The Artyzen Hospitality Group Limited, of registered address at Penthouse 39/F, West Tower, Shun Tak Centre, 200 Connaught Road Central, Hong Kong, (“Artyzen”) is committed to safeguarding your Personal Data. Please read the following policy to understand how any Personal Data that you provide to us will be Processed and protected.
This Policy forms an integral part of the terms and conditions governing your relationship with us (“Terms and Conditions”) and should be read in conjunction with those Terms and Conditions.
In this Policy we use a number of terms (such as “Personal Data” or “Data Controller”), paragraph 11.1 of this Policy contains an overview of these defined terms.
1. What Personal Data do we collect from you?
1.1 We receive and store information about you which you provide to us, or which we collect from our websites when you make a reservation, submit forms or enquiries to us or via other forms of interaction. This includes Personal Data and Special Categories of Personal Data. Personal Data means any information relating to an identified or identifiable natural person. Examples of Personal Data which we may collect from you include: personal information about yourself such as your name, passport/identification details, postal address, e-mail address, telephone or mobile number and credit card details. Occasionally, we may also collect Special Categories of Personal Data by processing Personal Data that provides information on person’s health (e.g. allergies or disabilities) to enable us to provide special assistance, if required. You may also be asked to provide further information including photo identification about yourself and your family members, such as the dates of your arrival and departure. In order to provide you with better service, we may also collect your preferences, e.g. smoking or non-smoking room, the preferred location of your apartment (low floor, high floor, etc.), type of bed, preferred newspaper etc. The Personal Data which we collect from you will be stored in electronic and/or in hard copy files.
2.How do we collect Personal Data?
2.1 Generally, we collect Personal Data in the following ways:
(a) when you make a reservation (which, if made online, is effected by clicking the ‘accept’ button) or submit forms relating to any of our Products and Services;
(b) when you make a reservation through our global reservation team over the phone or interact with any of our staff, for example, via telephone calls, letters, face-to-face meetings, online forms, reservation chat, social media platforms and emails;
(c) when you use some of our services, for example, websites and apps;
(d) when you request that we contact you to be included in an email or other mailing list;
(e) when you respond to our promotions (provided to you in accordance with your prior consent and with applicable laws), initiatives or to any request for additional Personal Data;
(f) when you are contacted by (in accordance with the consent provided by you and/or in accordance with applicable laws), and respond to, our marketing representatives;
(g) when we receive references or reservations from our business partners, online travel agents and third parties, for example, where you have been referred by them;
(h) when we seek information from third parties about you in connection with the Products and Services you have applied for; and
(i) when you submit your Personal Data to us for any other reasons.
2.2 When you browse our websites, you generally do so anonymously but please see our policy on cookies.
2.3 If you provide us with any Personal Data relating to a third party (e.g. information of your spouse, children, parents, and/or employees), by submitting such information to us (whether by yourself or through the third party directly and whether on the same day as your registration date at our property or otherwise), you represent to us that you have obtained the consent of the third party to provide us with their Personal Data for the respective purposes set forth in this Policy. It is your sole responsibility to ensure that such third parties are duly informed of the conditions under which their data may be Processed in accordance with this Policy and that you have authority to provide such information to Artyzen.
2.4 You should ensure that all Personal Data submitted to us is complete, accurate, true and correct. In the event your Personal Data becomes inaccurate because of modifications, it is your responsibility to update your information with Artyzen. Failure on your part to do so may result in our inability to provide you with the Products and Services you have requested.
3.What legal basis do we have for Processing your Personal Data?
3.1 Artyzen only Processes your Personal Data for legitimate purposes. The use of your Personal Data will also be justified on the basis of one or more legal “Processing grounds”.
3.2 The table below contains an explanation of the scope of the various legal Processing grounds for Processing of Personal Data on which Artyzen relies:
|(i) Contract performance: where Artyzen requires your Personal Data in order to enter into a contract with you, for example when you use one of our services.|
|(ii) Legitimate interests: where Artyzen uses your Personal Data to achieve a legitimate interest and our reasons for using it outweigh any prejudice to your data protection rights.|
|(iii) Legal claims: where your Personal Data is necessary for Artyzen to defend, prosecute or make a claim against you, us or a third party.|
|(iv) Our legal obligations and rights: where we are required to Process your Personal Data under a statutory obligation, for example to retain certain transaction data to comply with tax legislation.|
|(v) Consent: where you have consented to our use of your Personal Data (in which case you will have been presented with a consent form in relation to any such use and you may withdraw your consent at any time by the method explained in Section 9.|
3.3 Generally, Artyzen Processes Personal Data on the basis that it is necessary to do so in connection with the performance of our contractual relationship with you, e.g. to provide you with our Products and Services.
3.4 Artyzen may also Process Personal Data when we have a legitimate interest to do so and provided specific conditions are met, for example for marketing purposes and other business interests. Where we rely on this legal Processing ground, we will mitigate the effect(s) this may have on your privacy by appropriately minimising our use and putting in place adequate access and security safeguards to prevent unauthorised use.
3.5 Artyzen may Process copies of ID’s (such as a copy of your passport) where required under applicable law.
3.6 When we rely on consent, you always have the option of not providing the Personal Data requested, or of withdrawing your consent to any or all use of your Personal Data (see Section 9), although please note that we may be legally permitted or required to continue to Process your Personal Data in certain circumstances in accordance with applicable law even if you withdraw your consent. However, depending on the nature of your request and the Personal Data concerned (for example, if you do not provide us with mandatory information), we may not be able to Process your reservation, registration or request, or continue providing you with the Products and Services requested or administer any contractual relationship which may be in place.
4. What legal basis do we have for Processing your Special Categories of Personal Data?
4.1 Where we process health/medical information in an emergency situation, we may do so on the basis that we are protecting your vital interests or the vital interests of others. In specific, limited circumstances where we cannot rely on an alternative legal basis to justify the processing activities we will rely on your explicit consent for the collection, processing and disclosure of health/medical information. Where we do so, you are free to withdraw your consent at any time by contacting us (please see Section 9 below). Where you withdraw your consent or decide not to give consent we may not always be able to provide a service to you that requires the use of such data for its enablement (e.g. providing a special room suitable for guests with disabilities).
5.What are the purposes for which we collect your Personal Data and what are our justifications of uses?
5.1 This Section 5 specifies the purpose for which we use the various categories of Personal Data we collect from you. For each use, we note the applicable legal Processing ground(s) by which we justify the relevant use of your Personal Data.
5.2 Artyzen’s primary goals in Processing your Personal Data includes providing our Products and Services (for details see paragraph 5.6), enabling Artyzen to improve our services to our clients, maintain client relationships, respond to your feedback, queries, requests and resolve complaints, customer research, and other related purposes. To the extent Artyzen stores and uses usage/traffic data of websites to establish user profiles to improve services and for marketing purposes, this will be done only with a pseudonym and Artyzen will not reconnect such data with other data. Users may object to the establishment of such user profiles (see Section 9).
Use justification: contract performance, legitimate interests (to enable us to provide and promote our Products and Services).
5.3 We may also Process your Personal Data for the purposes of managing the administrative and business operations of Artyzen and complying with internal policies and procedures, including conducting audits, preventing, detecting and investigating crime and analysing and managing commercial risks and conducting investigations relating to disputes, billing or fraud, and other related purposes.
Use justification: contract performance, legal obligations and rights, legal claims, legitimate interests (to enable us to manage our administrative and business operations and to comply with internal policies and procedures and to enable us to prevent fraud).
5.4 We may also Process your Personal Data in order to meet or comply with any applicable rules, laws, regulations, codes of practice or guidelines issued by any legal or regulatory bodies which are binding on Artyzen, to facilitate any mergers, acquisitions or asset sales and to safeguard and enforce our contractual and legal rights and obligations, and other related purposes.
Use justification: our legal obligations and rights, legal claims, legitimate interests (allowing us to change our business structure).
5.5 We may also monitor or record phone calls and customer-facing interactions for quality assurance, employee training and performance evaluation, identity verification purposes, feedback, respond to your queries and requests and resolve complaints and other related purposes. We will inform you about the recording when you call us and give you the opportunity to indicate that you do not wish for the conversation to be recorded.
Use justification: contract performance, legal obligations and rights, legitimate interests (to enable us to provide and improve our Products and Services).
5.6 In addition:
(a) If you are an individual using the Products or Services of Artyzen, or an employee of an organisation which is a customer of Artyzen, Artyzen may Process your Personal Data for the purpose of providing you with the Products and Services which you have requested, facilitating the daily operation of the Products and Services (including but not limited to billing, customer service and customer verification), enforcement of repayment obligations, credit and internal risk management. We may also analyse your use of our Products and Services so as to help us improve, review, develop and efficiently manage the Products and Services offered to you and purposes which are reasonably related to the aforesaid.
Use justification: contract performance, legitimate interests (to enable us to provide and improve our Products and Services and provide you with a personalised service).
(b) If you are an employee, officer or owner of an external service provider or vendor outsourced or prospected by Artyzen, we may Process your Personal Data for the purposes of managing project tenders or the supply of goods and services, Processing and payment of vendor invoices and purposes which are reasonably related to the aforesaid.
Use justification: contractual performance.
(c) If you submit an application to us as a candidate for an employment position, we may Process your Personal Data for the purposes of conducting interviews and assessing your suitability for the position applied for, Processing your application which includes pre-recruitment checks and background screening, providing or obtaining employee references, Processing staff referrals and any other purposes relating to any of the above.
Use justification: contract performance, legitimate interests (to assess whether you are a suitable candidate for our organisation).
5.7 Like most businesses, marketing is important to our business' success. We may therefore, from time to time, send you marketing and promotional material in relation to Products and Services (including but not limited to our newsletter) or products and services of our marketing partners which we believe may be of interest to you, subject to the consent provided by you, whether you are a current or prospective customer. We may also Process your Personal Data for the following “Artyzen Additional Purposes”:
5.8 If you are receiving promotional information from us or your Personal Data is otherwise being used for Artyzen Additional Purposes and you no longer wish to receive suchinformation, or to have your Personal Data used or disclosed for these Artyzen Additional Purposes, please see Section 9 for more information.
5.9 If you have provided us with your telephone number(s) and have indicated your consent to receiving marketing or promotional information via your telephone number(s), then from time to time, Artyzen may contact you using such telephone number(s) (including via voice calls, text, fax or other means) with information about our Products and Services.
5.10 In relation to particular Products and Services or in your interactions with us, we may also have specifically notified you of other purposes for which we Process your Personal Data. If so, we will Process your Personal Data for these additional purposes as well, always in accordance with applicable law, unless we have specifically notified you otherwise.
6.Disclosure of Personal Data
6.1 Artyzen has implemented appropriate technical and organisational measures to protect your Personal Data against unauthorised access, modification, alteration, distortion, damage or disclosure. These safeguards will vary depending on sensitivity, format, location, amount, distribution and storage of the Personal Data. These safeguards are continually updated and maintained by qualified information security professionals. In carrying out our business, it may be necessary to share information about you with and between Data Processors that are our related corporations and third party service providers (please see paragraph 6.2). Some of these related corporations and third party service providers may be located in places outside your place of residence and may not afford an adequate protection to Personal Data or have protections in place which are similar to those in your place of residence. However, Artyzen will take reasonable steps to ensure that your Personal Data transmitted outside of your place of residence takes place in accordance with data protection legislation and that there will be an appropriate level of protection.
6.2 Subject to the provisions of any applicable law, your Personal Data may be disclosed, for the purposes listed above (where applicable), to Data Processors (whether inside or outside the country in which your Personal Data was originally collected), who will each be responsible for keeping your Personal Data confidential (subject to any applicable laws or regulations or orders issued by a court or regulatory authority of competent jurisdiction). Where Artyzen discloses Personal Data or Criminal Personal Data in response to requests from regulators and law enforcement agencies, these regulators and law enforcement or security agencies will be acting as a Data Controller. Occasionally Artyzen will also disclose your Personal Data to third parties acting as a Data Controller, for example in the context of a business re-structuring. Artyzen will always assess the legitimacy of such disclosures before disclosing any Personal Data and/or Criminal Personal Data and only disclose the data required with the request.
6.3 We may disclose your Personal Data to the following (categories of) recipients:
(a) Artyzen’s related corporations, affiliates and third parties to provide Products and Services to you, address your questions and requests in relation to your billing arrangements with us as well as our Products and Services, to maintain and operate our systems and/or services;
(b) companies providing services relating to insurance and consultancy to Artyzen;
(c) agents, contractors or third party service providers who provide operational services to Artyzen, such as courier services, telecommunications, information technology, payment, printing, billing, payroll, Processing, technical services, training, market research, call centre, security or other services to Artyzen;
(d) vendors or third party service providers in connection with marketing promotions and services offered by Artyzen, subject to and in accordance with the prior express consent provided by you;
(e) any investor, assignee or transferee (actual or prospective) to facilitate business asset transactions (which may extend to any merger, acquisition or asset sale) involving any of our group companies;
(f) collection and repossession agencies in relation to the enforcement of repayment obligations for debts;
(g) external banks, credit card companies and their respective service providers for the purposes of Processing payments made by or to you;
(h) our professional advisers such as auditors and lawyers;
(i) relevant government regulators, statutory boards or authorities or law enforcement agencies to comply with any laws, rules, guidelines and regulations or schemes imposed by any governmental authority; and
(j) any other party to whom you authorise us to disclose your Personal Data to.
For avoidance of doubt, reference to any organizations or entities in this Section 6 means reference to the organizations or entities and their representatives, employees, agents and advisors.
7.Term of retention of your Personal Data
7.1 Our retention periods for Personal Data are based on business needs and legal requirements. We will retain your Personal Data for a term which shall not exceed the time strictly necessary for the purposes for which the Personal Data was collected, and any other permissible, related purpose.
9.Your rights - Contacting Us
9.1 You have certain rights in relation to your Personal Data. Please be aware that certain exceptions apply to the exercise of these rights and so you may not be able to exercise these in all situations (please see below):
9.2 In addition, under certain conditions, you have the right to:
Should you object to the Processing of your Personal Data, you understand that we may not be able to provide you with the Products and Services.
These rights are subject to certain exceptions to safeguard the public interest (e.g., the prevention or detection of crime) and our interests (e.g., the maintenance of legal privilege). We will respond to most request within one month.
9.3 If you:
(a) have any questions, privacy concerns or feedback relating to your Personal Data or our Policy; or
(b) would like to exercise any of the rights set out in paragraph 9.1 or 9.2;
|please contact Artyzen as follows:|
|Write in: Data protection officer|
|Penthouse 39/F, West Tower, Shun Tak Centre, 200 Connaught Road Central, Hong Kong (when writing in, please enclose your full name and your email address so that we can identify you, where appropriate we will ask for additional information to identify you).|
(c) wish to unsubscribe from our mailing list, you may contact us at www.artyzen.com/contact. If submitting a formal request to unsubscribe from our mailing list through email, please include “Unsubscribe” in the subject title of your email.
9.4 Please note that if your Personal Data has been provided to us by a third party (e.g. a referrer, or your company), you should contact that organisation or individual to make such queries, complaints, and access and correction requests to Artyzen on your behalf.
10.Notices and revision
10.1 Artyzen may from time to time modify, update / change or amend this Policy to ensure that this Policy is consistent with our future developments, industry trends and/or any changes in legal or regulatory requirements. Subject to your rights at law, you agree to be bound by the prevailing terms of the Policy as updated from time to time on our websites. Please check back regularly for updated information on the handling of your Personal Data. If we make any material changes in the way we collect, use, and/or share your Personal Data, we will notify you by posting notice of the changes on our websites.
10.2 In the event of any inconsistencies between the English version and other translations of this Policy, the English version shall prevail.
11.Some Legal Terms
11.1 Under the applicable privacy legislation, the below terms have a defined meaning as set out in the table below:
|Criminal Personal Data||Any Personal Data that provides information on persons’ criminal confictions or offences.|
|Data Controller||The legal person, administrative body or any other entity which, alone or in conjunction with others, determines the purpose of and means for Processing of Personal Data.|
|Data Processor||The legal person, administrative body or any other entity which, alone or in conjunction with others, determines the purpose of and means for Processing of Personal Data.|
|Personal Data||Any information relating to an identified or identifiable natural person (e.g. a person whose identity can be established reasonably without disproportionate effort by means of name, address and date of birth). By way of example but not limitation, video and voice recording is also Personal Data if the video image or the voice recording is identifiable to a natural person.|
|Products and Services||Any products and services we provide to you, without limitation, providing accommodations in our hotels.|
|Processing, processed, process||Any operation or set of operations concerning Personal Data, including in any case the collection, recording, organisation, storage, updating or modification, retrieval, consultation, use, dissemination by means of transmission, distribution or making available in any other form, merging, linking, as well as blocking, erasure or destruction of Personal Data.|
|Special Categories of Personal Data||Any Personal Data that provides information on persons’ religious or philosophical beliefs, race, political opinions, health, sexual life or membership of trade unions.|