United States (US) federal and state privacy laws apply to the processing of information of residents of the United States. This section is meant to provide supplemental or specific information for residents of California and certain other US states. We encourage you to read the full policy for a complete picture of our privacy practices.
For purposes of the California Consumer Privacy Act (CCPA) personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household.
During the past 12 months, we have collected the following categories of information from the listed sources, used it for the listed business purposes and shared it with the listed categories of third parties. The categories of information include information we collect from our website visitors, registered users, vendors, suppliers and any other person that interacts with us either online or offline. Not all information is collected about all individuals. For instance, we may collect different information from applicants for employment or from vendors or from customers.
If you join the loyalty programme, we may also process your personal information in accordance with section 1.5 “WHAT INFORMATION WE PROCESS, AND HOW WE PROCESS AND USE YOUR INFORMATION IF YOU ARE A LOYALTY PROGRAMME MEMBER” in the General Terms. See also section 3.2 of this Notice below for our Notice of Financial Incentive for members of our loyalty programme.
| Category of information collected | Source | Business purposes* for use | Categories of third parties receiving information |
|---|---|---|---|
Identifiers (name, alias, date of birth, postal address, email address, phone number, fax number, account name, unique personal identifier, IP address) And Information About You. Information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, your name, signature, physical characteristics or description, address, telephone number, bank account number, credit card number, debit card number, or any other financial information, or medical information,. | Individuals submitting information to us Information we may receive from third-party marketing and data partners (e.g., for making bookings and reservations) | auditing relating to transactions security detection, protection and enforcement; ad customization performing services for you including operating our loyalty programme internal research and development quality control | service providers (such as payment processors, mail houses, marketing partners, shipping partners) affiliated companies government regulators and law enforcement (when lawfully requested) |
| Protected classification information (gender, ethnicity, religion, disability) | individuals submitting information | performing services for you to accommodate any special needs | service providers affiliated companies government regulators and law enforcement (when lawfully requested) |
| Commercial information (transaction history, products/services purchased, obtained or considered, product preference) | individuals submitting information information we automatically collect from website visitors information we may receive from third-party marketing or data partners information we collect for security purposes | auditing relating to transactions security detection, protection and enforcement ad customization performing services to you including operating our loyalty programme internal research and development quality control | service providers (such as payment processors, mail houses, marketing partners, shipping partners) affiliated companies government regulators and law enforcement (when lawfully requested) |
| Electronic network activity (browsing or search history, website interactions, advertisement interactions) | information automatically collected from website visitors | functionality debugging/error repair ad customization internal research and development quality control | service providers (such as marketing partners) affiliated companies government regulators and law enforcement (when lawfully requested) |
Audio, video or similar information (customer service calls, security monitoring) Geolocation (geo-targeting for digital and social media ads) | individuals submitting information information we automatically collect from website visitors information we may receive from third-party marketing or data partners information we collect for security purposes | auditing relating to transactions security detection, protection and enforcement performing services for you internal research and development quality control ad customization | service providers (such as payment processors) affiliated companies government regulators and law enforcement (when lawfully requested) service providers (such as marketing partners) |
| Inference from the above (preferences, characteristics, behaviour, attitudes, abilities, etc.) | internal analytics | auditing relating to transactions security detection, protection and enforcement ad customization; performing services for you internal research and development quality control | service providers (such as payment processors, mail houses, marketing partners) affiliated companies |
We also collect the below categories of sensitive personal information as defined under California law.
We do not use or disclose your sensitive personal information for purposes other than those necessary to provide you with benefits and services, to aid in protecting and securing your personal information and our systems, to verify or maintain the quality or safety of our services and systems, or as otherwise permitted under regulations or required by law.
| Category of sensitive information collected | Source | Business purposes* for use | Categories of third parties receiving information |
|---|---|---|---|
Account log-in, password, or credentials allowing access to an account. | individuals submitting information (including employment applications) | auditing relating to transactions security detection, protection and enforcement performing services for you internal research and development quality control | service providers (such as payment processors, employee benefits partners) affiliated companies government regulators and law enforcement (when lawfully requested) |
| Personal information collected and analyzed concerning a consumer’s health. | individuals submitting information | performing services for you to accommodate any special needs | service providers affiliated companies government regulators and law enforcement (when lawfully requested) |
| Precise Geolocation | individuals via the mobile App | locate the hotels in proximity with guest location and sorting the offerings by these hotels. during the guest registration on the mobile App, pre-populate the location field and the country code based on the guest location | service providers |
*MORE SPECIFICALLY, THE BUSINESS PURPOSES INCLUDE:
PERFORMING SERVICES FOR YOU
ADVERTISING CUSTOMIZATION
For marketing and promotions we believe you may find of interest and to provide you, or allow selected third parties to provide you, with information about products and services that may interest you.
AUDITING RELATING TO TRANSACTIONS, INTERNAL RESEARCH AND DEVELOPMENT
SECURITY DETECTION, PROTECTION AND ENFORCEMENT; FUNCTIONALITY DEBUGGING, ERROR REPAIR
QUALITY CONTROL
We offer our customers the opportunity to participate in our loyalty programme, which provides benefits, including discounts on meals, goods or hotel services, as well as the opportunity to earn points which can be used to redeem goods or services. Those benefits are described along with other important information in the Terms and Conditions . A full list of our participating venues, along with the benefits they provide, can be found here .
In order to offer the our loyalty program to our members, we collect and process member’s personal information as described above in section 1.5 “WHAT INFORMATION WE PROCESS, AND HOW WE PROCESS AND USE YOUR INFORMATION IF YOU ARE A LOYALTY PROGRAMME MEMBER” in the General Terms.
We estimate the value of a member’s personal information to us, solely for purposes of the California Consumer Privacy Act (CCPA) and pursuant to the valuation criteria specified by the CCPA Regulations, to be on average approximately $0.39 per consumer in 2024. This estimate is not specific to any individual consumer and varies per consumer. We have based this good-faith estimate on the value that arises from our commercial relationships and the collection and retention of the personal information of consumers who have voluntarily signed up and chosen to remain in the loyalty programme. The value of programme benefits to members varies significantly as individual members take advantage of programme benefits to varying degrees.
To join our loyalty programme, you may sign up on the loyalty programme website or mobile App (including the WeChat mini program), the Guest Registration Card, our booking system, or (if you have been part of a pre-existing loyalty programme) register on our Legacy Enrolment page. Programme members can withdraw from the programme at any time via email to enquiry@brilliantbylangham.com , as well as through prescribed forms on our websites . You may also have the right to request that we delete personal information that we collect about you, as well as other rights as described in this Privacy Policy. As the personal information we collect from loyalty programme members is necessary for us to provide the programme, exercising your right to request that we delete your personal information may prohibit us from being able to continue to offer your membership in the programme.
We do “share” the below categories of personal information relating to California residents for cross-context behavioural advertising purposes. This means that we may share your personal information with our business partners in order to target advertising based on personal information obtained from your activity across businesses, distinctly‐branded websites, applications, or services, other than our websites and services with which you intentionally interact. We may also transfer your information to other third party services that provide us with data analysis and security services, which may fall under the definition of “other valuable consideration” and may be considered a “sale” under the CCPA. We do not otherwise “sell” your personal information, as defined under California law. During the past 12 months we disclosed the below categories of personal information with third parties for a business purpose which may fall within the definition of a “sale”.
You have the right to opt out of this sharing. If you are a California resident over the age of 16 and would like to instruct us not to sell your personal information, please visit our Do-Not-Sell web page here . We do not sell personal information of individuals we actually know are less than 16 years of age. If you request that we not sell your information we will honour your request within 15 days, will notify those who received your information in the 90 days before your request to not further sell your information and will notify you when this has been completed. Once we receive your Do-Not-Sell request we will wait at least 12 months before asking you to reauthorise personal information sales.
VISIT OUR DO-NOT-SELL WEB PAGE
OR call our toll-free number at (+1) 833-906-2154
| Category of information we “share” or “sell” | Third Parties With Whom We Share This Information |
|---|---|
| Personal identifiers (identifiers such as a real name, alias, postal address, unique personal identifier, online identifier Internet Protocol address, email address, account name, or other similar identifiers) | service providers (such as marketing partners) affiliated companies |
| Commercial information (transaction history, products/services purchased, obtained or considered, product preference) | service providers (such as marketing partners) affiliated companies |
| Electronic network activity (browsing or search history, website interactions, advertisement interactions) | service providers (such as marketing partners) affiliated companies |
| Geolocation (geo-targeting for digital and social media ads) | service providers (such as marketing partners) affiliated companies |
As a California resident, you may be entitled to all or some of the rights described below regarding your personal information, subject to certain conditions and limitations. Only those rights relevant to you will apply, and our inclusion of information about privacy laws does not imply that all privacy laws are applicable.
Data solely retained for data backup purposes is principally excluded from these rights until it is restored to an active system or next accessed or used for a sale, disclosure, or commercial purpose.
We will not discriminate against you as a result of your exercise of any of these rights.
HOW TO EXERCISE YOUR RIGHTS
In order to make a request for disclosure California residents may contact us by calling us toll-free at (+1) 833-906-2154 or by visiting our CCPA request page here . We will ask you for information that allows us to reasonably verify your identity (that you are the person about whom we collected personal information) and will use that information only for that purpose. We may request that you submit a signed statement under penalty of perjury that you are the individual you claim to be. We will acknowledge receipt of your request within 10 days and will endeavor to respond within 45 days of receipt of your request, but if we require more time (up to an additional 45 days) we will notify you of our need for additional time. For requests that we not sell your information we will comply with your request within 15 days.
We cannot respond to your request or provide you with personal information if we cannot verify your identity and confirm that the personal information relates to you. In order to verify your identity, you will need to submit information about yourself, including your name, contact information, and, to the extent applicable, providing your account login credentials. We will match this information against information we have previously collected about you or provided to you to verify your identity and your request. If we are unable to verify your identity as part of your request, we will not be able to satisfy your request. We are not obligated to collect additional information in order to enable you to verify your identity. For deletion requests, you will be required to submit a verifiable request for deletion and then confirm separately that you want personal information about you deleted. Information collected for purposes of verifying your request will only be used for verification.
You may make a request for disclosure of the information we collected about you, or our sharing practices in respect of that data up to twice within a 12-month period. You may make a request that we not sell information or for deletion of your information at any time.
For requests for a copy of the personal information we have collected during the 12 months prior to your request we will endeavour to provide the information in a format that is readily useable, including by mailing you a paper copy or providing an electronic copy to your registered account, if you have registered an account with us.
For requests for deletion of your information please understand that California law permits us to retain certain information and not to delete it under certain circumstances. By way of example, we are not required to comply with a request to delete information if the information is necessary for us to complete a transaction for you or otherwise perform a contract; to detect, protect against, or prosecute security incidents, fraud or illegal activity; to use the information only internally in ways reasonably aligned with your expectations as our customer (such as maintaining sales records), and to comply with legal obligations. If we receive such a request from you we will notify any service providers we have engaged to delete your information as well.
Please note that under applicable privacy law, we are only obligated to respond to personal information requests from the same consumer up to two times in a 12-month period. In addition, under applicable privacy law, and for the protection of your personal information, we may be limited in what personal information we can disclose.
California law also permits you to request in writing a list of the types of personal information that we have disclosed to a third party for their direct marketing purposes during the preceding year and to whom that information was disclosed.
VISIT OUR CCPA REQUEST PAGE OR
call our toll-free number at (+1) 833-906-2154
USING AN AUTHORIZED AGENT
You may submit a request through someone holding a formal Power of Attorney. Otherwise, you may submit a request using an authorised agent only if (1) you provide the authorized agent with written permission to make a request and (2) you verify your own identity directly with us. We will require the agent to submit proof to us that they have been authorized to make requests on your behalf.
This Notice applies to you if you are located in Mainland China.
Langham Hotels (Shanghai) Company Limited and Langham Hotels International Limited process your personal information for the purposes set out in this Notice and are the controllers of all customer personal information. More specifically, Brilliant Loyalty Program Limited (an affiliate of Langham Hotels (Shanghai) Company Limited and Langham Hotels International Limited) operates the loyalty programme and is the controller of the personal information of loyalty programme members.
In this Notice, “personal information” means any type of information (recorded via electronic means or otherwise) associated with an identified or identifiable natural person, but excluding any anonymised information. “Sensitive personal information” means personal information which, if leaked or used illegally, may easily cause harm to the dignity of natural persons, or cause harm to personal or property safety, including biometric information, religious beliefs, specific identity information, health and medical information, financial account information, individual location tracking information and personal information of minors under the age of fourteen (14).
In general, we may collect and process your personal information in the following scenarios:
In addition to the purposes listed above, we may process your personal information for the following purposes:
We will obtain your consent for the processing of your personal information as required by applicable laws and regulations. If there is any change to the types of personal information processed, the purposes for which such information is processed or the means of processing, we will obtain your consent for such change if required by applicable law. Please note, we shall not be required to obtain your consent to process your personal information if any of the following situations apply:
We may also indirectly receive your personal information from third party organisations, such as the various partners with whom we work, where you have provided your consent for such information to be shared with us or where we have a legal basis to use the personal information in order to provide you with our products and services. You may contact us for more information about the source of your personal information.
If you join the loyalty programme, we may process (including collect, store, use, edit, transfer, provide, publish or delete) your personal information in accordance with section 1.5 “WHAT INFORMATION WE PROCESS, AND HOW WE PROCESS AND USE YOUR INFORMATION IF YOU ARE A LOYALTY PROGRAMME MEMBER” in the General Terms.
Your indication of consent to the Privacy Policy shall not entitle us to collect and process all personal information for the loyalty programme. We shall only collect and process those personal information which are necessary to perform and carry out the relevant business functions or purposes.
Please refer to the section 5.1 “COOKIES” in the General Terms of the Privacy Policy on how we may use cookies to enhance your experience on the loyalty programme website. We use cookies to understand site usage and to improve the content and offerings on our sites. For example, we may use cookies to personalise your experience at our web pages (such as to recognise you by name when you return to our site), save your username in password-protected areas, and to offer you products, programs, or services. For further details, please refer to our Cookies Policy . You may refuse to accept the cookies in accordance with our Cookies Policy, but if you do, certain functionality may become unavailable.
We may market products or services or deliver messages to you based on your preferences, interests and other personal characteristics. These messages may be marketed or delivered to you by way of letter, email, short message service, through social media platforms and/or push notifications within the loyalty programme website or mobile App. If you do not wish us to target our marketing based on your personal characteristics or if you wish to opt out from direct marketing, please contact us using the contact details provided in section 6 “HOW TO CONTACT US” in the General Terms. If you are using the mobile App, you may also turn off the permission for access to notifications in your device settings or the settings in the mobile App. After the access is disabled, you will not be able to receive push notifications from the mobile App.
The loyalty programme (now the Brilliant Loyalty Programme) enrols members who are eighteen (18) years old or above. Except where required by local laws, we do not knowingly collect personal information for the loyalty programme from any minors. If you are below the age of eighteen (18), please do not use the Brilliant website or mobile App. As a parent or legal guardian, please do not allow your minors under the age of eighteen (18) to submit personal information for the loyalty programme without your permission.
Like most international hotel brands, we may outsource the processing of certain functions and/or information to third parties, and thus our Group entities, hotels and residences managed and operated by us, and other third parties (such as market research firms, agents, advisors, consultants, other third party suppliers and/or services providers to assist us to operate effectively and provide you with the best experiences with our services) may process your personal information on our behalf. When we outsource the processing of your personal information to third parties or provide your personal information to third-party services providers, we require those third parties to protect your personal information with appropriate security measures.
When we share your personal information with any third parties, we will strive to ensure (including but not limited to using contractual measures or adopt encryption for transfer to ensure) that such third parties comply with this Privacy Policy and other appropriate confidentiality and security measures that we require them to comply with when using your personal information, except for the personal information you provide directly to the third parties through the use of their services. Where we are jointly processing your personal information with a third party personal information controller, we shall ensure that our responsibilities in processing your personal information are clearly and distinctively defined.
Where necessary for the relevant purposes identified above in “HOW DO WE COLLECT AND USE YOUR PERSONAL INFORMATION?” and sections 1.4 “HOW WE PROCESS AND USE YOUR INFORMATION” and 1.5 “WHAT INFORMATION WE PROCESS, AND HOW WE PROCESS AND USE YOUR INFORMATION IF YOU ARE A LOYALTY PROGRAMME MEMBER” in the General Terms, we may transfer or disclose your personal information (including sensitive personal information) to third parties located outside Mainland China with your separate consent. We may not be able to provide certain services to you if we do not carry out such transfer. We have adopted contractual and security measures to protect your relevant rights and interests in relation to the transfer. In particular, where required by law, we will enter into a data transfer agreement with such third parties.
Your personal information may be disclosed to the parties listed in section 1.9 “INFORMATION SHARING” above for the corresponding purposes. Here you may see the details of third party personal information recipients that are processing of your personal information or are based outside Mainland China, such as their identity, contact information, retention period, location, the processing activities undertaken by them (including types of personal information being processed, and the purposes and means of processing), their responsibilities in relation to processing of your personal information, (where applicable) the legal bases for such transfers to outside of Mainland China and how you may exercise your personal information privacy rights against them. Our contact details are set out in section 6 “HOW TO CONTACT US” in the General Terms of this Privacy Policy.
We will store your personal information in local databases in Mainland China and/or databases elsewhere in compliance with applicable data protection laws and regulations. Our corporate office is based in Hong Kong and as we do business globally, for the purposes specified in this Privacy Policy, we may transfer your personal information to other countries or regions in accordance with the applicable data protection laws and regulations. For details about such cross-border transfer of your personal information, please see section 1.8 “INFORMATION TRANSFER OVERSEAS” in the General Terms.
We will keep your personal information in line with our data retention policy for no longer than is necessary to fulfil the purposes we collected it for, unless we have a lawful ground for holding it for longer. Please refer to section 1.6 “HOW LONG WE KEEP YOUR PERSONAL INFORMATION” in the General Terms for further details.
In order to ensure the correct use and to maintain the accuracy of personal information collected from you, as well as preventing unauthorised or accidental access, disclosure, alteration, loss or other use of personal information, we have implemented various internal management policies (including physical, electronic and management measures) and various security technologies and procedures based on the classification of personal information we collect from you. For example:
Please note, the network environment is not 100% secure. However, we will use our best endeavours to ensure security of your personal information, and assume any legal liabilities in relation to data security in accordance with applicable laws and regulations.
You are conferred by the applicable data protection laws with the following personal information subject rights.
We will respond to your requests of exercising your personal information subject rights in accordance with the applicable data protection laws. To the extent as permitted by laws and regulations, we may not be able to respond to your request of exercising your rights in the following circumstances:
To the extent permitted by relevant laws and regulations, we reserve the right to (i) refuse unreasonable requests (for example, requests which infringe the privacy of others); and (ii) charge a reasonable fee for the cost of processing any request set out above.
If you want to exercise any of the above rights or if you have any questions, complaints, concerns or requests regarding this Privacy Policy or our personal information processing practices, you can contact us using the contact details provided in section 6 “HOW TO CONTACT US” in the General Terms. If you are not satisfied with our reply, especially if you consider our processing of your personal information infringes your legal rights and interests, you can lodge a complaint or claim with your local cyber administration departments or courts in accordance with the law.
This Notice to Mainland China Residents is effective from 26 February 2024 (the previous version of this Notice is available here ). From time to time, we may have to update, change, modify or amend this Privacy Policy (including this Notice to Mainland China Residents). Where required under applicable laws and regulations, we may seek your consent for such updates. If you do not provide your consent, we may be unable to continue to provide our services to you. You may check the most updated Privacy Policy and this Notice to Mainland China Residents on our website and in the mobile App.