1. PRIVACY POLICY – GENERAL

1.1   INTRODUCTION

We respect the privacy of all our customers and business partners, and treat personal information provided by you to us as confidential.

Please read this Privacy Policy (together with the country specific portions applicable to you) and any other privacy notice or fair processing notice we may provide on specific occasions carefully, as it is meant to help you understand what information we collect, why we collect it, and how you can manage it.

This Privacy Policy supplements and updates any other policies, notices or statements that we may have provided you, and is not intended to override them.

1.2    HOW WE GET THE INFORMATION ABOUT YOU

In order for us to operate effectively, we may collect information about you, whether as hotel guests, loyalty programme members, web site visitors or contact for any other purposes, where personal information is provided to us that can identify you as an individual.

Your personal information can come to us via various channels, including but not limited to:

Personal information provided directly by you

• Through your use of our products and services – such as when you make a reservation, stay as a guest or visit the hotels, restaurants, spa or facilities managed by us
• When you submit enquiries to us or provide us with you feedback
• When you participate in our promotional offers, competitions or surveys
• As a member of our loyalty programmes.

Data we collect when you use our Websites and Apps

• When you browse and interact with our website and/or use any mobile apps that we may make available - such as make a booking via our Online Reservation system, make an inquiry, sign up for newsletter subscription or make brochure  requests or download and use our mobile apps

Information we receive from third parties or public sources

• We may receive information from third party organizations, such as partners we work with, where you have provided your consent to that information sharing taking place or where we have a legitimate interest to use the personal information in order to provide you with our products and services.

1.3   WHAT INFORMATION ABOUT YOU DO WE COLLECT AND WHY

We may collect, use, store and transfer different kinds of personal information about you depending on our relationship with you and where you are located, this information may include:

Identity details: such as your name, gender, date of birth, nationality, passport and visa information

Contact Details: personal and work contact details (addresses, emails and telephone numbers)

Payment and credit card information: such as bank accounts, name of cardholder, credit card number, credit card billing address and expiry date

Guest stay information and lifestyle information: such as hotels where you have stayed, arrival and departure dates, room preferences, leisure activities, names and ages of children, observation of your services preference, and other information necessary to fulfil special requests. Information, feedback or content you provide regarding your interests and preferences

Profile Information: includes loyalty program member information, online account details, profile or password details

Technical Information: includes information from our security systems such as from our closed-circuit television system, card key, internet login and firewalls

Usage data: includes information about how you use and interact with our website and mobile apps and the services you use.

Sensitive Personal Information: some of the personal information which you provide to us may be considered “sensitive personal information” under the privacy and data protection laws in specific jurisdictions – such as personal information from which we can determine or infer an individual’s racial or ethnic origin, health or biometric data. We only process sensitive personal information to the extent permitted or required by applicable law.

Please note that, in respect of children’s personal information, except where required by local laws, we do not knowingly collect personal information from our websites from any children or minors. As a parent or legal guardian, please do not allow your children or minors to submit personal information without your permission.

1.4   HOW WE PROCESS AND USE YOUR INFORMATION

We may collect, process and/or use the personal information which we collect in order to:

• Deliver our products and services to you – such as completing your reservations, sending you reservation confirmations, supplying the purchased goods and services, registering you for program membership, fulfilling a request for information, customising our services to your preferences, earning and redeeming rewards, keeping proper records of your transactions with us
• Communicate and provide marketing and promotion to you – such as sending you information and updates on our products and services and other products and services that we think may be of interests to you, including latest promotions,  competitions, joint- and cross promotions with our business partners, response to enquiries, to send you important information regarding our website, changes to our terms, conditions and policies
• Develop and improve our services to you – such as performing market research, analytics and/or profiling, developing new products and services, improve the effectiveness of our website, your hotel experience, our various types of communications, advertising campaigns, and promotional activities
• Work and cooperate with third party parties to deliver our products and services to you – such as travel agents, group travel organisation, or anyone involved in the process of making your travel arrangements, credit card companies, airline operators and third party loyalty programs
• Maintain your safety and security as well as that of other guests and personnel – such as to make proper identification and verification in processing of transaction, implement security surveillance and access controls when you visit or stay at our hotels, and administer general record keeping
• Meet applicable legal and regulatory requirements
• Use it in other ways as required or permitted by law or with your consent

We will only collect, process and/or use the personal information where we are satisfied that we have an appropriate lawful basis to do so.

1.5    HOW LONG WE KEEP YOUR PERSONAL INFORMATION

We will keep your personal information in line with our data retention notice for no longer than is necessary to fulfil the purposes we collected it for, unless we have a lawful ground for holding it for longer.

To determine the appropriate retention period for your personal  information we consider the amount, nature and sensitivity of the information, the risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

We will safely and securely delete, dispose of or anonymise personal information when we no longer need it.

1.6   INFORMATION SECURITY

We endeavour to protect your personal information we maintain and have implemented reasonable technical, organizational and administrative measures to keep your personal information safe and secure and to protect it against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties that have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

When we outsource the processing of your personal information to third parties or provide your personal information to third-party services providers, we oblige those third parties to protect your personal information with appropriate security measures.

1.7   INFORMATION TRANSFER OVERSEAS

We do business globally. In order for us to operate effectively and provide you with the best experiences with our services, we may centralize certain aspects of our information processing activities and may have databases in different countries (some of which are operated by our local group company and some of which are operated by third parties on our behalf). We may therefore have to share and transfer your personal information from one country to another, or even across multiple jurisdictions, such as:

• In or to Hong Kong where our corporate office is located
• In those countries in which we manage and operate hotels, residences, sales or representative offices
• In those countries where our third-party suppliers and/or services providers, agents, advisors or consultants are located

Your personal information may therefore be subject to privacy laws that are different from those in the country where the personal information is collected or those in your country of residences. We will endeavour that the transfer of your personal information is carried out in accordance with applicable privacy laws and that appropriate technical, organizational and administrative measures are in place for its safeguard.

1.8   INFORMATION SHARING

Insofar as reasonably necessary for us in delivering our products and services to you and for the purposes set out in this Privacy Policy, we may share your personal information with the below parties. The specific kind of information we share will depend on your activities with us and only to the extent as required or permitted by law, and/or with your consent.

• Our group entities, hotels and residences managed and operated by us
• Our business partners and third parties involved in the delivery of our products and services to you – including those involved in a sale of all or part of our business operations or assets and those for business, operational and general administration
• Our marketing and advertisement partners
• Third party services providers which process data (including personal information) for us, based on our instructions and in compliance with our Privacy Policy and any other appropriate confidentiality and security measures
• Our agents, advisors, consultants, other third-party suppliers and/or services providers to assist us to operate effectively and provide you with the best experiences with our services
• Other third parties when we have your consent or are otherwise permitted or obliged by law to do so.

1.9   WHAT HAPPENS IF I DO NOT PROVIDE YOU WITH MY INFORMATION?

You may always choose what personal information (if any) you wish to provide to us. Please note, however, some of our products and services to you may be affected if you choose not to provide certain details, for example, we cannot reply to you without a name or contact details.

1.10  MARKETING AND COMMUNICATIONS

If you provide us with your contact details (e.g. postal address, email address, telephone number or fax number), we may contact you to let you know about the products, services, promotions and events offered that we think you may be interested in. You can always choose whether or not to receive any or all of these communications by contacting us as described in Section 8 below.  In addition to your agreeing to this Privacy Policy, we may also ask you to give us a separate consent before we send you with promotional information or to indicate how you would like to receive any communication (e.g. via email or regular mail). After you have indicated your preferences, you can always change them.

2.       RESIDENTS OF THE EUROPEAN UNION AND UNITED KINGDOM

European Union (EU) or United Kingdom (UK) data protection law applies to the processing of information of residents of the European Union and United Kingdom.

2.1   CONTROLLER

We are the Controller and responsible for your Personal information under this Privacy Policy. This means we decide why we collect your data, how we collect it, what data is collected, how this data is going to be used and how this data is protected.

2.2   DATA PROTECTION OFFICER (DPO)

We have appointed GRCI Law Limited as our DPO, who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, our privacy practices or how we handle your personal information please contact us in the first instance via email dataprotection@langhamhotels.com or, alternatively, you can contact our DPO directly via email dpoaas@grcilaw.com.

2.3   OUR EU REPRESENTATIVE

We have appointed IT Governance Europe Ltd to act as our EU representative. If you wish to exercise your rights under the EU General Data Protection Regulation (EU GDPR), or have any queries in relation to your rights or general privacy matters, please contact us in the first instance via email dataprotection@langhamhotels.com or, alternatively, you can contact our EU Representative directly via email eurep@itgovernance.eu (please ensure you include our company name, Langham Hotels International Limited in any correspondence you send to our representative).

2.4   UK GDPR/EU GDPR LAWFUL BASIS TABLE

The table below describes the ways we plan to use your Personal information, and which Lawful Basis we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Lawful Basis Table