Apple Leisure Group

Last Updated: December 2022

Introduction

We are Apple Leisure Group (“ALG, we, us, our”), part of the Hyatt Group, a leading resort brand-management, leisure travel and hospitality group with a unique business model serving travellers and destinations worldwide. ALG, through its group of subsidiary companies, is consistently focused on delivering exceptional value to travellers and strong performance to resort owners by strategically leveraging the ALG portfolio of brands and affiliates.

The application of this policy

To provide the best service we can, we need to collect, use and share personal information. This Policy explains how we use your personal information when you travel with or receive services from our portfolio. 

ALG Portfolio

This privacy policy (the “Policy”) applies to the following parts of the ALG portfolio:

• Each of the following branded hotels and resorts: Secrets® Resorts & Spas, Breathless Resorts & Spas®, Dreams® Resorts & Spas, Hyatt Vivid Hotels & Resorts, Alua Hotels & Resorts®, Zoëtry® Wellness & Spa Resorts, and Sunscape® Resorts & Spas.

• The separate and distinct legal entities that manage, market, operate, commercialise, franchise, license, own property and/or provide other services in connection with one of the above ALG brands (excluding brands and businesses under ALG Vacations Corp.).

• The separate and distinct legal entities that manage and operate hotels in connection with one of the independently branded hotels managed in association with an ALG entity.

• Our subsidiary companies who participate in and administer the World of Hyatt® loyalty program.

• The separate and distinct legal entities that provide services and products in connection with Unlimited Vacation Club®, and Amstar DMC.

This Policy does not apply to Trisept Solutions, LLC or ALG Vacations Corp. and its branded businesses which includes (but are not limited to), Apple Vacations®, Funjet Vacations®, Travel Impressions®, CheapCaribbean.com®, and BeachBound® .

Separate legal entities

This policy also applies to the use of your personal information by the separate and distinct legal entities that manage, operate, franchise, license or own properties and/or provide services in connection with our portfolio.  

Please check your booking and invoicing information for details of any other legal entity, such as the hotel owner, involved in independently processing your personal information when you travel or receive services from our portfolio. 

Hyatt

ALG is part of the Hyatt Group. However, this policy does not apply to the processing of your personal information by the Hyatt Group outside of ALG and our our portfolio. For more information on how the Hyatt Group processes your information, please see its privacy policy found here: https://www.hyatt.com/info/privacy-policy

Local laws

While this Policy is intended to describe the broadest range of our information collection, processing and sharing activities globally, some activities may be more limited in some jurisdictions based on the particular laws or regulations in those territories/countries. For example, the laws of a particular territory/country may limit the types of personal information we can collect or the manner in which we process that information. In those instances, we adjust our internal policies and/or practices to reflect the requirements of local law.

1. Types of personal information we may collect

The information we collect may vary by territory/country or by your preferred method of interaction with us. We obtain most of your information either directly from you or your booking channel. The main booking channels people use to travel with us or access our services are our websites, Hyatt.com, World of Hyatt, our mobile application(s), Hyatt mobile application(s), tour operators, and travel agents.

The table below contains more details regarding the information we may collect and process about you.

2. Biometric, health-related or other sensitive personal information

There may be instances in which the personal information listed above contains information that is categorised as sensitive personal information under the privacy laws of some territories or countries.

Special categories

Depending on the applicable law, sensitive personal information can mean personal information from which we can determine or infer an individual’s racial or ethnic origin, political opinions, religious beliefs or other beliefs of a similar nature, membership in a trade union or professional, religious, philosophical, or political association, physical or mental health or condition, medical treatment, genetic data, biometric information, information about an individual’s sexual orientation, personal information relating to potential crimes or international sanctions, or your precise geolocation. We may collect Sensitive Personal Information such as health-related or religion information you provide us to fulfil special requests (e.g., health or religious conditions that require specific accommodation or services, or biometric information, such as information used for facial recognition).

Financial information

In some rare instances, financial records, credit card information and location data may constitute sensitive personal information where you are located.

Use

We only process sensitive personal information in your jurisdiction if and to the extent permitted or required by applicable law (for example, (i) sanctions or anti-money laundering screening, (ii) so that we can ensure we tailor our services to you accordingly in terms of food allergies and medical conditions, or (iii) to ensure we can process card payments).

Consent

Importantly, where we rely on consent to process your sensitive personal information, you have the right to withdraw that consent at any time.

3. How we use your personal information and our lawful reasons for that use

We use your personal information to administer your travel or the services you receive from us. We also use your information for our wider business interests, such as planning, risk management and marketing. We describe that in more detail in the table below.

Lawful reasons for use

When we process your personal information as one of our guests or someone else with whom we do business, we process that information on the basis of one more of the following so called “legal bases” depending on the circumstances:

Contract

If you make a booking to travel with or receive services from us, our main lawful basis for using your personal information is the performance of our contract with you. 

Legitimate interests

If you are travelling or receiving services from us but someone else in your party or family contracted with us to make the booking, our lawful basis is our legitimate interest in administering your travel and services.  

Our main lawful basis for using your information for our wider business is the legitimate interests in providing, improving and developing our services. We will only use your information for the purposes of a legitimate interest when there is no unfair impact on you.

Legal obligations

Where necessary, we will use your personal information to meet our tax and other legal obligations.

We and the separate and distinct legal entities that manage, operate, franchise, license or own properties and/or provide services in connection with our portfolio also use your personal information as controllers to meet our tax and other legal obligations. 

Special category

Where we use your special category information, we must identify an additional condition. This condition will mainly be that the use is necessary for a substantial public interest. However, at times we may also rely on your consent. Where we rely on your consent, we will explain at the time what we need your information for and what we will do with it.

Purpose and lawful basis

The table below sets out in more detail how we use your information and our lawful bases.

4. Disclosures of Your Personal Information

Apple Leisure Group and Hyatt Group

We may disclose your information to other organisations within the Apple Leisure Group and the Hyatt Group for the purposes described in this Policy, including for providing you with our services, and for administering membership/loyalty programs.

Our Service Providers and Suppliers of Goods

Like most international hotel brands, we may outsource the processing of certain functions or  provision of goods and/or information to third parties. When we do outsource the processing of your personal information to third parties or provide your personal information to third-party service providers or suppliers, we oblige those third parties to protect your personal information with appropriate security measures.

Reservations and Other Requests at Third-Party Locations

Our services allow you to make requests for reservations and other items or services with third parties, including hotels that are not locations we manage, and excursions offered by third parties.  Where you make such a request, we will pass information about your request that you provide to us to the third party. The information we provide to these third parties will be handled in accordance with their own privacy policies and procedures, and not ALG’s.

Consumer Insights

Where we hold personal information about you, we may disclose this personal information to other companies that may also hold information about you. These companies may combine the information in order to better understand your preferences and interests, thereby enabling them and us to serve you better. If your personal information is used for direct marketing purposes, you have the right to object to that by contacting us using the contact information provided below.

On-Property Companies

We may share your personal information with companies and other organisations that own and manage the spas, restaurants, health clubs, and other outlets at ALG locations so they can provide you with services you have requested and we can charge their services to your room account.

Business Transfers

As we continue to develop our business, we may sell hotels and other assets, or cease being the manager or franchisor of an ALG location. In those circumstances, we may include the personal information collected about you, or control of that personal information, as a business asset in any such transfer. Also, in the unlikely event that we, or substantially all of our assets, are acquired, personal information collected about you, or control of such information, may be one of the transferred assets. In each case we may also transfer information to third party legal, technical or financial advisers as part of the relevant transaction.

Similarly, we may disclose your personal information to a third party whom we acquire in order to facilitate mergers and acquisitions of our business and for the furtherance of the purposes described above.

Owners of Hotel Properties

The main third parties that receive your personal information are the separate legal entities that own or lease the various hotels operating under (or in connection with) our portfolio. These entities use your personal information as processors or co-controllers on behalf of our brands to administer your travel or provide our services. These entities also use your personal information as controllers to meet their tax and other legal obligations. 

E-Folio Program

If you are an employee or independent contractor of a company that participates in our E-Folio Program, and you use the corporate credit card that is provided to you by your employer (if you are an employee) or corporate client (if you are an independent contractor) to pay for your hotel bill at a ALG property, then you may benefit from our E-Folio Program.

Under the E-Folio Program, an extract of your bill (including the dates of your stay, your credit card details and amounts incurred at the ALG property including room charges and all incidental charges including but not limited to food, beverage and entertainment charges) will be transferred electronically by the ALG property either to ALG, Hyatt or to a third-party service provider located in the United States who acts on ALG’s behalf to compile the extract and transfer it to:

• the credit card network operator, the credit card issuer and/or their respective subcontractors, who will, in turn, forward that extract to your employer or corporate client (and/or their respective subcontractors) to facilitate the processing and tracking of your travel-related expenses; or
• in some limited circumstances, your employer or corporate client (and/or their respective subcontractors) directly for the same purpose.

Once the personal information is transferred to the credit card network operator, credit card issuer, your employer or corporate client and/or their respective subcontractors, it is no longer subject to the protections described in this Policy, but rather your own arrangements with your employer or corporate client, the relevant credit card network operator and/or the relevant card issuer.

Regulators and Official authorities

We reserve the right to disclose any personal information we have concerning you if we are compelled to do so by a court of law or lawfully requested to do so by a governmental entity or if we determine it is necessary or desirable to comply with the law or to protect or defend our rights or property in accordance with applicable laws.

Summary of Recipients

Further information about what information we share with service providers and third parties is included in the table below. Please note that the table below contains personal information we may share where necessary on an occasional or one-off basis as well as personal information we share routinely. We will always minimise the amount of personal information shared wherever possible. 

5. International transfers

Because of the international nature of our business, we will need to transfer your personal information to other countries. These countries may have different laws and data protection compliance requirements to those that apply in the country in which you are located. 

For example, we will transfer your personal information to the legal entities that manage, franchise, license, or own property and/or provide services in connection with the our portfolio and the other third-party suppliers responsible for administering your travel and providing our services. You can see the countries where these resorts are based on our website.

When we transfer your personal information to another country, we will ensure that country has been recognised as providing an adequate level of data protection or implement appropriate EU approved standard contractual clauses safeguards (or where appropriate clauses approved for use in other jurisdictions). Where it is not possible to implement an appropriate safeguard, we will identify an exemption, such as consent or the contract for our services. 

Hyatt Group

Where your personal information is shared with the Hyatt Group, it will be transferred to the major locations in which Hyatt or Hyatt Locations (as defined by the Hyatt Privacy Policy) operate including the United States of America, Hong Kong and Germany (a full list of the locations where your information could be transferred can be found by selecting “All” at www.hyatt.com/explore-hotels). Hyatt has implemented binding corporate rules to protect personal information it transfers to other countries. You can find out more about how the Hyatt Group safeguards international transfers of personal information here – www.hyatt.com/info/privacy-policy

Please contact us if you want further information on the specific mechanism used by us when transferring your personal information. Contact details can be found at the bottom of this policy.

6. Retention

We will only retain your personal information (including your sensitive personal information) for as long as is reasonably necessary for the purpose for which information was collected, or as legally required. 

Once the purpose for collecting your personal information has been achieved, we will delete your personal information. That is usually ten years after our last contact with you subject to: regulatory requirements that we are subject to, including laws and regulations related to tax, employment, accounting, and securities; whether a legal claim might be brought against us, for which the information would be relevant; the necessity of the information to provide our services to our customers; and the types and sensitivity of personal information being processed (which might result in a shorter period).

7. Children

We do not sell products or services for purchase by children. You may only use our websites if you are at least 18 years of age and can form legally binding contracts under applicable law. We will only collect information relating to children with the specific permission of parents or guardians. 

8. Your Privacy Rights

United Kingdom, European Economic Area, and Switzerland

If you are based in the UK, European Economic Area or Switzerland or receiving services from one of our European brands, you have the right to:

• Access your information
• Object to the use of your information
• Erasure of your information 
• Portability of your information to other organisations 
• Correct and update your information if it is inaccurate
• Restrict our use of your information while any concerns you raise are resolved
• Complain to your data protection authority
• Withdraw your consent

The contact details to exercise these rights are set out below. Please be sure to include your full name, address and telephone number and a copy of a document evidencing your identity (such as an ID card or passport) so we can ascertain your identity and whether we have any personal information regarding you, or in case we need to contact you to obtain any additional information we may require to make that determination. Where you make more than one request in quick succession, we may respond to your subsequent request by referring to our earlier response and only identifying any items that have changed materially.

Please be aware that these rights are not absolute and there are situations where they cannot be exercised or they are not relevant. You can find out more information about your rights on the website of your country’s data protection authority.

United States

Depending on the privacy laws in your state of residence, you may also be able to make some or all of the following requests with respect to your personal information:

• Access/Right to Know – You have the right to confirm whether we process personal information about you, and you can request that we disclose to you the categories of personal information collected about you (including sensitive personal information), the categories of sources from which the personal information is collected, the categories of personal information sold or disclosed, the business or commercial purpose for collecting and selling the personal information, the categories of third parties with whom we share the personal information, the specific pieces of personal information collected about you, and information about the logic involved in any automated decision-making processes used by us (if applicable), as well as a description of the likely outcome of the process with respect to you.

• Deletion – You can request that we delete your personal information that we maintain about you, subject to certain exceptions.
• Do Not Sell or Share My Personal Information for Behavioral Advertising – You can request to opt out of the sale of your personal information and the sharing of your personal information for cross-context behavioral advertising. We use cookies and related technology for advertising purposes, which could constitute a “sale” or “sharing” of your personal information according to some privacy laws. If you would like to opt out of such cookie-based tracking for advertising purposes, you can update your cookie preferences on our websites by clicking on the cookie center link in the footer of the page you are viewing. Additionally, you can opt out of certain uses of cookies for advertising purposes by visiting info/choices.

Your opt-out of cookie-based tracking for advertising purposes is specific to the device, website, and browser you are using, and is deleted whenever you clear your browser’s cache. This means you need to adjust your cookie preferences on each website, device, and browser you use.

• Correct or Update my Personal Information – You have the right to request that we correct, update, or modify the personal information we maintain about you. If you have an account, you can also update your profile information any time by visiting the account settings page within your account.
• Opt-out of Automated Decision-Making – You have the right to request to opt-out of any profiling or automated decision-making, to the extent we engage in those processing activities.
• Limit the Use of my Sensitive Personal Information – If you are a California resident, in relation to any sensitive personal information identified below, you can request that we limit our use and sharing of such information only to those uses which are necessary to carry out our relationship with you (such as providing our goods and services that you’ve requested, maintaining the quality of our services, or protecting our services against illegal activity), or as otherwise allowed by relevant privacy laws.

As is the case for all consumers regardless of residency, we will not deny you any products or services, nor charge you different prices, nor discriminate against you in any other manner in response to you exercising any of these rights.

Eligible individuals can request to exercise these rights by emailing or calling us using the contact information below or by clicking on the link in the footer of the page you are viewing: 

• Email – PHLCO-SMB-Privacy@hyatt.com
• Phone – +1-414-934-2271

We may deny certain requests, or fulfil a request only in part, based on our legal rights and obligations. For example, we may retain personal information as permitted by law, such as for tax or other record-keeping purposes, to maintain an active account, and to process transactions and facilitate customer requests.

We will take reasonable steps to verify your identity prior to responding to your requests. The verification steps will vary depending on the sensitivity of the personal information, the nature of your request, and whether you have an account with us.

You may designate an authorised agent to make a request on your behalf. When submitting the request, please ensure the authorised agent is identified as an authorised agent and ensure the agent has the necessary information to complete the verification process.

For purposes of exercising these rights, please note the following additional details regarding how we collect and use your personal information as described in this policy:

• We may collect, and use for our business and commercial purposes, the following categories of Personal Information as set forth in applicable California law: Identifiers; California customer records (such as birthdate, contact information, and payment information); characteristics of protected classifications under California or federal law (such as demographic information like age and gender); commercial information; biometric information; Internet or other electronic network activity information; geolocation data; audio, electronic or visual information; sensitive personal information; and inferences. Please see Section 1 and Section 2 above for more details about the information and sensitive information we collect.
• We use the above categories of personal information for the business and commercial purposes described in Section 3 above.
• We collect personal information from the following categories of sources, as more fully described in Section 1 above: directly from you, automatically from your devices, from our service providers, from social media, from our business partners, and from our affiliates and parents.
• We may disclose each of these categories of personal information to the extent permitted by applicable law with the following categories of parties, as more fully described in Section 4 above: affiliates and parents, service providers, business partners, advertising networks, data analytics providers, social media networks, with entities for our legal compliance purposes, and with potential acquirers or creditors.
• We may “sell” or “share” the following categories of personal information: identifiers; California customer records; demographic information; commercial information; website data or other electronic network activity; geolocation data; and inferences. We sell and share this personal information with advertisers, advertising networks, and social networks. We do not knowingly sell or share the personal information of consumers under 16 years of age.
• We do not use or disclose sensitive personal information for purposes other than those specified under applicable California privacy regulations.

Brazil

If you reside in Brazil or otherwise subject to the Brazilian Federal Law nº 13.709/18 (LGPD), you may also exercise the following rights when applicable:

• Withdraw consent – You have the right, when the basis for processing is consent, to withdraw the consent at any time, through an easy to use and free of charge procedure.
• Right to review of automated decision-making – You may request review of decisions taken solely on the basis of automated processing of your personal data which affects your interests, including decisions intended to define personal, professional, consumer or credit profile or aspects of your personality. You may also request clear and adequate information regarding the criteria and procedures used for an automated decision, subject to our commercial and industrial secrecy.
• Right to Petition – You may petition with the Brazilian regulatory authority as well as consumer protection entities regarding the processing of your personal data.

Brazilian residents can exercise these rights by emailing or calling us using the contact information above. 

Mexico

If you are based in Mexico or receiving services from one of our Mexican brands, subject to any applicable legal limitations, you have the right to:

• Access your information
• Object to the use of your information
• Erasure of your information 
• Portability of your information to other organisations 
• Correct and update your information if it is inaccurate

9. Contact

If you have any questions about this policy or would like to exercise any of your rights, please contact the brand you are travelling with via your online account or the contact details on the brand’s website. 

Alternatively, please contact us by: 

Inclusive Collection

• Email – PHLCO-SMB-Privacy@hyatt.com

Amstar

• Email –  privacy@amstardmc.com

UVC

• Email – privacy@unlimitedvc.com