Data Privacy and Security Policy | The Peninsula Hotels
DATA PRIVACY & SECURITY POLICY (Mainland China)
You can find a Peninsula Hotel and/or restaurants or other goods and services operated and provided by the HSH Group from the following websites online: www.peninsula.com, zbarchicago.com, www.peninsulalondonproject.co.uk, www.peninsularesidences.london, www.hshgroup.com, www.quaillodge.com, signatureevents.peninsula.com, www.therepulsebay.com, www.thepeak.com.hk, www.thelandmarkvietnam.com, www.thaicountryclub.com and www.peninsulaboutique.com,
or from a web-enabled mobile device.
The websites are not intended for children and minors and we do not knowingly solicit or collect Personal Data from children and minors. As a parent or legal guardian, please do not allow your children to submit Personal Data without your permission.
The term “Personal Data” refers to any personal data that can be used to identify you as an individual. We may collect and process your Personal Data for the following purpose.
1.1 Hotel related services
(a) Registration of My Peninsula account ► When you make a hotel room reservation online, you can enrol for a My Peninsula account by providing us with your title, name, email address and password.
(b) Hotel room reservation ► you can process your reservation requests via our website, mobile application, our Global Customer Service Centre (GCSC) or our third party service providers’ website. You must provide us with your basic information, including your title, name, email address, mobile number and country/city of residence. You are also required to give us your credit card information, including cardholder name, credit card type, card number and expiration date. You may also provide us with your personalised information, such as flight number, arrival and departure date and time, airport transport service, frequent flyer information, your travel partner information, room preferences, requirements relating to your dietary, spa treatment and internet access. We may also need to collect information as required by local laws such as passport numbers, type of entry visa, and driver’s licence; We may send a confirmation of your booking via email, SMS or other means and in the case of room reservations, a pre-arrival message summarising your confirmation details and preferences. In respect of hotel-related services, such pre-arrival message will include other information about the hotel, the area and the weather.
(c) To provide you with services ► to provide and charge for hotel related services, including but not limited to accommodation, food and beverage and spa treatment, and to facilitate any special requests or assistance that you have asked for, we will collect your Personal Data including, among others,
(i) Check-in: you are required to fill in the guest registration card when checking-in and provide us with your name, title, nationality, passport number, room preference and request. You may also provide us with information including your date of birth, address, payment method (credit card number and expiration date), arrival time, departure time, room type, number of guests, deposit, room rate and room number.
(ii) Spa treatment services: to enable us to provide you with spa treatment services, you are required to fill in a consultation form with your name and may also give us your health related information.
(iii) Food and beverage services: to provide you with better food and beverage services, you may fill in our food and beverage questionnaire which requires you to provide information including your name, telephone number, date of birth and email address.
We collect your itemised spending to properly assemble your folio during your stay at our hotel, which includes your room rate and other expenses billed to your room.
(d) To complete your purchase ► we may collect your name, telephone number, email address, residential and/or delivery addresses to deliver your orders when you purchase a Peninsula gift certificate or merchandise.
(e) To customise our services and products to you ► to assure your future comfort and attention to your individual needs, we collect and store specific information about you, such as your food and beverage preferences and other special requests. For example, if you are a repeat guest at our hotels or restaurants or have filled out our food and beverage questionnaire, we may store your Personal Data in our system to serve you better upon your return.
1.2 Residences and commercial leasing, operation of residential clubs and food and beverage outlets, and transport
(a) To provide you with services ► to complete transaction and provide you with service, we may collect information such as identity card and passport details, tenancy particulars, employment particulars and club membership particulars.
(a) Customer services ► if you contact us such as when you make enquiries, we may keep a record of that correspondence, including your telephone number or email address.
(b) To follow our WeChat official account ► when you follow our WeChat official account and use our services provided, we may collect your WeChat nickname, profile picture, basic information, your visiting and purchase record in our official account.
(c) For survey and research purpose to improve our services and products ► to facilitate the research of new services and products, as well as improve our existing services and products, we may also ask you to complete surveys that we use for research purpose. In such circumstances we shall collect the information provided in the completed survey.
(d) To provide marketing materials to you ► to provide you with updates, offers, and subscriptions where you have chosen to receive these, or connected with us via social media platforms, such as WeChat. With your consent, we shall send you information about The Peninsula Hotels, the Peak Tram, and restaurants and residential clubs operated by our group companies, including news, offers and promotions about our hotels and arcades, food and beverage, spa treatments, merchandise, branded residences, touristic services and special events by us or our arcade partners by post, email, telephone, SMS. You may also see these offers, promotions and information on social media platforms through which you have connected with us. Please note that this is subject to the terms and conditions of use of the relevant social media platform. It is however our intention to only send you communications that you may want to receive. When you opt-in to receiving promotional material either on a guest registration card or when you enrol in My Peninsula, or patronise our restaurants or sign up on our websites and provide your details to us specifically and expressly in order to receive marketing communications specified above, we will periodically contact you via your preferred channel(s). We typically use third party email service providers to send emails. These service providers are contractually prohibited from using your email address for any purpose other than to send emails related to the HSH Group operations and any organised special events. Personal Data will not be shared with third parties for their own marketing purposes. We provide you with the ability to unsubscribe from all marketing communications. Every time you receive an email, you will be provided with the choice to opt-out of future emails by following the instructions provided in the email. You may also opt-out of receiving promotional materials by updating your My Peninsula account, or contacting us as set out in Section 6 below.
(e) For analytics and profiling to tailor our marketing to you ► in connection with our marketing activities, we analyse information that we collect about customers to determine what offers are most likely to be of interest to different categories of customers in different circumstances and at different times. To do this for hotel-related services, we combine Personal Data that we have collected about a customer from a Peninsula Hotel with Personal Data that we have collected from the same customer from another Peninsula Hotel. Such Personal Data include customer behavioural information such as transaction history, spending pattern, preferences, service requests and interactions with us. From time to time, we will assess the Personal Data that we hold about you. in order to tailor our marketing communications to include offers and content that are relevant to you. We may also use this method to avoid sending you offers that are inappropriate or unlikely to be of interest to you. You have the right to opt-out of such analysis of your Personal Data at any time. You can exercise this right by contacting us as set out in section 6 below.
(f) To handle incidents and process any claims we receive ► to handle any accidents and incidents such as liaising with emergency services, and to handle any claims made by customers such as personal injury claims, please note that this may also require the processing of your health/medical information.
1.4 We do not collect Personal Data when you apply for a Peninsula/American Express credit card. If you apply for a Peninsula/American Express credit card, you will be required to provide certain personal information as part of the credit card application process. We do not own any of the personal information supplied to American Express group of companies in connection with the Peninsula/American Express credit card application process. You can refer to American Express’ privacy statement posted on their website to understand how the information you supply will be used. American Express is the issuer of the credit card, and all terms and conditions of being a cardholder are dictated by American Express.
1.5 We may collect your Personal Data from you directly. We may also collect Personal Data from third parties including agents and online service providers that make hotel, spa or restaurant reservations on your behalf, facilitate online payment or gift purchase or that are otherwise involved in the reservations process or delivering our services to you.
1.7 “Sensitive Personal Data” are a subset of Personal Data, which may result in bodily injury, property damage, reputation damage, deterioration of physical and mental health, or discriminatory treatment if such data were to be disclosed or misused for illegal reasons. Sensitive Personal Data may include your identity card number, biometric data, bank account number, communication record and content, financial information, credit information, tracking activities, accommodation information, health information, transaction information, Personal Data of children under the age of 14, etc. We will process such Sensitive Personal Data, where necessary, only if you have given us explicit consent for the collection, processing and disclosure of the Sensitive Personal Data as set out above.
1.8 In relation to “Special Categories of Personal Data” (which is defined as Personal Data relating to your health, political opinions, religious beliefs, ethnicity and race, sex life, trade union membership and in some cases, criminal activity), we do not, as a general rule, process such Personal Data. We may however process health or medical information in order to handle medical incidents and/or claims as per paragraph 1.3(f) above. Where we process Special Categories of Personal Data to handle medical incidents, we do so in order to protect the vital interests of you or another person. Where we process Special Categories of Personal Data to handle claims, we do so on the basis of establishing, exercising or defending legal claims or whenever courts are acting in their judicial capacity. In addition to this, we may process Special Categories of Personal Data in limited circumstances where you have provided such Special Categories of Personal Data (e.g. allergies, disabilities, dietary requirements), so that we can provide our services safely to you, for instance in relation to spa treatments and meals.
1.9 Where we must process Special Categories of Personal Data mentioned in paragraph 1.8 above, we will only do so where you have given us explicit consent for the collection, processing and disclosure of the Special Categories of Personal Data. Where you are providing Special Categories of Personal Data about a travel partner, you agree that you have procured their consent to our collection, processing and disclosure of their Special Categories of Personal Data.
2.2 Do-not-track (DNT): Because there is not yet a consensus on how companies should respond to web browser-based DNT mechanisms, we do not respond to web browser-based DNT signals at this time.
3.1 We may share your Personal Data in the following ways.
(a) Third party service providers who process Personal Data on our behalf to help us undertake the activities described in section 1 ► We may permit selected third parties such as service providers, agents, contractors, entities which may be the hotel owner, and other HSH Group companies to use your Personal Data for the purposes set out in section 1, including mail houses and email service providers that we engage to send and disseminate promotional materials for the HSH Group, data centre providers that host our servers and third party agents that process mailing, online bookings and purchases of gift cards on our behalf. These parties are contractually prohibited from using Personal Data for any purpose other than for the purpose specified in their respective contracts, and will be subject to obligations to process Personal Data in compliance with the same safeguards that we deploy. We do not permit the sale of Personal Data to entities outside of the HSH Group for any use unrelated to our group operations or use of Personal Data by third parties for their own purposes.
(b) Law enforcement agencies, government authorities, regulators and the court in order to comply with our legal obligations or to handle incidents/claims► We may disclose your Personal Data when required by relevant law or court order, or as requested by other government or law enforcement authorities to assist with proceedings or investigations. Where permitted, we will direct any such request to you or notify you before responding unless to do so would prejudice the prevention or detection of a crime. This also applies when we have reason to believe that disclosing the Personal Data is necessary to obtain legal advice, to identify, investigate, protect, contact, or bring legal action against someone who may be causing interference with our guests, visitors, associates, rights or properties, or to others, whether intentionally or otherwise, or when anyone else could be harmed by such activities.
4.1 Security of communications ► It is important to note that no security system or system of transmitting information over the Internet is guaranteed to be secure. There is a risk inherent in the submission of information online, use of email and facsimile. Please be aware of this when requesting information or sending forms to us online or by email or facsimile, for example, from the “Contacting Us” section. We recommend that you do not include any sensitive information including credit card details when submitting information online, using email, facsimile or when using any public computers/public WIFI.
4.2 Security controls ► We maintain administrative, technical and physical safeguards designed to protect the personal data we maintain against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. Despite such efforts, however, please note that no company can fully eliminate risks or guarantee the security of personal information. Unauthorised entry or use, hardware or software failure, and other factors may compromise the security of information about you at any time, and we bear no liability for uses or disclosures of personal information or other data arising in connection with theft of the information or other malicious actions.
4.3 We store certain customer information and reservation details in our Customer Information System and Reservation System on our subcontractor’s secure servers. Our server resides behind firewalls to protect Personal Data collected from you against unauthorised or accidental access. Because laws applicable to personal information vary by country, our hotels or other business operations may put in place additional measures that vary depending on the applicable legal requirements.
*Currently, guest data may be transferred to our headquarters in Hong Kong as well as other countries where we are present, including China, Japan, Vietnam, United Kingdom, United States of America, Thailand, the Philippines and France. We also use third party service providers which are located in countries such as United States of America and Australia to process mailing, certain online bookings and purchases of gift cards.
4.5 Your Personal Data will be stored for the period of time required or permitted by law in the jurisdiction of the operation holding the information (for example, certain transaction details and correspondence may be retained until the time limit for claims in respect of the transaction has expired or in order to comply with regulatory requirements regarding the retention of such data). So if information is used for two or more purposes we will retain it until the purpose with the latest period expires, but we will stop using it for the purpose with a shorter period once that period expires.
4.6 Our retention periods are based on business needs and your Personal Data that is no longer needed is either irreversibly anonymised (and the anonymised information may be retained) or securely destroyed.
5.1 Opt-out of marketing: You have the right to ask us not to process your Personal Data for marketing purposes at any time. You can exercise your right by checking certain boxes online or on the data collection forms, talking to us in person, or by contacting us as set out in section 6 below.
5.2 Subject to various exceptions and data protection laws in your country, you may have the following rights. We will process your request within a reasonable period in accordance with the applicable data protection laws.
(a) Access: you can ask us to provide you with further details on the use we make of your Personal Data and a copy of the Personal Data we hold about you;
(b) Correction: you can ask us to correct any inaccuracies in the Personal Data we hold about you;
(c) Complaint: if you are not satisfied with our use of your Personal Data or our response to any exercise of these rights, you have the right to complain to the data protection authority in your country;
(d) Erasure: you can ask us to delete your Personal Data if we no longer have a lawful ground for use;
(e) Withdrawal of consent: where processing is based on consent (e.g. marketing, or certain uses of Special Categories of Personal Data), you can withdraw your consent to processing and we will stop that particular processing;
(f) Object to processing: you have the right to object to other types of processing (e.g. analytics and profiling activities carried out in relation to your Personal Data), unless our reasons for undertaking that processing outweigh any prejudice to your data protection rights;
(g) Restriction: you can restrict how we use your Personal Data pending any investigation, for example whilst we are verifying the accuracy of your Personal Data or where we are verifying the grounds that we use as the basis of holding your Personal Data;
(h) Portability: where technically feasible, you have the right to ask us to transmit the Personal Data that you have provided to us to a third party in a structured, commonly used and machine readable form.
(i) Removal of account: you can at any time request for removal of your registered account. Once we receive your request, we will erase your My Peninsula account as soon as practicable.
Data Privacy Team
The Hongkong and Shanghai Hotels, Limited
8/F St George’s Building
2 Ice House Street
Fax: +852 2147 3720
8.1 The website or mobile application may contain links to other third party websites. If you follow a link to any of those third party websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for their policies or processing of your personal information. Please check these policies before you submit any personal information to such third party websites.
9.1 Our careers websites at www.peninsula.com and www.hshgroup.com allow individuals that wish to be considered for potential employment to attach their curriculum vitae for consideration. We will not use the information you provide for any purpose other than to determine your qualifications for potential employment at the HSH Group.
24 June 2019
Data Privacy Team
If after reviewing this privacy statement you have any privacy questions or concerns or would like to request access to, correction or object to the processing of your data for legitimate purposes, please contact our Data Privacy Team.
Data Privacy Team
The Hongkong and Shanghai Hotels, Limited
8/F, St George's Building
2 Ice House Street
Central, Hong Kong
+852 2147 3720
PLEASE ALLOW 20 BUSINESS DAYS
FOR US TO PROCESS ANY
CORRECTION OF DATA