1

Personal Data we collect

The term “Personal Data” refers to any personal data that can be used to identify you as an individual.

1. Personal information about you ► personal information that you provide to us, including your name, telephone number, email address and address (residential and/or delivery address);
2. Your payment information ► your payment information such as your credit card information (including credit card number, code and expiry date) and your bank account details;
3. Our correspondence ► if you contact us (whether by email, telephone or other means of communication) such as when you make enquiries, we may keep a record of that correspondence;
4. Social media account information ► depending on your interactions with various social media platforms linked to us or with which we engage, we may process your profile names, photographs or publicly available posts;
5. CCTV images and recordings ► to ensure the security of our properties, we may have close circuit television systems installed which will take visual and/or aural recordings where appropriate and relevant, and we may keep recordings as permitted by applicable laws;
6. Survey information ► we may also ask you to complete surveys that we use for research purposes. In such circumstances we shall collect the information provided in the completed survey;
7. Your use of our website and mobile applications ► details of your visits to our website, mobile application and information collected through cookies and other tracking technologies including, but not limited to, your IP address and domain name, your browser version and operating system, traffic data, location data, web logs and other communication data, and the resources that you access.
8. Do-not-track ► Because there is not yet a consensus on how companies should respond to web browser-based do-not-track (DNT) mechanisms, we do not respond to web browser-based DNT signals at this time.

For our hotel related services only (for example when you make a hotel or spa reservation, or purchase a gift certificate from us)

7. Your travel details and preferences ► we may collect information such as your travel details (including flight number, arrival and departure dates and time, country/point of origin and destination), your frequent flyer information, your travel partner information, preferences about room, food and beverages and treatment, service requests, information relating to your dietary, access or treatment requirements. We may also need to collect information as required by local laws such as passport numbers, type of entry visa, and driver’s license;
8. Your transactions with us ► we collect your itemised spending to properly assemble your folio during your stay, which includes your room rate and other expenses billed to your room.

For non-hotel related services only (for example residential and commercial leasing, and operation of residential clubs and food and beverage outlets and transport)

Your transactions with us ► we may collect information such as identity card and passport details, tenancy particulars, employment particulars and club membership particulars.

In addition to paragraph 1.6 above, we may process Special Categories of Personal Data in limited circumstances where you have provided such Special Categories of Personal Data including health/medical information (e.g. allergies, disabilities, dietary requirements) so that we can provide our services safely to you (e.g. spa treatments and meals).

2

How we use Personal Data

1. To administer your reservations ► to process your reservation requests, which may be made via our website, mobile application, our Global Customer Service Centre (GCSC) or our third party service providers’ website and to confirm your booking. We may send a confirmation of your booking via email, SMS or other means and in the case of room reservations, a pre-arrival message summarising your confirmation details and preferences. In respect of hotel-related services, such pre-arrival message will include other information about the hotel, the area and the weather.
   Use justification: contract performance, legitimate interests (to enable us to perform our obligations and provide services to you);
2. To provide you with services ► to provide and charge for (i) hotel related services, including but not limited to accommodation, food and beverages and spa treatment, and to facilitate any special requests or assistance that you have asked for, and (ii) non-hotel services including residential club, tenant leasing and transport services.
   Use justification: contract performance, legitimate interests (to enable us to perform our obligations and provide services to you);
3. To complete your purchase ► to deliver your orders when you purchase a Peninsula gift certificate or merchandise.
   Use justification: contract performance, legitimate interests (to enable us to perform our obligations and provide services and products to you);
4. To customize our services and products to you ► to assure your future comfort and attention to your individual needs, we collect and store specific information about you, such as your food and beverage preferences and other special requests. For example, if you are a repeat guest at our hotels or restaurants or have filled out our food and beverage questionnaire, we may store your Personal Data in our system to serve you better upon your return.
   Use justification: legitimate interests (to allow us to provide customized services and products to you);
5. To provide marketing materials to you ► to provide you with updates, offers, and subscriptions where you have chosen to receive these, or connected with us via social media platforms, such as WeChat. With your consent, we may send you information about The Peninsula Hotels, the Peak Tram, and restaurants and residential clubs operated by our group companies, including news, offers and promotions about our hotels and arcades, food and beverage, spa, merchandise, branded residences, touristic services and special events by us or our arcade partners by post, e-mail, telephone, SMS. You may also see these offers, promotions and information on social media platforms through which you have connected with us. Please note that this is subject to the terms and conditions of use of the relevant social media platform. It is however our intention to only send you communications that you may want to receive. When you opt-in to receiving promotional material either on a guest registration card or when you enrol in My Peninsula, or patronise our restaurants or sign up on our websites and provide your details to us specifically and expressly in order to receive marketing communications specified above, we will periodically contact you via your preferred channel(s). We typically use third party e-mail service providers to send e-mails. These service providers are contractually prohibited from using your e-mail address for any purpose other than to send e-mails related to the HSH Group operations and any organised special events. Personal Data will not be shared with third parties for their own marketing purposes. We provide you with the ability to unsubscribe from all marketing communications. Every time you receive an e-mail, you will be provided with the choice to opt-out of future e-mails by following the instructions provided in the e-mail. You may also opt-out of receiving promotional materials by updating your My Peninsula account, or contacting us as set out in Section 7 below.
   Use justification: consent (which can be withdrawn at any time – please see paragraph 5.1 below);
6. For analytics and profiling ► to tailor our marketing to you. In connection with our marketing activities, we analyse information that we collect about customers to determine what offers are most likely to be of interest to different categories of customers in different circumstances and at different times. To do this for hotel-related services, we combine Personal Data that we have collected about a customer from a Peninsula Hotel with Personal Data that we have collected from the same customer from another Peninsula Hotel. Such Personal Data include customer behavioural information such as transaction history, spending pattern, preferences, service requests and interactions with us. From time to time, we will assess the Personal Data that we hold about you. in order to tailor our marketing communications to include offers and content that are relevant to you. We may also use this method to avoid sending you offers that are inappropriate or unlikely to be of interest to you. You have the right to opt-out of such analysis of your Personal Data at any time. You can exercise this right by contacting us as set out in section 7 below.
   Use justification: consent (which can be withdrawn at any time – please see section 5.1 below); legitimate interests (to enable us to tailor our marketing to you);
7. To comply with our legal obligations and defend our legal rights ► to comply with our legal obligations such as financial reporting requirements imposed by our auditors and government authorities, to safeguard our legal rights including (without limitation) in relation to the defence of any claims, and to cooperate with law enforcement agencies, government authorities, regulators and/or the court in connection with proceedings or investigations anywhere in the world where we are compelled to do so.
   Use justification: legal obligation, legal claims, legitimate interests (to cooperate with law enforcement and regulatory authorities);
8. To handle incidents and process any claims we receive ► to handle any accidents and incidents such as liaising with emergency services, and to handle any claims made by customers such as personal injury claims. Please note that this may also require the processing of Special Categories of Personal Data – please see section 1.6 for further information about this.
   Use justification: vital interest (in relation to Special Categories of Persona Data), legal claims, legitimate interests (to ensure that incidents and accidents are handled appropriately and to allow us to assist our customers);
9. To improve our services and products ► to assist in developing new services and products and to improve our existing services and products.
   Use justification: legitimate interests (to allow us to continuously improve and develop our services);
10. To ensure our website and mobile application function correctly ► to ensure that content from our website and mobile applications is presented in the most effective manner for you and for your computer.
    Use justification: contract performance, legitimate interests (to allow us to provide you with the content and services on the Website); and
11. In connection with any reorganisation of our business ► To analyse, or enable the analysis of, any proposed sale or reorganisation of our business.
    Use justification: contract performance, legitimate interests (to allow us to continue providing services to you).

In respect of hotel-related services only

1. To register you as a user ► to create your My Peninsula account. You can set up, review or update your My Peninsula information (including your Personal Data) online upon completing an online room reservation.
   Use justification: contract performance, legitimate interests (to allow us to on-board you as a user);

3

How we share Personal Data

1. Third party service providers who process Personal Data on our behalf to help us undertake the activities described in section 2 ► We may permit selected third parties such as service providers, agents, contractors, entities which may be the hotel owner, and other HSH Group companies to use your Personal Data for the purposes set out in section 2, including mail houses and e-mail service providers that we engage to send and disseminate promotional materials for the HSH Group, data centre providers that host our servers and third party agents that process mailing, online bookings and purchases of gift cards on our behalf. These parties are contractually prohibited from using Personal Data for any purpose other than for the purpose specified in their respective contracts, and will be subject to obligations to process Personal Data in compliance with the same safeguards that we deploy. We do not permit the sale of Personal Data to entities outside of the HSH Group for any use unrelated to our group operations or use of Personal Data by third parties for their own purposes.
   Use justification: contract performance, legitimate interests (to allow us to effectively providing services to you and to run and manage our business);
2. Law enforcement agencies, government authorities, regulators and the court in order to comply with our legal obligations or to handle incidents/ claims ► We may disclose your Personal Data when required by relevant law or court order, or as requested by other government or law enforcement authorities to assist with proceedings or investigations. Where permitted, we will direct any such request to you or notify you before responding unless to do so would prejudice the prevention or detection of a crime. This also applies when we have reason to believe that disclosing the Personal Data is necessary to obtain legal advice, to identify, investigate, protect, contact, or bring legal action against someone who may be causing interference with our guests, visitors, associates, rights or properties, or to others, whether intentionally or otherwise, or when anyone else could be harmed by such activities.
   Use justification: legal obligation, legal claims, legitimate interests (to cooperate with law enforcement and regulatory authorities); and
3. Third parties who require such data in connection with a change in the structure of our business ► In the event that we (or a part thereof) are (i) subject to negotiations for the sale of our business or (ii) sold to a third party or (iii) undergo a reorganisation, you agree that any of your Personal Data which we hold may be transferred to that re-organised entity or third party and used for the same purposes as set out in this Privacy Policy, or for the purpose of analysing any proposed sale or re-organisation. We will ensure that no more of your Personal Data is transferred than is necessary.
   Use justification: contract performance, legitimate interests (to allow us to run and manage our business).

Use justifications

We note the grounds we use to justify each use of your Personal Data next to the use in the How we use Personal Data and How we share Personal Data sections of this Privacy Policy.

These are the principal legal grounds that justify our use of your Personal Data:

These are the principal legal grounds that justify our use of your Special Categories of Personal Data:

4

How we transmit, protect and store Personal Data

5

Your rights

1. Access: you can ask us to provide you with further details on the use we make of your Personal Data and a copy of the Personal Data we hold about you;
2. Correction: you can ask us to correct any inaccuracies in the Personal Data we hold about you;
3. Complaint: if you are not satisfied with our use of your Personal Data or our response to any exercise of these rights, you have the right to complain to the data protection authority in your country;
4. Erasure: you can ask us to delete your Personal Data if we no longer have a lawful ground for use;
5. Withdrawal of consent: where processing is based on consent (e.g. marketing, or certain uses of Special Categories of Personal Data), you can withdraw your consent to processing and we will stop that particular processing;
6. Object to processing: you have the right to object to other types of processing (e.g. analytics and profiling activities carried out in relation to your Personal Data), unless our reasons for undertaking that processing outweigh any prejudice to your data protection rights;
7. Restriction: you can restrict how we use your Personal Data pending any investigation, for example whilst we are verifying the accuracy of your Personal Data or where we are verifying the grounds that we use as the basis of holding your Personal Data;
8. Portability: where technically feasible, you have the right to ask us to transmit the Personal Data that you have provided to us to a third party in a structured, commonly used and machine readable form.

6

California and Nevada privacy rights

6.4.1 The Peninsula Beverly Hills: +1 800 462 7899
6.4.2 The Peninsula Chicago: +1 866 288 8889
6.4.3 The Peninsula New York: +1 800 262 9467
6.4.4 Quail Lodge & Golf Club: +1 866 675 1101

7

Contacting Us

8

Cookies

9

Changes to the Privacy Policy

10

Other Sites