Swire Hotels PERSONAL INFORMATION COLLECTION STATEMENT for employees, workers, consultants, contractors and interview candidates

SWIRE HOTELS PRIVACY POLICY FOR JOB APPLICANTS, EMPLOYEES, WORKERS, CONSULTANTS AND INDEPENDENT CONTRACTORS

Version 3: 1 November 2021

General Section

This Privacy Policy ("Privacy Policy") applies to all job applicants, employees, temporary workers, consultants, independent contractors of Swire Hotels relevant legal entity (please refer to Appendix 1 below for the list of entities collecting relevant personal data) (“Swire Hotels”, “we”, “us”, “our”), and any reference to "employment" or "engagement" in this Privacy Policy refers to the employment, contractor engagement or secondment relationship that such persons have with Swire Hotels, or any persons who are applying for aforementioned jobs or positions with Swire Hotels (as applicable). We may have specific privacy policies for specific situations (in which case such specific privacy policies will apply).

Please read this Privacy Policy to understand your rights and the choices you can make about the way how your Personal Data is collected, used, stored, transferred, disclosed or otherwise processed by us. In this Privacy Policy, “Personal Data” means any data (i) relating directly or indirectly to a living individual; (ii) from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and (iii) in a form which access to or processing of the data is practicable.

If you stay within Chinese Mainland, Appendix 2 will also apply. To the extent that there is any conflict between the General Section of this Privacy Policy and Appendix 2, Appendix 2 shall apply.

Throughout your employment by, engagement with, secondment to or application to work in Swire Hotels, Personal Data will be collected in relation to you for purposes related to your employment or engagement as specified hereinbelow. It is also necessary for you to supply to us with Personal Data about yourself and sometimes also your family members from time to time in connection with your employment and engagement. You represent and warrant that the consent of your family members whose Personal Data you have provided and disclosed to us have been sufficiently obtained to allow us to process the same in relation to the purposes stated herein.

TYPES OF PERSONAL DATA

To process your application for a job or a position with Swire Hotels, we may collect the following Personal Data from you:

·name, email address, residential address, phone number, gender, education information, job experience, nationality, work permit information, social media account name, identity card or passport information, photograph, professional experience, dismissal and criminal records, referee information, signature.

To administer your employment offer and onboarding you as an employee of Swire Hotels, we may also collect the following Personal Data from you:
·name, email address, residential address, phone number, date of birth, age, gender, education information, job experience, nationality, passport or identity information, bank account information, work permit information, marital status, emergency contact, place of birth, signature and Personal Data of your family members (if applicable for any fringe or insurance benefits)

To engage you as an independent contractor or secondee of Swire Hotels, we may also collect the following Personal Data from you:
·name, email address, residential address, phone number, date of birth, age, gender, education information, job experience, nationality, passport or identity information, bank account information, work permit information, marital status, emergency contact, place of birth, signature and Personal Data of your family members (if applicable for any fringe or insurance benefits).

PURPOSE OF COLLECTION

The purposes for which such Personal Data may be used will include the following:

Recruitment and selection;
Fulfilment of the statutory and legal obligations of Swire Hotels, including compliance with any request from any governmental or regulatory authority or court order (in any jurisdiction);
Administration and management of personnel, including determining and reviewing salaries, bonuses and other benefits for you and your eligible dependant(s), if any;
Administration of individual records during the course of employment or engagement;
Manpower planning, training and development, including secondment and transfer;
To introduce and/or cross-refer you to any of the divisions, subsidiaries, associated, affiliated companies and/or other business units within John Swire & Sons (H.K.) Ltd., local or overseas, for which we may or may not be remunerated;
Career and performance development, including consideration for promotion;
Provision of personal reference or reference for any personnel related activities;
Disciplinary purposes arising from the conduct of personnel or their ability to perform services for Swire Hotels properly;
Administration of Swire Hotels' business, including making tax returns and/or other related filings with government authorities, whether locally or overseas;
Corporate restructuring, reorganization, transfer, assignment of all or part of Swire Hotels or its businesses, or such similar purposes;
Health care and ensuring appropriate and safe working environment;
Communication between Swire Hotels and its personnel, and between Swire Hotels and their family members in relation to death, illness, injury or emergency in connection with work;
Legal proceedings (including prospective legal proceedings) and obtaining legal advice, whether locally or overseas;
Establishing, exercising or defending legal rights, whether locally or overseas;
Promotion or marketing of Swire Hotels' business whether locally or overseas via various media, including but not limited to newspapers, magazines, Swire Hotels' website and social media platforms;
Monitoring compliance with internal rules and policies of Swire Hotels;
Compliance with applicable procedures, laws and regulations, whether locally or overseas; and
Purposes directly relating thereto.

It is obligatory that you provide any Personal Data requested from you, unless you are informed otherwise on or before collection by Swire Hotels. Failure to supply such Personal Data may result in Swire Hotels being unable to carry out its human resources management functions including (but not limited to) provision of benefits or otherwise the management of Swire Hotels' affairs. Swire Hotels will take all practicable steps to ensure that Personal Data collected and held by Swire Hotels are protected against unauthorized or accidental access, processing, erasure or other use.

CLASSES OF TRANSFEREES

Swire Hotels may nonetheless use or disclose Personal Data in accordance with the relevant law from time to time. Swire Hotels may provide Personal Data to the following parties, whether locally or overseas, for the above-mentioned purposes for which the Personal Data is to be used (or a directly related purpose) as follows:

Appropriate and authorized persons within Swire Properties Limited and its affiliate and/or subsidiary companies;
Swire Properties Limited and its affiliate and/or subsidiary companies, local or overseas;
Senior executives of existing or potential business partners of Swire Hotels and Swire Properties Limited;
Any joint venture of Swire Properties Hotel Management Limited, Swire Hotels, relevant legal entities and Swire Properties Limited and their affiliate and/or subsidiary companies;
John Swire & Sons (H.K.) Limited in their capacity as the parent company of Swire Hotels for the following purposes:
- Salary, bonus and remuneration review and approval by John Swire & Sons (H.K.) Limited;
- Talent review for human resources plan and management including succession plans by John Swire & Sons (H.K.) Limited;
- Records for qualification, certification and/or training for professional qualified persons;
- Manpower planning, training and development, including secondment and transfer;
- Special circumstances involving protection of your vital interest or public health interest such as COVID-19;
- Any of the divisions, subsidiaries, associated, affiliated companies and/or other business units within John Swire & Sons (H.K.) Ltd., local or overseas, for cross referral of transfer, assignment and secondment;
Any relevant government or regulatory authorities, including but not limited to, the tax department, the labour department and the immigration or custom department;
Persons seeking employee references;
Any of our auditors, legal and/or other professional advisors or any other person under a duty of confidentiality to us;
Any subsidiary/affiliated companies or service providers, local or overseas, for matters related to career planning/development within Swire Hotels;
Third parties in connection with any corporate restructuring, reorganization, transfer, assignment or sale of all or part of Swire Hotels or its businesses, or such similar purposes;
Third parties for promotional or marketing purposes, including but not limited to advertising and PR agencies;
All relevant third parties in connection with the operation of Swire Hotels' business, including but not limited to any actual or proposed bidder, tenderer, service provider, downstream sub-contractor(s), business partner or any other person who provides/ introduces services to us or to whom we provide introductions or referrals.

ACCESS TO PERSONAL DATA

You may have the right to:

check whether Swire Hotels holds any Personal Data about you;
request access to such Personal Data in accordance with relevant legal requirement;
request Swire Hotels to correct any Personal Data relating to you which is inaccurate in accordance with the relevant legal requirement; and
ascertain Swire Hotels' policies and practices in relation to Personal Data and be informed of the types of Personal Data held by Swire Hotels.

In accordance with the relevant legal requirement, Swire Hotels may have the right to charge a reasonable fee for the processing of any Personal Data access request. In determining a reasonable charge for handling such requests, the cost of actual time spent by administrator(s) / manager(s) who are involved in processing a particular Personal Data access request is the basic element of the fee charged. In addition, cost of copying per sheet of paper will also be charged.

SECURITY OF PERSONAL DATA

In order to ensure the correct use and to maintain the accuracy of Personal Data collected from you, as well as preventing unauthorised or accidental access, processing, erasure or other use of the Personal Data, we have implemented various physical, electronic and management measures to safeguard and secure the Personal Data we collect.

For the Personal Data we collect online, we use an industry standard for encryption over the Internet, to protect the Personal Data.

The Personal Data you provide to us will be stored in a database for no longer than is necessary. The website has a firewall in place, which should protect the Personal Data collected from you against unauthorised or accidental access. However, complete confidentiality and security is not yet possible over the Internet, and privacy cannot be completely assured in your communications to us. You acknowledge that personal information is disclosed at your own risk, and may be subject to unauthorised use by others. This may result in, among others, you receiving unsolicited messages from other parties. We are not responsible in any manner for direct, indirect, special or consequential damages, howsoever caused arising out of the communication of information to us. You are encouraged to protect against unauthorised access to your password. Make sure you sign out from your account when finished particularly when using a shared computer.

ENQUIRIES

All requests for a list of our subsidiaries/associated/affiliated companies, or access to Personal Data, or correction of Personal Data, or for information regarding policies and practices and types of Personal Data held, should be addressed to the Data Protection Officer in Swire Hotels at the following address:

The Data Protection Officer

Suite 2701-05, Cityplaza One

1111 King’s Road

Taikoo Shing, Hong Kong

dataprotectionoffice@swirehotels.com

Amendment of Privacy Policy

We may amend the terms of this Privacy Policy from time to time. The amendments form part of this Privacy Policy. You may access and obtain a copy of this Privacy Policy, as amended from time to time, at our relevant website so that you are always informed of the ways we collect and use Personal Data.

Where required under applicable data protection laws and regulations in the relevant jurisdiction, we may seek your consent. If you do not provide your consent, we may be unable to continue performing our obligations to you.

APPENDIX 1: SWIRE HOTELS RELEVANT LEGAL ENTITIES

Update date: 1 November 2021

Swire Properties Hotel Management Limited

Swire Properties Hotel Holdings Limited

Swire Properties Hotel Services Limited

Airline Hotel Limited

成都乾豪置业有限公司博舍酒店管理分公司Chengdu Qianhao Real Estate Company Limited The Temple House Hotel Management Branch Office

冠丰（上海）房地产发展有限公司Guan Feng (Shanghai) Real Estate Development Company Limited The Middle House

北京麟联置业有限公司Beijing Linlian Real Estate Company Limited East Hotel

北京三里屯酒店管理有限公司Beijing Sanlitun Hotel Management Company Limited

BCC Hospitality Services LLC

APPENDIX 2: CHINESE MAINLAND APPENDIX

(Last updated: 1 November 2021)

INTRODUCTION

This Chinese Mainland Appendix applies (in addition to the General Terms) if you stay within the mainland People’s Republic of China (“Chinese Mainland”). For the purpose of this Privacy Policy, Chinese Mainland excludes the Hong Kong Special Administrative Region, the Macau Special Administrative Region and Taiwan. Unless defined otherwise in this Chinese Mainland Appendix, all capitalised terms herein shall have the same meaning as given to them in the General Terms.

PERSONAL INFORMATION

In this Chinese Mainland Appendix, “Personal Information” means any type of information (recorded via electronic means or otherwise) associated with an identified or identifiable natural person, but excluding information after anonymisation handling. Personal Information may include Sensitive Personal Information (defined below).

CONSENT

We will collect, store, use, process, transmit, provide, disclose or delete (together, “Process”) your Personal Information in accordance with this Privacy Policy, and we may only do so with your consent. Where the applicable Chinese Mainland data protection laws and regulations require us to provide separate consent under certain circumstances, we will only Process such Personal Information upon obtaining your separate consent.

SENSITIVE PERSONAL INFORMATION

Certain Personal Information may be considered sensitive Personal Information due to their particularity. “Sensitive Personal Information” means Personal Information which, if leaked or used illegally, may easily cause harm to the dignity of natural person, or harm to personal or property safety, including: biometric information, religious belief, specific identity information, health and medical information, financial account information, individual location tracking information, and Personal Information of minors under the age of fourteen (14).

For administering your job application, employment offer and onboarding you as an employee, independent contractor or secondee of Swire Hotels, we may collect the following Sensitive Personal Information from you: passport or identity information, bank account information, work permit information, marital status of your and that of your family members (if applicable for any fringe or insurance benefits) and criminal records (if any).

This Privacy Policy describes how your Sensitive Personal Information will be Processed for the purposes and by the means described in this Privacy Policy. We shall Process such Sensitive Personal Information upon obtaining your separate consent.

You need to carefully consider whether your Sensitive Personal Information should be disclosed to us when you apply for a job or position with Swire Hotels, or when you come onboard as an employee, independent contractor or secondee of Swire Hotels. It is necessary for you to provide us with such Sensitive Personal Information, so that we can facilitate your job application or onboarding process (as applicable). If you do not provide us with your separate consent, we may not be able to facilitate your job application or onboarding process (as applicable).

AGE LIMIT

We will not collect, use or otherwise process Personal Information of individuals who are under fourteen (14) years of age. If we are required to do so (e.g. to facilitate medical insurance for an employee’s child), we shall only do so upon obtaining separate consent from their parents or guardians.

Where we have obtained separate consent from parents or guardians for Processing their minors’ Personal Information, we will only Process, retain and protect those minors’ Personal Information in the same manner and in the same locations as set out in this Privacy Policy (as supplemented by the Chinese Mainland Appendix). If the parents or guardians refused to provide separate consent for our Processing of their minors’ Personal Information which are necessary, we may not be able to provide certain services to their minors. To exercise any data subject rights for minors, please refer to “How do you exercise your data subject rights” section below.

SCOPE AND USE OF PERSONAL INFORMATION

The sections titled “Types of Personal Data” and “Purposes of Collection” in the General Section of this Privacy Policy shall also apply to this Chinese Mainland Appendix, and all references to “Personal Data” shall be replaced by “Personal Information”.

There are several ways for us to collect your Personal Information, including that we may directly collect your Personal Information from you (such as when you apply for our jobs), or we may collect your Personal Information from third parties including our recruitment or background check agents and services providers or your referees, or we may collect your Personal Information when you participate in our activities.

We shall not be required to obtain your consent to Process your Personal Information if any of the following situations applies:

where the Processing of Personal Information is necessary for the conclusion or performance of a contract to which you are a contracting party, or where it is necessary to carry out human resources management according to lawfully formulated labour rules and lawfully concluded collective contracts;
where it is necessary to perform a statutory responsibility or obligation, for example, making disclosures when required by law, regulation, or court order of any jurisdiction and/or as requested by any government, regulatory or law enforcement authority or administrative organisation, which may be within or outside the Chinese Mainland;
if the Processing of Personal Information is necessary to respond to a public health emergency, or to protect the life, health or property safety of an individual in case of an emergency;
where Personal Information is processed within a reasonable scope to carry out news reporting, public opinion supervision or any other activity for public interest purposes;
where the Processing relates to Personal Information disclosed by you or otherwise already lawfully disclosed, within a reasonable scope in accordance with applicable laws;
if the Processing of Personal Information is directly related to:

onational security and national defence;
public safety, public health and major public interest; or
criminal investigations, criminal prosecutions, adjudication or enforcement of judgments, or other related matters.

Your Personal Information may be Processed in our headquarters in Hong Kong as well as other countries, including Mainland China and the United States of America.

HOW WE SHARE YOUR PERSONAL INFORMATION

To facilitate the purposes mentioned under the Privacy Policy, and without prejudice to relevant laws and regulations, we may transfer and/or disclose your Personal Information to our Group Companies (as defined below), and/or third parties who will Process your Personal information according to their own purposes and methods of Processing (together, “Third Party Personal Information Handlers”). These Third Party Personal Information Handlers may be located within or outside the Chinese Mainland. We will only transfer and/or disclose such Personal Information upon obtaining your separate consent, and in accordance with applicable Chinese Mainland data protection laws. These Third Party Personal Information Handlers will include (but not limited to) Swire Properties Limited. You can contact us for the relevant information regarding these Third Party Personal Information Handlers. Our contact details are located below.

Furthermore, we may transfer and/or disclose your Personal Information to third parties appointed by us who only Process your Personal Information on our behalf, including any agent, contractor or third-party service provider who provides administrative, data processing, telecommunications, computer, payroll, private insurance or other services to or support our operations.

Other than those stated in this “How We Share Your Personal Information” section and in situations stated in the “Scope and use of Personal Information” section, we will not share your Personal Information with any other third parties, except that we may share data or statistics (which are not Personal Information) with third parties in aggregated or anonymised form.

When we share your Personal Information with any third parties, we will strive to ensure (including but not limited to using contractual measures or adopt encryption for transfer to ensure) that such third parties comply with this Privacy Policy and other appropriate confidentiality and security measures that we require them to comply with when using your Personal Information, except for the Personal Information you provide directly to the third parties through the use of their services. Where required by applicable Chinese Mainland regulations and where the any sharing of Personal Information will bring higher risks to you, we will notify you of such high risks.

With the continuous development of our business, we may engage in mergers, acquisitions, dissolution, liquidation, transfer of assets or similar transactions, and in such cases, we shall: (i) inform you all such information that is required under applicable Chinese Mainland data protection laws; and (ii) your Personal Information may be transferred to any actual assignee or purchaser of all or any part of our (and/or our Group Companies’) business and/or assets; and our service providers in these situations.

HOW WE RETAIN, STORE AND PROTECT YOUR PERSONAL INFORMATION

Your Personal Information will be retained by us only for as long as is necessary to fulfil the purposes mentioned in this Privacy Policy, or for a duration as required or permitted by laws and regulations. In any event, unless required by applicable laws and regulations or with your consent, your Personal Information shall be retained for seven (7) years from the end of your employment or our last interaction with you. After the end of the retention period, we will delete or anonymise your Personal Information.

In order to ensure the correct use and to maintain the accuracy of Personal Information collected from you, as well as preventing unauthorised or accidental access, disclosure, alteration, loss or other use of Personal Information, we have implemented various internal management policies (including physical, electronic and management measures) and various security technologies and procedures based on classification of Personal Information we collect from you. For example:

where we collect Personal Information online, we use an industry standard for encryption over the Internet known as Secure Socket Layer (SSL) protocol to protect Personal Information;
·our websites have firewalls in place, which should protect Personal Information collected from you against unauthorised or accidental access;
where required under applicable Chinese Mainland data protection laws and regulations, we will encrypt and/or de-identify your Personal Information;
your Personal Information will only be accessed by our personnel on a “need-to-know” basis;
we ensure that our personnel are regularly trained on data protection matters; and
in order to mitigate any potential risks of unauthorised Processing of your Personal Information, we maintain a security incident response plan. Where required by applicable Chinese Mainland regulations, we will also seek to inform you and the relevant authorities of any incidents concerning the Personal Information we Process on your behalf.

However, please understand that, due to technical and risk prevention limitations, even if we have made our best effort to enhance security measures, we cannot ensure that the information is absolutely safe. You should note that the systems and communication networks you use to access our websites may be subject to problems beyond our control. Therefore, you are advised to protect against unauthorised access to your password. When using a shared computer, make sure you sign out from your account when finished.

HOW DO YOU EXERCISE YOUR DATA SUBJECT RIGHTS

You (or your next of kin or you acting on behalf of your minors, as permitted by applicable Chinese Mainland data protection laws and regulations) are entitled to exercise the following data subject rights under the applicable Chinese Mainland data protection laws and regulations:

access, copy, (where your Personal Information is inaccurate or incomplete) correct and/or supplement your Personal Information held by us;
restrict or reject the Processing of your Personal Information held by us;
request deletion or de-registration of your Personal Information which is held by us (where the purposes of Processing have been or cannot be fulfilled or no longer necessary, where we cease to provide the Services or the retention period ends, where there is a breach of applicable law in our Processing or otherwise required by applicable law);
withdraw your consent to us processing your Personal Information;
request us to transfer your Personal Information to another organisation, if such transfer is permitted by applicable laws; and
explain our rules on Processing of your Personal Information.

If you wish to exercise any of the rights above, please contact us as follows:

Contact person: Data Protection Officer

Address: Suite 2701-05, 1111 King’s Road, Taikoo Shing, Hong Kong

Email address: Dataprotectionoffice@swirehotels.com

We will endeavour to use appropriate technical means to ensure that you can exercise the above data subject access rights on our intranet websites or by contacting us. In processing your requests relating to your data subject rights your Personal Information, we may ask for you to authenticate your identify in order to protect the safety of your Personal Information.

To the extent permitted by relevant laws and regulations, we reserve the right: (i) to refuse unreasonable requests (for example, requests which infringe the privacy of others); and (ii) charge a reasonable fee for the cost of processing any data request.