Hotel Properties Limited

Privacy Statement and Data Protection Policy

The purpose of this Privacy Statement and Data Protection Policy (“Policy”) is to inform you of how Hotel Properties Limited (“HPL”) manages Personal Data (as defined below) which is subject to the Personal Data Protection Act 2012 of Singapore (“the Act”). Please take a moment to read this Policy so that you know and understand the purposes for which we collect, use and disclose your Personal Data.

By interacting with us, submitting information to us, staying in or leasing any properties or interest therein at our property developments, or registering for, purchasing, or using, any products and services offered by us (“Products and Services”), you agree and consent to HPL and its related and associated companies (the “Companies”), as well as their representatives and/or agents (collectively referred to herein as “HPL Group”, “us”, “we” or “our”) collecting, using, disclosing and sharing amongst themselves your Personal Data (as defined below), and disclosing such Personal Data to our authorised service providers and relevant third parties in the manner set forth in this Policy.

This Policy supplements but does not supersede nor replace any other consents you may have previously provided to HPL Group in respect of your Personal Data, and your consents in connection with this Policy are cumulative and additional to any rights which to any of the Companies may have at law to collect, use or disclose your Personal Data. This Policy will provide you with information about the basis upon which we may lawfully collect, use, and/or disclose your Personal Data without your consent, where permitted by applicable law. You may also contact us in the manner set out in this Policy for more information about our handling and processing of your Personal Data.

HPL Group may from time to time update this Policy to ensure that this Policy is consistent with our future developments, industry trends and/or any changes in legal or regulatory requirements. We may notify you of updates to this Policy through any means we deem appropriate, including without limitation by publishing an updated version of this Policy on our website, by posting a notice on our website or in our properties, or notifying you through other forms of communication (such as by sending you a SMS or email or by giving you a phone call). To the maximum extent permissible under applicable law, you agree to be bound by the prevailing terms of this Policy as updated from time to time on our website. Please check regularly check our website for updated information on our handling and processing of your Personal Data and the latest version of this Policy.

1. Personal Data

1.1. In this Policy, “Personal Data” refers to any data, whether true or not, about an individual who can be identified,

(a) from that data; or

(b) from that data and other information to which we have or are likely to have access, including data in our records as may be updated from time to time.

1.2. Examples of such Personal Data you may provide to us include (depending on the nature of your interaction with us) your name, NRIC, passport or other identification number, telephone number(s), mailing address, email address and any other information relating to any individuals which you have provided us in any forms you may have submitted to us, or via other methods of interaction with you.

1.3. Please note that the data protection provisions of the Act do not apply to business contact information (“BCI”). BCI is defined in the Act as an individual’s name, position name or title, business telephone number, business address, business electronic mail address or business fax number and any other similar information about the individual, not provided by the individual solely for his personal purposes.

2. Collection of Personal Data

2.1. Generally, we collect Personal Data in the following ways:

(a) when you submit any form, including but not limited to application and registration forms or other forms relating to any of our properties, developments, or Products and Services;

(b) when you enter into any agreement or provide other documentation or information in respect of your interactions with us, or when you use our Products and Services;

(c) when you interact with our staff, including customer service officers, for example via telephone calls (which may be recorded), letters, face-to-face meetings, social media platforms and emails;

(d) when you use our electronic services, including without limitation where you interact with us via our websites and apps or use the same;

(e) when you request that we contact you or request that you be included in an email or other mailing list;

(f) when you respond to our promotions, initiatives or to any request for additional Personal Data;

(g) when you submit an employment application or when you provide documentation or information including your résumé and/or CV in connection with any appointment as an officer, director, representative or any other position;

(h) when your images are captured by us via CCTV cameras while you are within our premises or photographs or videos taken by us or our representatives when you attend events hosted by us at non-public spaces;

(i) when you are contacted by, and respond to, our marketing representatives and customer service officers;

(j) when we receive references from business partners and third parties, for example, where you have been referred by them, with your consent;

(k) when we seek information from third parties about you and receive your Personal Data in connection with your relationship with us, including for our Products and Services or job applications, for example, from business partners, public agencies, your ex-employer, referral intermediaries and the relevant authorities; and/or

(l) when you submit your Personal Data to us for any other reason.

2.2. If you provide us with any Personal Data relating to a third party (e.g. information relating to your spouse, children, parents, and/or employees), by submitting such information to us, you represent to us that you have obtained the consent of the third party to provide us with their Personal Data and for the collection, use, and disclosure of their Personal Data for the respective purposes by or for the benefit of HPL Group.

2.3 You should ensure that all Personal Data submitted to us is complete, accurate, true and correct. If you do not do so, we may not be able to provide you with Products and Services.

3. Purposes for the Collection, Use and Disclosure of Your Personal Data

3.1. Generally, HPL Group collects, uses, processes and discloses your Personal Data for the following purposes:

(a) transacting with you and providing our Products and Services;

(b) responding to your queries, feedback, complaints and requests;

(c) managing the administrative and business operations of HPL Group and complying with internal policies, reporting requirements and procedures;

(d) facilitating business asset transactions (which may extend to any mergers, acquisitions or disposals) involving any of the Companies;

(e) requesting feedback or participation in surveys, as well as conducting market research and/or analysis for statistical, profiling or other purposes for us to design our Products, understand customer behaviour, preferences and market trends, and to review, develop and improve the quality of our Products and Services;

(f) monitoring or recording phone calls and customer-facing interactions for quality assurance, employee training and performance evaluation and identity verification purposes;

(g) matching any Personal Data held which relates to you for any of the purposes listed herein; preventing, detecting and investigating crime and analysing and managing commercial risks;

(h) managing the safety and security of our premises and services (including but not limited to carrying out CCTV surveillance and conducting security clearances);

(i) hosting, storing, backing-up, and/or processing your Personal Data, including without limitation on third party servers, platforms, or data clouds;

(j) legal purposes in connection with any claims, actions or proceedings (including but not limited to drafting and reviewing documents, transaction documentation, obtaining legal advice, and facilitating dispute resolution), and/or protecting and enforcing our contractual and legal rights and obligations;

(k) conducting investigations relating to disputes, billing or fraud;

(l) meeting or complying with any applicable rules, laws, regulations, codes of practice or guidelines issued by any legal, statutory or regulatory bodies which are binding on HPL Group (including but not limited to responding to regulatory complaints, disclosing to regulatory bodies, disclosures required in the public interest or emergencies and conducting audit checks, due diligence and investigations which may be carried out by statutory authorities); and/or

(m) purposes which are reasonably related to the aforesaid.

3.2. In addition, HPL Group collects, uses and discloses your Personal Data for the following purposes, depending on the nature of our relationship with you:

(a) If you are a shopper or visitor to our retail malls;

(i) providing customer service and support (including but not limited to customer relationship management, service operations and delivery, administering rewards and benefits and attending to your requests for any other goods and services whether or not offered by HPL Group); and/or

(ii) purposes which are reasonably related to the aforesaid.

(b) If you are an owner or tenant, or an employee, business partner, director or representative of an organisation that is an owner or tenant of any of our properties, whether existing or prospective:

(i) facilitating and administrating the sale or lease of our properties (including but not limited to customer relationship management which may include the setting up and administration of any online portals for such customer relationship management, processing and confirming your purchase or tenancy, providing you with services, facilities and administrative support, and administering rewards and benefits);

(ii) maintaining our property developments and remedying defects;

(iii) managing referrals; and/or

(iv) purposes which are reasonably related to the aforesaid.

(i) facilities management (including but not limited to issuing visitor access passes, and recording entries to and exits from our premises);

(ii) providing services and facilities; and/or

(iii) purposes which are reasonably related to the aforesaid.

(d) If you are an employee, officer or owner of an external service provider or vendor outsourced or prospected by HPL Group:

(i) assessing your suitability as an external service provider or vendor for HPL Group;

(ii) managing project tenders and quotations, processing orders or managing the supply of goods and services;

(iii) managing business operations and product development; and/or

(iv) purposes which are reasonably related to the aforesaid.

(e) If you submit an application to us as a candidate for an employment:

(i) conducting interviews;

(ii) processing your application (including but not limited to pre-recruitment checks involving your qualifications and facilitating interviews);

(iii) providing or obtaining references and for background screening;

(iv) assessing your suitability for the position applied for;

(v) onboarding successful candidates and facilitating human resource planning and management; and/or

(vi) purposes which are reasonably related to the aforesaid.

(f) If you are a shareholder of HPL Group:

(i) onboarding or facilitating your appointment as a shareholder, including the verification of your identity and/or the identity of your proxy (as may be applicable);

(ii) maintaining statutory registers and to manage the publication and dissemination of shareholder statistics in annual reports, newsletters and circulars; and/or

(iii) purposes which are reasonably related to the aforesaid.

(g) If you are staying in a HPL Group hotel:

(i) Reservation fulfilment information such as your name, address, telephone number, email address, date of birth, nationality, credit or debit card number, airline frequent flyer information or other similar customer-loyalty programmes;

(ii) Stay related information such as arrival and departure dates, goods and services purchased, information and observations about your special requests made and service preferences (e.g. specific room type, amenities requested, room preferences and other facilities or services used);

(iii) Guest feedback survey both in-hotel and online;

(iv) Marketing preferences through registering for e-newsletters or programme membership.

3.3. In relation to particular products or services, or in your interactions with us, we may also specifically notify you of other purposes for which we collect, use, and/or disclose your Personal Data. If so, we may collect, use, and/or disclose your Personal Data for those purposes as well.

4. Disclosure of Personal Data

4.1. HPL Group will take commercially reasonable steps to protect your Personal Data against unauthorised disclosure. Subject to the provisions of any applicable law, your Personal Data may be disclosed, for the purposes listed above (where applicable), to the following entities or parties, whether they are located overseas or in Singapore:

(a) HPL Group’s related corporations and employees, to provide Products and Services to you, address your questions and requests in relation to your interactions with us as well as our Products and Services, and to maintain and operate our systems and/or services;

(b) companies providing services relating to medical screening, insurance and consultancy to HPL Group;

(d) real estate management agents;

(e) agents, contractors or third party service providers who provide operational services to HPL Group, such as courier services, customer service, telecommunications, information technology, payment, printing, billing, payroll, processing, technical services, training, market research, call centre, security, or other services to HPL Group;

(f) vendors or third party service providers in connection with marketing promotions and services offered by HPL Group;

(g) any business partner, investor, assignee or transferee (actual or prospective) to facilitate business asset transactions (which may extend to any merger, acquisition or asset sale) involving any of the Companies;

(h) collection and repossession agencies in relation to the enforcement of repayment obligations for debts;

(i) external banks, credit card companies and their respective service providers;

(j) building and car park management and their respective service providers;

(k) share registrars;

(l) companies which provide corporate secretarial, depository, clearing and book-entry settlement services;

(m) our professional advisers such as consultants, auditors and lawyers;

(n) foreign embassies in relation to facilitating overseas travel arrangements;

(o) relevant government ministries, regulators, statutory boards or authorities or law enforcement agencies to comply with any laws, rules, guidelines and regulations or schemes imposed by any governmental authority; and/or

(p) any other party to whom you authorise us to disclose your Personal Data to.

5. Deemed Consent

5.1. In addition to the above, and subject to and in accordance with applicable law, you shall be deemed to have consented to HPL Group collecting, using, disclosing, and/or sharing your Personal Data within HPL Group and disclosing such Personal Data to HPL Group’s authorised service providers and relevant third parties:

(a) where in response to a request for your Personal Data in connection with identified purposes, you voluntarily provide such Personal Data to HPL Group for such purpose(s) and it is reasonable that you would voluntarily provide such Personal Data; and

(b) where the collection, use and/or disclosure of your Personal Data is reasonably necessary for the conclusion and/or performance of a contract, between you and any member of HPL Group or any other organisation entered into at your request, which may include recipients of your Personal Data not indicated in this Data Protection Policy.

6. Other bases for handling or processing your Personal Data

6.1. In addition to and without limiting the consents you have provided to us for our collection, use, and/or disclosure of your Personal Data for the purposes set out elsewhere in this Policy or as may otherwise have been notified to you, where permitted by applicable law, HPL Group may also, in accordance with the requirements thereof, collect, use, and/or disclose your Personal Data as further detailed below, including without consent, where we meet the requirements of applicable law:

(a) for our legitimate interests or the legitimate interests of other persons, including without limitation for the following purposes:

(i) any investigations or proceedings;

(ii) fraud detection and prevention;

(iii) entering into, managing, or terminating an employment relationship or appointment; and

(iv) detection and prevention of misuse of Products and Services; and

(b) we may collect your Personal Data from any of the Companies, we may use your Personal Data, and any of the Companies may disclose your Personal Data to us, for improving our products, services, processes or business, understanding customer preferences and personalising experiences and recommendations (regardless whether you are an existing or prospective customer of any of the Companies).

7. Use of Cookies

7.1. When you interact with us on our websites, we may automatically receive information from your browser and record this in our server logs. We may also employ cookies in order for our server to recognise a return visitor and understand user behaviour including, without limitation, monitoring information relating to how a visitor arrives at the website, what kind of browser a visitor is on, what operating system a visitor is using, a visitor’s IP address, and a visitor’s click stream information and time stamp (for example, which pages they have viewed, the time the pages were accessed, and the time spent per web page). You agree that: (a) we shall retain all rights, title and interest in and to all such gathered information and data; and (b) any intellectual property rights of or in the results of such analytics shall vest solely in us.

7.2. Cookies are small text files stored in your computing or other electronic devices which allow us to remember you. The cookies placed by our server are readable only by us. Cookies are not programs and therefore cannot access, read or modify any other data on an electronic device.

7.3. Should you wish to disable the cookies associated with these technologies, you may do so by changing the setting on your browser. However, you may not be able to use certain services or enter certain part(s) of our websites. This may also impact your user experience while on our websites.

8. Marketing and promotion

8.1. If you have provided us with your Singapore telephone number(s) or email and have indicated that you consent to receiving marketing or other promotional information via your Singapore telephone number(s) or email, or where we are permitted to do so under the Act, then from time to time, we may contact you using such Singapore telephone number(s) (including via voice calls, text, fax or other means) or email you have provided to us with information about our Products, Services and other marketing or promotional materials/communication even if these telephone number(s) are registered with the Do Not Call Registry.

8.2. You may withdraw your consent for receiving marketing or promotional materials/communication at any time by contacting us via the contact details below.

8.3. Please be aware that once we receive confirmation that you wish to withdraw your consent for marketing or promotional materials/communication, it may take up to 10 working days for your withdrawal to be reflected in our systems. Therefore, you may still receive marketing or promotional materials/communication during this period of time.

8.4. Please note that if you withdraw your consent for the receipt of marketing or promotional materials only, we may still contact you for other purposes unless you also withdraw your consent for those other purposes.

9. Data Security

9.1. HPL Group will take reasonable efforts to protect Personal Data in our possession or our control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. However, we cannot completely guarantee the security of any Personal Data we may have collected from or about you, or that for example no harmful code will enter our website (for example viruses, bugs, trojan horses, spyware or adware). You should be aware of the risks associated with using websites.

9.2. While we strive to protect your Personal Data, we cannot ensure the security of the information you transmit to us via the Internet, and we urge you to take every precaution to protect your Personal Data.

9.3. If applicable, you undertake to keep your username and password secure and confidential and shall not disclose or permit it to be disclosed to any unauthorised person, and to inform us as soon as reasonably practicable if you know or suspect that someone else knows your username and password or believe the confidentiality of your username and password has been lost, stolen or compromised in any way or that actual or possible unauthorised transactions have taken place. We are not liable for any damages resulting from any security breaches, or unauthorised and/or fraudulent use of your username and password.

10. Contacting Us – Withdrawal of Consent, Access and Correction of your Personal Data

10.1. If you:

(a) have any questions or feedback relating to your Personal Data or our Policy, including without limitation our reliance on the legitimate interests and/or deemed consent bases for collecting, using and/or disclosing your Personal Data as described in this Data Protection Policy;

(b) would like to withdraw your consent to any use of your Personal Data as set out in this Policy; or

you can contact us via the contact details set out below:

Data Protection Officer

[email protected]

10.2. Please note that if your Personal Data has been provided to us by a third party (e.g. a referrer, or your company), you should contact that organisation or individual to make such queries, complaints, and access and correction requests to HPL Group on your behalf.

10.3. If you withdraw your consent to any or all use of your Personal Data, depending on the nature of your request, HPL Group may not be in a position to continue to provide its Products and Services to you, administer any contractual relationship in place, which in turn may also result in the termination of any agreements with HPL Group, and breach of your contractual obligations or undertakings. HPL Group’s legal rights and remedies in such event are expressly reserved.

11. Links to Third-Party Website(s)

11.1. Our websites may contain links to other third-party operated websites operated by third parties over which we have no control over. We are not responsible for the privacy and/or data protection practices of such third-party operated websites that are linked to our websites. Once you have left our website by clicking a relevant link, you should check the applicable privacy and/or data protection policy of the third party website to find out more about how they will handle any information they collect from you.

12. Governing Law

12.1. This Policy and your use of this website shall be governed in all respects by the laws of Singapore.