification in processing of transaction, implement security surveillance and access controls when you visit or stay at our hotels, and administer general record keeping).

• When you submit enquiries to us or provide us with your feedback, we may collect your name, contact details and the other information submitted by you (such as feedback or content you provide regarding your interests and preferences) to handle your enquiries and feedbacks.
• When you participate in our promotional offers, competitions or surveys, we may collect your  name, contact details (such as addresses, emails and telephone numbers), social media information, and other information submitted by you for us to process your interaction and/or transaction with us.
• When you join our loyalty programme or when your friends refer you to our programme, we may collect your name, gender, date of birth, nationality, passport and visa information, personal and work contact details (addresses, emails and telephone numbers), your guest stay information and lifestyle information, or such other relevant information to register you for the programme membership.

In addition to the purposes listed above, we may process your personal information for the following purposes:

• Fulfilling a request for information;
• Customizing our services to your preferences;
• Earning and redeeming rewards;
• Sending you information and updates on our products and services and other products and services that we think may be of interests to you, including latest promotions, competitions, joint- and cross promotions with our business partners;
• Sending you important information regarding our website, changes to our terms, conditions and policies;
• Performing market research, analytics and/or profiling;
• Developing new products and services;
• Improving your hotel experience, our various types of communications, advertising campaigns, and promotional activities;
• Improving the effectiveness of our website; and
• Meeting applicable legal and regulatory requirements.

HOW DO WE SHARE AND ENTRUST THE PROCESSING OF YOUR PERSONAL INFORMATION?

Like most international hotel brands, we may outsource the processing of certain functions and/or information to third parties, and thus our group entities, hotels and residences managed and operated by us, and other third parties (such as market research firms, agents, advisors, consultants, other third party suppliers and/or services providers to assist us to operate effectively and provide you with the best experiences with our services) may process your personal information on our behalf. When we outsource the processing of your personal information to third parties or provide your personal information to third-party services providers, we require those third parties to protect your personal information with appropriate security measures.

Your personal information may be disclosed to the parties listed below for the corresponding purposes:

• We partner with certain third parties to allow you to enrol, register, link accounts or use their services. These companies include business such as airlines, rental car providers, car services partners, travel agents or spa and other facilities provider and we may provide your name, account or membership details, and stay information (such as hotels where you have stayed, arrival and departure dates) to them so you can obtain their reward points (such as frequent flyer points) or provide you with a single source for purchasing packages that include travel-related services (such as airline tickets, rental cars or vacation packages).
• Owners of our hotels and branded properties have a limited right to use certain personal data for their own purposes such as for complying with their own legal obligations (including maintaining books and records and other compliance obligations).
• in the event of any change, merger, acquisition, reorganization, or liquidation involving the transfer of personal information, we will ask the new company or organization holding your personal information to continue to process your personal information in accordance with this Privacy Policy. If the new company or organization needs to use your personal information for purposes not stated in this Privacy Policy, they will obtain your consent in accordance with the applicable laws and regulations.
• to the relevant law enforcement body, regulatory, government agency, court or other third party where we believe that such disclosure is to (1) comply with an applicable law or regulation; (2) exercise, establish or defend our legal rights; or (3) protect your vital interests or those of any other person.

WHERE WE STORE YOUR PERSONAL INFORMATION

We will store your personal information in local databases in Mainland China and/or databases elsewhere in compliance with applicable data protection laws and regulations. Our corporate office is based in Hong Kong and as we do business globally, for the purposes specified in this Privacy Policy, we may transfer your personal information to other countries or regions in accordance with the applicable data protection laws and regulations. For details about such cross-border transfer of your personal information, please see the “INFORMATION TRANSFER OVERSEAS” of this Privacy Policy.

YOUR RIGHTS

You are conferred by the applicable data protection laws with the following data subject rights. If you want to exercise any of such rights, you can contact us using the contact details provided in “HOW TO CONTACT US”.

• Right of access. You are entitled to a copy of the personal information we hold about you and to learn details about how we process it. We may require you to prove your identity before providing the requested information.
• Right to rectification. We take reasonable steps to ensure that the information we hold about you is accurate and complete. However, if you believe this is not the case, you have the right to request that any incomplete or inaccurate personal information that we process about you is amended.
• Right to deletion. You have the right to ask us to delete your personal information, for example where the personal information we collected is no longer necessary for the original purpose, where the personal information has become obsolete or where you withdraw your consent (if we are processing your personal information based on your consent). However, this will need to be balanced against other factors. For example, we may not be able to comply with your request due to certain legal or regulatory obligations.
• Right to restriction of processing. You are entitled to ask us to stop using your personal information.
• Right to data portability. You have the right to ask us to transfer your personal information that you have provided to us to a third party of your choice. This right can only be exercised in certain circumstances as provided by Chinese laws.
• Rights relating to automated decision-making. You have the right not to be subjected to automated decision-making, including profiling, which produces legal effect for you or has a similar significant effect. If you believe you have been subject to an automated decision and do not agree with the outcome, you can contact us using the details below and ask us to explain, and you also have the right to refuse the decisions made only through automated decision-making methods.
• Right to withdraw consent. We may ask for your consent to process your personal information in specific cases. When we do this, you have the right to withdraw your consent at any time. We will stop the further processing as soon as possible after the withdrawal of your consent. However, this does not affect the lawfulness of the processing before consent was withdrawn.

We will respond to your requests of exercising your data subject rights in accordance with the applicable data protection laws. To the extent as permitted by laws and regulations, we may not be able to respond to your request of exercising your rights in the following circumstances:

• • If your request is contrary to our obligations under laws and regulations;
  • If the requested data is directly related to national security or national defense security;
  • If the requested data is directly related to public safety, public health, or significant public interest;
  • If the requested data is directly related to criminal investigations, prosecutions, trials and enforcement of judgments, etc.;
  • If we have sufficient evidence of your subjective malice or abuse of rights;
  • If it is in the interest of safeguarding your or other individuals' significant legitimate rights and interests, such as life and property, but it is difficult to obtain your authorization or consent;
  • If responding to your request to exercise your rights would result in serious harm to your or other individuals' or organizations' legitimate interests;
  • If the requested data involves trade secrets.