PRIVACY NOTICE FOR WELLNESS AND FITNESS CENTRE MEMBERSHIP & WELLNESS CONSULTATION AND FITNESS ASSESSMENTS
We hereby inform you of how we process your personal data, pursuant to Articles 13 and 14 of EU Regulation dated April 27, 2016 No. 679 (“General Data Protection Regulation” or “GDPR”) and other applicable law.
Rosewood Hotels and Resorts (Asia Pacific) Limited, Rosewood Hotels & Resorts LLC (US)- New World Hotel Management Limited/ Rosewood Hotels and Resorts Netherlands B.V./ Rosewood Hotels and Resorts, L.L.C.] (“Rosewood”, “we”, “our”, “us”) is a controller of your personal data. Rosewood manages Rosewood Hong Kong Limited (the “Hotel”) on behalf of Rosewood Hotels (Hong Kong) Limited the owner of the Hotel (“Owner”).
Whenever the Owner collects information from you and processes it for its own purposes, the Owner is also a controller of your personal data. The use of your information by the Owner will be governed by its own privacy notices, if and to the extent not already covered under this Notice.
- PERSONAL DATA: USE, PURPOSE AND LEGAL BASIS
Rosewood collects certain information from you in order to complete your application of membership, process your reservation at the wellness and fitness centre, and provide you with goods and services you request, including your contact details, financial banking details, and your travel information (length of stay, nationality, passport information, visa, etc.), images through video surveillance systems. We also collect your personal data to provide you with quality service during your stay such as your contact details to communicate with you, your profile or image, and other information you provide to us such as your room preferences, special requests, dietary preferences, event details or in connection with on-property services, such as concierge services, health clubs, spas, wellness and fitness centers or other activities, including handling of your application for membership in wellness and fitness centers. Also in order to provide you with quality service and based upon our legitimate interests to constantly improve the quality of our service, Rosewood may retain certain documents (including guest comment cards or e-mails) that you send us before, during or following your stay. To further personalize your experience and/or assess your suitability for treatments, we may collect special categories of personal data (if any), such as your health-related data, religious belief, with your explicit consent.
More specifically, Rosewood will process your personal data for the following purposes and based on the following legal basis:
- Performance of hotel reception services and/or wellness treatments and the consequent operation; management of information relating to your stay at the Hotel and visit to the Hotel’s wellness and fitness center, including correspondence, telephone calls and messages directed to you, according to the instructions you will provide to us. To protect your privacy, we will not disclose your stay at the Hotel to any third party, unless you indicate otherwise. The legal basis for this processing is the contract to which you are party.
- Retain certain information and preferences regarding your stay at the Hotel or your visit at the wellness and fitness centre in order to personalize your experience at all Rosewood member hotels; the legal basis for this processing is Rosewood’s legitimate interests in providing you with a personalized experience. If special categories of personal data are concerned (if any), the legal basis is your consent.
- Marketing of Rosewood products and services and promotional activities of Rosewood, our affiliates and partners. The legal basis for this processing is either your consent or legitimate interests in marketing our services to you.
- Provision of the services offered by the Hotel’s wellness and fitness center; in order to further personalize your experience and to protect your health, special categories of personal data relating to your physical condition and your state of health (e.g., medical conditions and allergies) may be processed. The legal basis for this processing is your consent. Such consent will be collected separately at the wellness and fitness center.
More specifically, the Owner will process your personal for the following purposes and based on the following legal basis:
- Fulfilment of law requirements, including all applicable administrative, accounting and tax obligations. The legal basis for this data processing is the need to comply with legal obligations applicable to Owner.
- Marketing and promotional activities of the Hotel by Owner (currently, the Hotel is operated by Rosewood and might in the future be operated by another party). The legal basis for this processing is your consent.
- In furtherance of the Owner’s legitimate interest to ensure your safety and security as well as the safety and security of the Hotel’s employees and the Hotel property, the Hotel uses a video surveillance system in its lobby and other common areas in the Hotel. Images collected from the Hotel’s surveillance feeds are stored only for a limited period of time, subject to legal requirements to retain data (including statutory retention periods), upon which they are deleted.
Providing your personal data for the purposes referred to in Paragraphs (a) and (e) above is required by law or in accordance with a contract to which you are a party. As such, failure to provide such data will prevent Rosewood and Owner from performing its contract and provide you with the services.
Providing your personal data for the purposes referred to in Paragraphs (b) and (d) above (if and to the extent special categories of personal data (such as health data) is concerned), Paragraphs (c) and (f) above is optional and based on your consent. We will inform you the medical conditions that present a contra-indication for using the wellness and/or fitness centre and you may be required to sign a letter of discharge to the use of such services, if required. Alternatively, Paragraphs (b) and (c) is based upon the legitimate interests of Rosewood when it is processing ordinary types of personal data, and failure to provide such data will not affect your membership application or your visit to the wellness and fitness centre. If you give your consent to such processing, we remind you that you have the right to revoke such consent at any time.
Images collected for the purposes referred to in Paragraph (g) is based on the legitimate interest of the Owner and data are kept anonymized unless an incident or complaint has been established.
- YOUR TRAVEL COMPANIONS
You are responsible for delivering a copy of this Notice to your travel companions, on our behalf, and for obtaining the consent of your travel companions, on our behalf, when providing their personal data to us (if applicable). For minors, you represent and warrant that you have the legal authority to provide us their personal data
- SHARING YOUR PERSONAL DATA AND INTERNATIONAL TRANSFERS
- RETENTION OF PERSONAL DATA
In accordance with the principles of proportionality and necessity, your personal data will not be retained for a period longer than the time necessary to achieve the purposes for which data are collected, subject to legal requirements to retain data (including statutory retention periods).
Your personal data that we process based upon your consent, including your consent into marketing activities or your consent into processing special categories of personal data (if any), can generally be used for the purposes of the consent and retained until your consent is revoked, unless there are other legal grounds for processing, such as legal requirements to retain data (including statutory retention periods).
Generally, we may also retain your personal data as long as necessary for the establishment, exercise or defense of legal claims. More detailed information can be communicated upon request.
- YOUR RIGHTS
To the extent these rights are provided to you by law (including the GDPR, the UK Data Protection Act or other laws), you are entitled to obtain access to and information on the processing of your personal data, make use of your right to data portability and to have your personal data rectified or deleted or their processing restricted.
You may object to the processing of your personal data under certain circumstances, including objecting to processing your personal data when it is done based upon legitimate interests (e.g., sending you marketing related-materials or using your personal data contained in documents, such as guest comment cards or emails, that you send us for the purpose of personalizing our services to you).
If you no longer wish to receive any marketing-related materials, you may also opt-out by unsubscribing following the instructions included in any email or other marketing material you receive from us.
You may withdraw any consent to the processing of your personal data, including any marketing consent, at any time with future effect.
If you believe that your Personal Data is not being processed in accordance with the applicable law (including GDPR), you are also entitled to contact or lodge a complaint with the supervisory authority or seek other remedies under applicable law.
To fulfill your requests for exercising your rights under applicable law (including the GDPR or the CCPA), it may be necessary for us to verify your identity or authority to make the request and confirm the personal data relates to you.
FOR OUR GUESTS WHO ARE CALIFORNIA RESIDENTS
If you are a California resident, the California Consumer Privacy Act (“CCPA”) provides you with specific rights regarding your personal information. You have the right to be informed of the categories of personal data that we collect about you, the categories of sources from which the personal data was collected, the business or commercial purposes for which the personal data is used, disclosed, or sold, and the categories of third parties with whom we share the personal information, as set forth in this Notice. You have the right to request that we disclose specific pieces of personal data we collected about you over the past (12) twelve months. You have the right to request that we delete any of your personal data that we collected from you and retained, subject to certain exceptions. You also have the right to opt out of the sale of your personal information. If you would like to exercise any of your above rights, please contact us as described below.
To fulfill your requests for exercising your rights, we verify your identity or authority to make the request and confirm the personal data relates to you, or others, if you are an Authorized Agent (see below). Accordingly, Rosewood will collect your name, e-mail address and phone number to verify your identity. Once we have verified your identity, we will respond to your request within 45 days, unless additional time is needed, in which case we will let you know.
You may also exercise your rights via an authorized agent (“Authorized Agent”). An Authorized Agent can be a third party that you authorize to act on your behalf, such as a third party with power of attorney. When an Authorized Agent is submitting a request on your behalf, we will require such Authorized Agent to provide evidence (e.g., a written permission, declaration or affidavit) demonstrating that they have authority to make the request on your behalf, and the Authorized Agent would have to verify their own identity directly with us.
Please note that if we cannot verify your identity, we are not obligated to provide you or your Authorized Agent information regarding your personal information.
- CONTACT US
If you wish to exercise any of your rights above, or if you have any questions concerning the content of this Notice or generally our data processing practices, or, you may:
- Email us at firstname.lastname@example.org
- Calls us toll-free in the U.S. at 1-866-923-1608 (fees may apply outside the United States)
- Visit Rosewood Hotels And Resorts Privacy Rights Request Form at https://www.rosewoodhotels.com/en/privacy-rights-request