CHINA ADDENDUM TO THE GLOBAL HOTEL ALLIANCE - PRIVACY POLICY

This China Addendum to the Global Hotel Alliance - Privacy Policy ("Addendum") is a part of the Global Hotel Alliance - Privacy Policy ("Privacy Policy") and should be read in conjunction with it and can be found here.

Please get in touch with us using the information in the "HOW TO CONTACT US" section below if you have any questions about the Privacy Policy or this Addendum.

1. ABOUT THIS ADDENDUM

Protecting your Personal Information is very important to GHA, and this Addendum describes the practices that we follow as a Personal Information Processor to Process Personal Information that is protected by the PIPL. Specifically, this Addendum applies to any activity where we Process the Personal Information of a natural person within China or where we Process the Personal Information of a natural person outside China under the following circumstances:

• where the purpose of the activity is to provide a product or service to a natural person located within China;
• where the purpose of the activity is to analyse or assess the behaviour of a natural person located within China; or
• any other circumstance as provided by law or administrative regulations.

This Addendum describes:

• definitions;
• how we collect and Process your Personal Information;
• transfers of Personal Information;
• your rights; and
• how to contact us.

If the terms of the Privacy Policy and this Addendum conflict in relation to Personal Information protected by the PIPL, this Addendum prevails.

2. DEFINITIONS

In this Addendum, we use some special words and phrases. The following definitions apply to those special words and phrases:

"Anonymisation" refers to the process in which any Personal Information is Processed to the extent that it cannot identify a specific natural person and cannot be restored to its original state.

"China" for the purposes of this policy refers to mainland China only and does not refer to the Hong Kong Special Administrative Region, Macau Special Administrative Region, or Taiwan China.

"Controller" or "Personal Information Processor" refers to any organisation or individual that independently determines the purpose and method of Processing in their activities of Processing of Personal Information.

"Entrusted Processor" generally refers to any vendor or service provider we engage to Process Personal Information on our behalf under a contract that meets the requirements in Article 21 of the PIPL.

"GHA", "us", or "we" refers to GHA Loyalty DMCC, a legal entity with a place of business at 21st Floor, JBC5 Tower, Jumeirah Lake Towers, PO Box 487771 Dubai, United Arab Emirates.

"Overseas Recipient" refers to an organisation or individual located outside China that receives Personal Information from GHA.

"Personal Information", "Personal Data", or "Data" all bear the same meaning for the purposes of this Addendum and refer to any kind of information related to an identified or identifiable natural person as electronically or otherwise recorded, excluding information that has been Anonymised.

"PIPL" means the Personal Information Protection Law of the People's Republic of China. 

"Processing", "Process", or "Processed" includes the collection, storage, use, editing, transmission, provision, disclosure, and deletion of Personal Information.

"Relevant Laws and Regulations" refers to the Personal Information Protection Law of the People's Republic of China, the Cybersecurity Law of the People's Republic of China, the Data Security Law of the People's Republic of China, the Civil Code of the People's Republic of China, and other applicable laws and regulations of the People's Republic of China.

"SDK" refers to Software Development Kit, which is usually a software tool used to assist application development to realise specific functions of the application. Common SDK types include advertising, push, statistics, maps, third-party login, social payment, risk control, identity authorisation, framework, etc.

"Security Incident" refers to the unlawful or accidental destruction, alteration, loss, misuse, access, modification, or disclosure of Personal Information.

"Sensitive Personal Information" refers to Personal Information that, once leaked or illegally used, will easily lead to infringement of the human dignity or harm to the personal or property safety of a natural person, including biometric recognition, religious belief, specific identity, medical and health, financial account, personal location tracking and other information of a natural person, as well as any Personal Information of a minor under the age of 14.

"Sites" refers to zh.ghadiscovery.com, the GHA DISCOVERY mobile application, and other websites and applications operated by or on behalf of GHA.

3. HOW WE COLLECT AND PROCESS YOUR PERSONAL INFORMATION

We only Process your Personal Information if there is a legal basis. The legal bases we rely on to Process Personal Information may depend on the specific purposes we are trying to achieve. We typically rely on one or more of the following legal bases:

• where it is necessary for the conclusion or performance of a contract to which you are a contracting party;
• where it is necessary for performing a statutory responsibility or statutory obligation;
• where it is necessary for responding to a public health emergency or for protecting the life, health, or property safety of a natural person in the case of an emergency; and
• any other circumstance as provided by Relevant Laws and Regulations.

Where none of the above legal bases apply, we will seek your consent before Processing your Personal Information.

Types of Personal Information we collect

We collect the Personal Information from you as follows:

We have marked Sensitive Personal Information that we Process with "*" for your reference. We need to Process your Sensitive Personal Information to achieve the purposes described below. Before we Process your Sensitive Personal Information, we will seek your separate consent in accordance with Relevant Laws and Regulations.

We do not collect Personal Information from minors under the age of 14. Please ensure that minors in your care do not send us their Personal Information without your consent. If we have received the Personal Information of any minor under the age of 14 in your care, you can get in touch with us using the information in the "HOW TO CONTACT US" section below to have such Personal Information deleted.

Our Processing purposes

We Process your Personal Information for the following purposes:

When you use our application and WeChat mini program, to ensure the normal, safe, and stable operation of related services and functions, we may seek the following device operating system permissions from you:

4. TRANSFERS OF PERSONAL INFORMATION

Entrusted Processing

In order to provide certain services to you, we may need to engage an Entrusted Processor to Process some of your Personal Information. We will enter into strict confidentiality agreements and include Personal Information protection clauses in other agreements with Entrusted Processors that require them to process and protect your Personal Information in accordance with our own high standards, this Addendum and Relevant Laws and Regulations.

Typical examples of Entrusted Processors that we engage with include:

• Professional advisors, such as lawyers, accountants, tax consultants, etc.;
• Technical experts, such as IT security specialists, etc.; and
• Others, such as marketing experts, surveyors, etc.

Domestic Transfers

In order to provide you with the best guest experience possible, we need to share your Personal Information with third parties within China. Please see the list below for more information about the third parties within China that may receive your Personal Information: Before we transfer your Personal Information or Sensitive Personal Information, we will seek your separate consent in accordance with Relevant Laws and Regulations.

Transfers outside China

As a result of the global nature of our business, Members' Personal Information will need to be transferred to Overseas Recipients. Please see the list below for more information about the Overseas Recipients that may receive your Personal Information:

If you would like to exercise any of your legal rights over your Personal Information in accordance with Relevant Laws and Regulations against any of the Overseas Recipients named above, please get in touch with us using the information in the "HOW TO CONTACT US" section below.

Before we transfer your Personal Information or Sensitive Personal Information outside China, we will seek your separate consent in accordance with Relevant Laws and Regulations.

SDKs

We may embed third-party SDKs in our website, app, and WeChat mini program to ensure their stable operation and provide services to you. Please see the list below for more information about the SDKs that we rely on:

Corporate Transactions

If we need to transfer your Personal Information due to a merger, division, dissolution, bankruptcy or any other reason, we will notify you of the organisational or personal name and contact information of the receiving party.

Foreign Governments

We do not share Personal Information with foreign governments except as Relevant Laws and Regulations permit. 

Other Transfers

Because unforeseen situations can occur, we may need to transfer Personal Information in other circumstances not described above. Where this occurs, we will obtain any consent required from you, as required by Relevant Laws and Regulations.

5. SECURITY

We will take reasonable steps to secure your Personal Information against Security Incidents in accordance with Relevant Laws and Regulations and as described in the Privacy Policy. If you have any concerns about the security of your Personal Information or believe that you have experienced a Security Incident, please get in touch with us using the information in the "HOW TO CONTACT US" section below.

6. YOUR RIGHTS

Under Relevant Laws and Regulations, you have the right to:

• require GHA to explain its Personal Information Processing rules;
• restrict or deny the Processing of your Personal Information;
• request access to and make copies of your Personal Information;
• require the transfer of your Personal Information to certain third parties;
• correct your Personal Information if it is incomplete or inaccurate;
• have your Personal Information deleted if:
  • the purpose of Processing has been achieved or cannot be achieved;
  • the Personal Information is no longer necessary to achieve the purpose of Processing;
  • the provision of goods or services cease;
  • the retention period expires; 
  • the Processing conducted by GHA violates Relevant Laws and Regulations or relevant agreements; and
  • required to by Relevant Laws and Regulations in any other circumstances.
• withdraw consent, at any time, to any Personal Information Processing based on consent; 
• demand an explanation of and refuse decisions made solely employing automated decision-making that have a material impact on your rights and interests; and
• refuse or restrict business marketing or push-based information delivery conducted by means of automated decision-making.

Please note that if you decide to withdraw your consent, such withdrawal will not affect the validity of any Personal Information Processing already carried out before the withdrawal based on your consent.

If you would like to exercise the rights described above, please get in touch with us using the information in the "HOW TO CONTACT US" section below. We will deal with your requests to exercise your rights under applicable Chinese laws or administrative regulations promptly and within 15 working days.

Additionally, if you use our mobile application, you can also correct, complete or delete some of your Personal Information by clicking on Account/ Profile in the app.

7. HOW TO CONTACT US

If you have any questions about anything described in the Privacy Policy or this Addendum, or you wish to exercise your rights under Relevant Laws and Regulations, you may get in touch with us using any of the contact details listed below:

GHA Loyalty DMCC (Head Office)

Head office: 21st Floor, JBC5 Tower, Jumeirah Lake Towers, PO Box 487771

阿联酋，迪拜

电话：+971 4 4214287

Email: contact@ghadiscovery.com (available in Chinese and English)

GHA Loyalty DMCC (Representative in China)

Email: contact@ghadiscovery.com (available in Chinese and English)

Prof. Dr. Rolf Lauser

Data Protection Officer

Dr.-Gerhard- Hanke-Weg 31, 85221 Dachau, Germany

电子邮件：data.privacy@gha.com