Personal Data Protection is important to us
Protection of your Personal Data is important to us. This Ascott Personal Data Protection Policy ("Policy") outlines how we manage the Personal Data we hold. The Policy applies to all departments and business units across the Ascott Group. The Ascott Limited (Reg. No.197900881N), and/or its related corporations and affiliates (referred to hereunder as "Ascott", the "Ascott Group", "we", "us" or "our") collectively or singularly as the context requires, recognise the importance of protecting Personal Data.
We respect the confidentiality of Personal Data and privacy of individuals and are committed to complying with the Singapore Personal Data Protection Act (Act 26 of 2012) ("PDPA") and other applicable data protection laws, including the European Union ("EU") General Data Protection Regulation ("GDPR") where applicable. Please read this Policy so that you know and understand the purposes for which we collect, use and disclose your Personal Data.
We adopt a pragmatic"Data-light, Data-tight"approach in our business conduct.
"Data-light" means that we collect Personal Data only for what is required in business or in activities conducted by our organisation and will properly destroy the Personal Data once there is no business or legal purpose. We do not collect Personal Data randomly or indiscriminately without purpose.
"Data-tight" means that we do not disclose your Personal Data unless prior consent has been obtained and we have administrative, physical and Information Technology (IT) security measures to protect your Personal Data.
This Policy supplements but does not supersede nor replace any other consents you may have previously provided to us in respect of your Personal Data, and your consents herein are additional to any rights which any member of the Ascott Group may have at law to collect, use or disclose your Personal Data. This Policy does not affect any rights which we may have at law in connection with the collection, use or disclosure of your Personal Data.
For the avoidance of doubt, to the maximum extent permitted under applicable law, nothing in this Policy establishes any joint and several liability on the part of the Ascott Group members.
1. Your Personal Data
1.1. "Personal Data" refers to any data or information about you from which you can be identified either (a) from that data alone; or (b) from that data combined with other information. Examples of such Personal Data which you may provide us include (depending on the nature of your interaction with us):
a) your name, NRIC number, passport number or other identification number, telephone number(s), mailing address, email address and any other information relating to you which you have provided us in any form you may have submitted to us, or in other forms of interaction with you;b) information about your use of our websites and services, including cookies, IP addresses, subscription account details and membership details; andc) your payment related information, such as your bank account or credit card information, and your credit history.In addition, if you make a reservation to be a resident at one of our serviced apartments or hotels, you may also be asked to provide further information including photo identification about yourself and your family members, such as the dates of your arrival and departure. In order to provide you with better service, we may also collect your preferences, e.g. smoking or non-smoking room, the preferred location of your apartment (low floor, high floor, etc.), type of bed, preferred newspaper etc. All those additional information will be collected in compliance with local laws and regulations. 1.2. In addition, if your Personal Data has been collected, used or disclosed by us in a particular jurisdiction which has specific requirements or exceptions to the definition of Personal Data, including sensitive Personal Data, we will comply with those requirements under the applicable data protection regulations in that jurisdiction.
2. Collection of Personal Data
2.1. We collect your Personal Data in the following ways: a) when you make a reservation (for example through our global reservation team over the phone or online); b) when you submit forms, information or feedback relating to any of our products or services (including by use of our interactive IT touch screens such as iPads/Tablets), or submit any online queries;c) when you register for or use any of our services on websites or apps owned or operated by us or when you register as a member of websites owned and/or operated by us; d) when you interact with our customer service officers or any of our staff, for example, via face-to-face meetings, telephone calls, letters, online forms (such as any "Contact Us" forms on our websites), reservation chat, social media platforms and emails;e) when you use or purchase our services or products; f) when you establish any online accounts with us (such as Ascott Star Reward accounts); g) when you request that we contact you; h) when you respond to our request for additional Personal Data; i) when you ask to be included in an email or other mailing list; j) when you respond to our promotions and other initiatives; k) when you respond to our market surveys; l) when we receive references from business partners, online travel agents and third parties, for example, where you have been referred by them; m) when you submit your Personal Data to us for any other reason; andn) when you browse our website after giving your consent for cookies to run. Please refer to paragraph 8 (Cookie Policy) for more information. We may supervise or record phone calls and customer-facing interactions for quality assurance, employee training and performance evaluation, identity verification purposes, feedback, respond to your queries and requests and resolve complaints and other related purposes. Such monitoring or recording will be in accordance with applicable law, including obtaining explicit consent where required. 2.2. If you provide Personal Data of a third party (e.g. information of your dependent, spouse, children and/or parents) to us, you represent and warrant that the collection, use and disclosure of that Personal Data to us, as well as the further processing of that Personal Data by us for the purposes set out below, is lawful. 2.3. We disclose Personal Data and other data to any legal entity which operates an Ascott Group's Franchised Property (the "Franchisee"). The Franchisee may use these data for the sole purpose of operating the franchised property ("Franchised Property") and therefore qualifies as an independent Data Controller, as defined in article 4 of the GDPR, for the following duties: a) managing and coordinating the stay at the Franchised Property that the Franchisee operates; and b) compliance with legal and contractual obligations, including where applicable maintaining guest registration books and transactional records. 2.4. Each Franchised Property will have its own Data Protection Officer (DPO) who will be an employee or representative of the Franchisee at the property level. 2.5. In respect of our activities in the EU, CapitaLand Limited (the parent entity of The Ascott Limited), The Ascott Limited and Citadines SA (a wholly owned subsidiary of The Ascott Limited) are the ultimate primary data controllers for processing of the Personal Data, and the respective contact details are as follows: CapitaLand Limited (Registration Number 198900036N)Address: 168 Robinson Road #30-01 Capital Tower Singapore 068912Email Address: data.protection@the-ascott.comPhone Number: +33141057879The Ascott LimitedAddress: 168 Robinson Road #30-01 Capital Tower Singapore 068912Email Address: data.protection@the-ascott.comPhone Number: +33141057879Citadines SAAddress: 120 rue jean jaurès F-92532 Levallois-Perret cedex France Email Address: data.protection@the-ascott.comPhone Number: +33141057879 CapitaLand Limited and its related corporations and affiliates are referred to hereunder as the "CapitaLand Group".
3. Use and Disclosure of Personal Data
3.1. Our business is to understand and meet your needs and provide you with the products and services that you require. To do this effectively, we need to collect a range of Personal Data about you as described in paragraph 1 above. 3.2. We will, subject to applicable law, process your Personal Data for the following purposes:
3.3. Depending on the nature of your relationship with us (for example, if you are a member of Ascott Star Rewards), we may collect, use and disclose your Personal Data for additional purposes which you will be notified of or for which your consent would be sought, where required, in accordance with any applicable terms and conditions and applicable laws, regulations and guidelines that govern personal data protection.3.4. Where you have provided us with specific consent, we may also use and disclose your Personal Data for the following purposes: a) providing services and extending benefits to you, including promotions, loyalty and reward programmes, sending you industry market updates (e.g. in real estate), newsletters (e.g. on property) and other information on our products, services, offers or promotions which may be of interest to you and conducting market research to develop special offers, promotional and/or marketing programmes; andb) administering contests, competitions and conducting lucky draws, including, where necessary, announcing the results of these contests, competitions and lucky draws and identifying and contacting the winners.3.5. When you apply for or hold a co-brand product which is offered jointly by us and our co-brand partner(s), we may also collect, use and disclose your Personal Data for the purpose of sharing your Personal Data with the co-brand partners for offering, marketing and promoting to you any products, services, offers or events which the co-brand partner thinks may be of interest to you, in accordance with applicable law, including obtaining consent where required. We will only share your Personal Data with the co-brand partners where permitted by applicable law or if we have collected your consent.3.6. The Personal Data collected for the purposes mentioned in paragraphs 3.2, 3.3 and 3.4 of this Policy will be collected, used and disclosed by relevant members of the Ascott Group and may be shared with relevant members of the CapitaLand Group where necessary for such purposes. For avoidance of doubt, Personal Data collected by third party brand operators of our properties is not covered by this Policy. Third party brand operators refer to operators who are not members of the Ascott Group. These third party brand operators operate their business on these properties independently of the Ascott Group and the Personal Data of individuals such as guests and vendors are collected by the third party brand operators for themselves. The Ascott Group does not have access to such Personal Data. Individuals should check directly with the third party brand operators on their data rights. 3.7. Your Personal Data will be protected and kept confidential, but subject to the provisions of any applicable law, your Personal Data may, depending on the products or services concerned, be disclosed to third parties set out below. Such disclosure may be subject to additional legal requirements under applicable law, depending on the nature of such transfer to third parties. Your Personal Data will, in each case, only be disclosed to the extent necessary and proportionate.The third parties are: a) other divisions or entities within the CapitaLand Group; b) our joint venture/ alliance partners;c) our agents, contractors, third party service providers and specialist advisers who have been contracted to provide us with administrative, financial, research, operational or other services in pursuance of the purposes set out in this Policy, such as telecommunications, information technology, payment, processing, market research, storage and archival; d) any third party business partners who offer goods and services or sponsor contests or other promotional programmes, whether in conjunction with us or not, and where permitted by applicable laws; e) insurers or insurance investigators and credit providers; f) the Credit Bureau, or in the event of default or disputes, any debt collection agencies or dispute resolution centres; g) any business partner, investor, assignee or transferee (actual or prospective) to facilitate business asset transactions (which may extend to any merger, acquisition or asset sale) involving the CapitaLand Group; h) our professional advisors such as our auditors and lawyers; i) relevant government regulators or authority or law enforcement agency to comply with any laws or rules and regulations imposed by any governmental authority; j) anyone to whom we transfer or may transfer our rights and obligations, including, for example, where we obtain the services of a third party organisation to handle any aspect of the processing of your Personal Data for the purposes notified to you in accordance with this Policy; k) banks, credit card companies and their respective service providers; and l) any other party as may be consented to by you, as specified by you or as may be notified to you by us in subsequent notices.In the event that your Personal Data is shared with a third party that acts with a member of the Ascott Group as joint controllers under GDPR, we will, to the extent required by law, provide you with additional information on the responsibilities of each joint controller, any particular means by which you can enforce your rights and the primary contact person for such requests in relation to your rights. 3.8. We require that organisations outside the Ascott Group which handle or obtain Personal Data as service providers to us acknowledge the confidentiality of this data, undertake to respect any individual's right to privacy and comply with the PDPA, the GDPR and any other applicable data protection laws. As a requirement under these laws, we may be required to have specific agreements in place with such third parties to regulate and safeguard your data protection rights. We also require that these organisations use this information only for our purposes and follow our directions with respect to this information.
4. Transfer of Personal Data
4.1. Your Personal Data may be stored in external servers located overseas. In addition, as described above, in carrying out our business, it may be necessary to share information about you with and between our related corporations and third party service providers, some of which may be located in countries outside your country of residence. Such countries may not afford a standard of protection similar to those in your country of residence. However, we will take reasonable steps to ensure that your Personal Data transferred outside of your country of residence is adequately protected. In addition, we will ensure that such transfers comply with the requirements of the applicable data protection laws.4.2. In respect of our activities in EU, where your Personal Data is transferred to locations outside the European Economic Area, we have entered into a special type of contract (called European Commission Model Contractual Clauses) with the recipients of your Personal Data to ensure that they will provide adequate levels of protection for your Personal Data. Moreover, a Data Protection Agreement have been signed between all our entities to ensure compliance with data protection laws and regulations. If you wish, you may request for more information about the transfers of your Personal Data and/or a copy of the European Commission Model Contractual Clauses by contacting the relevant Data Protection Officer at the contact details provided in paragraph 10.1. below.
5. Retention of Personal Data
We may retain your Personal Data for as long as it is necessary for the purposes it has been collected, in accordance with local laws and regulations. You may request for more information about the data retention of your Personal Data by contacting the relevant Data Protection Officer at the contact details provided in paragraph 10 below. Where we no longer require your Personal Data for those purposes, we will delete and therefore cease to retain such Personal Data in accordance with our internal retention policy.
6. Your Rights
6.1. You have the following rights, under applicable data protection laws (except where the exercise of these are restricted under applicable laws – for example, due to judicial proceedings or the carrying out of investigations), which can be exercised by contacting the relevant Data Protection Officer at the contact details provided in paragraph 10.1. below:
a) you have the right to obtain from us confirmation as to whether or not your Personal Data is being processed, request a copy of your information and certain information regarding the processing of your Personal Data as stipulated under applicable data protection laws; b) you are entitled to rectification of your Personal Data. We endeavour to ensure that all Personal Data we have about you is accurate and up-to-date. We understand that this information changes frequently with changes of address and other personal circumstances. We encourage you to contact us as soon as possible to enable us to update any Personal Data we have about you. Incomplete or outdated Personal Data may result in our inability to provide you with products and services you have requested;c) where the processing of your Personal Data is based on consent or on a contract and is carried out by automated means, you have the right to receive your Personal Data you have provided us in a structured, commonly used and machine-readable format or to demand transmission to another controller;d) in certain circumstances, you have the right to request to have your Personal Data deleted or the processing of which restricted;e) where we use your data for direct marketing purposes, you can always object using the unsubscribe link in such communications or by contacting us at the details provided in paragraph 10.1. below;f) to prevent any processing of Personal Data that is causing or is likely to cause unwarranted and substantial damage or distress to you or another individual;g) to be informed about any use of your Personal Data to make automated decisions about you where such decisions produce legal effects or have similarly significant effects on you, and to obtain meaningful information about the logic involved, as well as the significance and the envisaged consequences of this processing; and h) to lodge a complaint about the way in which your Personal Data is being used to a supervisory authority. If you are located in the European Union, as a rule, you can contact the supervisory authority for your habitual residence or place of work or our registered offices.
6.2. Where we rely on your consent to use your Personal Data, you have the right to withdraw that consent at any time. This withdrawal will however not affect the lawfulness of processing based on your consent before your withdrawal.If you withdraw your consent to any or all purposes and depending on the nature of your request, we may not be in a position to continue to provide our products or services to you. Please note, however, that if you have provided us consent in respect of the use of your Singapore telephone number(s) for receiving marketing or promotional information, any such consent provided will not be affected by your withdrawal of your other consent in accordance with the terms set out in this Policy. If you do not wish for your Singapore telephone number(s) to be used for receiving marketing or promotional information, please contact the relevant Data Protection Officer and specify that you wish to withdraw your consent for such purpose.
6.3. Where we process your Personal Data based on the legitimate interests explained in paragraph 3 above, you can object to this processing in certain circumstances. In such cases, we will cease processing your information unless we have compelling legitimate grounds to continue processing or where it is necessary for legal reasons.
6.4. Where mandated under the applicable data protection laws, your exercise of the rights described or referred to above shall be free of charge. In all other situations, we may charge a fee to cover the cost of verifying the request and locating, retrieving and copying any material requested.
6.5. If you want to exercise any of your rights or if you wish to raise a complaint on how Ascott Group has handled your Personal Data, you may contact the relevant Data Protection Officer at the contact details provided in paragraph 10.1. below.
7. Management and Security
7.1. We have appointed Data Protection Officers (as detailed in section 10) to oversee our management of your Personal Data in accordance with this Policy and the applicable data protections laws. We train our employees who handle your Personal Data to respect the confidentiality of your Personal Data, and we regard breaches of all applicable data protection laws very seriously.7.2. As part of our data protection measures against fraudulent activities, please be aware of the following:a) our staff will not be requesting for your confidential or sensitive personal information (including passwords and credit card details) over the phone; or email b) if you receive any call or message, please check the display name, company name and email address or telephone number; andc) please call or email the property you stay with us immediately if you wish to verify the authenticity of the request. Alternatively, you can contact the Data Protection Officers (as detailed in section 10).
8. Cookie Policy
8.1. We use cookies when you use our websites. For our Purpose, Ascott's brand websites have made use of a Cookie Consent Management (CCM) platform to help our online users know which cookies are used on our websites and why they are used. We use two types of cookies, Essential Cookies and Non-Essential Cookies. Please see our Cookie Policy for more details. 8.2. Our website may contain links to other websites operated by third parties, such as our business partners. We are not responsible for the privacy practices of websites operated by third parties that are linked to our website. We have explained third-party cookies and third-party social media cookies under Cookie Provenance in the Cookie Policy. We encourage you to learn about the privacy policies of such third parties. Once you have left our website, you should check the applicable privacy policy of such third parties at their respective websites to determine how they will handle any information they collect from you.
9. Telemarketing Policy
9.1. This section outlines our telemarketing policy which relates only to individual users of Singapore telephone numbers and was developed to comply with the Do Not Call ("DNC") provisions under the PDPA. Our telemarketing policy applies to the Ascott Group unless we have notified you otherwise in writing.9.2. We aim to comply with the DNC provisions and your choices to receive promotional and marketing messages:a) if you have registered your Singapore telephone number with the relevant Singapore DNC registers, we will not send you promotional and marketing messages via SMS, fax, calls and other means (as applicable) to your telephone number;b) however, if you have previously consented to our sending you such messages to your Singapore telephone number(s), we will continue to do so until you withdraw such consent, regardless of your DNC nominations; andc) if you currently have an existing, ongoing relationship with us, depending on the nature of that relationship, we may continue to send you promotional or marketing messages via SMS or fax about products and services which are related to that ongoing relationship notwithstanding your registration with the DNC Registry, unless you opt-out of receiving such messages.
10. How to contact us
10.1. If you have any questions about this Policy or any queries relating to your Personal Data, or you would like to obtain access and/or make corrections to your Personal Data records, please contact the relevant Data Protection Officers: All countries (except EU and Georgia) Name: Dr Freddie Tan, Group Data Protection Officer, CapitaLand LimitedEmail: ascottdpo@the-ascott.comNumber: +65 6713 2705 EU and Georgia For individuals residing in the EU (except Germany) and Georgia, please contact the Data Protection Officer below: Name: Philippe De L'EspinayEmail: data.protection@the-ascott.com Number: +33 1 4105 7879For residents residing in Germany, please contact the Data Protection Officer below: Name: Daniela HartjesEmail: data.protection@the-ascott.comNumber: +33 1 4105 7881
11. Governing Law
11.1. This Policy and your use of this website shall be governed in all respects by the laws of Singapore. For the avoidance of doubt, where applicable, the processing of your Personal Data is also subject to other data protection laws.
12. Review of this Policy
12.1. This Policy will be reviewed from time to time by us. We may also update this Policy to take account of new laws and technology, changes to our operations and practices and the changing business environment. If you are unsure whether you are reading the most current version, please contact us. 12.2. In the event of any inconsistencies between the English version and other translations of this Policy, the English version shall prevail.
Posted as of 15 September 2020
