2 Scope of Personal Information We Collect
2.1 The types of Personal Information we collect will depend on the specific type of Services as requested by, or provided to, you, including Personal Information you provide from time to time and Personal Information we collect, generate and compile about you from time to time. The types of Personal Information may include (without limitation) the following:
(a) your personal information (e.g. your name, gender, date of birth, age or other personally identifiable number);
(b) your contact information (e.g. telephone numbers, addresses, WeChat accounts, WeChat avatars, email addresses and fax numbers, including your contacts and business information you disclosed to us through the exchange of business cards when you participate in events and activities conducted by us, whether registered in advance or open to the public at any time);\
(c) your WeChat pay information and related order list, loyalty member bonus points collection and redemption, e-coupons collection and usage, members self-help parking orders and page visits information relevant to your use of our WeChat mini programme services;
(d) information relevant to your use of our Information Services or any Services (e.g. behavioural information, browser details, IP addresses, purchasing history, location information, etc.);
(e) information stored when you use our Information Services or any Services (including "Log Information", "Location Information" and "Other Information", as defined in paragraph 2.2 below); and/or
(f) shared information about you as provided by third parties when they use our Services (Please refer to “How we share your information” below).
2.2 When you use our Services (including Information Services), we may also collect the following information:
(a) log information, which refers to the technical information that the system may automatically collect through Cookies or other means when you use our Services ("Log Information"), including:
(i) device or software information, e.g. configurations provided by your mobile device, web browser or other programs that you use to access our Services, your Internet Protocol (IP) address and Media Access Control (MAC) address and version of your mobile device and device identification number;
(ii) information you search and browse while using our Services, e.g. the web search terms you use, URL of the social media page you visit, and other information and content details that you browse or request while using our Services;
(iii) information of the App and other software that you have previously used, and the log data of your previous use of such App and software;
(iv) information about your communications through using our Services, e.g. the accounts that were used to communicate, and the time, data and duration; and/or
(v) information (metadata) contained in the content that you have shared through using our Services, e.g. date, time or location of shared photographs or videos taken or uploaded.
(b) location information, which refers to the information about your location that we collect when you turn on the positioning function of your device and use our related location-based services ("Location Information"), including:
(i) your location information we collect through GPS or WiFi etc., when you use our Services with your mobile device with positioning function;
(ii) real-time information provided by you or other users that includes your geographic location, e.g. your location information contained in the account information you provide, shared information uploaded by you or others that shows your current or previous geographic location, e.g. geo-tagging information contained in photographs shared by you or others; and/or
(iii) you may cease our collection of your Location Information at any time by turning off the positioning function; and
2.3 There are several ways for us to collect your Personal Information, including that we may directly collect your Personal Information from you (such as when you reserve for our Services or register for our membership programme), or we may collect your Personal Information from third parties including our agents and services providers to facilitate your use of our Services, or we may collect your Personal Information when you participate in our activities.
2.4 Your Personal Information is required for the use of our Services. If you fail to supply such Personal Information requested, we may not be able to deliver to you the relevant services or products. By providing your Personal Information to us, you acknowledge that you have made an informed decision in providing such Personal Information.
3 How We Use Your Information
3.1 When we provide our Services to you, we may Process the following Personal Information of yours for one or more of the following purposes:
(a) sharing your Personal Information with us and other third parties (see paragraph below) for the purposes contemplated under this paragraph;
(b) identification and verification of Personal Information in connection with registration, subscription, payment and/or provision of the Services that may be supplied to you;
(c) facilitating and receiving payment for any of the Services, including verification of purchase order details with third parties;
(d) providing you with Services content on our website or other telecommunications channels, including our account page on WeChat / Weixin (“Pages”);
(e) facilitating reservations with or through us or any of our subsidiaries, holding companies, any of their direct or indirect subsidiaries, or any of our joint ventures or associated companies (“Group Companies”);
(f) facilitating the leasing, development, sale, purchase and/or management of our portfolio properties in the Chinese Mainland with Merchants (as defined in paragraph 3.1(k)), and managing our ongoing relationships with Merchants;
(g) marketing or promotions of the Services and/or Activities (as defined in paragraph 3.1(k) below) of us, our Group Companies and/or the Merchants (as defined in paragraph 3.1(k) and 4.1 below). We, our Group Companies or the Third Party Personal Information Handlers (as defined in paragraph 4.1 below) may send you (at no charge) any news, latest offers, promotions or marketing information relating to those Services (provided by us or our Group Companies), Activities (held by Merchants) or activities held by us or our Group Companies in the portfolio of properties we msanage via email, letter correspondences, telephone, text messages, WeChat Push etc., or any direct marketing information sent to you by direct marketing suppliers, including but not limited to products, facilities, services, membership programmes, reward programmes, activities, contests, lucky draws, promotions, blogs, communications and/or project information (“Business Information”) related to cultural, entertainment and sports facilities and activities, commercial and residential properties, restaurants, spas, consumer products, food and beverages, books and stationery, fashion and accessories, children’s products, watches, jewellery and other luxury goods, eye-care products, personal care products, health and beauty products and services, household decoration and appliances, florists, sporting goods and products, electronic products and electrical appliances, banks and financial services, charity activities, motor vehicles and parking facilities;
(h) promoting and soliciting donations or contributions for charitable or non-profit making causes (including poverty alleviation, advancement of education or religion, health promotion, life-saving, relief to victims of disasters or epidemics, relief to persons with disabilities, assistance to those in need due to young age, old age, gender, ethnicity, ill health, financial hardship or other disadvantageous conditions, protection of animals, protection and improvement of environment, or any other charitable purpose for the benefit of the society);
(i) communicating with you by email, letter correspondences, telephone, WeChat Push or other means, including contacting you regarding any enquiries or feedback that you may have about our Services;
(j) conducting research and/or analysis from time to time to better understand your shopping, dining, spending and/or other consumption needs, preferences, interests, experiences and/or habits;
(k) designing new and/or enhancing existing Services, products, facilities, activities, contests, lucky draws and/or other projects relating to our or our Group Companies’ portfolio of properties or tenants in such portfolios of properties (“Merchants”) (together, the “Activities”), and/or administering any of the Activities conducted by us or our Group Companies (or on our behalf) or by the Merchants;
(l) providing customer support services and managing relationship with our Merchants;
(m) facilitating applications of, and operating and administering any membership, loyalty or reward programmes (including joint collaborations with other brands that we may partner with from time to time);
(n) making disclosures when required by law, regulation, or court order of any jurisdiction and/or as requested by any government, regulatory or law enforcement authority or administrative organisation, which may be within or outside the Chinese Mainland; and
(o) establishing legal claims or defences, and/or obtaining legal advice, and/or exercising, safeguarding and/or protecting the rights or properties of us and our Group Companies, including identifying, contacting or bringing legal action against any person who may be causing interference with such rights or properties (whether intentionally or otherwise) or where any other person could be harmed or property of any other person could be damaged by such interfering activities.
3.2 We will not knowingly or intentionally use, share or sell your Personal Information in ways which are unrelated to the above purposes without your prior consent.
3.4 If you agreed to receive Business Information, but do not wish to receive Business Information in the future, you may opt out of receiving or unsubscribe from our Business Information at any time, free of charge, by the following applicable means:
(a) unsubscribing by following the "Reply To" instructions contained in the marketing text message; or
(b) following the unsubscribe instructions or hyperlink in the email; or
(c) following the unsubscribe instructions in the mobile application; or
(d) notifying us that you no longer wish to receive Business Information when receiving our marketing calls; or
(e) notifying us in the manner set out in paragraph 9.1 that you no longer wish to receive Business Information through any channel.
3.5 We may issue Service-related announcements to you when necessary (e.g. when we suspend a Service due to system maintenance). You may not be able to opt out of these announcements which are Service-related and not promotional in nature.
3.6 In order to enhance your experience, to improve our Services or for other uses to which you agreed, we, subject to compliance with applicable laws and regulations, may combine or customize the Personal Information we collected through one of our Services and make them available for use in our other Services. For example, Personal Information collected when you use one of our Services may be used in another Service for the provision of specific content or display of information to you which is relevant to you but not otherwise distributed generally. You may also request that we use the Personal Information you provided and stored in the relevant Service for use in our other Services, if we provide the option in the relevant Service.
3.8 We shall not be required to obtain your consent to Process your Personal Information if any of the following situations applies:
(a) where the Processing of Personal Information is necessary for the conclusion or performance of a contract to which you are a contracting party, or where it is necessary to carry out human resources management according to lawfully formulated labour rules and lawfully concluded collective contracts;
(b) where it is necessary to perform a statutory responsibility or obligation, for example, making disclosures when required by law, regulation, or court order of any jurisdiction and/or as requested by any government, regulatory or law enforcement authority or administrative organisation, which may be within or outside the Chinese Mainland;
(c) if the Processing of Personal Information is necessary to respond to a public health emergency, or to protect the life, health or property safety of an individual in case of an emergency;
(d) where Personal Information is processed within a reasonable scope to carry out news reporting, public opinion supervision or any other activity for public interest purposes;
(e) where the Processing relates to Personal Information disclosed by you or otherwise already lawfully disclosed, within a reasonable scope in accordance with applicable laws;
(f) if the Processing of Personal Information is directly related to:
(i) national security and national defence;
(ii) public safety, public health and major public interest; or
(iii) criminal investigations, criminal prosecutions, adjudication or enforcement of judgments, or other related matters.
4. How We Share Your Information
4.1 We will not transfer and/or disclose your Personal Information to Third Party Personal Information Handlers who will Process your Personal Information according to their own purposes and methods of Processing.
4.2 Furthermore, we may transfer and/or disclose your Personal Information to third parties appointed by us who only Process your Personal Information on our behalf, including any agent, contractor or third-party service provider who provides administrative, marketing and research, distribution, data processing, telemarketing, telecommunications, computer, payment or other services to or support the operation of our or our Group Companies’ business (including its/their direct marketing activities). You can contact us for information about the overseas parties to whom we provide personal information from Chinese Mainland.
4.3 Other than those stated in paragraphs 4.1, 4.2 and 3.8 above, we will not share your Personal Information with any other third parties, except that we may share data or statistics (which are not Personal Information) with third parties in aggregated or anonymised form.
4.5 With the continuous development of our business, we may engage in mergers, acquisitions, dissolution, liquidation, transfer of assets or similar transactions, and in such cases, we shall: (i) inform you all such information that is required under applicable Chinese Mainland data protection laws; and (ii) your Personal Information may be transferred to any actual assignee or purchaser of all or any part of our (and/or our Group Companies) business and/or assets; and our service providers in these situations.
5 Third-party Services
5.1 In order to better provide our Services to you, our Services may include or link to social media or other services (including websites, mobile applications, etc.) provided by third parties, e.g.:
(a) You may share certain content with our Services using the “Share” button, or you may log in to our Services through the connection services of third parties. Your information (including your Log Information) may be collected through these functions, and Cookies may be transferred to your computer for normal operation of the above functions;
(b) We provide you with links through advertisements or other means of our Services that give you access to third-party services or websites.
6 Reminder About User Information Sharing
6.1 Our various Services allow you to publicly share your relevant information, not only with your social networks but also with all users of those Services, e.g., the information you upload or post through our Services (including your publicised Personal Information, the lists you have created), your responses to information uploaded or posted by others, the relevant Location Information and Log Information. Other users of our Services may also share your related information (including Location Information and Log information). In particular, our social media services are specifically designed to allow you to share information with users around the world so that shared information can be delivered real time and extensively. As long as you do not delete the shared information, the information remains in the public domain; even if you delete the shared information, the information may still be cached, copied or stored independently by another user or unrelated third parties not controlled by us, or kept by other users or such third parties in the public domain. Therefore, you should carefully consider the content of the information you upload, post and exchange through our Services.
7 Reminder About Sensitive Personal Information
7.1 Certain Personal Information may be considered sensitive Personal Information due to their particularity. “Sensitive Personal Information” means Personal Information which, if leaked or used illegally, may easily cause harm to the dignity of natural persons, or cause harm to personal or property safety, including biometric information, religious belief, specific identity information, health and medical information, financial account information, individual location tracking information and Personal Information of minors under fourteen (14) years old.
7.2 Please note that the content and information you provide, upload or post through our Services (e.g. photographs or information about your social activities) may disclose your Sensitive Personal Information. You need to carefully consider whether your Sensitive Personal Information should be disclosed through our Services. For certain Services, it is necessary for you to provide such Sensitive Personal Information to us before we can provide you such Services. If you do not provide us with your separate consent, we may not be able to provide such Services to you.
7.3 We will only Process your Sensitive Personal Information after we obtain your separate consent.
8 How We Retain, Store and Protect Your Information
8.2 In order to ensure the correct use and to maintain the accuracy of Personal Information collected from you, as well as preventing unauthorised or accidental access, disclosure, alteration, loss or other use of Personal Information, we have implemented various internal management policies (including physical, electronic and management measures) and various security technologies and procedures based on classification of Personal Information we collect from you. For example:
(a) where we collect Personal Information online, we use an industry standard for encryption over the Internet known as Secure Socket Layer (SSL) protocol to protect Personal Information;
(b) our websites have firewalls in place, which should protect Personal Information collected from you against unauthorised or accidental access;
(c) where required under applicable Chinese Mainland data protection laws and regulations, we will encrypt and/or de-identify your Personal Information;
(d) your Personal Information will only be accessed by our personnel on a “need-to-know” basis;
(e) we ensure that our personnel are regularly trained on data protection matters; and
(f) in order to mitigate any potential risks of unauthorised Processing of your Personal Information, we maintain a security incident response plan. Where required by applicable Chinese Mainland regulations, we will also seek to inform you and the relevant authorities of any incidents concerning the Personal Information we Process on your behalf.
However, please understand that, due to technical and risk prevention limitations, even if we have made our best effort to enhance security measures, we cannot ensure that the information is absolutely safe. You should note that the systems and communication networks you use to access our Services may be subject to problems beyond our control. Therefore, you are advised to protect against unauthorised access to your password and credit card details. When using a shared computer, make sure you sign out from your account when finished.
To the extent required under applicable Chinese Mainland laws, we will be responsible for the Personal Information security incidents.
9 How Do You Exercise Your Data Subject Rights
9.1 You (or your next of kin or you acting on behalf of your minors, to the extent permitted by applicable Chinese Mainland data protection laws and regulations) are entitled to exercise the following data subject rights as permitted under applicable Chinese Mainland data protection laws and regulations:
(a) access, copy, (where your Personal information is inaccurate or incomplete) correct and/or supplement your Personal Information held by us;
(b) restrict or reject the Processing of your Personal Information;
(c) request deletion or de-registration of your Personal Information which is held by us (where the purposes of Processing have been or cannot be fulfilled or are no longer necessary, where we cease to provide the Services or the retention period ends, where there is a breach of applicable law in our Processing or otherwise required by applicable law);
(d) withdraw your consent to us Processing your Personal Information;
(e) request us to transfer your Personal Information to another organisation, if such transfer satisfies the applicable rules imposed by relevant authorities; or
(f) request us to explain our rules on Processing of your Personal Information.
9.2 If you wish to exercise any of the rights in paragraph 9.1 above, please contact us as follows:
Contact person: Data Protection Officer
Address: 25/F, ONE INDIGO, 20 Jiuxianqiao Road, Chaoyang District, Beijing, PRC
Email address: email@example.com
9.3 We will endeavour to use appropriate technical means to ensure that you can exercise the above data subject rights through the use of our Services. In processing your requests relating to your data subject rights, we may ask you to authenticate your identify in order to protect the safety of your account.
9.4 To the extent permitted by relevant laws and regulations, we reserve the right to: (i) refuse unreasonable requests (e.g. requests which infringe the privacy of others); and (ii) charge a reasonable fee for the cost of processing any data access or correction requests.
10.2 Cookies contain information about you and your preferences. For example, if you inquire about rates and availability, the site might create a Cookie that contains the details you entered. Cookies might only contain a record of which pages within the site you visited, to help the site customise the view for you the next time you visit.
10.3 Only the information that you provide, or the choices you make while visiting a website, would be stored in Cookies. For example, the site cannot identify your email name unless you choose to input it. Allowing a website to create Cookies does not give that site or any other site access to the rest of your computer, and only the site that created the Cookies can read it.
10.4 We may also collect Log Information regarding your IP address, browser type, domain name and access time. Such information will be used for internal research purposes. As it is not associated with any identified or identifiable natural person, it may be separate from your Personal Information. In rare instances, IP addresses may be used to assist in deterring and/or preventing abusive or criminal activities on the website.
10.5 If you use the WiFi available at our properties, we may collect the MAC address of your mobile device. We may use your MAC address to keep track of your activity patterns and preferences in order to improve the level of service you receive. Your MAC address may be combined with other information we receive from third parties to provide you with better service and, where you have consented to receive marketing and promotions messages, we may provide you with targeted advertisements, content, features, deals and offers.
10.6 If you interact with us on social media platforms (e.g. if you "Like" our Weibo Page or post on our Timeline, or subscribe to our WeChat Official Account), we can interact with you and send you messages via these platforms. We will interact with you in accordance with the rules of the social media platform but we are not responsible for how the platform operators collect and handle your personal data. We will not be responsible for what third parties post on our social media accounts.
11. Age Limit
11.1 Our Services target those who are above the age of fourteen (14). If you have not reached fourteen (14) years of age, please ensure that you have obtained your guardian’s consent before providing us with your Personal Information.
11.2 We will not collect, use or otherwise process Personal Information of individuals who are under fourteen (14) years of age without separate consent from their parents or guardians.
(a) the situation as expressly set out in paragraph 5.2 above; and
(b) information collected by other companies and institutions that advertise through our Services.