- Personal identifiers, commercial transaction data, and account information could be shared with PMS (Property Management Systems), CRM (Customer Relationship Management) platforms, guest services and hotel operations, and hotel property owners. Certain situations may require that we share your Personal Information with promotional or fulfillment vendors, marketing support vendors, vendors supporting or hosting the website, transaction support vendors, data analytics vendors, professional employer organizations, recruiting firms, staffing agencies, consumer reporting agencies, security and risk management vendors, corporate customers, insurance carriers or administrators and brokers, company affiliates, and financial institutions. In limited situations, your Personal Information could be shared with government agencies.
- Geolocation and mobile app device data could be shared with security and risk management vendors, including IT, cybersecurity, and privacy employees, vendors, and consultants. Facility and systems access information may be disclosed to security and risk management vendors and employees, including IT, cybersecurity, and privacy professionals, and Company Affiliates.
- Mobile App, online portal data, Internet, and Inferences could be shared with PMS and CRM platforms, guest services, hotel operations, hotel property owners, promotional or fulfillment vendors, marketing support vendors, vendors that support the website services, and data analytics vendors.
- Candidate, applicant, employee, independent contractor data, including, but not limited to, Personal Information and Personal Sensitive Information, could be shared with financial institutions, government agencies, talent acquisition management systems, vendors providing HRIS (Human Resource Information Systems), company affiliates, and job applicant and recruiting vendors and employees. Additionally, candidate, applicant, employee, independent contractor data could be disclosed to professional employer organizations, staffing agencies, consumer reporting agencies, and credit reporting agencies.
- Biometric data is not shared or disclosed to parties other than the vendor we engage to process this data, and video data is only disclosed to the video security and risk management vendors and employees, including IT, Cybersecurity, and Privacy employees, vendors, and consultants.
SENSITIVE PERSONAL INFORMATION
We will use or disclose your Sensitive Personal Information for the following purposes:
1. To perform the services expected by an average employee who requests those services.
2. o detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted Personal Information.
3. To resist malicious, deceptive, fraudulent, or illegal actions directed at the business and to prosecute those responsible for those actions.
4. To ensure the physical safety of natural persons.
5. For short-term, transient use.
6. To perform services on behalf of the Company.
7. To verify or maintain the quality or safety of a product, service or device that is owned, manufactured, manufactured for, or controlled by the Company, and to improve, upgrade, or enhance the service or device that is owned, manufactured by, manufactured for, or controlled by the Company.
8. For purposes that do not involve inferring characteristics about the guests, customers, contractors, and applicants.
DISCLOSURE OR SHARING OF DATA IN THE PRIOR 12 MONTHS
In the last 12 months we have shared the following types of personal data with the parties mentioned in the ‘How and When we Share your Personal Information’ section, including personal identifiers, commercial transaction data, account information, mobile device data, geolocation data, inferences, and account information has been shared with promotional or other fulfillment vendors. For job applicants, based on analysis of the Personal Information collected, we may develop inferences regarding job applicants’ predispositions, behavior, attitudes, intelligence, abilities, and aptitudes for purposes of recruiting and hiring assessments and decisions, which is not shared, disclosed, or sold to third parties.
Mobile App, online portal data, Internet, credentials, education, other professional information, job applicant, facility and systems access information, medical and health information, or surveillance data have not been shared within the last 12 months.
We may collect and process your Personal Information for the following business purposes:
1. To fulfill or meet the purpose for which you provided the information.
2. To process, complete, and maintain records on transactions.
3. To support hotel management operations.
4. To retain your selection for text message, opt in/opt out to ensure guests and customers who opted out are not sent any text messages.
5. To schedule, manage and keep track of guest and customer appointments.
6. To maintain records of when customers decline a service or sale.
7. To respond to guest and customers inquiries, including requests for information, customer support online, phone calls, and onsite inquiries.
8. To manage loyalty rewards programs (if applicable).
9. To manage promotions and events.
10. To provide interest-based and targeted advertising.
11. To market relevant products and/or services.
12. To contact you by email, telephone calls, mail, SMS, or other equivalent forms of communication regarding updates or informative communications related to the functionalities, services, or other information you requested or asked the Company to provide to you.
13. To comply with federal, state, and local law.
14. To improve user experience on our website.
15. To understand the demographics of our website visitors.
16. To detect security incidents.
17. To debug, identify, and repair errors that impair existing intended functionality of our website.
18. To protect against malicious or illegal activity and prosecute those responsible.
19. To verify and respond to guest and customer requests.
20. To prevent identity theft.
21. JOB APPLICANT PURPOSES:
1. To fulfill or meet the purpose for which you provided the information. For example, if you share your name and contact information to apply for a job with the Company, we will use that Personal Information in connection with your candidacy for employment.
2. To comply with local, state, and federal law and regulations requiring employers to maintain certain records, as well as local, state, and federal law, regulations, ordinances, guidelines, and orders relating to infectious diseases, pandemics, outbreaks, and public health emergencies, including applicable reporting requirements.
3. To evaluate your job application and candidacy for employment.
4. To obtain and verify background check and references.
5. To communicate with you regarding your candidacy for employment.
6. To permit you to create a job applicant profile, which you can use for filling out future applications if you do not get the job you apply for.
7. To keep your application on file even if you did not get the job applied for in case there is another position for which we want to consider you as a candidate even if you do not formally apply.
8. To evaluate and improve our recruiting methods and strategies.
9. To engage in lawful monitoring of job applicant activities and communications when they are on Company premises or utilizing Company internet and Wi-Fi connections, computers, networks, devices, software applications or systems.
10. To engage in corporate transactions requiring review or disclosure of job applicant records subject to any non-disclosure agreements, such as for evaluating potential mergers and acquisitions of the Company.
11. To evaluate, assess, and manage the Company’s business relationship with vendors, service providers, and contractors that provide services to the Company related to recruiting or processing of data from or about job applicants.
12. To improve job applicant experience on Company computers, networks, devices, software applications or systems, and to debug, identify, and repair errors that impair existing intended functionality of our systems.
13. To reduce the risk of spreading infectious diseases in or through the workplace.
22 INDEPENDENT CONTRACTOR PURPOSES:
1. To fulfill or meet the purpose for which you provided the information.
2. To comply with state and federal law and regulations requiring businesses to maintain certain records (accident or safety records, and tax records/1099 forms).
3. To engage the services of independent contractors and compensate them for services.
4. To evaluate, make, and communicate decisions regarding an independent contractor, including decisions to hire and/or terminate.
5. To grant independent contractors access to secure Company facilities, systems, networks, computers, and equipment, and maintain information on who accessed such facilities, systems, networks, computers, and equipment, and what they did therein or thereon.
6. To implement, monitor, and manage electronic security measures on independent contractor devices that are used to access Company networks and systems.
7. To evaluate, assess, and manage the Company’s business relationship with vendors, service providers, and contractors that provide services to the Company.
8. To improve user experience on Company computers, networks, devices, software applications or systems, and to debug, identify, and repair errors that impair existing intended functionality of our systems.
9. To reduce the risk of spreading infectious diseases in or through the workplace.
Guests and customers may make the following privacy rights requests in accordance with applicable law.
1. Right to Know and Access: You may have the right to confirm: (1) the categories of Personal Information we have collected about you, (2) the categories of sources from which the Personal Information was collected, (3) the business or commercial purpoe for collecting, selling, or sharing this information, (4) the categories of third parties with whom we share or have shared your Personal Information, (5) the categories of Personal Information that we have sold or shared about you and the categories of third parties to whom the Personal Information was sold or shared, by category or categories of Personal Information for each category of third parties to whom the Personal Information was sold or shared, and (6) the categories of Personal Information that we have disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.
2. Right to Data Portability: You have the right to obtain a copy of your Personal Information, that you previously provided to us, in a format that: to the extent technically feasible, is portable; to the extent practicable, is readily usable; and allows you to transmit the data to another without impediment, where the processing is carried out by automated means.
3. Right to Delete: You may be entitled to request that we delete the Personal Information that we have collected from you, subject to certain exceptions.
4. Right to Correct: You have the right to request that we correct inaccurate Personal Information (to the extent such an inaccuracy exists) that we maintain about you.
5. Right to Limit the use of your Sensitive Personal Information: You have the right to limit our use or disclosure of your sensitive Personal Information to uses that are necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those services or goods.
6. Right to Not Be Discriminated: You have the right not to receive discriminatory treatment if you exercise the rights conferred to you by applicable privacy law.
7. Right to Designate an Authorized Agent: You have the right to designate an authorized agent to submit one of these requests on your behalf. See below for how you can designate an authorized agent. You can authorize someone else as an authorized agent who can submit a request on your behalf. To do so, you must either (a) execute a valid, verifiable, and notarized power of attorney or (b) provide other written, signed authorization that we can then verify. When we receive a request submitted on your behalf by an authorized agent who does not have a power of attorney, that person will be asked to provide written proof that they have your permission to act on your behalf, and we will also contact you and ask you for information to verify your own identity directly with us and not through your authorized agent. We may deny a request from an authorized agent if the agent does not provide your signed permission demonstrating that they have been authorized by you to act on your behalf.
8. Opt-out of Selling and Sharing of your information (Do Not Sell or Share): While we do not sell or share your Personal Information in exchange for money, we may share your Personal Information for other valuable consideration. You have the right to tell us NOT to sell or share your Personal Information. You have the full and free right to opt-out of our disclosure of your Personal Information to any third parties where the disclosure constitutes “selling” or “sharing.”
9. Opt-out of processing Personal Information for Targeted Advertising and Profiling: You have the right to opt-out of targeted ads and profiling based on cross-contextual or behavioral data, as well as data collected from automated processes, that have been obtained from your activities over time and across nonaffiliated internet websites or online applications to predict your preferences or interests. Targeted advertising does not include (a) advertisements based on activities within a controller’s own internet websites or online applications, (b) advertisements based on the context of your current search query, visit to an internet website or online application, (c) advertisements directed to you in response to your request for information or feedback, or (d) processing personal data solely to measure or report advertising frequency, performance or reach.
10. Do Not Track (Opt-out Preference Signal): Opt-out preference signals provide consumers with a simple and easy-to-use method by which to exercise the right to opt-out of the selling and sharing of their information. Global Privacy Controls (GPC) is a user-enabled opt-out preference signal which can communicate a user’s “Do Not Sell or Share” request on behalf of the person or device. We will process opt-out preferences from GPC signals which are in formats commonly used and recognized by businesses, such as an HTTP field header. We will treat a consumer’s use of GPCs as a valid request to opt-out of the selling and sharing of information for that browser. We currently do not connect browser use to consumers and, as such, you will need to use GPCs on all browsers in which you access our website and use our opt-out form to opt-out of offline sales. Do Not Track (DNT) is a privacy preference that users can set if they do not want web services to collect information about their online activity. We do not respond to DNT signals or other mechanisms (except for GPCs) that provide a choice regarding the collection of Personal Information about activities over time and across different websites or online services. We encourage users who have DNTs to use GPCs.
SPECIAL NOTICE FOR CALIFORNIA RESIDENTS
In compliance with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), we provide California residents with certain information upon request, up to 2 times in a 12-month period, going back to January 1, 2023 (except for Right to Opt-out and Right to Limit), unless doing so would be impossible or involve disproportionate effort, or unless you request a specific time-period. You have:
- Right to Know and Access
- Right to Data Portability
- Right to Deletion
- Right to Correct
- Right to Opt-Out of Sales and Sharing of Personal Information. You may opt out of sales of your Personal Information to third parties and to opt out of the disclosure of your Personal Information to third parties for certain targeted advertising. A request to opt-out by a California resident need not be a verifiable request. However, we may deny a request to opt-out if we have a good faith, reasonable, and documented belief that a request to opt-out is fraudulent. If we deny your request to opt-out, we shall inform you of our decision not to comply and provide an explanation as to why we believe the request is fraudulent.
- Right to Limit Use of Sensitive Personal Information. You have the right to limit the use or disclosure of your sensitive Personal Information to uses that are necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those services or goods.
- Right to Non-Discrimination. The California Shine the Light law (Civil Code 1798.83) permits California Residents with whom we have an established business relationship to request that we provide you with a list of certain categories of Personal Information that we have disclosed to third parties for their direct marketing purposes during the preceding calendar year. To make such a request, please send an email to privacy@hotel-privacy.com. Please mention that you are making a “California Shine the Light” request.
SPECIAL NOTICE FOR COLORADO RESIDENTS
In compliance with the Colorado Privacy Act (CPA), we provide Colorado residents with certain information upon request. You have:
- Right to Know and Access
- Right to Data Portability
Right to DeleteRight to Correct
- Right to Opt-Out. You may request to opt-out of the processing of your Personal Information for purposes of targeted advertising and profiling, used to make important decisions that have legal or similarly significant impacts on a consumer or the sale of Personal Information.
SPECIAL NOTICE FOR CONNECTICUT RESIDENTS
In compliance with the Connecticut Personal Data Privacy and Online Monitoring Act (CTDPA), we provide Connecticut residents with certain information upon request. You have:
- Right to Know and Access
- Right to Data Portability
- Right to Delete
- Right to Correct
- Right to Opt-Out of the processing of your Personal Information for purposes of targeted advertising and profiling, used to make important decisions that have legal or similarly significant impacts on a consumer or the sale of Personal Information.
SPECIAL NOTICE FOR NEVADA RESIDENTS
In compliance with Nevada Senate Bill 220, we provide Nevada residents with the right to opt out of the sale of the Personal Information we may have collected about you. We do not sell, rent, or lease your Personal Information to third parties.
SPECIAL NOTICE FOR UTAH RESIDENTS
In compliance with the Utah Consumer Privacy Act (UCPA), we provide Utah residents with certain information upon request. You have:
- Right to Know and Access
- Right to Data Portability
- Right to Delete
- Right to Opt-Out of certain processing. You have the right to opt out of the processing of your Personal Information for the purposes of targeted advertising, or the sale of Personal Information.
SPECIAL NOTICE FOR VIRGINIA RESIDENTS
In compliance with the Virginia Consumer Data Protection Act (VCDPA), we provide Virginia residents with certain information upon request up to two (2) times in a 12-month period. You have:
- Right to Know and Access
- Right to Correct
- Right to Delete
- Right to Obtain a copy of your Personal Information, in a readily usable format.
- Right to Opt-out of
- 1. the processing of your Personal Information for targeted advertising purposes.
- 2. the sale of your Personal Information.
- 3. profiling based upon your Personal Information.
We will not treat you differently because of you exercise your privacy rights. We will not deny goods or services to you; charge different rates for goods or services; provide a different level quality of goods or services; or suggest any of the preceding will occur. Thus, you may exercise your rights without fear of discrimination. We ask you to identify yourself and the information requested before processing such requests, and, to the extent permitted by applicable law, we may decline to process requests that are unreasonably repetitive or systematic, require disproportionate technical effort, jeopardize the privacy of others or would be extremely impractical.
To exercise your rights, you can do any of the following:
- Submit an online request on our website by clicking HERE
- Call our privacy toll-free line at (888) 828-4280.
When you submit a consumer request, we will ask you to provide some information to verify your identity and respond to your request. Specifically, we will ask you to verify information that can be used to link your identity to records in our possession, which depends on the nature of your relationship and interaction with us. For example, we may need you to provide your name, email, phone number, amount of your last purchase with the business, and/or date of your last transaction with the business.
Responding To Your Rights
State: CALIFORNIA
Response Time: Upon receiving a verifiable request for Right to Know, Right to Access, Right to Delete, and Right to Correct, we will confirm receipt of the request no later than ten (10) business days after receiving it. We endeavor to respond to a verifiable request within forty-five (45) calendar days of its receipt. If we require more time (up to an additional forty-five (45) calendar days, or ninety (90) calendar days total from the date we receive your request), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable. Upon receiving a request to opt-out we will act within fifteen (15) business days of its receipt. We will notify all third parties to whom we have sold or shared Personal Information of your request and instruct them to comply with the request within the same time frame. We will notify you when the request has been completed by mail or electronically, at your option.
Fee: We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
Procedure to Appeal: You may appeal our refusal to act on a request without an undue delay after your receipt of our decision. To submit an appeal, you may call our privacy toll-free line at (888) 828-4280 to request an appeal form, which must be returned within thirty (30) calendar days of your receipt of our decision. Within 60 days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, we will also provide you with a method through which you may contact the California Attorney General to submit a complaint. (This appeal process does not apply to California job applicants or independent contractors.)
State: COLORADO
Response Time: We endeavor to respond to a verifiable request for Right to Opt-Out, Right to Know, Right to Access, Right to Delete, and Right to Correct without undue delay or within forty-five (45) calendar days of its receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period within the initial 45-day period after receipt of your request. If we deny your request, we shall inform you within forty-five (45) calendar days of our decision not to comply and provide an explanation as to why we believe the request cannot be processed further.
Fee: We do not charge a fee for first request. We may charge for a second or subsequent request within a 12 -month period.
Procedure to Appeal: You may appeal our refusal to act on a request within a reasonable period of time after your receipt of our decision. To submit an appeal, you may call our privacy toll-free line at (888) 828-4280 to request an appeal form, which must be returned within forty-five (45) calendar days of your receipt of our decision. Within forty-five (45) calendars days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, we will also provide you with a method through which you may contact the Colorado Attorney General to submit a complaint. (This appeal process does not apply to Colorado job applicants or independent contractors.
State: CONNECTICUT
Response Time: We endeavor to respond to a verifiable request for Right to Opt-Out, Right to Know, Right to Access, Right to Delete, and Right to Correct without undue delay or within forty-five (45) calendar days of its receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period within the initial 45-day period after receipt of your request. If we deny your request, we shall inform you within forty-five (45) calendar days of our decision not to comply and provide an explanation as to why we believe the request cannot be processed further.
Fee: We do not charge a fee for first request (during 12-month period), unless the requests are manifestly unfounded, excessive, or repetitive, in which case we may charge you a reasonable fee to cover the administrative costs of complying with the requests, or we may decline to act on the request.
Procedure to Appeal: You may appeal our refusal to act on a request within a reasonable period after your receipt of our decision. To submit an appeal, you may call our privacy toll-free line at (888) 828-4280 to request an appeal form, which must be returned within 60 calendar days of your receipt of our decision. Within 60 days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, we will also provide you with a method through which you may contact the Connecticut Attorney General to submit a complaint. (This appeal process does not apply to Connecticut job applicants or independent contractors.)
State: UTAH
Response Time: We endeavor to respond to a verifiable request for Right to Opt-Out, Right to Know, Right to Access, Right to Delete, and Right to Correct within forty-five (45) calendar days of its receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period within the initial 45-day period after receipt of your request. If we deny your request, we shall inform you within forty-five (45) calendar days of our decision not to comply and provide an explanation as to why we believe the request cannot be processed further.
Fee: We do not charge a fee for up to 2 requests annually, unless the requests are manifestly unfounded, excessive, or repetitive, in which case we may charge you a reasonable fee to cover the administrative costs of complying with the requests, or we may decline to act on the request.
Procedure to Appeal: You may appeal our refusal to act on a request within 30 calendar days after your receipt of our decision. To submit an appeal, you may call our privacy toll-free line at (888) 828-4280 to request an appeal form, which must be returned within 30 calendar days of your receipt of our decision. Within 60 days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, we will also provide you with a method through which you may contact the Virginia Attorney General to submit a complaint. (This appeal process does not apply to Virginia job applicants or independent contractors.)
State: VIRGINIA
Response Time: We endeavor to respond to a verifiable request for Right to Opt-Out of Targeted Advertising, selling of Personal Information, and Profiling, Right to Know, Right to Access, Right to Delete, and Right to Correct within forty-five (45) calendar days of its receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period within the initial 45-day period after receipt of your request.
Fee: We do not charge a fee for up to 2 requests annually, unless the requests are manifestly unfounded, excessive, or repetitive, in which case we may charge you a reasonable fee to cover the administrative costs of complying with the requests, or we may decline to act on the request.