4. NOTICE TO MAINLAND CHINA RESIDENTS

HOW DO WE COLLECT AND USE YOUR PERSONAL INFORMATION?

In general, we may collect and process your personal information in the following scenarios:

When you browse and interact with our website and/or use any mobile apps that we may make available, we may collect your account or membership details, social media details, profile, password details and other information relating to your use and interaction with our website/mobile apps. If you sign up for newsletter subscription or make brochure requests, we may collect your name and email address to provide you the newsletter or brochure.
When you make a booking on our online reservation systems or other channels, we may collect your name, passport and visa information, contact details (such as addresses, emails and telephone numbers), payment details (such as bank information or credit card information), or such information of the guests for who you make the reservation to complete your reservations and send the reservation confirmation to you or the guests.
When you purchase our goods or services, we may collect your name, contact details (such as addresses, emails and telephone numbers), payment details (such as bank information or credit card information,) and other information relevant to us supplying you the goods and services.

When you stay as a guest or visit the hotels, restaurants, spa or facilities managed by us, we may collect your name, passport and visa information, contact details (such as addresses, emails and telephone numbers), payment details (such as bank information or credit card information), your guest stay information and lifestyle information (such as hotels where you will or have stayed, arrival and departure date, room preferences, leisure activities, names and age of children, observation of your services preference), your review and feedback on our property and/or services, other information necessary to fulfil special requests, and other information relevant to supply you the services and keep proper records of your transactions with us. We may also collect information from our security systems such as from our closed circuit television system, card key, internet login and firewalls to maintain your safety and security as well as that of other guests and personnel (such as to make proper identification and verification in processing of transaction, implement security surveillance and access controls when you visit or stay at our hotels, and administer general record keeping).

When you submit enquiries to us or provide us with your feedback, we may collect your name, contact details and the other information submitted by you (such as feedback or content you provide regarding your interests and preferences) to handle your enquiries and feedbacks.
When you participate in our promotional offers, competitions or surveys, we may collect your name, contact details (such as addresses, emails and telephone numbers), social media information, and other information submitted by you for us to process your interaction and/or transaction with us.
When you join our loyalty programme or when your friends refer you to our programme, we may collect your name, gender, date of birth, nationality, passport and visa information, personal and work contact details (addresses, emails and telephone numbers), your guest stay information and lifestyle information, or such other relevant information to register you for the programme membership.

In addition to the purposes listed above, we may process your personal information for the following purposes:

Fulfilling a request for information;
Customizing our services to your preferences;
Earning and redeeming rewards;
Sending you information and updates on our products and services and other products and services that we think may be of interests to you, including latest promotions, competitions, joint- and cross promotions with our business partners;
Sending you important information regarding our website, changes to our terms, conditions and policies;
Performing market research, analytics and/or profiling;
Developing new products and services;
Improving your hotel experience, our various types of communications, advertising campaigns, and promotional activities;
Improving the effectiveness of our website; and
Meeting applicable legal and regulatory requirements.

HOW DO WE SHARE AND ENTRUST THE PROCESSING OF YOUR PERSONAL INFORMATION?

Like most international hotel brands, we may outsource the processing of certain functions and/or information to third parties, and thus our group entities, hotels and residences managed and operated by us, and other third parties (such as market research firms, agents, advisors, consultants, other third party suppliers and/or services providers to assist us to operate effectively and provide you with the best experiences with our services) may process your personal information on our behalf. When we outsource the processing of your personal information to third parties or provide your personal information to third-party services providers, we require those third parties to protect your personal information with appropriate security measures.

Your personal information may be disclosed to the parties listed below for the corresponding purposes:

We partner with certain third parties to allow you to enrol, register, link accounts or use their services. These companies include business such as airlines, rental car providers, car services partners, travel agents or spa and other facilities provider and we may provide your name, account or membership details, and stay information (such as hotels where you have stayed, arrival and departure dates) to them so you can obtain their reward points (such as frequent flyer points) or provide you with a single source for purchasing packages that include travel-related services (such as airline tickets, rental cars or vacation packages).
Owners of our hotels and branded properties have a limited right to use certain personal data for their own purposes such as for complying with their own legal obligations (including maintaining books and records and other compliance obligations).
in the event of any change, merger, acquisition, reorganization, or liquidation involving the transfer of personal information, we will ask the new company or organization holding your personal information to continue to process your personal information in accordance with this Privacy Policy. If the new company or organization needs to use your personal information for purposes not stated in this Privacy Policy, they will obtain your consent in accordance with the applicable laws and regulations.
to the relevant law enforcement body, regulatory, government agency, court or other third party where we believe that such disclosure is to (1) comply with an applicable law or regulation; (2) exercise, establish or defend our legal rights; or (3) protect your vital interests or those of any other person.

WHERE WE STORE YOUR PERSONAL INFORMATION

We will store your personal information in local databases in Mainland China and/or databases elsewhere in compliance with applicable data protection laws and regulations. Our corporate office is based in Hong Kong and as we do business globally, for the purposes specified in this Privacy Policy, we may transfer your personal information to other countries or regions in accordance with the applicable data protection laws and regulations. For details about such cross-border transfer of your personal information, please see the “INFORMATION TRANSFER OVERSEAS” of this Privacy Policy.

YOUR RIGHTS

You are conferred by the applicable data protection laws with the following data subject rights. If you want to exercise any of such rights, you can contact us using the contact details provided in “HOW TO CONTACT US”.

Right of access. You are entitled to a copy of the personal information we hold about you and to learn details about how we process it. We may require you to prove your identity before providing the requested information.
Right to rectification. We take reasonable steps to ensure that the information we hold about you is accurate and complete. However, if you believe this is not the case, you have the right to request that any incomplete or inaccurate personal information that we process about you is amended.
Right to deletion. You have the right to ask us to delete your personal information, for example where the personal information we collected is no longer necessary for the original purpose, where the personal information has become obsolete or where you withdraw your consent (if we are processing your personal information based on your consent). However, this will need to be balanced against other factors. For example, we may not be able to comply with your request due to certain legal or regulatory obligations.
Right to restriction of processing. You are entitled to ask us to stop using your personal information.
Right to data portability. You have the right to ask us to transfer your personal information that you have provided to us to a third party of your choice. This right can only be exercised in certain circumstances as provided by Chinese laws.
Rights relating to automated decision-making. You have the right not to be subjected to automated decision-making, including profiling, which produces legal effect for you or has a similar significant effect. If you believe you have been subject to an automated decision and do not agree with the outcome, you can contact us using the details below and ask us to explain, and you also have the right to refuse the decisions made only through automated decision-making methods.
Right to withdraw consent. We may ask for your consent to process your personal information in specific cases. When we do this, you have the right to withdraw your consent at any time. We will stop the further processing as soon as possible after the withdrawal of your consent. However, this does not affect the lawfulness of the processing before consent was withdrawn.

We will respond to your requests of exercising your data subject rights in accordance with the applicable data protection laws. To the extent as permitted by laws and regulations, we may not be able to respond to your request of exercising your rights in the following circumstances:

- If your request is contrary to our obligations under laws and regulations;
- If the requested data is directly related to national security or national defense security;
- If the requested data is directly related to public safety, public health, or significant public interest;
- If the requested data is directly related to criminal investigations, prosecutions, trials and enforcement of judgments, etc.;
- If we have sufficient evidence of your subjective malice or abuse of rights;
- If it is in the interest of safeguarding your or other individuals' significant legitimate rights and interests, such as life and property, but it is difficult to obtain your authorization or consent;
- If responding to your request to exercise your rights would result in serious harm to your or other individuals' or organizations' legitimate interests;
- If the requested data involves trade secrets.

4. NOTICE TO MAINLAND CHINA RESIDENTS

4.1 HOW DO WE COLLECT AND USE YOUR PERSONAL INFORMATION?

This Notice applies to you if you are located in Mainland China.

Langham Hotels (Shanghai) Company Limited and Langham Hotels International Limited process your personal information for the purposes set out in this Notice and are the controllers of all customer personal information. More specifically, Brilliant Loyalty Program Limited (an affiliate of Langham Hotels (Shanghai) Company Limited and Langham Hotels International Limited) operates the loyalty programme and is the controller of the personal information of loyalty programme members.

In this Notice, “personal information” means any type of information (recorded via electronic means or otherwise) associated with an identified or identifiable natural person, but excluding any anonymised information. “Sensitive personal information” means personal information which, if leaked or used illegally, may easily cause harm to the dignity of natural persons, or cause harm to personal or property safety, including biometric information, religious beliefs, specific identity information, health and medical information, financial account information, individual location tracking information and personal information of minors under the age of fourteen (14).

In general, we may collect and process your personal information in the following scenarios:

When you browse and interact with our website and/or use any mobile apps that we may make available, we may collect your account or membership details, social media details, profile, password details and other information relating to your use and interaction with our website/mobile apps. If you sign up for newsletter subscription or make brochure requests, we may collect your name and email address to provide you the newsletter or brochure.
When you make a booking on our online reservation systems or other channels, we may collect your name, identification document information (including passport, identity card, driver’s licence or other official government documentation), contact details (such as addresses, emails and telephone numbers), loyalty programme membership number, payment details (such as bank information or credit card information), or such information of the guests for whom you make the reservation to complete your reservations and send the reservation confirmation to you or the guests.
When you purchase our goods or services, we may collect your name, contact details (such as addresses, emails and telephone numbers), loyalty programme membership number, payment details (such as bank information or credit card information) and other information relevant to us supplying you the goods and services.
When you stay as a guest or visit the hotels, restaurants, spa or facilities managed by us, we may collect your name, identification document information (including passport, identity card, driver’s licence or other official government documentation), contact details (such as addresses, emails and telephone numbers), loyalty programme membership number, payment details (such as bank information or credit card information), your guest stay information and lifestyle information (such as hotels where you will or have stayed, arrival and departure date, room preferences, leisure activities, names and age of children, observation of your services preference), your review and feedback on our property and/or services, other information necessary to fulfil special requests, and other information relevant to supply you the services and keep proper records of your transactions with us. We may also collect information from our security systems such as from our closed circuit television system, card key, internet login and firewalls to maintain your safety and security as well as that of other guests and personnel (such as to make proper identification and verification in processing of transaction, implement security surveillance and access controls when you visit or stay at our hotels, and administer general record keeping).
When you submit enquiries to us or provide us with your feedback, we may collect your name, contact details, loyalty programme membership number and the other information submitted by you (such as feedback or content you provide regarding your interests and preferences) to handle your enquiries and feedbacks.
When you participate in our promotional offers, competitions or surveys, we may collect your name, contact details (such as addresses, emails and telephone numbers), loyalty programme membership number, social media information, and other information submitted by you for us to process your interaction and/or transaction with us.

In addition to the purposes listed above, we may process your personal information for the following purposes:

Fulfilling a request for information;
Customising our services to your preferences;
Earning and redeeming rewards;
Sending you information and updates on our products and services and other products and services that we think may be of interests to you, including latest promotions, competitions, joint- and cross promotions with our business partners;
Sending you important information regarding our website, changes to our terms, conditions and policies;
Performing market research, analytics and/or profiling;
Developing new products and services;
Improving your hotel experience, our various types of communications, advertising campaigns, and promotional activities;
Improving the effectiveness of our website; and
Meeting applicable legal and regulatory requirements.

We will obtain your consent for the processing of your personal information as required by applicable laws and regulations. If there is any change to the types of personal information processed, the purposes for which such information is processed or the means of processing, we will obtain your consent for such change if required by applicable law. Please note, we shall not be required to obtain your consent to process your personal information if any of the following situations apply:

where the processing of personal information is necessary for the conclusion or performance of a contract to which you are a contracting party, or where it is necessary to carry out human resources management according to lawfully formulated labour rules and lawfully concluded collective contracts;
where it is necessary to perform a statutory responsibility or obligation;
if it is necessary to respond to a public health emergency, or to protect the life, health or property safety of an individual in case of an emergency;
where personal information is processed within a reasonable scope to carry out news reporting, public opinion supervision or any other activity for public interest purposes;
where the processing relates to personal information published by you or otherwise already lawfully disclosed, within a reasonable scope in accordance with applicable laws; or
if the processing of personal information is directly related to:
- national security and national defence;
- public safety, public health and major public interest; or
- criminal investigations, criminal prosecutions, adjudication or enforcement of judgments; and/or
- ensuring the safe and stable provision of our product or services, and the processing is necessary.

We may also indirectly receive your personal information from third party organisations, such as the various partners with whom we work, where you have provided your consent for such information to be shared with us or where we have a legal basis to use the personal information in order to provide you with our products and services. You may contact us for more information about the source of your personal information.

4.2 IF YOU ARE A MEMBER OF THE LOYALTY PROGRAMME, HOW DO WE PROCESS YOUR PERSONAL INFORMATION?

If you join the loyalty programme, we may process (including collect, store, use, edit, transfer, provide, publish or delete) your personal information in accordance with section 1.5 “WHAT INFORMATION WE PROCESS, AND HOW WE PROCESS AND USE YOUR INFORMATION IF YOU ARE A LOYALTY PROGRAMME MEMBER” in the General Terms.

Your indication of consent to the Privacy Policy shall not entitle us to collect and process all personal information for the loyalty programme. We shall only collect and process those personal information which are necessary to perform and carry out the relevant business functions or purposes.

Please refer to the section 5.1 “COOKIES” in the General Terms of the Privacy Policy on how we may use cookies to enhance your experience on the loyalty programme website. We use cookies to understand site usage and to improve the content and offerings on our sites. For example, we may use cookies to personalise your experience at our web pages (such as to recognise you by name when you return to our site), save your username in password-protected areas, and to offer you products, programs, or services. For further details, please refer to our Cookies Policy. You may refuse to accept the cookies in accordance with our Cookies Policy, but if you do, certain functionality may become unavailable.

We may market products or services or deliver messages to you based on your preferences, interests and other personal characteristics. These messages may be marketed or delivered to you by way of letter, email, short message service, through social media platforms and/or push notifications within the loyalty programme website or mobile App. If you do not wish us to target our marketing based on your personal characteristics or if you wish to opt out from direct marketing, please contact us using the contact details provided in section 6 “HOW TO CONTACT US” in the General Terms. If you are using the mobile App, you may also turn off the permission for access to notifications in your device settings or the settings in the mobile App. After the access is disabled, you will not be able to receive push notifications from the mobile App.

4.3 Minors’ personal data

The loyalty programme (now the Brilliant Loyalty Programme) enrols members who are eighteen (18) years old or above. Except where required by local laws, we do not knowingly collect personal information for the loyalty programme from any minors. If you are below the age of eighteen (18), please do not use the Brilliant website or mobile App. As a parent or legal guardian, please do not allow your minors under the age of eighteen (18) to submit personal information for the loyalty programme without your permission.

4.4 HOW DO WE SHARE AND ENTRUST THE PROCESSING OF YOUR PERSONAL INFORMATION?

Like most international hotel brands, we may outsource the processing of certain functions and/or information to third parties, and thus our Group entities, hotels and residences managed and operated by us, and other third parties (such as market research firms, agents, advisors, consultants, other third party suppliers and/or services providers to assist us to operate effectively and provide you with the best experiences with our services) may process your personal information on our behalf. When we outsource the processing of your personal information to third parties or provide your personal information to third-party services providers, we require those third parties to protect your personal information with appropriate security measures.

When we share your personal information with any third parties, we will strive to ensure (including but not limited to using contractual measures or adopt encryption for transfer to ensure) that such third parties comply with this Privacy Policy and other appropriate confidentiality and security measures that we require them to comply with when using your personal information, except for the personal information you provide directly to the third parties through the use of their services. Where we are jointly processing your personal information with a third party personal information controller, we shall ensure that our responsibilities in processing your personal information are clearly and distinctively defined.

Where necessary for the relevant purposes identified above in “HOW DO WE COLLECT AND USE YOUR PERSONAL INFORMATION?” and sections 1.4 “HOW WE PROCESS AND USE YOUR INFORMATION” and 1.5 “WHAT INFORMATION WE PROCESS, AND HOW WE PROCESS AND USE YOUR INFORMATION IF YOU ARE A LOYALTY PROGRAMME MEMBER” in the General Terms, we may transfer or disclose your personal information (including sensitive personal information) to third parties located outside Mainland China with your separate consent. We may not be able to provide certain services to you if we do not carry out such transfer. We have adopted contractual and security measures to protect your relevant rights and interests in relation to the transfer. In particular, where required by law, we will enter into a data transfer agreement with such third parties.

Your personal information may be disclosed to the parties listed in section 1.9 “INFORMATION SHARING” above for the corresponding purposes. Here you may see the details of third party personal information recipients that are processing of your personal information or are based outside Mainland China, such as their identity, contact information, retention period, location, the processing activities undertaken by them (including types of personal information being processed, and the purposes and means of processing), their responsibilities in relation to processing of your personal information, (where applicable) the legal bases for such transfers to outside of Mainland China and how you may exercise your personal information privacy rights against them. Our contact details are set out in section 6 “HOW TO CONTACT US” in the General Terms of this Privacy Policy.

4.5 WHERE WE STORE YOUR PERSONAL INFORMATION

We will store your personal information in local databases in Mainland China and/or databases elsewhere in compliance with applicable data protection laws and regulations. Our corporate office is based in Hong Kong and as we do business globally, for the purposes specified in this Privacy Policy, we may transfer your personal information to other countries or regions in accordance with the applicable data protection laws and regulations. For details about such cross-border transfer of your personal information, please see section 1.8 “INFORMATION TRANSFER OVERSEAS” in the General Terms.

4.6 HOW LONG WE KEEP YOUR PERSONAL INFORMATION

We will keep your personal information in line with our data retention policy for no longer than is necessary to fulfil the purposes we collected it for, unless we have a lawful ground for holding it for longer. Please refer to section 1.6 “HOW LONG WE KEEP YOUR PERSONAL INFORMATION” in the General Terms for further details.

4.7 HOW WE KEEP OUR PERSONAL INFORMATION SECURE

In order to ensure the correct use and to maintain the accuracy of personal information collected from you, as well as preventing unauthorised or accidental access, disclosure, alteration, loss or other use of personal information, we have implemented various internal management policies (including physical, electronic and management measures) and various security technologies and procedures based on the classification of personal information we collect from you. For example:

your personal information will only be accessed by our personnel on a “need-to-know” basis;
we ensure that our personnel are regularly trained on data protection matters;
where required by applicable data protection laws and regulations, we will encrypt and/or de-identify your personal information;
to mitigate any potential risks of unauthorised processing of your personal information, we maintain a security incident response plan; and
where required by applicable data protection laws and regulations, we will also seek to inform you and the relevant authorities of any incidents concerning the personal information we process on your behalf.

Please note, the network environment is not 100% secure. However, we will use our best endeavours to ensure security of your personal information, and assume any legal liabilities in relation to data security in accordance with applicable laws and regulations.

4.8 YOUR RIGHTS

You are conferred by the applicable data protection laws with the following personal information subject rights.

Right of access. You are entitled to a copy of the personal information we hold about you and to learn details about how we process it. We may require you to prove your identity before providing the requested information.
Right to rectification. We take reasonable steps to ensure that the information we hold about you is accurate and complete. However, if you believe this is not the case, you have the right to request that any incomplete or inaccurate personal information that we process about you is amended or supplemented.
Right to deletion. You have the right to ask us to delete your personal information, for example where the personal information we collected is no longer necessary for the original purpose, where the personal information has become obsolete or where you withdraw your consent (if we are processing your personal information based on your consent). However, this will need to be balanced against other factors. For example, we may not be able to comply with your request due to certain legal or regulatory obligations.
Right to restriction of processing. You are entitled to ask us to stop using your personal information. • Right to data portability. You have the right to ask us to transfer your personal information that you have provided to us to a third party of your choice. This right can only be exercised in certain circumstances as provided by Chinese laws. • Rights relating to automated decision-making. Where automated decision-making is involved in processing your personal information, you have the right not to be subjected to decisions made merely through automated decision-making, including profiling, which produces legal effect for you or has a similar significant effect. If you believe you have been subject to an automated decision which has a material impact on your personal interest, you can contact us and ask us to explain the decision, and you also have the right to refuse the decisions made only through automated decision-making methods.
Right to withdraw consent. We may ask for your consent to process your personal information in specific cases. When we do this, you have the right to withdraw your consent at any time. We will stop the further processing as soon as possible after the withdrawal of your consent. However, this does not affect the lawfulness of the processing before consent was withdrawn.
Right to delete or deregister your loyalty programme account. You can delete or deregister your loyalty programme account by contacting us using the contact details provided in section 6 “HOW TO CONTACT US” in the General Terms, and we will respond to your request within the timeframe required by law. After deletion or de-registration of your loyalty programme account, we will stop providing you with any product and service and delete or anonymise your personal information according to our data retention policy and applicable laws and regulations.

We will respond to your requests of exercising your personal information subject rights in accordance with the applicable data protection laws. To the extent as permitted by laws and regulations, we may not be able to respond to your request of exercising your rights in the following circumstances:

if your request is contrary to our obligations under laws and regulations;
if the requested data is directly related to national security or national defense security;
if the requested data is directly related to public safety, public health, or significant public interest;
if the requested data is directly related to criminal investigations, prosecutions, trials and enforcement of judgments, etc.;
if we have sufficient evidence of your subjective malice or abuse of rights;
if it is in the interest of safeguarding your or other individuals' significant legitimate rights and interests, such as life and property, but it is difficult to obtain your authorization or consent;
if responding to your request to exercise your rights would result in serious harm to your or other individuals' or organisations' legitimate interests; or
if the requested data involves trade secrets.

To the extent permitted by relevant laws and regulations, we reserve the right to (i) refuse unreasonable requests (for example, requests which infringe the privacy of others); and (ii) charge a reasonable fee for the cost of processing any request set out above.

If you want to exercise any of the above rights or if you have any questions, complaints, concerns or requests regarding this Privacy Policy or our personal information processing practices, you can contact us using the contact details provided in section 6 “HOW TO CONTACT US” in the General Terms. If you are not satisfied with our reply, especially if you consider our processing of your personal information infringes your legal rights and interests, you can lodge a complaint or claim with your local cyber administration departments or courts in accordance with the law.

4.9 UPDATES TO THIS NOTICE

This Notice to Mainland China Residents is effective from 29 February 2024 (the previous version of this Notice is available here ). From time to time, we may have to update, change, modify or amend this Privacy Policy (including this Notice to Mainland China Residents). Where required under applicable laws and regulations, we may seek your consent for such updates. If you do not provide your consent, we may be unable to continue to provide our services to you. You may check the most updated Privacy Policy and this Notice to Mainland China Residents on our website and in the mobile App.