Privacy Notice

Last Updated on 10th of March 2023

DATA COVERED BY THIS PRIVACY STATEMENT

This Privacy Statement describes the privacy practices of the Komsara Group for data that we collect:

• through websites operated by us from which you are accessing this Privacy Statement, including Komsara.com and other websites owned or controlled by the Komsara Group (collectively, the Websites);
• through the software applications made available by us for use on or through computers and mobile devices (the Apps);
• through our social media pages that we control from which you are accessing this Privacy Statement (collectively, our Social Media Pages);
• through email messages that we send you that link to this Privacy Statement and through your communications with us online or in person;
• from third parties such as Authorized Licensees, Owners and Franchisees, and Other Sources, such as public databases, marketing partners, and other third parties; and
• when you visit or stay as a guest at one of our properties, or at homes and villas offered on the Homes and Villas by Komsara International platform (Homes and Villas), or through other offline interactions (collectively, Property Visits and Offline Interactions).

Collectively, we refer to the Websites, the Apps, and our Social Media Pages, as the “Online Services” and, together with the Property Visits and Offline Interactions, the “Services.”

THE DATA WE COLLECT

At touchpoints throughout your guest journey, we collect Personal Data in accordance with the law, and to provide you with exemplary services. Personal Data is information that may identify you as an individual or relate to you as an identifiable individual. We collect and process the following types of Personal Data about you:

Categories of Personal Data	Categories of Third Parties to Whom Personal Data Has Been Disclosed for Operational Business Purposes	Categories of Third Parties to Whom Personal Data Has Been Sold	Categories of Third Parties to Whom Personal Data Has Been Shared for Cross-Context Behavioral Advertising
Identifiers, such as name, nationality, passport, visa or other government-issued ID, and online identifiers	Komsara Group Service Providers Franchisees Owners Homes and Villas Property Management Companies Authorized Licensees On-Property or Travel Partners Strategic Business Partners Third Parties (for purposes of approved Linked Accounts and Promotional activities) Governmental Agencies (if required)	Komsara Vacations Worldwide Credit Card Partners (Name and Online Identifiers only) Advertising Partners	Advertising Partners
Personal information, as defined in the California safeguards law, such as name, contact information, government-issued ID, and financial information	Komsara Group Service Providers Franchisees Owners Homes and Villas Property Management Companies Authorized Licensees On-Property or Travel Partners Strategic Business Partners Third Parties (for purposes of approved Linked Accounts and Promotional activities) Governmental Agencies (if required)	Komsara Vacations Worldwide Credit Card Partners	Advertising Partners
Characteristics of protected classifications under California or federal law, such as gender, age, medical conditions, primary language, national origin, citizenship, and marital status	Komsara Group Service Providers Franchisees Owners Homes and Villas Property Management Companies Authorized Licensees On-Property or Travel Partners Strategic Business Partners Third Parties (for purposes of approved Linked Accounts and Promotional activities) Governmental Agencies (if required)	Komsara Vacations Worldwide Credit Card Partners	Advertising Partners
Commercial information, such as transaction information, purchase history, financial details, payment methods, and membership or loyalty program data	Komsara Group Service Providers Franchisees Owners Homes and Villas Property Management Companies Authorized Licensees On-Property or Travel Partners Strategic Business Partners Third Parties (for purposes of approved Linked Accounts and Promotional activities) Governmental Agencies (if required)	Komsara Vacations Worldwide Credit Card Partners	Advertising Partners
Biometric information	Service Providers Governmental Agencies (if required)	N/A - Komsara does not sell this data	N/A - Komsara does not share this data
Internet or network activity information, such as browsing history and interactions with our and other websites and computer systems	Komsara Group Service Providers Governmental Agencies (if required) Geolocation data, such as device location and IP location	Advertising Partners	Advertising Partners
Geolocation data, such as device location and approximate location derived from IP address	Komsara Group Service Providers Governmental Agencies (if required)	Advertising Partners	Advertising Partners
Audio, electronic, visual and similar information, such as images and audio, video or call recordings created in connection with our business activities	Komsara Group Service Providers Governmental Agencies (if required)	N/A - Komsara does not sell this data	N/A - Komsara does not share this data
Inferences drawn from any of the Personal Data listed above to create a profile or summary about, for example, an individual's preferences and characteristics	Komsara Group Franchisees Owners Homes and Villas Property Management Companies On-Property or Travel Partners Governmental Agencies (if required)	Credit Card Partners Advertising Partners	Advertising Partners
Sensitive Personal Data Personal Data that reveals an individual's Social Security, driver's license, state identification card, or passport number; account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; racial or ethnic origin, religious or philosophical beliefs, citizenship, immigration status, or union membership; the contents of mail, email, and text messages unless the Komsara Group is the intended recipient of the communication; genetic data; The processing of biometric information for the purpose of uniquely identifying an individual; Personal Data collected and analyzed concerning an individual's health; Personal Data collected and analyzed concerning an individual's sex life or sexual orientation	Komsara Group Service Providers Governmental Agencies (if required)	N/A - Komsara does not sell this data	N/A - Komsara does not share this data

We may also disclose the above categories of Personal Data to a third party in the context of any reorganization, financing transaction, merger, sale, joint venture, partnership, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

We may also collect information about your "Stay Preferences" that we use to make your current and future stays and experience with us more enjoyable, including information about your interests and other relevant information that we learn about you during your stay. This may also include any likes and dislikes about our services that you tell us about so that we can improve our services, and specific dietary, health restrictions or personal needs to ensure your wellbeing. We may also collect your “Personal Preferences,” that may include details of your special anniversaries (such as your birthday or wedding anniversary), what type of activities you prefer to take part in when staying with us, and your hobbies. Personal Preferences may also include details about who you usually travel with, their relationship to you, and your marital status.

If you submit any Personal Data about other people to us or our Service Providers (e.g., if you make a reservation for another individual), you represent that you have the authority to do so and you permit us to use the data in accordance with this Privacy Statement.

THE ONLINE AND MOBILE DATA WE COLLECT

Typically, we do not collect Personal Data through your use of the Online Services. However, we may collect “Other Data” that does not directly identify you. To the extent Other Data reveal your specific identity or relate to an individual, we will treat Other Data as Personal Data.

“Other Data” includes:

System Data: When you use both desktop and mobile devices to access the Online Services, we collect certain data through your browser or automatically through your device, such as your computer type, screen resolution, operating system name and version, device manufacturer and model, language, internet browser type and version and the name and version of the Online Services you are using.

IP Address: We also collect your IP address, a number that is automatically assigned to the device that you are using by your Internet Service Provider (ISP). An IP address is identified and logged automatically in our server log files when a user accesses the Online Services, along with the time of the visit and the pages that were visited. We use IP addresses to calculate usage levels, diagnose server problems and administer the Online Services. We also may derive your approximate location from your IP address.

Precise Location-Based Services: With your consent, we may collect the precise physical location of your device by using satellite, cell phone tower, Wi-Fi signals, or other technologies. We will collect this data if you opt-in through the App or other program (either during your initial login or later) to improve special offers and to enable location-driven capabilities on your device. If you have opted-in to share your location, the App or other program will continue to collect location data based on how you chose to share the data.

• Precise Location Opt-Out: You can specify via your device's operating system (such as through the “Settings” icon) to always share location data, only when the App is in use, or never. If you choose only when the App is in use, we will have access to the data until you log off or close the application or until you use your phone's or other device's settings to disable location capabilities for the Bonvoy™ App or other program.

Cookies and Similar Technologies on our Websites:
When you visit our Websites from either a desktop or mobile device, we may collect and use cookies or other identifiers to serve you with personal advertisements for Komsara and third party products, either via email, on our website, or on other websites on the Internet; to measure how you interact with our Websites; and to maintain your preferences. We do this primarily through cookies, which are pieces of data stored directly on the computer or mobile device that you are using.

Apps and Mobile Devices

We collect certain data when you download and use an App, such as App usage data, the date and time the App on your device accesses our servers, and what data and files have been downloaded to the App based on your device id. We use this data to ensure that the Online Services function properly.

Our Apps may also contain software development kits (SDKs) from third parties which may collect and transmit data to enable various features in the App.

With your consent if required by the operating system, we may also collect mobile device advertising identifiers to enhance and personalize your experience and deliver relevant products, content, or ads to show you on our Websites, Apps, or external advertising.

• Optional App Features. Our Apps may contain optional features made available to developers by the device's operating system. To improve your experience, we may require your permission for the use of your device's location, camera, or other functions (e.g., using your device's camera to capture your credit card information). You may choose not to allow the use of such functions, in which case the App features relying on such functions may not be available to you. Go to your device's settings to manage these permissions.

Aggregated and Segmented Data.

We may aggregate data that we collect, and this aggregated data will not personally identify you or any other user. We may also use both Personal Data and Other Data to divide customers into segments, or groups, in order to provide more relevant advertising, including third party advertising.

HOW AND WHERE WE COLLECT YOUR DATA

This Privacy Statement describes the privacy practices of the Komsara Group for Personal and Other Data that we collect through the following:

• Komsara Group. We collect Personal Data and Other Data from other companies within the Komsara Group for the purposes described in this Privacy Statement, such as providing and personalizing the Services, communicating with you, facilitating the loyalty programs and to accomplish our business purposes.
• Owners, Franchisees Joint Ventures. We collect Personal Data and Other Data from Owners of Komsara Group branded properties that we manage, from Franchisees of Komsara Group branded properties that are independently owned and operated under a franchise agreement with us, and from Joint Venture Partners. Owners and Franchisees are independent from the Komsara Group. Franchisees include their third- party operators and management companies.
• Homes and Villas Property Management Companies. We collect Personal Data and Other Data from companies and their service providers who manage Homes and Villas properties, your booking of Homes and Villas, and provide additional support to you during your stay at Homes and Villas (“Homes and Villas Property Management Companies”). Homes and Villas Property Management Companies are independent from the Komsara Group.
• Authorized Licensees. We collect Personal Data and Other Data from companies when we enter into a license or similar agreement to sell goods and services under a Komsara Group brand (“Authorized Licensees”). Examples of Authorized Licensees include our time share partner, Komsara Vacations Worldwide Corporation, Cruise Yacht Optco Ltd. d/b/a The Ritz-Carlton Yacht Collection, developers of Komsara Group branded real estate, and co-branded credit card partners. Authorized Licensees are independent from the Komsara Group.
• On-Property and/or Travel Providers. We may collect your Personal Data and Other Data from spa, restaurant, health club, concierge, and other outlets at our properties.
• Linked Accounts. We collect Personal Data and Other Data when you use your loyalty program number or Online Services login to receive or register for certain third- party services. These companies include businesses such as airlines and rental car providers, and restaurant reservation and car services partners. Additionally, your social media account provider allows you to connect your social media account to your Online Services account or log into your Online Services account from your social media account. When you enroll in those services, we disclose your Personal Data and Other Data to those third parties. If you do not want us to collect your Personal Data or Other Data in this way, do not provide your loyalty program number to third parties, do not use your Online Services login to register for third-party promotions and do not connect your Online Services account with accounts on third-party services.
• Promotional Activity. We collect Personal Data and Other Data from with third parties who may provide promotions to you, such as sweepstakes, contests, or other offers.
• eFolio Program. If you are an employee of a company that participates in the Komsara Group eFolio Program and book your room using a company corporate code or pay for your expenses using a corporate credit card, we may collect Personal Data and Other Data related to your stay or employment. This Privacy Statement does not apply to the handling of your Personal Data by your employer, credit card company or bank, and we are not responsible for their practices.
• Other Sources Service Providers. We collect Personal Data and Other Data from various third parties, such as public databases, joint marketing partners, and online travel agencies (OTAs).
• Online Services. We collect Personal or Other Data when you interact with our Online Services, by performing such actions as, but not limited to, browsing, making a reservation, purchasing goods and services from our Websites or Apps, communicating with us or otherwise connecting with us or posting to social media pages, or signing up for a newsletter or participating in a survey, contest or promotional offer.
• Customer Care Centers. We collect Personal Data when you make a reservation over the phone, communicate with us by email, fax, or via online chat services or contact customer service. These communications may be recorded for purposes of quality assurance and training.
• Internet-Connected Devices. We collect Personal and Other Data from internet-connected devices available in our properties. For example, when you connect a device to the hotel's internet, or when a smart home assistant may be available for your use to tailor your accommodations and experience.

WHY WE COLLECT YOUR DATA (LEGAL BASIS)

Please note that in some jurisdictions you must agree to the collection of your Personal Data in order for Komsara to provide its services.

PURPOSE	DESCRIPTION OF ACTIVITIES ASSOCIATED WITH PURPOSE	LEGAL BASES
Booking Guest Registration	There are a number of activities associated with this purpose, such as: facilitating reservations and bookings of hotel accommodations and related services; engaging in pre-arrival communications (logistics, changes, preferences, etc.); and processing payments and security deposits.	Performance of contract for the individual with the guest booking the room Legitimate interests for the individual booking the room, for example, honoring his/her preferences, as well as for any individuals accompanying the primary guest (e.g., spouse, children, friends) Legal obligations relating to financial transactions, such as the obligation to maintain books and records
On-Site Reception Stay Services	There are a number of activities associated with this purpose, such as: facilitating check-in and check-out; processing payments; providing consistent and personalized service and advice about the on-site services (based on past usage or expressed preferences); providing concierge, luggage storage and parking services; making arrangements with third-party providers on behalf of guests (such as coordinating tours and other sightseeing excursions; arranging taxi, shuttle and chauffeur services; and facilitating reservations and bookings at restaurants and events); administering and facilitating access to Wi-Fi, TV and other connectivity services (including access to business center amenities, such as fax and photocopying services) and entertainment systems (such as PlayStations and music players); facilitating in-room dining (including taking into account any dietary, health restrictions or other personal needs expressed by the guest); housekeeping services (including preferences for special pillows, duvets and other amenities expressed by the guest) and dry-cleaning services; handling customer requests, inquiries and complaints; and determining eligibility for age-restricted goods and services (such as alcohol or in-room adult entertainment).	Performance of contract, such as processing payments Legitimate interests, such as honoring the guest's preferences (e.g., for a room near the elevator or on a top floor) Consent, such as collecting information regarding dietary preferences that the guest chooses to provide Legal obligations, such as collecting national ID numbers where legally required
Conferences Events	There are a number of activities associated with this purpose, such as: communicating with customers about conferences and other event planning (“Events”); facilitating reservation and bookings of Events; engaging in pre Event communications (logistics, accommodations, changes, etc.); preparing for and coordinating Events in accordance with customer instructions, expectations and preferences; facilitating catering; communicating about billing and recovering amounts owed; processing payments and security deposits; performing credit checks; handling customer requests, inquiries and complaints; and communicating with participants during Events.	Performance of contract, such as collecting information regarding a planned Event Legitimate interests, such as responding to customer complaints or concerns relating to an Event Legal obligations relating to financial transactions, such as the obligation to maintain books and records
Komsara Operations General Business	There are a number of activities associated with this purpose, such as: administering customer-care services to facilitate and address inquiries, comments and complaints about any of our services (such as in person, through phone lines, email, or on social media); handling security and fraud prevention; administering online services (including troubleshooting, data analysis, testing, system maintenance, support, reporting and the hosting of data); monitoring and analyzing usage of services and using data analytics to improve services, marketing, programs, overall customer experience, gathering feedback, carrying out pilot programs for potential new services and both developing new and improving existing services; and facilitating mergers, acquisitions and other reorganizations and restructurings of our business (including prospective transactions).	Performance of contract, such as ensuring that online services are functioning so that individuals can make reservations or manage loyalty accounts Legitimate interests, such as responding to customer complaints and concerns which may include, where applicable law permits, recording customer service calls Consent, such as for marketing programs Legal obligations relating to financial transactions, such as the obligation to maintain books and records
Emergency Incident Response	There are a number of activities associated with this purpose, such as: ensuring the security of on-site services; responding to, handling and documenting on-site accidents and medical and other emergencies (including facilitating in-house doctor services); actively monitoring properties to ensure adequate incident prevention, response and documentation (including CCTV); requesting assistance from emergency services; and sending notifications and alerts in the event of incidents or emergencies (such as via SMS, email, call, audio-visual device prompts, etc.).	Performance of contract, such as ensuring the safety of guests and personnel through interactions with on-site security personnel Legitimate interests, such as monitoring properties through CCTV to ensure the safety of guests and personnel Legal obligations, such as documenting on-site accidents Individuals' vital interests, such as contacting medical or emergency services for an ill guest
Legal Compliance	There are a number of activities associated with this purpose, such as: complying with applicable laws; complying with legal processes; responding to requests from public and government authorities; meeting national security or law enforcement requirements; enforcing our terms and conditions; protecting our operations; protecting the rights, privacy, safety, or property of the Komsara Group, guests, visitors and other relevant individuals; and allowing us to pursue available legal remedies and limiting the damages that Komsara may sustain.	Legal obligations, such as complying with legal processes Legitimate interests, such as enforcing terms and conditions to protect trademarks Individuals' vital interests, such as contacting emergency services in case of disturbances and incidents involving guests
Spa, Beauty, Golf, Fitness Services	There are a number of activities associated with this purpose, such as: facilitating reservations and bookings; determining eligibility for services; honoring disability or other health-related restrictions and providing appropriate and safe activities, services and treatments; providing consistent and personalized service based on past usage and preferences expressed by the individual; processing payments; arranging requested professionals for specific treatments and services; and handling customer requests, inquiries and complaints.	Performance of contract, such as processing payments Consent, such as collecting information about back problems when providing massage services Legitimate interests, such as providing personalized services (e.g., offering golfing opportunities based on past activity) Legal obligations relating to financial transactions, such as the obligation to maintain books and records Individuals' vital interests (e.g., when an individual becomes ill while using the fitness equipment)
Food Beverage Services	There are a number of activities associated with this purpose, such as: facilitating reservations; honoring dietary preferences; providing consistent and personalized service based on past usage and preferences expressed by the individual; processing payments; arranging reservations; and handling customer requests, inquiries, and complaints.	Performance of contract, such as processing payments Consent, such as collecting information about dietary, health restrictions, or personal needs of a guest when ordering food Legitimate interests, such as providing personalized services (e.g., offering red wine to a guest based on previous requests) Legal obligations relating to financial transactions, such as the obligation to maintain books and records Individuals' vital interests (e.g., when an individual becomes ill in one of the restaurants)
Child-Related Services (for Parents Legal Guardians)	There are a number of activities associated with this purpose, such as: facilitating babysitting/hotel nanny, kids club and junior golf program services; facilitating reservations and bookings; preparing for and coordinating hotel accommodations and services in accordance with guest preferences, instructions and expectations; payment and billing services; dining services (for example, special menus for children or special discounts for breakfast for children under a certain age).	Performance of contract, such as having a child of a certain age stay in the room with his/her parents may amount to extra charges or discounts Consent of parent or legal guardian, such as accommodating needs of children Legitimate interests, such as providing a crib or child-sized bathrobes and other amenities for children Legal obligations relating to financial transactions, such as the obligation to maintain books and records Individuals' vital interests, such as when a child becomes ill while participating in kids' club
Loyalty Programs, Accounts, Relationship Management	There are a number of activities associated with this purpose, such as: registering users in loyalty and other client account programs and payment card programs; determining eligibility for various programs and related services; administering loyalty programs; providing consistent and personalized service based on past usage and the preferences expressed by members; ensuring access to Online Services; processing payments; notifying members about changes to programs, terms and conditions; and handling members' requests, inquiries and complaints.	Performance of contract, such as assessing points and distributing benefits Consent, such as honoring the mode of communication preferences (e.g., email, SMS) Legitimate interests, such as managing members' choices regarding how they wish to earn, track, and use points Legal obligations relating to financial transactions such as the obligation to maintain books and records
Marketing, Promotions, Contests Third Party Products	There are a number of activities associated with this purpose, such as: communicating about products and services that may be of interest to guests; providing personalized advertisements for products and services on selected websites; facilitating participation in sweepstakes, contests and other promotions (such as best vacation photo contests on social media); and handling customer requests, inquiries and complaints.	Performance of a contract, such as fulfilling obligations associated with a contest Consent, such as honoring the mode of communication preferences (e.g., email, SMS) Legitimate interests, such as providing advertisements for similar products and services Legal obligations, such as handling information consistent with rules relating to sweepstakes

MORE INFORMATION ABOUT YOUR PERSONAL PREFERENCES

Our goal is to serve you better and meet your expectations and preferred level of hospitality at each stage, from the moment that you book with us through to when you check out. See below to learn more.

PERSONAL PREFERENCES	PURPOSES	LEGAL BASES
Anniversaries	When you stay with us, we want to help you celebrate any special occasion, such as an anniversary, birthday. For example, we may make a note of these dates to allow us to provide you with a birthday or anniversary gift.	Consent, where applicable
Activity type and hobbies (such as trips to beach, babysitting, fitness, travel and transportation details, kids club theater, restaurant etc.)	We want to ensure that we provide you with services that enhance your Komsara experience. To do this, we may retain your preferences about the types of activities that you like to take part in, so that we can ensure we are able to offer you similar experiences when you stay with us in the future.	Consent, where applicable
Relationships (husband, wife, son, daughter, etc.)	We understand that your Preferences may change depending on who you are traveling with (such as your preferred room type). We may keep a record of your relationships to assist us with making your Komsara stay as comfortable as possible. For example, if we know you are traveling with small children, we can proactively plan for additional accommodations such as a crib or roll-away bed.	Legitimate interest, in order to provide you with exceptional service Consent, where applicable
Preferences for properties, clubs, and facilities	When you are staying with us, we want to make sure that we can provide you with services to enhance your Komsara experience. To do this, we may retain your preferences for our properties, clubs, and facilities, based on your past stay preferences, of our kids' clubs, nanny services, spa and beauty services, golf, restaurant, and fitness facilities.	Legitimate interest, in order to provide you with exceptional service Consent, where applicable
Dietary preferences	When you stay with us, we want to ensure that you are safe, that we are looking after your wellbeing, and to provide you with services to enhance your Komsara experience. For example, we may make a note of your dining or beverage preferences so that we are prepared if you request room service or dine at one of our cafes or restaurants.	Legitimate interest, in order to provide you with exceptional service Consent, where applicable

HOW AND WHEN WE SHARE YOUR DATA

Our goal is to provide you with the highest level of hospitality and Services, and to do so, we may share Personal Data and Other Data with the following:

• Komsara Group. We disclose Personal Data and Other Data to other companies within the Komsara Group for the purposes described in this Privacy Statement, such as providing and personalizing the Services, communicating with you, facilitating the loyalty programs and to accomplish our business purposes. We share your Personal Data and Other Data used for making reservations with the applicable property and Komsara entity to fulfil and complete your reservation.
• Franchisees. We disclose Personal Data and Other Data to Franchisees of Komsara Group branded properties for the purposes described in this Global Privacy Statement. Franchisees have a limited right to use certain Personal Data for their own purposes and therefore qualify as independent data controllers for the following processing: Franchisees manage and coordinate your stay at hotels that they operate so they may use your Personal Data for that purpose. Franchisees may also use your Personal Data for compliance with their own legal obligations, including maintaining books records and other compliance obligations.
• Owners: We disclose Personal Data and Other Data to Owners of Komsara Group branded properties for the purposes described in this Global Privacy Statement. Owners have a limited right to use certain Personal Data for their own purposes and therefore qualify as independent data controllers for the following processing: Owners may use your Personal Data for complying with their own legal obligations, including maintaining books records and other compliance obligations.
• Homes and Villas Property Management Companies. We disclose Personal Data and Other Data to Homes and Villas Property Management Companies and their service providers for the purpose described in this Privacy Statement, such as providing, facilitating, and personalizing the Services, facilitating the loyalty programs and their own marketing.
• Authorized Licensees. Where allowed by law we disclose Personal Data and Other Data to our Authorized Licensees, including Komsara Vacations Worldwide, Ritz-Carlton Yacht Collection, Komsara Group branded real estate, co-branded credit cards from American Express, Chase and other banks, for the purposes described in this Privacy Statement, such as providing and personalizing the Services, fulfilling your requests and providing their own marketing. For example, this sharing enables you to purchase Komsara branded goods and services, including time share properties and Komsara Group branded real estate.
  
  • Select Authorized Licensees as defined in the Komsara Bonvoy Communication Preferences means Komsara Vacations Worldwide Corporation and international co-branded credit cards.
• On-Property and/or Travel Providers. We may share your information with spa, restaurant, health club, concierge and other outlets at our properties to provide you with services and their own marketing such as with Disney Destinations, LLC and Walt Disney Travel Company when you stay at one of our properties affiliated with Walt Disney World®. This sharing also enables us to provide you with a single source for purchasing packages that include travel-related services, such as airline tickets, rental cars, and vacation packages.
• Linked Accounts and Travel Insurance. We partner with certain third parties that allow you to enroll in their services or purchase their products. For example, certain companies allow you to use your loyalty program number or Online Services login to receive or register for their services. These companies include businesses such as airlines and rental car providers, and restaurant reservation and car services partners. Additionally, your social media account provider allows you to connect your social media account to your Online Services account or log into your Online Services account from your social media account. When you enroll in those services or purchase their products, we disclose your Personal Data and Other Data to those third parties. If you do not want us to share your Personal Data or Other Data in this way, do not provide your loyalty program number to third parties, do not use your Online Services login to register for third-party promotions and do not connect your Online Services account with accounts on third-party services. We may also share your Personal Data with Travel Insurance companies when you choose to purchase their products. Data shared in this way will be governed by the third party's privacy policy and not this Privacy Statement.
• Promotional Activity. We partner with third parties who may provide promotions to you, such as sweepstakes, contests, or other offers.
• eFolio Program. If you are an employee of a company that participates in the Komsara Group eFolio Program and book your room using a company corporate code or pay for your expenses using a corporate credit card, an extract of your folio detailing the goods and services provided to you may be sent to your company and to the credit card company. This Privacy Statement does not apply to the handling of your Personal Data by your employer, credit card company or bank, and we are not responsible for their practices.
• Service Providers. We disclose Personal Data and Other Data to third party service providers including, for example, companies that provide website hosting, data analysis, payment processing, order fulfilment, information technology and related infrastructure provision, customer service, email delivery, marketing, auditing, and other services.

Other Uses and Disclosures:

We will use and disclose Personal Data as we believe to be necessary or appropriate: (a) to comply with applicable law, including laws outside your country of residence; (b) to comply with legal process; (c) to respond to requests from public and government authorities, including authorities outside your country of residence and to meet national security or law enforcement requirements; (d) to enforce our terms and conditions; (e) to protect our operations, such as in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of the Komsara Group business, assets or stock (including any bankruptcy or similar proceedings); (f) to protect the rights, privacy, safety or property of the Komsara Group, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.

We may use and disclose Other Data for any purpose, except where we are not allowed to under applicable law.

YOUR DATA, YOUR CHOICES: YOUR PRIVACY PREFERENCES RIGHTS

At Komsara, we believe that you should have choices with respect to your data. We provide you with the options, information, and choices below to express your preferences: what and how much you share with us and when and how you hear from us.

Communication Preferences

• To change how we or our partners communicate with you, please sign into your loyalty account profile and select Communication Preferences.
• You can also use the unsubscribe link at the bottom of any of our communications.
• If you no longer wish to receive marketing-related emails, you may opt out by visiting our unsubscribe page or by following the instructions in any such email you receive from us.
• In addition, you can opt out from marketing-related emails by sending a letter to: Internet Customer Care - Unsubscribe, 123 Street, New York, USA, Omaha, Nebraska +1 000 000 0000 USA or Komsara Reservations Limited - Unsubscribe, 12 Weston Drive, Dublin D65, Ireland
• NOTE: Even if you choose to opt out of marketing-related emails, we will continue to send you transactional messages, such as information about your reservations or stays, including confirmation and pre-arrival emails, or account security updates.
• If you want to adjust your Stay Preferences, log into your loyalty account, and choose Room Options, Stay Preferences.

Individual Rights

How You Can Request to Access, Change, Delete, Restrict or Confirm the Use or Object to the Processing of Your Personal Data

If you or your authorized agent would like to request to access, change, delete, restrict or confirm the use or object to the processing of your Personal Data that you have previously provided to us, or if you would like to receive an electronic copy of your Personal Data for purposes of transmitting it to another company, or appeal our decision regarding your privacy request (to the extent these rights are provided to you by law), please see this form. If you have any questions about the form or our process, feel free to contact us at privacy@Komsara.com. Please see also, Contact Us.

For your protection, we only fulfill requests for the Personal Data associated with the email address and/or loyalty account number that you identify in your request, and we may need to verify your identity before fulfilling certain requests. When permitted by law, we may charge an appropriate fee to cover the costs of responding to your request.

Komsara acknowledges and respects our guests' privacy and we will try to comply with your request as soon as reasonably practicable and consistent with applicable law. Please note that all individual rights may not be available under applicable law to all of our guests or other users of our Services.

CALIFORNIA INDIVIDUAL RIGHTS

Overview of California Individual Rights

If you are a California resident, you may make the following requests:

Request to Know. You may request that we disclose to you the following information:

• The categories of Personal Data we collected about you and the categories of sources from which we collected such Personal Data;
• The specific pieces of Personal Data we collected about you;
• The business or commercial purpose for collecting, selling, or sharing (if applicable) Personal Data about you;
• The categories of Personal Data about you that we sold or “shared” and the categories of third parties to whom we sold or “shared” such Personal Data (if applicable); and
• The categories of Personal Data about you that we otherwise disclosed, and the categories of third parties with whom we disclosed such Personal Data (if applicable).

Request to Delete. You may request that we delete the Personal Data we collected from you.

Request to Correct. You may request that we correct inaccuracies in your Personal Data.

Request to Opt-Out of Sale and/or Sharing. You may request to opt-out of the “sale” and/or “sharing” (for cross-context behavioral advertising purposes) of your Personal Data.

How You Can Request to Know, Delete, Correct, or Opt-Out of Sale and/or Sharing of Your Personal Data

To make a Request to Know, Delete, or Correct, please contact us via this form or 1-000-000-0000. We may request information from you in order to verify your request, such as your name, email address, postal address, phone number, or loyalty number, and then use that information to match it with information we already have. We may also ask you for additional identifiers such as your date of birth or the last four digits of your credit card if we need additional information to verify your identity. We will respond to your request consistent with applicable law.

To make a Request to Opt-Out of Sale and/or Sharing, click here or call 1-000-000-0000.

You have the right to be free from unlawful discrimination for exercising your rights under the CCPA.

Authorized Agents: If you would like an authorized agent to submit a request on your behalf, the agent may do so by using the submission methods noted above. Upon receipt of a Request to Know, Delete, or Correct by an agent, Komsara will ask the California resident for written, signed permission that the agent has been authorized by the resident to act on their behalf. Once written authorization is provided, Komsara will open a request for the resident in the portal. Komsara will respond directly to the individual email address provided by the authorized agent regarding the fulfillment of the request, and not in a platform or portal.

CHANGES TO THIS CCPA STATEMENT

We may change or update this CCPA Statement from time to time. When we do, we will post the revised CCPA Statement on this page with a new “Last Updated” date.

PRIVACY RIGHTS REQUEST METRICS

Between January 1 and December 31, 2021, Komsara received the following requests from consumers identifying themselves as California residents:

Request Type	Consumer Requests Received	Verified Consumer Requests Completed in Whole or in Part	Verified Consumer Requests Denied	Mean Number of Days to Substantively Respond to Verified Consumer Requests
Requests to Know	153	49	0	30
Requests to Delete	316	78	0	18
Requests to Opt-Out of Sale	143,337	39,108	0	1

STATE-SPECIFIC PRIVACY RIGHTS

You may have additional privacy rights under the law of the state in which you live. This section describes those rights for residents of Virginia and Nevada. If you are a resident of California, your privacy rights are described in the California Privacy Rights section below.

VIRGINIA.

You have the right to access, delete, and correct certain personal information we collect about you. When you request access to personal information, you have the right to receive that information in a portable and readily usable format. You also have the right to restrict the use of that personal information for targeted advertising, restrict the sale of that personal information, and control our use of personal information considered sensitive. You also have a right not to receive discriminatory treatment for the exercise of your privacy rights.

You or your authorized agent may submit a request to exercise your access, deletion, and correction rights by submitting a Data Rights Request or calling 1-000-000-0000. If we deny your request, you have the right to appeal our decision.

Komsara will request your consent for processing sensitive personal information. You may revoke your consent at any time. For example, you may revoke your consent to the use of device precise location information through our app by turning off the precise location feature in the app settings on your device.

NEVADA.

Residents of Nevada have the right to opt out of the sale of certain types of their information to other companies who will sell or license their information to others. At this time, Komsara does not engage in such sales. If you are a Nevada resident and would like more information about our privacy practices, please email US_Privacy@Komsara.com.

COLORADO

You have the right to access, delete, and correct certain personal information we collect about you. When you request access to personal information, you have the right to receive that information in a portable and readily usable format. You also have the right to restrict the use of that personal information for targeted advertising, restrict the sale of that personal information, and control our use of personal information considered sensitive. You also have a right not to receive discriminatory treatment for the exercise of your privacy rights.

You or your authorized agent may submit a request to exercise your access, deletion, and correction rights by submitting a Data Rights Request or calling 1-000-000-0000. If we deny your request, you have the right to appeal our decision.

Komsara will request your consent for processing sensitive personal information. You may revoke your consent at any time. For example, you may revoke your consent to the use of device precise location information through our app by turning off the precise location feature in the app settings on your device.

UTAH

You have the right to access, delete, and correct certain personal information we collect about you. When you request access to personal information, you have the right to receive that information in a portable and readily usable format. You also have the right to restrict the use of that personal information for targeted advertising, restrict the sale of that personal information, and control our use of personal information considered sensitive. You also have a right not to receive discriminatory treatment for the exercise of your privacy rights.

You or your authorized agent may submit a request to exercise your access, deletion, and correction rights by submitting a Data Rights Request or calling 1-000-000-0000. If we deny your request, you have the right to appeal our decision.

Komsara will request your consent for processing sensitive personal information. You may revoke your consent at any time. For example, you may revoke your consent to the use of device precise location information through our app by turning off the precise location feature in the app settings on your device.

CONNECTICUT

You have the right to access, delete, and correct certain personal information we collect about you. When you request access to personal information, you have the right to receive that information in a portable and readily usable format. You also have the right to restrict the use of that personal information for targeted advertising, restrict the sale of that personal information, and control our use of personal information considered sensitive. You also have a right not to receive discriminatory treatment for the exercise of your privacy rights.

You or your authorized agent may submit a request to exercise your access, deletion, and correction rights by submitting a Data Rights Request or calling 1-000-000-0000. If we deny your request, you have the right to appeal our decision.

Komsara will request your consent for processing sensitive personal information. You may revoke your consent at any time. For example, you may revoke your consent to the use of device precise location information through our app by turning off the precise location feature in the app settings on your device.

OTHER IMPORTANT PROVISIONS

Non-Komsara Group Entities

This Privacy Statement does not address, and we are not responsible for the privacy, data, or other practices of any entities outside of the Komsara Group, including Franchisees, Owners, Homes and Villas Property Management Companies, Authorized Licensees, Strategic Business Partners, or any third party operating any site or service to which the Services link, payment service, loyalty program, or website that is the landing page of the high-speed Internet providers at our properties. The inclusion of a link on the Online Services does not imply endorsement of the linked site or service by us. We generally have no control over, and are not responsible for, any third party's collection, use and disclosure of your Personal Data.

In addition, we are not responsible for the data collection, use, disclosure, or security policies or practices of other organizations, such as Facebook, Apple, Google, Microsoft, RIM or any other app developer, app provider, social media platform provider, operating system provider, wireless service provider or device manufacturer, including with respect to any Personal Data you disclose to other organizations through or the Apps or our social media pages.

Security

We seek to use reasonable organizational, technical, and administrative measures to protect Personal Data. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of your account has been compromised), please immediately notify us in accordance with the “Contact Us” section, below.

Retention

We will retain your Personal Data for the period necessary to fulfill the purposes outlined in this Privacy Statement unless a longer retention period is required or permitted by law.

The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide the Services to you (for example), for as long as you have an account with us or keep using the Services and for as long as necessary to satisfy the terms of the Bonvoy program
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them)
• Whether retention is advisable considering our legal position (such as, for statutes of limitations, litigation, or regulatory investigations)

Sensitive Data

Unless specifically requested, we ask that you not send us, and you not disclose, on or through the Services or otherwise to us, any Sensitive Personal Data (e.g., social security number, taxpayer identification number, passport number, driver's license number, or other government-issued identification number; credit or debit card details or financial account number, with or without any code or password that would permit access to the account, credit history; or information on race, religion, ethnicity, sex life or practices or sexual orientation, medical or health information, genetic or biometric information, biometric templates, political or philosophical beliefs, political party or trade union membership, background check information, judicial data such as criminal records, or information on other judicial or administrative proceedings).

Use of Services by Minors

The Services are not directed to individuals under the age of sixteen (16), and we request that they not provide Personal Data through the Services.

International Data Transfers

The Komsara Group is a global organization and provides a global service. Transferring data internationally is essential to the Services so that you receive the same high-quality service wherever you are in the world. As a result, we will, subject to law, transfer Personal Data and Other Data collected in connection with the Services, to entities in countries where data protection standards may differ from those in the country where you reside, including outside the EEA, UK, or Switzerland. By making a reservation, visiting, or staying at a Komsara branded property or using any Komsara Group branded service, you understand that we transfer your Personal Data globally.

In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in those other countries may be entitled to access your Personal Data.

Some of the countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards. The Komsara Group enters into Standard Contractual Clauses or another approved mechanism for cross-border transfer where appropriate.

Updates to This Privacy Statement

The “Last Updated” legend at the top of this page indicates when this Privacy Statement was last revised. Any changes will become effective when we post the revised Privacy Statement on the Online Services. If you would like to review the version of the Privacy Statement that was effective immediately prior to this revision, please contact us at privacy@Komsara.com.

CONTACT US

If you have any questions about this Privacy Statement, please contact us at privacy@Komsara.com.

If you live in the United States or any other country outside of the European Economic Area, the United Kingdom, or Switzerland, the data controller responsible for your personal data is Komsara International, Inc. with an address of:

Komsara International, Inc.
Global Compliance, Privacy
123 Street, New York, USA

If you live in the European Economic Area, the United Kingdom, or Switzerland, the data controller is Komsara Reservations Limited, with an address of:

Komsara Reservations Limited
12 Weston Drive
Dublin D65
Ireland

Additional Information

DATA CONTROLLER

The Komsara Group acts as an independent data controller in relation to our owners and franchisees, who have a limited right to use the Data we collect as described below:

Owners: As the hotel you are booked to stay in may not be owned by the Komsara Group, we disclose Data to owners of Komsara Group branded properties for the purposes described in this Global Privacy Statement. Owners have a limited right to use certain Personal Data for their own purposes and therefore qualify as independent data controllers in order to comply with their own legal obligations, including maintaining books records and other compliance obligations.

Franchisees: In addition, some Komsara-branded hotels are owned and operated under a franchise agreement with the Komsara Group. As such, we disclose Data to franchisees of Komsara Group branded properties for the purposes described in this Global Privacy Statement. Franchisees have a limited right to use certain Personal Data for their own purposes and therefore qualify as independent data controllers for the purposes of managing and coordinating your stay at hotels, and for complying with their own legal obligations, including maintaining books records and other compliance obligations.

You can also:

• Contact our data protection officer responsible for your country or region via KomsaraDPO@Komsara.com. In your email, please indicate the country from which you are contacting us.
• Lodge a complaint with a data protection authority for your country or region or where an alleged infringement of applicable data protection laws occurs. For the EEA, a list of the national data protection authorities can be found at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080. For the UK, the responsible data protection authority is the Information Commissioner's Office (ICO), more details about which can be found on the ICO website.