Harbour Plaza Hotel Management Limited ("Company")

Personal Data Statement to Customers ("Statement")

This Statement serves is to inform the customers of the policies and practices with respect to the collection, use, retention, disclosure, transfer, security and access of personal data adopted by the Company and the owners of the hotel properties managed and/or operated by the Company in accordance with the Personal Data (Privacy) Ordinance Cap. 486 ("Ordinance") and applicable data protection laws. This includes personal data collected offline at our hotels, and online through our websites, applications (including mobile apps) and third-party platforms (together referred to as “Sites”).  References to "we", "us", "our" or "ours" in this Statement are to be construed, depending on the context, as referring to those properties or entities collectively or severally.

Like many other websites, we record customers’ visits automatically through cookies, which are some small data structures sent to customers’ computers to record their visits to our official website and to identify them during their future visits. Customers may refuse to accept these cookies by activating such setting on their browsers. However, if customers select the cookies refusal setting, they may be unable to fully experience certain features of our websites.
 
We may also collect information regarding customers’ IP address, browser type, domain name and access time. This information is used for our own research purposes. As it is not linked to any personal information, it is separate from customers’ personal data.

1. We collect personal data from the following categories of sources:

• Directly from customers: Much of the personal data we process is information that customers or someone acting on customers’ behalf directly provides to us. For example, customers may provide us with Contact and Identification Information, Demographic Information, and Health-related Information, when customers create accounts, make reservations, complete surveys, participate in contests or promotional offers, contact customer service, use our Wi-Fi, or contact us via email, text, or chat, over the phone, in person, or through third parties.
• From customers’ devices and our networks: We use cookies and related technologies to collect personal data from and across devices when customers interact with us through our Website, Application, emails, or other online content or when their devices connect to, or are detected by, the wireless networks at our properties.
• From other businesses or individuals: We work with business and marketing partners and social media platforms that give us personal data of customers from whom they have collected either directly or indirectly. We also receive customers’ personal data from customers’ friends and family, for example when a family member or friend makes reservation or checks in on a customer’s behalf. We may also offer device- or operating system-based authentication as a log-in method of accessing certain services. In those instances, we are notified as to whether the authentication was successful.
• From social media: If customers post to one of our pages on a social media site, we may receive their Contact and Identification Information (ID), and any other personal data contained in customers’ social media posts or profile.

2. From time to time, it is necessary for customers to supply us with personal data in connection with the provision of goods and/or services. Customers must provide us with the personal data marked with an asterisk or otherwise indicated as mandatory, otherwise we may not be able to process their requests or comply with our legal obligations. Failure to supply such data may result in us not being able to provide the goods and/or services.

3. Customers will be asked to confirm their acceptance of and/or consent to the terms of this Statement when making reservations or otherwise communicating with us via this website or as required under applicable laws. Customers’ use or access of this website will also constitute deemed consent/acceptance of the terms of this Statement.
   
   From time to time, we would like to use customers’ names, email addresses, mobile phone numbers, and other relevant contact information to send them either via emails, SMS / MMS messages, telephone calls, push notifications, post, or social media (e.g. WeChat and Facebook), information that we think may be of interest to them, including about our hotels, products and services, news about our membership programme (if they become members or already are members of Harbour Plaza Club), satisfaction surveys, events, offers and promotions, but we would only do so with their consent.
   
   Customers may, in accordance with applicable law, choose not to receive marketing communications or opt-out from receiving marketing communications at any time, free of charge, by following the unsubscribe instructions contained in the marketing communications or contact us directly at [email protected]. If customers opt out of these communications, we may still send them non-promotional communications, such as those relating to their reservations or Harbour Plaza Club programme members communications, unless we are prohibited from doing so by applicable laws.

4. In certain instances, we will only process customer’s personal data if customer has given us permission, or indication of no objection to do so, for example where we process the personal data for direct marketing purposes or when we process customer’s personal data for any new purposes of the purposes set out in this Privacy Policy.
   
   If customer has become a member of our loyalty program, customer may still receive service notices or non-direct marketing communications about the program despite having opted out of receiving direct marketing communications from us without detriment to their loyalty benefits.
   
   Where we process customer’s personal data that requires customer’s consent or indication of no objection, we will ask for customer’s consent or indication explicitly and only for the particular purpose.
   
   Where a customer provides personal data of third parties (e.g. names and contact details of family members or friends for reservation purposes), the customer acknowledges and confirms that the relevant third parties’ consent to provide their personal data to us has been obtained.

5. We collect personal data from customers for the purposes mentioned below:
   
   Contact and Identification Information: We may collect information such as name, contact details (e.g., phone number(s), address, or email) professional title, employer or professional affiliations, passport and visa information and information from other government IDs.

6. The customer agrees that any personal data with respect to the customer or any other party which has been provided by the customer to us ("Personal Data") may be disclosed and transferred to the following locations or persons who shall hold, use, process, retain or transfer such Personal Data for the purposes mentioned in paragraph 5 and on a need-to-know basis:

• our corporate office in Hong Kong and our hotel properties where the customer has booked or stayed at or visited;
• any agent, contractor, credit provider, financial institution, service provider or professional adviser of ours or any other person under a duty of confidentiality to us;
• any of our holding companies, their subsidiaries and any company in which the same has a direct interest;
• any actual or proposed assignee or transferee of ours; and
• any other party at the customer’s consent or instruction.

7. The customer acknowledges and agrees that his/her personal data is provided to and retained by us for the following purposes and for other purposes as shall be agreed between the customer and us or required by law from time to time:

• the provision of any goods and/or services to the customer (including hotel accommodation and/or restaurant reservations and arrangements, membership-related services and responding to inquiries and requests for information or services);
• the analysis, verification and/or checking of the customer's credit, credit history and payment;
• the ensuring of the customer's on-going credit worthiness;
• the processing of any payment instructions, direct debit facilities and/or credit facilities requested by the customer;
• the determination of the amount of debt owed to or by the customer and/or the processing and/or collection of amounts outstanding from the customer and those providing security for the customer's obligations;
• the performance, preparation and enforcement of any agreement between the customer and us;
• in connection with any merger, sale, financing or acquisition of our business by/with another company;
• the meeting of the requirements to make disclosures under the requirements of any law; and
• any other purposes relating to the above.

8. We intend to use the customers’ personal information (including their names and contact details) for use in direct marketing of the news, offers, services, promotions, events and other information in relation to our hospitality businesses. We may not so use the customers’ personal information without the customers’ consent or indication of no objection. We will always ask for the customers’ consent or indication of no objection before using the customers’ personal information for direct marketing. Customers may always opt-out from receiving our direct marketing communications by following the instructions in the relevant communications or contact us directly at [email protected].

9. We use cookies, pixel tags, web beacons and similar technologies (together referred to as “Cookies”) to improve our products and customers’ experience at our Sites by collecting information on how they use our Sites. Some of the cookies we use are required to enable core site functionality, for example to provide secure log-in or to remember the progress made through an order, but we also use cookies that allow us to analyse site usage (so that we can measure and improve performance), and advertisement cookies which are used by advertising companies to serve ads that are relevant to customer’s interests.
   
   Our websites are initially set up to accept cookies. Customers can opt-out of or delete historical cookies by changing the settings on their web browsers; however, if they do so, they may find that certain features on our website and/or our app do not work properly.

10. Our Websites do not sell products or services for purchase by children and we do not knowingly solicit or collect personal data from children. The Site should be used only by customers who are at least eighteen (18) years of age and can form legally binding contracts under applicable law. The Site is not intended for and should not be used by minors.

11. We maintain appropriate technical and organizational measures to protect the personal data customers provide to us against accidental or unlawful destruction, loss, alteration, disclosure of, or access to customers’ personal data.

12. Under and in accordance with the applicable data protection laws, the customer has the right to:

• check whether we hold any personal data with respect to the customer;
• access such of the personal data which we hold with respect to the customer;
• require us to correct any personal data which is inaccurate;
• ascertain our policies and practices (from time to time) in relation to the personal data and to be informed of the kinds of the Personal Data held by us;
• withdraw consent to the processing of his/her personal data;
• erasure of his/her personal data;
• restrict data processing;
• object against profiling;
• data portability; and
• lodge a complaint with a supervisory authority (where applicable).

13. In accordance with the Ordinance, we have the right to charge a reasonable fee for the processing of any data access request.
    
    Any request for access to the personal data, correction of the personal data or information regarding policies and practices and kinds of personal data held by us or any request in relation to the customers’ rights under paragraph 12 above should be in writing and addressed as follows:
    
    Harbour Plaza Hotel Management Limited
    8th Floor
    813 Two Harbourfront
    22 Tak Fung Street
    Hunghom, Kowloon
    Hong Kong
    Attn: Personal Data Administrator
    
    Customers can also send written requests regarding access to the personal data or correction of the personal data addressed to the Sales & Marketing Administrator at the individual hotel property managed and/or operated by the Company.

14. We will only retain the personal data for so long as necessary to fulfill the purposes for which it was collected and for the purposes of satisfying our legal, accounting or compliance-related requirements.
    
    To determine the appropriate retention period, we consider the amount, nature, sensitivity, the potential risk of harm from unauthorised use or disclosure of the personal data, the purposes for which we collect/process the personal data and the applicable legal requirements.

15. This Statement has been translated into different languages. If there is any inconsistency or ambiguity between the English version and the other versions, the English version shall prevail.