Artyzen Hospitality Group Limited, of registered address at Penthouse 39/F, West Tower, Shun Tak Centre, 200 Connaught Road Central, Hong Kong, (“Artyzen”) is committed to safeguarding your Personal Data. Please read the following policy to understand how any Personal Data that you provide to us will be Processed and protected.
This Policy forms an integral part of the terms and conditions governing your relationship with us (“Terms and Conditions”) and should be read in conjunction with those Terms and Conditions.
In this Policy we use a number of terms (such as “Personal Data”, or “Data Processor”), and paragraph 11.1 of this Policy contains an overview of these defined terms.
1. What Personal Data do we collect from you?
1.1 We receive and store information about you which you provide to us, or which we collect from our website when you make a reservation, submit forms or enquiries to us or via other forms of interaction. This includes Personal Data and Sensitive Personal Data. Personal Data means any information relating to an identified or identifiable natural person. Examples of Personal Data which we may collect from you include personal information about yourself such as your name, passport/identification details, postal address, e-mail address, and/or telephone or mobile number. Occasionally, we may also collect and Process Sensitive Personal Data, such as information on person’s health (e.g. allergies or disabilities) in order to enable us to provide special assistance, if required. You may also be asked to provide further information including photo identification about yourself and/or your family members, and the dates of your arrival and departure. In order to provide you with better service, we may also collect your preferences, e.g. smoking or non-smoking room, the preferred location of your apartment (low floor, high floor, etc.), type of bed, preferred newspaper etc. The Personal Data which we collect from you will be stored in electronic and/or in hard copy files.
2. How do we collect Personal Data?
2.1 Generally, we collect Personal Data in the following ways:
(a) when you make a reservation (which, if made online, is effected by clicking the ‘accept’ button) or submit forms relating to any of our Products and Services;
(b) when you make a reservation through our global reservation team over the phone or interact with our staff for a reservation, for example, via telephone calls, letters, face-to-face meetings, online forms, reservation chat, social media platforms and/or emails;
(c) when you use some of our services, for example, our website and/or apps;
(d) when you request that we contact you to be included in an email or other mailing list;
(e) when you respond to our promotions (provided to you in accordance with your prior consent and with applicable laws), initiatives or to our request for additional Personal Data;
(f) when you are contacted by (subject always to your prior consent and compliance with applicable laws), and/or respond to our marketing representatives;
(g) when we receive references or reservations from our business partners, online travel agents and/or third parties, for example, where you have been referred by them;
(h) when we seek information from third parties about you in connection with the Products and Services you have applied for; and
(i) when you submit your Personal Data to us for any other reasons.
2.3 If you provide us with any Personal Data relating to a third party (e.g. information of your spouse, children, parents, and/or employees), by submitting such information to us (whether by yourself or through the third party directly and whether on the same day as your registration date at our hotel or otherwise), you represent to us that you have obtained the consent of the third party to provide us with their Personal Data for the respective purposes set forth in this Policy. It is your sole responsibility to ensure that such third parties are duly informed of the conditions under which their Personal Data may be processed in accordance with this Policy and that you have the authority to provide such information to Artyzen.
2.4 You should ensure that all Personal Data submitted to us is complete, accurate, true and correct. In the event your Personal Data becomes incomplete, inaccurate, untrue or incorrect because of modifications, it is your responsibility to update your information with Artyzen. Failure on your part to do so may result in our inability to provide you with the Products and Services you have requested.
3. What legal basis do we have for processing your Personal Data?
3.1 Artyzen only Processes your Personal Data for legitimate purposes. The use of your Personal Data will also be justified on the basis of one or more legal “Processing grounds”.
3.2 The table below contains an explanation of the scope of various legal Processing grounds for Processing of Personal Data on which Artyzen relies:
|(i) Contract performance: where Artyzen requires your Personal Data in order to enter into a contract with you, for example when you use one of our Products or Services.|
|(ii) Legitimate interests: where Artyzen uses your Personal Data to achieve a legitimate interest and our reasons for using it outweigh any prejudice to your data protection rights.|
|(iii) Legal claims: where your Personal Data is necessary for Artyzen to defend, prosecute or make a claim against you, us or a third party.|
|(iv) Our legal obligations and rights: where we are required to Process your Personal Data under a statutory obligation, for example, to retain certain transaction data to comply with tax legislation.|
|(v) Consent: where you have consented to our use of your Personal Data (in which case you will have been presented with a consent form in relation to any such use and you may withdraw your consent at any time by the method as set out in Section 9.|
3.3 Generally, Artyzen Processes your Personal Data on the basis that it is necessary to do so in connection with the performance of our contractual relationship with you, e.g. to provide you with our Products and Services.
3.4 Artyzen may also Process Personal Data when we have a legitimate interest to do so and provided that specific conditions are met, for example for marketing purposes and other business interests. Where we rely on this legal Processing ground, we will mitigate the effect(s) it may have on your privacy by appropriately minimizing our use and putting in place adequate access and security safeguards to prevent unauthorized use of your Personal Data.
3.5 Artyzen may Process copies of your ID’s (such as a copy of your passport) where required under applicable laws.
3.6 When we rely on consent, you always have the option of not providing the Personal Data requested, or of withdrawing your consent to any or all use of your Personal Data (see Section 9), although please note that we may be legally permitted or required to continue to Process your Personal Data in certain circumstances in accordance with applicable laws even if you withdraw your consent. However, depending on the nature of your request and the Personal Data concerned (for example, if you do not provide us with requested information), we may not be able to Process your reservation, registration or request, or continue providing you with the Products and Services you have requested or administer any contractual relationship with you which may be in place.
4. What legal basis do we have for Processing your Sensitive Personal Data?
4.1 We will not Process your Sensitive Personal Data unless we have obtained a separate consent from you.
4.2 Where we process your health/medical information in an emergency situation, we may do so on the basis that we are protecting your vital interests or the vital interests of others. In specific, limited circumstances where we cannot rely on an alternative legal basis to justify the processing activities we will rely on your explicit consent for the collection, Processing and disclosure of health/medical information. Where we do so, you are free to withdraw your consent at any time by contacting us (please see Section 9 below). Where you withdraw your consent or decide not to give consent, we may not always be able to provide a service to you that requires the use of such data for its enablement (e.g. providing a special room suitable for guests with disabilities).
4.3 Our website and/or apps are not intended for children under eighteen (18) years of age. We will not collect, use or otherwise Process Personal Data of individuals who are under fourteen (14) years of age without separate consent from their parents or guardians.
5. What are the purposes for which we collect your Personal Data and what are our justifications of uses?
5.1 This Section 5 specifies the purposes for which we use various categories of Personal Data we collect from you. For each use, we note the applicable legal Processing ground(s) by which we justify the relevant use of your Personal Data.
5.2 Artyzen’s primary goals in Processing your Personal Data include providing our Products and Services (for details please see paragraph 5.6), enabling Artyzen to improve our services to our clients, maintain client relationships, respond to your feedback, queries, requests, resolve complaints, conduct customer research, and other related purposes. To the extent Artyzen stores and uses usage/traffic data of websites to establish user profiles to improve services and for marketing purposes, this will be done only with a pseudonym and Artyzen will not reconnect such data with other data. Users may object to the establishment of such user profiles (see Section 9).
Use justification: contract performance, legitimate interests (to enable us to provide and promote our Products and Services).
5.3 We may also Process your Personal Data for the purposes of managing the administrative and business operations of Artyzen and complying with internal policies and procedures, including conducting audits, preventing, detecting and investigating crime, analyzing and managing commercial risks, conducting investigations relating to disputes, billing or fraud, and other related purposes.
Use justification: contract performance, our legal obligations and rights, legal claims, legitimate interests (to enable us to manage our administrative and business operations, to comply with internal policies and procedures and to enable us to prevent crime).
5.4 We may also Process your Personal Data in order to meet or comply with any applicable laws, regulations, rules, codes of practice or guidelines issued by any legal or regulatory bodies which are binding on Artyzen, to facilitate any mergers, acquisitions or asset sales, to safeguard and enforce our contractual and legal rights and obligations, and other related purposes.
Use justification: our legal obligations and rights, legal claims, legitimate interests (allowing us to change our business structure).
5.5 We may also monitor or record phone calls and customer-facing interactions for quality assurance, employee training and performance evaluation, identity verification purposes, feedback, respond to your queries and requests and resolve complaints and other related purposes. We will inform you about the recording when you call us and give you the opportunity to indicate whether you wish for the conversation to be recorded or not.
Use justification: contract performance, our legal obligations and rights, legitimate interests (to enable us to provide and improve our Products and Services).
5.6 In addition:
(a) If you are an individual using the Products or Services of Artyzen, or an employee of an organization which is a customer of Artyzen, Artyzen may Process your Personal Data for the purpose of providing you with the Products and Services which you have requested, facilitating the daily operation of the Products and Services (including but not limited to billing, customer service and customer verification), enforcement of repayment obligations, and credit and internal risk management. We may also analyze your use of our Products and Services so as to help us improve, review, develop and efficiently manage the Products and Services offered to you and purposes which are reasonably related to the aforesaid.
Use justification: contract performance, legitimate interests (to enable us to provide and improve our Products and Services and provide you with a personalized service).
(b) If you are an employee, officer or owner of an external service provider or vendor outsourced or prospected by Artyzen, we may Process your Personal Data for the purposes of managing project tenders or the supply of goods and services, Processing and payment of vendor invoices and purposes which are reasonably related to the aforesaid.
Use justification: contractual performance.
(c) If you submit an application to us as a candidate for an employment position, we may Process your Personal Data for the purposes of conducting interviews and assessing your suitability for the position applied for, Processing your application which includes pre-recruitment checks and background screening, providing or obtaining employee references, Processing staff referrals and any other purposes relating to any of the above.
Use justification: contract performance, legitimate interests (to assess whether you are a suitable candidate for our organization).
5.7 Like most businesses, marketing is important to the success of our business. We may therefore, from time to time, send you marketing and promotional materials in relation to Products and Services (including but not limited to our newsletters) or products and services of our marketing partners which we believe may be of interest to you, subject to your express consent (whether you are our current or prospective customer). We may also Process your Personal Data for the following “Artyzen Additional Purposes”:
i. conducting market research and surveys to enable us to understand and determine customer location, preferences and demographics to develop special offers and marketing programmes in relation to Artyzen’s Products and Services;
ii. collecting and managing information of prospective customers for marketing Artyzen’s Products and Services;
iii. providing, marketing and/or offering other Products and Services and benefits to you, including promotions, loyalty and reward programmes from Artyzen;
iv. administering contests, competitions, marketing campaigns, or organizing promotional events and/or corporate social responsibility projects; and
v. purposes which are reasonably related to the aforesaid.
5.8 If you are receiving promotional information from us or your Personal Data is otherwise being used for Artyzen Additional Purposes, and you no longer wish to receive such information, or to have your Personal Data used or disclosed for these Artyzen Additional Purposes, please refer to Section 9 for more information on your rights in this regard.
5.9 If you have provided us with your telephone number(s) and have indicated your consent to receiving marketing or promotional information via your telephone number(s), then from time to time, Artyzen may contact you using such telephone number(s) (including via voice calls, text, fax or other means) with information about our Products and Services.
5.10 In relation to particular Products and Services or in your interactions with us, we may also have specifically notified you of other purposes for which we Process your Personal Data. If so, we will Process your Personal Data for these additional purposes as well, subject always to applicable laws.
6. Disclosure and Transfer of Personal Data
6.1 Artyzen has implemented appropriate technical and organizational measures to protect your Personal Data against unauthorized access, modification, alteration, distortion, damage or disclosure. These safeguards will vary depending on sensitivity, format, location, amount, distribution and storage of the Personal Data. These safeguards are continually updated and maintained by qualified information security professionals.
6.2 To facilitate the purposes mentioned under this Policy, and without prejudice to relevant laws and regulations, we may transfer and/or disclose your Personal Data to our related corporations and/or third party service providers (collectively, “Third Party Data Processor”) who will Process your Personal Data according to their own purposes and methods of Processing. These Data Processors may be located within (“Onshore Data Processor”) or outside (“Offshore Data Processor”) the country in which your Personal Data was originally collected. We will only transfer and/or disclose such Personal Data to Offshore Data Processor upon obtaining your separate consent and in accordance with all applicable data protection laws; and Artyzen will take all reasonable measures to protect your Personal Data which have been transferred and/or disclosed to Third Party Data Processor.
6.3 Where Artyzen discloses Personal Data or Criminal Personal Data in response to requests from regulators, law enforcement or security agencies, these regulators, law enforcement or security agencies will be acting as a Data Processor. Occasionally Artyzen may also disclose your Personal Data to third parties acting as a Data Processor, for example in the context of a business re-structuring. Artyzen will always assess the legitimacy of such disclosures before disclosing any Personal Data and/or Criminal Personal Data, and only disclose the data which are absolutely necessary for the aforesaid purposes.
6.4 We may disclose your Personal Data to the following (categories of) recipients:
(a) Artyzen’s related corporations, affiliates and/or third parties to provide Products and Services to you, address your questions and requests in relation to your billing arrangements with us as well as our Products and Services, to maintain and operate our systems and/or services;
(b) companies providing services relating to insurance and/or consultancy to Artyzen;
(c) agents, contractors or third-party service providers who provide operational services to Artyzen, such as courier services, telecommunications, information technology, payment, printing, billing, payroll, technical services, training, market research, call centre, security or other services to Artyzen;
(d) vendors or third-party service providers in connection with marketing, promotions and services offered by Artyzen, subject to and in accordance with your express prior consent;
(e) any investor, assignee or transferee (actual or prospective) to facilitate business asset transactions (which may extend to any merger, acquisition or asset sales) involving any of our group companies;
(f) collection and repossession agencies in relation to the enforcement of repayment obligations for debts;
(g) external banks, credit card companies and their respective service providers for the purposes of Processing payments made by or to you;
(h) our professional advisers such as auditors or lawyers;
(i) relevant government regulators, statutory boards, authorities or law enforcement agencies to comply with any laws, regulations, rules, guidelines and/or schemes imposed by any governmental authority; and
(j) any other party to whom you authorize us to disclose your Personal Data to.
For avoidance of doubt, reference to any organizations or entities in this Section 6 means reference to the organizations or entities and their representatives, employees, agents and advisors.
7. Retention Period
7.1 Our retention periods for your Personal Data are based on business needs and legal requirements. We will retain your Personal Data for as long as is necessary for the Processing purposes for which the Personal Data was collected, and any other permissible, related purposes. For example, we may retain (i) certain transaction details and correspondence until the time limit for claims arising from the transaction has expired, or (ii) certain data to comply with regulatory requirements regarding the retention of such data.
7.2 When your Personal Data is no longer needed, we either irreversibly anonymize the data (and we may further retain and use the anonymized information) or securely destroy the data.
8. Third-Party Sites
9. Your rights – Contacting Us
9.1 You have certain rights in relation to your Personal Data as set forth below. Notwithstanding the foregoing, please be aware that certain exceptions apply where you may not be able to exercise all of these rights in every and all situations.
- Subject access: You have a right to be provided with access to any of your Personal Data held by Artyzen.
- Rectification: You have a right to ask for any rectifications in relation to the Personal Data that we Process about you.
- Erasure: You can ask us to erase your Personal Data in certain circumstances and we will take reasonable steps to inform other Data Processors who are Processing the Personal Data that you have requested the erasure of your Personal Data including any links to, copies or replication of it.
- Restriction: You can request your certain Personal Data to be marked as restricted whilst complaints are resolved and also restrict Processing in certain other circumstances.
- Portability: You can ask us to transmit the Personal Data that you have provided to us and we still hold about you to a third party electronically insofar as permitted under applicable laws.
- Raise a complaint: You can raise a complaint about our Processing with the data protection regulator in the relevant jurisdiction.
9.2 In addition, under certain conditions, you have the right to:
- withdraw the consent, where our Processing is based on your consent;
- object to any Processing of your Personal Data that Artyzen justifies on the “legitimate interests” legal ground, unless our reasons for undertaking that Processing outweigh any prejudice to your privacy rights; and
- object to the Processing of user profiles or to the use of your Personal Data for marketing purposes.
Should you object to the Processing of your Personal Data, you understand that we may not be able to provide you with the Products and Services.
Notwithstanding the foregoing, your rights under this paragraph 9.2 are subject to certain exceptions to safeguard the public interest (e.g., the prevention or detection of crime) and our interests (e.g., the maintenance of legal privilege).
9.3 If you:
(a) have any questions, privacy concerns or feedback relating to your Personal Data or our Policy; or
(b) would like to exercise any of the rights set out in paragraph 9.1 or 9.2, please contact Artyzen as follows:
Contact person: Data protection officer
Address: Penthouse 39/F, West Tower, Shun Tak Centre, 200 Connaught Road Central, Hong Kong
(when writing in, please enclose your full name and your email address so that we can identify you. Where appropriate, we will ask for additional information to identify you.)
(c) wish to unsubscribe from our mailing list, you may contact us at www.artyzen.com/contact. If submitting a formal request to unsubscribe from our mailing list through email, please include the word “Unsubscribe” in the subject title of your email.
9.4 Please note that if your Personal Data has been provided to us by a third party (e.g. a referrer, or your company), you should contact that organization or individual to make such queries, complaints, and/or access and correction requests to Artyzen on your behalf.
10. Notices and revision
10.1 Artyzen may from time to time modify, update, change or amend this Policy to ensure that this Policy is consistent with our future developments, industry trends and/or any changes in legal or regulatory requirements. Subject to your rights at law, you agree to be bound by the prevailing terms of the Policy as updated from time to time on our website. Please check back regularly for updated information on the handling of your Personal Data. If we make any material changes in the way we collect, use, and/or share your Personal Data, we will notify you by posting notice of the changes on our website.
10.2 In the event of any inconsistencies between the English version and other translations of this Policy, the English version shall prevail.
11. Legal Terms
11.1 Under the applicable privacy legislations, below terms have a defined meaning as set out in the table below:
|Criminal Personal Data||Any Personal Data that provides information on persons’ criminal convictions or offences.|
|Data Processor||The individual, legal person, administrative body or any other entity which, alone or in conjunction with others, determines the purpose of and means for Processing of Personal Data.|
|Personal Data||Any data relating to an identified or identifiable natural person recorded electronically or by other means, and does not include anonymized data.|
|Products and Services||Any products and services we provide to you, without limitation, providing accommodations in our hotels.|
|Processing, processed, process||Any operation or set of operations concerning Personal Data, including the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, dissemination by means of transmission, distribution or making available in any other form, provision, disclosure, merging, linking, as well as blocking, erasure or destruction of Personal Data.|
|Sensitive Personal Data||Any Personal Data which, if leaked or used illegally, may easily cause harm to the dignity of natural persons, or cause harm to personal or property safety, including biometric data; racial or ethnic origin; political opinions; religious/philosophical beliefs; specific identity data; health and medical data; genetic data; sex life or sexual orientation; financial account data; individual location tracking data and Personal Data of minors under the age of fourteen (14).|