Privacy Policy

Last Updated: December 5, 2024 

INTRODUCTION

At Hotel Miramar (“Company”), we value you as a guest and are committed to  safeguarding, preserving, and respecting your privacy rights. In this Privacy Statement (the  “Statement” or “Policy”), we provide you with a description of how we collect, use,  disclose, and secure the personal information we gather about you through our website, https://www.hotelmiramarpr.com/ (the “Site”). 

For purposes of this Statement, personal information means data that classifies as  personal information, personal data, personal identifiable information, or similar terms  under applicable data privacy and security laws and regulations. It does not include data  excluded or exempted from those laws and regulations. We collect data from websites,  software applications, social media pages, email messages, and from third parties such as  marketing partners. 

You should also refer to privacy policies posted on each of our affiliates / brand websites to  understand how we collect, use, disclose, and secure the personal information we collect  through your use of those websites and our services. 

COLLECTION OF PERSONAL INFORMATION 

We collect information you voluntarily provide to us directly, information that we collect  automatically when you interact with the website, and information collected from third  parties. The categories of personal information that we collect and the purposes for which  we collect that information are described below. 

Categories of Personal Information We Collect 

The following list describes the categories of personal information we may collect.

• Analytics Information.

Includes system data, IP address, precise location-based services, and precise location  choices. We may collect certain analytics information automatically as you navigate our  website and the communications we may provide, such as emails. This may include  cookies, tracking pixels, tags or similar tools, such as session replay technologies, which  may collect information about your browser, device, geolocation, and that may log to how  you interact with our website. For more information, please view the “How Do We Use  “Cookies” and Other Tracking Technologies?” section below. We collect this information for the purposes of analytics and research, marketing and advertising, and website security  and maintenance.

• Contact, Demographic, Financial, and Loyalty Program Information 

Includes full name, mailing address, email address, phone number, gender, language  preferences, nationality, birthdays, anniversaries, special occasions, passport, visa,  government-issued identification, credit, debit, or payment data, membership or loyalty  program data, travel partner program affiliations, travel itinerary, and stay preferences. We  collect this information when you provide it to us directly, such as when you reserve a stay or utilize our services. We also may obtain this information indirectly from other sources  including our service providers. We collect this information for the purposes of  performance of the contract for the reservation, legal obligations related to financial  transactions, legitimate interests such as responding to customer complaints and  concerns, consent for marketing programs. 

• Claims Information 

Includes insurance information, emergency contacts, complaints, employment details,  data about family members and companions (including names, and ages of children),  biometric data; and images, videos, and audio data via: (a) recordings of your voice (such as when we record customer service calls for quality assurance); (b) security cameras  located in public areas, such as hallways and lobbies, in our properties; and (c) body-worn  cameras carried by our loss prevention officers and other security personnel. We collect  this information for the purposes of operation of our business and legal obligations and  contacting medical or emergency services. 

• Responses to Surveys and Questionnaires 

Includes any information you provide to us when you voluntarily complete market research  surveys such as email address. We collect this information when you provide it directly to  us. We collect this information for the purposes of analytics and research and marketing  and advertising. 

• Social Media Information

Includes social media account ID, profile photo, and other information that you post or  share on a blog or other form of social media platform. We collect this information when  you provide it directly to us. Please note that your comments may be visible to the public,  so you should never share personal information that you would like to keep private. We  collect this information for the purposes of analytics and research and marketing and advertising.

Purposes for Collection of Personal Information 

The following chart identifies the purposes for which we may collect your personal  information, as well as information regarding our use and disclosure of that personal  information. Please note that we may not collect each category of information about each  user of our website. 

Purpose	Categories of Personal Information	Targeted Ad/Sales	Data Shared with Third Parties	Categories of Third Parties
Marketing, Advertising, Analytics and Research	Analytics Information Contact Information Responses to Surveys and Questionnaires Social Media Information	Yes / Yes	Contact Information Email Lists  Analytics Information	Analytics   Providers  Third Party   Advertisers
Website Security and Maintenance	Analytics Information	No / No	System data  IP address	Service   Providers
Operations and General Business	Contact, Demographic,  Financial, and Loyalty  Program Information	No / Yes	Reservation details  Stay preferences	Owners  Payment care  issuers and   processors  Service   Providers

Other Ways We May Collect, Use, or Share the Information 

We may also reserve the right to collect, use, or share personal information for the  following purposes: 

• Based on your consent or direction: Throughout the course of using our website, you  may be provided with additional opportunities to consent to the disclosure of your  personal information with various third parties. In these circumstances, the  Company will provide you with clear and specific notice of the opportunity in order  to obtain your consent.
• For legal purposes: We reserve the right to cooperate with local, provincial, state,  federal and international officials in any investigation requiring either personal  information or reports about lawful or unlawful user activity on this site. We also  reserve the right to share your personal information to establish, exercise, or defend  our legal and property rights, including providing information to others for the  purposes of fraud prevention. We may also share your personal information (i) if we  are ordered by a legal process or government to do so, or (ii) with any person who we  reasonably believe may apply to a court or other competent authority for disclosure  of that personal information where, in our reasonable opinion, such court or  authority would be reasonably likely to order disclosure of that personal  information. 
• Business transactions or mergers: We reserve the right to share your personal  information with third parties as part of any potential business or asset sale, merger,  acquisition, investment, round of funding, or similar type of transaction.  Additionally, if we are entering into a corporate transaction with a third party, we may  receive personal information in connection with the diligence. If we close a  transaction, the third party may transfer personal information, which we would use  as described in this Policy. 
• Bankruptcy or insolvency: In the event of bankruptcy, insolvency, or dissolution  proceedings, we may share your personal information with third parties as part of  the sale or reorganization process. 
• Service Providers: With service providers who perform services on our behalf. Any  such service providers will be under an obligation to us to maintain the  confidentiality of your personal information. 
• Our partners, affiliates, and subsidiaries: We may collect information from - or share  information with - our partners such as market research firms and our affiliates,  subsidiaries, joint ventures, or other companies under common control. We may  combine that information with other information we collect about you. Furthermore,  all information gathered about you by the Company may be shared with any of the  Company's current or future subsidiaries or affiliates. 

INFORMATION REGARDING AUTOMATED PROFILING 

We may rely on certain types of automated processing to prevent, detect, and protect  against fraud, identity theft, and other illegal activities. Under some privacy laws, this  processing may constitute “profiling.” This means that we may use automated programs  that analyze your Contact Information in the future, without human assistance in order to detect indicators of fraud and verify your identity. If you wish to opt-out of Automated  Profiling, you may submit a request by utilizing any of the methods described in the “Contact Us” section below. 

COOKIES AND OTHER TECHNOLOGIES 

We may send one or more cookies to your computer or other device. We may also use  other similar technologies such as tracking pixels, tags, or similar tools when you visit our  website. These technologies can collect data regarding your operating system, browser  type, device type, screen resolution, IP address, and other technical information, as well as  navigation events and session information as you interact with our website. This  information allows us to understand how you use the website. 

What Are Cookies? 

Cookies are small files created by websites, including our Services, that reside on your  computer’s hard drive and that store information about your use of a particular website.  When you access our Services, we use cookies and other tracking technologies to: 

• Estimate our audience size and usage patterns; 
• Contact you to provide you with information or services that you request from us;
• Advertise new content, events, and services that relate to your interests;
• Recognize when you return to our website. 

We set some cookies ourselves and others are set by third parties. You can manage your  Cookies preference as described in the “Managing Your Cookies” section below. 

What Types of Cookies Do We Use and Why?

The following chart lists the different types of cookies that we and our service providers use  on the Services, examples of who serves those cookies and links to the privacy notices and opt-out information of those cookie servers.

Types of Cookies	Purpose
Essential	These cookies are required for the operation of the website and enable  you to move around the website and use its features. This includes the  ability to remember login information, language preferences, and  settings. Disabling these cookies can negatively impact the performance.

Functionality	These cookies are used to recognize you when you return to the website.  This enables us to personalize content for you and remember your  preferences.
Analytics, Performance, and Research	These cookies, beacons, and pixels allow us to analyze activities on the  website. They can be used to improve the functioning of the website. For  example, these cookies recognize and count the number of visitors and  see how they move around the website.
Social Networking	These cookies are used to enable you to share pages and content that  you find interesting on our website through third-party social networking  and other websites.
Advertising	These cookies and pixels are used to deliver relevant ads, track ad campaign performance, or track email marketing.

Who serves (for example), include: Google, Microsoft, Meta, Revinate, LinkedIn, Google Ad.  For more information about interest-based advertising and cross-device linking, please  visit the Network Advertising Initiative (“NAI”) website and the Digital Advertising Alliance  (“DAA”) website. 

How Long Do Cookies Stay on My Device? 

Some cookies operate from the time you visit the website until the end of that particular  browsing session. These cookies, which are called “session cookies,” expire and are  automatically deleted when you close your Internet browser. 

Some cookies will stay on your device between browsing sessions and will not expire or  automatically delete when you close your Internet browser. These cookies are called  “persistent cookies” and the length of time they will remain on your device will vary from  cookie to cookie. Persistent cookies are used for a number of purposes, such as storing  your preferences so that they are available for your next visit and to keep a more accurate  account of how often you visit the website.

Managing Your Cookies 

It may be possible to block cookies by changing your Internet browser settings to refuse all  or some cookies. If you choose to block all cookies (including Essential cookies), you may  not be able to access all or parts of the website. 

You can find out more about cookies and how to manage them by visiting 

https://www.aboutcookies.org/. 

Does the Site Respond to “Do Not Track” Signals? 

We respond to the Global Privacy Control ("GPC") signal. The GPC signal is a browser level  signal that can reflect the desire to opt-out of having personal information shared or sold.  Some browsers allow transmission of GPC signal. When you broadcast this signal, we will not transmit your personal information to third parties who perform analytics services or  who advertise to you based on this information. Please note that your use of our website  will still be tracked by the Company and its service providers who have agreed to limit their  use of personal information. 

CONSUMER USERS’ RIGHTS 

Under certain privacy laws, some state residents are entitled to various privacy rights.  Although they may not all apply to the Company, the states with privacy laws that will be in  effect in 2024 include California, Colorado, Connecticut, Montana, Oregon, Texas, Utah  and Virginia. 

The Company values your privacy and complies with all applicable state privacy laws. The  chart below explains these rights, although some exceptions may apply.

Consumer Right	Explanation
Right to Know/Access	You have the right to confirm whether we are processing your personal data, to  know the categories of personal data we are processing or have processed,  and the right to access that data. You also have the right to know the third  parties to whom we have disclosed your personal data.
Right of Correction	You have the right to correct inaccuracies in your personal data, taking into  account the nature of the personal data and the purposes of the processing of  the personal data.

Right of Deletion	You have the right to delete your personal data provided by you or obtained about you.
Right of Portability	Up to two times per calendar year, you have the right to obtain your personal  data in a portable and—to the extent technically feasible—readily usable  format that allows you to transmit the data to another entity without  hindrance.  *Note: We may charge a reasonable fee to cover the administrative costs of  complying with a second or subsequent request.
Right to Opt out:	You have the right to opt-out of the processing of your personal data for the  purposes of:  (1) Targeted advertising;  (2) The sale of personal data; and/or (3) Profiling in furtherance of decisions that produce legal or similarly  significant effects concerning you.  To opt-out, you can contact us in the methods described in the “Contact Us” section below.

To exercise any of the rights listed in the chart below, please utilize any of the methods  described in the “Contact Us” section below. 

If you are a resident of California, Colorado, or Nevada, please also refer to our state  specific Section. 

Sensitive Information 

We will process Sensitive Data in accordance with any applicable privacy laws. In some  instances, that means we will not collect Sensitive Data without first obtaining your  consent or providing you with the right to opt out. 

For the purposes of serving you relevant advertisements based on your location, we collect  geolocation information to perform geofencing from our service providers. These service  providers will not collect this information from Connecticut, Utah, and Virginia residents  without first obtaining consent.

Exercising Your Rights 

If you wish to exercise one of the above rights, please utilize any of the methods described  in the “Contact Us” section below. If necessary, we may request additional information  reasonably necessary to authenticate you and your request. 

In certain circumstances, you may make a request on behalf of another such as if you are  an authorized agent or the parent or guardian of a child on behalf of whom you wish to  exercise their rights. 

We will respond to verified consumer requests, if applicable, within 45 days of receipt of  the request and without undue delay. If we need to extend this period, we will notify you of  the delay and explain the reasonably necessary justifications for our delay. 

We will provide responses to your requests free of charge unless certain exclusions apply,  depending on the state in which you reside. 

Appealing a Rights Request Decision 

If we deny or fail to take action on your request to exercise your applicable consumer  privacy rights, you may appeal our decision. If this happens, we will send you an email  informing you of our decision to deny your request. The email will provide instructions on  how to initiate the appeals process. 

We will inform you in writing within 45 days of any action taken or not taken in response to  the appeal. We will also provide a written explanation of the reasons for our decisions  regarding your request(s). 

MARKETING COMMUNICATIONS CHOICES 

We may send you communications via email, text message, push notifications, in-app  alerts, direct mail, and social media. We respect your rights in how your personal  information is used and shared. If at any time you would like to unsubscribe from receiving  our communications, you can follow the instructions at the bottom of each email or reply  “STOP” to a text message, and we will promptly remove you from correspondence. You may  control whether our mobile apps send you push notifications by changing your notification  settings on your mobile device. If we engage in sending you in-app messages, we will allow  control for those in our apps' settings. 

DATA RETENTION PERIODS 

We will retain your personal information until the personal information is no longer  necessary to accomplish the purpose for which it was provided. We may retain your  personal information for longer periods for specific purposes to the extent that we are 

obliged to do so in accordance with applicable laws and regulations, to protect you, other  people, and us from fraud, abuse, an unauthorized access, as necessary to protect our  legal rights, or for certain business requirements. 

We will delete your personal information when it is no longer necessary for the purpose for  which it was collected, or upon your request, subject to exceptions as discussed in this  Statement or under applicable law, contract, or regulation. 

OUR COMMITMENT TO DATA SECURITY 

The Company sees to use reasonable administrative, technical, and physical security  measures to protect your information from unauthorized access, disclosure, alteration, or  destruction. However, we cannot and do not guarantee complete security. 

THIRD PARTY LINKS 

Our website may contain links to third-party websites. When we provide links, we do so  only as a convenience and we are not responsible for any content of any third-party  website or any links contained within. It is important to note that this Statement only  applies to the Company. We are not responsible and assume no responsibility for the  privacy, data, or other practices of any entities outside of the Company, or any third-party  operating any site or payment service, loyalty program, or website that is the landing page  of the high-speed Internet providers at our properties. 

In addition, we are not responsible for the data collection, use, disclosure, or security  policies or practices of other organizations, such as Meta, Apple, Google, Microsoft, or any  other app developer, app provider, social media platform provider, operating system  provider, wireless service provider or device manufacturer, including with respect to any  Personal Data you disclose to other organizations through or the Apps or our social media  pages. 

CHILDREN’S PRIVACY 

Protecting the privacy of the very young is especially important. Our website is not intended  for children under 16 years of age, and we do not knowingly collect personal information  from children under 16. In the event that we learn that we have collected personal  information from a child under age 16 without verification or parental consent, we will  immediately delete that information. If you believe that we might have any information from  or about a child under 16, please contact us using the information provided in the “Contact  Us” section below. If you are under the age of 16, you must ask a parent or legal guardian to  transact with the Company.

CHANGES TO THIS STATEMENT 

We may modify this Statement from time to time. If we need to change this Statement, we  will post the revised Statement with the date updated. Your continued use of the Site  constitutes acceptance of the most current version of this Statement. 

This Statement applies regardless of how the website is accessed and will cover any  technologies or devices by which we make the website available to you, including mobile  devices. 

CONTACT US 

If you have any questions about this Privacy Policy, please contact us by email at info@miramarhotelpr.com or via phone at 787-977-1000 or by sending a letter to 606 Ave. Ponce de León, San Juan, PR 00907. 

ADDITIONAL PROVISIONS APPLICABLE TO SPECIFIC RESIDENTS 

This Section provides additional information for individuals residing in countries and U.S.  states that have enacted privacy laws giving certain additional rights to residents of those  jurisdictions. Once effective, the U.S. states include, but are not limited to: California,  Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Nevada, Oregon,  Tennessee, Texas, Utah, and Virginia. These countries include, but are not limited to: those  in the European Economic Area (EEA), the United Kingdom and Switzerland, as well as  Australia, Brazil, China, Korea, Hong Kong, Monaco, Israel, Japan, Nigeria and Türkiye. 

California and Colorado Consumers’Rights 

The California Consumer Privacy Act (“CCPA”) affords California consumers certain rights,  as defined by the California Consumer Privacy Act (“CCPA”), Cal. Civ. Code § 1798.100 et  seq., as amended by the California Privacy Rights Act (“CRPA”) and implementing  regulations, including: (1) the right to know what personal information we collect, use,  disclose, and/or sell; (2) the right to request that we delete their personal information; and  (3) the right to request that we no longer sell or share their personal information. Similarly,  the Colorado Privacy Act (“CPA”) provides Colorado consumers certain rights. 

We reserve the right to limit these rights where permitted under applicable law, including  where your identity cannot be reasonably verified or to the extent your rights adversely  affect the rights and freedoms of others. 

What Information Do We Collect? 

The following chart details categories of personal information we have collected or may  collect for operational business purposes, cross-context behavioral, or targeted advertising. We have or may disclose these categories of information with third parties like  service providers, data analytics providers, and social media platforms within the  preceding 12 months.

Category	Examples
Identifiers	Real name, alias, postal address, online identifier, Internet Protocol address, email address, passport,  visa, or other government issued ID
Personal Information	Name, address, telephone number (may overlap with other categories
Protected Classification  Characteristics	Age, nationality, sex (including gender, gender identity, or gender expression), veteran or military status
Commercial Information	Transaction information, purchase history, financial details, payment methods, membership or loyalty  program data
Biometric Information	Genetic, physiological, behavioral, and biological characteristics, or activity patterns
Internet or Other Similar  Network Activity	Search history, interaction with a website
Geolocation Data	Physical location or movements
Sensory Data	Audio, electronic, visual, thermal, olfactory, or similar information
Inferences Drawn	Inferences drawn from Personal Information identified above to create a profile about a consumer reflecting  a consumer’s preferences, characteristics,  psychological trends, predispositions, behavior,  attitudes, intelligence, abilities, and aptitudes
Sensitive Personal Information	Personal information that reveals (a) Social Security, driver’s license, state identification card, or passport  number; (b) account log-in, financial account, debit  card, or credit card number in combination with any   required security or access code, password, or  credential allowing access to an account; (c) precise  geolocation; or (d) the contents of a consumer’s mail,  email, and text messages unless the business is the  intended recipient of the communication

What Sources Do We Collect Personal Information From? 

We collect your personal information directly from you, from your interaction with the Site,  and from publicly available sources, which collect the personal information directly from  you. We may collect information from - or share information with - our partners such as  market research firms and our affiliates, subsidiaries, joint ventures, or other companies 

under common control. We may combine that information with other information we  collect about you. Furthermore, all information gathered about you by the Company may  be shared with any of the Company's current or future subsidiaries or affiliates. 

Please refer to the California Privacy Policies posted on each of our affiliate / brands  websites for information on how we may use Sensitive Personal Information in providing  Services to our customers and how to exercise the Right to Limit Use and Disclosure of  Sensitive Personal Information. 

What Business or Commercial Purposes Are the Personal Information Collected For? 

We primarily collect personal data in order to: present our website and its contents in a  suitable and effective manner for you and your device; contact you to provide you with  information you request from us; to advertise opportunities, services, or special events that  we think may be of interest to you; to measure the effectiveness of our website; to provide  support, troubleshoot issues, and respond to requests, questions or comments; to carry  out our obligations and enforce our rights; and other purposes as permitted by applicable  law. 

We do not offer a financial incentive for the collection, sale, or deletion of personal  information. The ability to accumulate points and to access discounted rates is not directly  related to the value provided to the business of members' data. 

What Individual Rights Do You Have? 

You have the right to know the personal information we collect, use, and disclose about you  to third parties. There are two types of right to know requests that you can make. There are  certain exceptions to a consumer’s right to know. We will state in our response if an  exception applies. 

o If you make a Right to Know Abbreviated Request, you will receive the following  information about you: 

▪ Categories of personal information collected, sold, or shared; 

▪ Categories of sources from which personal information is collected; ▪ Categories of third parties to whom the information is sold, shared or  disclosed; 

▪ Business or commercial purpose for collecting, sharing, or selling personal  information; 

▪ Categories of personal information disclosed for a business purpose and  categories of persons to whom it was disclosed for a business purpose. o If you make a Right to Know Specific Pieces of Information Request, you will receive  the following information about you: Specific pieces of personal information 

collected about you. This information will be provided to you free of charge, unless  we determine that your request is manifestly unfounded or excessive. You may  request this information twice in a 12-month period. 

Right of Deletion: You have the right to request that we and our service providers delete any  personal information about you that we have collected from you upon receipt of a verifiable  request. This right is subject to certain exceptions. We will state in our response if an exception applies. 

Right to Opt-Out of the Sale or Sharing of Personal Information: You have the right to opt out of the sale or sharing of your personal information by a business subject to certain laws  and regulations. Our use of cookies and other tracking technologies may be considered a  sale of personal information under the CCPA. Categories of personal information that we  have sold under the CCPA include identifiers (e.g., IP addresses), and Internet or other  similar network activity. Categories of third parties to whom personal information is sold  under the CCPA include data analytics providers. 

We recognize the Global Privacy Control. Your browser must be able to support the Global  Privacy Control for us to recognize your opt-out preference signal. You can opt out of our  tracking technologies for analytics providers by clicking the link or by broadcasting the GPC  signal during your browsing session. Please note that opt-out choices may be stored via  cookies. If you clear cookies, if your browser blocks cookies, or if you view the page from a  different browser or device, your opt-out choice may no longer be logged or recognized. 

Right of Correction: If we maintain inaccurate personal information about you, then you  have the right to request that we correct the inaccurate personal information upon receipt  of a verifiable request. Taking into account the nature of the personal information and  purposes of processing the personal information, you have the right to request that we  correct inaccurate personal information about you, if applicable. 

Right to Limit Use and Disclosure of Sensitive Personal Information: In the preceding twelve  (12) months, the Company has not used or disclosed Sensitive Personal Information for  purposes other than those specified under the CCPA Regulation 7027(m). 

Request to Appeal: If you are a Colorado resident and we refuse to act on your request, you  may appeal our refusal within a reasonable period after you have received notice of the  refusal by utilizing any of the methods in the Contact Us Section. 

What is the Process for Contacting Us? 

Submitting Requests: You can submit your request by email at info@miramarhotelpr.com or via phone at 787-977-1000 or by sending a letter to 606 Ave. Ponce de León, San Juan, PR 

907. You may choose a person, or a business registered with the California Secretary of  State that you authorize to act on your behalf to submit your requests (“Authorized Agent”).  If you choose to use an Authorized Agent, we require that you provide the Authorized Agent  with written permission to allow them to submit your request and that you verify your  identity directly with us. Failure to do so may result in us denying your request. 

Verifying Requests: To ensure the protection of your personal information, we must verify  that the individual submitting a request to know, request to delete, or request to correct is  the consumer to whom the request relates prior to processing the request. To verify a  California consumer’s identity, we may request up to three pieces of personal information  about you when you make a request to compare against our records. We may also request  that you sign a declaration under the penalty of perjury from the consumer whose personal  information is the subject of the request. 

We will only use personal information provided in your request to verify your identity and  will delete any information you provide after processing the request. We reserve the right to  take additional steps as necessary to verify the identity of California consumers where we  have reason to believe a request is fraudulent. 

You have the right not to receive discriminatory treatment for exercising the privacy rights  conferred by California law. We will not discriminate against you because you exercised  any of your privacy rights. We will also not retaliate against any employee, applicant for  employment, or independent contractor for exercising their rights under the CCPA. 

Nevada Consumers’Rights 

If you are a Nevada resident, you may request that we stop selling certain categories of  personal information that we collect. You may (A) submit a request to opt out of any  potential future sales, and/or (B) request changes to your Covered Information by utilizing  any of the methods described in the “Contact Us” section. 

Washington Consumers’ Rights 

Consumer Health Data is a subset of personal information that is linked or reasonably  linkable to a consumer’s past, present, or future physical or mental health status. We may  request information from you regarding various health conditions as needed to safely  provide spa services or in connection with responding to or submitting a personal injury  claim. We may also receive Consumer Health Data about you from third parties with your  authorization. We may use and share Consumer Health Data to operate, manage, and  maintain our business, to provide our services, and to accomplish our business purposes  and objectives, including, for example, to undertake quality and safety assurance  measures; conduct internal investigations; comply with law, legal process, and internal 

policies; maintain records; and exercise and defend legal claims. We do not “sell”  Consumer Health Data, as defined in the Health Privacy Laws.  

If you are Washington resident, you may have the right to submit some or all of the  following requests regarding your Consumer Health Data, subject to applicable law and  certain exceptions: request to know, request to correct, request to delete, request to  withdraw consent, and request to appeal. 

International Transfers of Personal Information 

To deliver exceptional guest service, you acknowledge that we may share your personal  information among affiliates, brands, our service providers, and other third parties, which  may be located in countries outside of your own. 

When you stay at a property outside the United States, the data controller for that property  transfers the personal information relating to your reservation to the Company in the United  States pursuant to data transfer agreements when required by applicable laws or  regulations. The data controller may also maintain a local copy of your personal  information when so required by applicable laws or regulations. Although the data  protection laws of various countries may differ from those in your own country, we will take  appropriate steps to ensure that your personal information is handled as described in this  Statement and in accordance with the law.