Swire Hotels PERSONAL INFORMATION COLLECTION STATEMENT for employees, workers, consultants, contractors and interview candidates
Version 3: 1 November 2021
Throughout your employment by, engagement with, secondment to or application to work in Swire Hotels, Personal Data will be collected in relation to you for purposes related to your employment or engagement as specified hereinbelow. It is also necessary for you to supply to us with Personal Data about yourself and sometimes also your family members from time to time in connection with your employment and engagement. You represent and warrant that the consent of your family members whose Personal Data you have provided and disclosed to us have been sufficiently obtained to allow us to process the same in relation to the purposes stated herein.
TYPES OF PERSONAL DATA
To process your application for a job or a position with Swire Hotels, we may collect the following Personal Data from you:
- ·name, email address, residential address, phone number, gender, education information, job experience, nationality, work permit information, social media account name, identity card or passport information, photograph, professional experience, dismissal and criminal records, referee information, signature.
To administer your employment offer and onboarding you as an employee of Swire Hotels, we may also collect the following Personal Data from you:
- ·name, email address, residential address, phone number, date of birth, age, gender, education information, job experience, nationality, passport or identity information, bank account information, work permit information, marital status, emergency contact, place of birth, signature and Personal Data of your family members (if applicable for any fringe or insurance benefits)
To engage you as an independent contractor or secondee of Swire Hotels, we may also collect the following Personal Data from you:
- ·name, email address, residential address, phone number, date of birth, age, gender, education information, job experience, nationality, passport or identity information, bank account information, work permit information, marital status, emergency contact, place of birth, signature and Personal Data of your family members (if applicable for any fringe or insurance benefits).
PURPOSE OF COLLECTION
The purposes for which such Personal Data may be used will include the following:
- Recruitment and selection;
- Fulfilment of the statutory and legal obligations of Swire Hotels, including compliance with any request from any governmental or regulatory authority or court order (in any jurisdiction);
- Administration and management of personnel, including determining and reviewing salaries, bonuses and other benefits for you and your eligible dependant(s), if any;
- Administration of individual records during the course of employment or engagement;
- Manpower planning, training and development, including secondment and transfer;
- To introduce and/or cross-refer you to any of the divisions, subsidiaries, associated, affiliated companies and/or other business units within John Swire & Sons (H.K.) Ltd., local or overseas, for which we may or may not be remunerated;
- Career and performance development, including consideration for promotion;
- Provision of personal reference or reference for any personnel related activities;
- Disciplinary purposes arising from the conduct of personnel or their ability to perform services for Swire Hotels properly;
- Administration of Swire Hotels' business, including making tax returns and/or other related filings with government authorities, whether locally or overseas;
- Corporate restructuring, reorganization, transfer, assignment of all or part of Swire Hotels or its businesses, or such similar purposes;
- Health care and ensuring appropriate and safe working environment;
- Communication between Swire Hotels and its personnel, and between Swire Hotels and their family members in relation to death, illness, injury or emergency in connection with work;
- Legal proceedings (including prospective legal proceedings) and obtaining legal advice, whether locally or overseas;
- Establishing, exercising or defending legal rights, whether locally or overseas;
- Promotion or marketing of Swire Hotels' business whether locally or overseas via various media, including but not limited to newspapers, magazines, Swire Hotels' website and social media platforms;
- Monitoring compliance with internal rules and policies of Swire Hotels;
- Compliance with applicable procedures, laws and regulations, whether locally or overseas; and
- Purposes directly relating thereto.
It is obligatory that you provide any Personal Data requested from you, unless you are informed otherwise on or before collection by Swire Hotels. Failure to supply such Personal Data may result in Swire Hotels being unable to carry out its human resources management functions including (but not limited to) provision of benefits or otherwise the management of Swire Hotels' affairs. Swire Hotels will take all practicable steps to ensure that Personal Data collected and held by Swire Hotels are protected against unauthorized or accidental access, processing, erasure or other use.
CLASSES OF TRANSFEREES
Swire Hotels may nonetheless use or disclose Personal Data in accordance with the relevant law from time to time. Swire Hotels may provide Personal Data to the following parties, whether locally or overseas, for the above-mentioned purposes for which the Personal Data is to be used (or a directly related purpose) as follows:
- Appropriate and authorized persons within Swire Properties Limited and its affiliate and/or subsidiary companies;
- Swire Properties Limited and its affiliate and/or subsidiary companies, local or overseas;
- Senior executives of existing or potential business partners of Swire Hotels and Swire Properties Limited;
- Any joint venture of Swire Properties Hotel Management Limited, Swire Hotels, relevant legal entities and Swire Properties Limited and their affiliate and/or subsidiary companies;
- John Swire & Sons (H.K.) Limited in their capacity as the parent company of Swire Hotels for the following purposes:
- Salary, bonus and remuneration review and approval by John Swire & Sons (H.K.) Limited;
- Talent review for human resources plan and management including succession plans by John Swire & Sons (H.K.) Limited;
- Records for qualification, certification and/or training for professional qualified persons;
- Manpower planning, training and development, including secondment and transfer;
- Special circumstances involving protection of your vital interest or public health interest such as COVID-19;
- Any of the divisions, subsidiaries, associated, affiliated companies and/or other business units within John Swire & Sons (H.K.) Ltd., local or overseas, for cross referral of transfer, assignment and secondment;
- Any relevant government or regulatory authorities, including but not limited to, the tax department, the labour department and the immigration or custom department;
- Persons seeking employee references;
- Any of our auditors, legal and/or other professional advisors or any other person under a duty of confidentiality to us;
- Any subsidiary/affiliated companies or service providers, local or overseas, for matters related to career planning/development within Swire Hotels;
- Third parties in connection with any corporate restructuring, reorganization, transfer, assignment or sale of all or part of Swire Hotels or its businesses, or such similar purposes;
- Third parties for promotional or marketing purposes, including but not limited to advertising and PR agencies;
- All relevant third parties in connection with the operation of Swire Hotels' business, including but not limited to any actual or proposed bidder, tenderer, service provider, downstream sub-contractor(s), business partner or any other person who provides/ introduces services to us or to whom we provide introductions or referrals.
ACCESS TO PERSONAL DATA
You may have the right to:
- check whether Swire Hotels holds any Personal Data about you;
- request access to such Personal Data in accordance with relevant legal requirement;
- request Swire Hotels to correct any Personal Data relating to you which is inaccurate in accordance with the relevant legal requirement; and
- ascertain Swire Hotels' policies and practices in relation to Personal Data and be informed of the types of Personal Data held by Swire Hotels.
In accordance with the relevant legal requirement, Swire Hotels may have the right to charge a reasonable fee for the processing of any Personal Data access request. In determining a reasonable charge for handling such requests, the cost of actual time spent by administrator(s) / manager(s) who are involved in processing a particular Personal Data access request is the basic element of the fee charged. In addition, cost of copying per sheet of paper will also be charged.
SECURITY OF PERSONAL DATA
In order to ensure the correct use and to maintain the accuracy of Personal Data collected from you, as well as preventing unauthorised or accidental access, processing, erasure or other use of the Personal Data, we have implemented various physical, electronic and management measures to safeguard and secure the Personal Data we collect.
For the Personal Data we collect online, we use an industry standard for encryption over the Internet, to protect the Personal Data.
The Personal Data you provide to us will be stored in a database for no longer than is necessary. The website has a firewall in place, which should protect the Personal Data collected from you against unauthorised or accidental access. However, complete confidentiality and security is not yet possible over the Internet, and privacy cannot be completely assured in your communications to us. You acknowledge that personal information is disclosed at your own risk, and may be subject to unauthorised use by others. This may result in, among others, you receiving unsolicited messages from other parties. We are not responsible in any manner for direct, indirect, special or consequential damages, howsoever caused arising out of the communication of information to us. You are encouraged to protect against unauthorised access to your password. Make sure you sign out from your account when finished particularly when using a shared computer.
All requests for a list of our subsidiaries/associated/affiliated companies, or access to Personal Data, or correction of Personal Data, or for information regarding policies and practices and types of Personal Data held, should be addressed to the Data Protection Officer in Swire Hotels at the following address:
The Data Protection Officer
Suite 2701-05, Cityplaza One
1111 King’s Road
Taikoo Shing, Hong Kong
Where required under applicable data protection laws and regulations in the relevant jurisdiction, we may seek your consent. If you do not provide your consent, we may be unable to continue performing our obligations to you.
APPENDIX 1: SWIRE HOTELS RELEVANT LEGAL ENTITIES
Update date: 1 November 2021
Swire Properties Hotel Management Limited
Swire Properties Hotel Holdings Limited
Swire Properties Hotel Services Limited
Airline Hotel Limited
成都乾豪置业有限公司博舍酒店管理分公司Chengdu Qianhao Real Estate Company Limited The Temple House Hotel Management Branch Office
冠丰（上海）房地产发展有限公司Guan Feng (Shanghai) Real Estate Development Company Limited The Middle House
北京麟联置业有限公司Beijing Linlian Real Estate Company Limited East Hotel
北京三里屯酒店管理有限公司Beijing Sanlitun Hotel Management Company Limited
BCC Hospitality Services LLC
APPENDIX 2: CHINESE MAINLAND APPENDIX
(Last updated: 1 November 2021)
In this Chinese Mainland Appendix, “Personal Information” means any type of information (recorded via electronic means or otherwise) associated with an identified or identifiable natural person, but excluding information after anonymisation handling. Personal Information may include Sensitive Personal Information (defined below).
SENSITIVE PERSONAL INFORMATION
Certain Personal Information may be considered sensitive Personal Information due to their particularity. “Sensitive Personal Information” means Personal Information which, if leaked or used illegally, may easily cause harm to the dignity of natural person, or harm to personal or property safety, including: biometric information, religious belief, specific identity information, health and medical information, financial account information, individual location tracking information, and Personal Information of minors under the age of fourteen (14).
For administering your job application, employment offer and onboarding you as an employee, independent contractor or secondee of Swire Hotels, we may collect the following Sensitive Personal Information from you: passport or identity information, bank account information, work permit information, marital status of your and that of your family members (if applicable for any fringe or insurance benefits) and criminal records (if any).
You need to carefully consider whether your Sensitive Personal Information should be disclosed to us when you apply for a job or position with Swire Hotels, or when you come onboard as an employee, independent contractor or secondee of Swire Hotels. It is necessary for you to provide us with such Sensitive Personal Information, so that we can facilitate your job application or onboarding process (as applicable). If you do not provide us with your separate consent, we may not be able to facilitate your job application or onboarding process (as applicable).
We will not collect, use or otherwise process Personal Information of individuals who are under fourteen (14) years of age. If we are required to do so (e.g. to facilitate medical insurance for an employee’s child), we shall only do so upon obtaining separate consent from their parents or guardians.
SCOPE AND USE OF PERSONAL INFORMATION
There are several ways for us to collect your Personal Information, including that we may directly collect your Personal Information from you (such as when you apply for our jobs), or we may collect your Personal Information from third parties including our recruitment or background check agents and services providers or your referees, or we may collect your Personal Information when you participate in our activities.
We shall not be required to obtain your consent to Process your Personal Information if any of the following situations applies:
- where the Processing of Personal Information is necessary for the conclusion or performance of a contract to which you are a contracting party, or where it is necessary to carry out human resources management according to lawfully formulated labour rules and lawfully concluded collective contracts;
- where it is necessary to perform a statutory responsibility or obligation, for example, making disclosures when required by law, regulation, or court order of any jurisdiction and/or as requested by any government, regulatory or law enforcement authority or administrative organisation, which may be within or outside the Chinese Mainland;
- if the Processing of Personal Information is necessary to respond to a public health emergency, or to protect the life, health or property safety of an individual in case of an emergency;
- where Personal Information is processed within a reasonable scope to carry out news reporting, public opinion supervision or any other activity for public interest purposes;
- where the Processing relates to Personal Information disclosed by you or otherwise already lawfully disclosed, within a reasonable scope in accordance with applicable laws;
- if the Processing of Personal Information is directly related to:
- onational security and national defence;
- public safety, public health and major public interest; or
- criminal investigations, criminal prosecutions, adjudication or enforcement of judgments, or other related matters.
Your Personal Information may be Processed in our headquarters in Hong Kong as well as other countries, including Mainland China and the United States of America.
HOW WE SHARE YOUR PERSONAL INFORMATION
Furthermore, we may transfer and/or disclose your Personal Information to third parties appointed by us who only Process your Personal Information on our behalf, including any agent, contractor or third-party service provider who provides administrative, data processing, telecommunications, computer, payroll, private insurance or other services to or support our operations.
Other than those stated in this “How We Share Your Personal Information” section and in situations stated in the “Scope and use of Personal Information” section, we will not share your Personal Information with any other third parties, except that we may share data or statistics (which are not Personal Information) with third parties in aggregated or anonymised form.
With the continuous development of our business, we may engage in mergers, acquisitions, dissolution, liquidation, transfer of assets or similar transactions, and in such cases, we shall: (i) inform you all such information that is required under applicable Chinese Mainland data protection laws; and (ii) your Personal Information may be transferred to any actual assignee or purchaser of all or any part of our (and/or our Group Companies’) business and/or assets; and our service providers in these situations.
HOW WE RETAIN, STORE AND PROTECT YOUR PERSONAL INFORMATION
In order to ensure the correct use and to maintain the accuracy of Personal Information collected from you, as well as preventing unauthorised or accidental access, disclosure, alteration, loss or other use of Personal Information, we have implemented various internal management policies (including physical, electronic and management measures) and various security technologies and procedures based on classification of Personal Information we collect from you. For example:
- where we collect Personal Information online, we use an industry standard for encryption over the Internet known as Secure Socket Layer (SSL) protocol to protect Personal Information;
- ·our websites have firewalls in place, which should protect Personal Information collected from you against unauthorised or accidental access;
- where required under applicable Chinese Mainland data protection laws and regulations, we will encrypt and/or de-identify your Personal Information;
- your Personal Information will only be accessed by our personnel on a “need-to-know” basis;
- we ensure that our personnel are regularly trained on data protection matters; and
- in order to mitigate any potential risks of unauthorised Processing of your Personal Information, we maintain a security incident response plan. Where required by applicable Chinese Mainland regulations, we will also seek to inform you and the relevant authorities of any incidents concerning the Personal Information we Process on your behalf.
However, please understand that, due to technical and risk prevention limitations, even if we have made our best effort to enhance security measures, we cannot ensure that the information is absolutely safe. You should note that the systems and communication networks you use to access our websites may be subject to problems beyond our control. Therefore, you are advised to protect against unauthorised access to your password. When using a shared computer, make sure you sign out from your account when finished.
HOW DO YOU EXERCISE YOUR DATA SUBJECT RIGHTS
You (or your next of kin or you acting on behalf of your minors, as permitted by applicable Chinese Mainland data protection laws and regulations) are entitled to exercise the following data subject rights under the applicable Chinese Mainland data protection laws and regulations:
- access, copy, (where your Personal Information is inaccurate or incomplete) correct and/or supplement your Personal Information held by us;
- restrict or reject the Processing of your Personal Information held by us;
- request deletion or de-registration of your Personal Information which is held by us (where the purposes of Processing have been or cannot be fulfilled or no longer necessary, where we cease to provide the Services or the retention period ends, where there is a breach of applicable law in our Processing or otherwise required by applicable law);
- withdraw your consent to us processing your Personal Information;
- request us to transfer your Personal Information to another organisation, if such transfer is permitted by applicable laws; and
- explain our rules on Processing of your Personal Information.
If you wish to exercise any of the rights above, please contact us as follows:
Contact person: Data Protection Officer
Address: Suite 2701-05, 1111 King’s Road, Taikoo Shing, Hong Kong
Email address: Dataprotectionoffice@swirehotels.com
We will endeavour to use appropriate technical means to ensure that you can exercise the above data subject access rights on our intranet websites or by contacting us. In processing your requests relating to your data subject rights your Personal Information, we may ask for you to authenticate your identify in order to protect the safety of your Personal Information.
To the extent permitted by relevant laws and regulations, we reserve the right: (i) to refuse unreasonable requests (for example, requests which infringe the privacy of others); and (ii) charge a reasonable fee for the cost of processing any data request.