This China Addendum to the Privacy Policy ("Addendum") is a part of the privacy policy ("Privacy Policy") and should be read in conjunction with it and can be found here. 

Please get in touch with us using the information in the section "HOW TO CONTACT US" below if you have any questions about the Privacy Policy or this Addendum. 

1. ABOUT THIS ADDENDUM 

Protecting your Personal Information is very important to Minor Hotels Europe & Americas, S.A (hereinafter, “MINOR HOTELS EUROPE & AMERICAS”), and this Addendum describes the personal information processing practices that we follow as a Personal Information Processor in accordance with the PIPL and, in particular, in view of its territorial scope established in the second paragraph of article 3 of the aforementioned regulatory text.  

This Addendum describes: 

• Definitions; 
• How we collect and Process your Personal Information; 
• Transfers of Personal Information; 
• Your rights; and 
• How to contact us. 

If the terms of the Privacy Policy and this Addendum conflict in relation to Personal Information protected by the PIPL, this Addendum prevails. 

2. DEFINITIONS 

 In this Addendum, we use some special words and phrases. The following definitions apply to those special words and phrases: 

"Anonymisation" refers to the process of processing personal information to make it impossible to identify specific natural persons and impossible to restore. 
"China" for the purposes of this policy refers to the territory of the People's Republic of China only. 
"Personal Information Processor" refers to an organisation or individual that autonomously determines the purposes and means of personal information processing.  
"Entrusted Processor" or “Entrusted party” generally refers to any vendor or service provider we engage to Process Personal Information on our behalf under a contract that meets the requirements established in Article 21 of the PIPL. 
"Overseas Recipient" refers to an organisation or individual located outside the territory of the People's Republic of China that receives Personal Information from the personal information processor. 
"Personal Information", refers to various information related to an identified or identifiable natural person recorded electronically or by other means, but does not include anonymised information 
"PIPL" means the Personal Information Protection Law of the People's Republic of China.  
"Personal information processing”" includes personal information collection, storage, use, processing, transmission, provision, disclosure and deletion, among others. 
"Relevant Laws and Regulations" refers to the Personal Information Protection Law of the People's Republic of China (PIPL), the Cybersecurity Law of the People's Republic of China (CSL), the Data Security Law of the People's Republic of China (DSL), the Civil Code of the People's Republic of China, and other applicable laws and regulations of the People's Republic of China. 
"Security Incident" refers to the unlawful or accidental destruction, alteration, loss, misuse, access, modification, or disclosure of Personal Information. 
"Sensitive Personal Information" refers to Personal Information that, once leaked or illegally used, may easily lead to infringement of the personal dignity of a natural person or may endanger his personal safety or property, including information such as biometrics, religious belief, specific identity, medical health status, financial accounts, and the person's whereabouts, as well as the personal information of a minor under the age of 14 years. 
"Sites" refers to the Minor DISCOVERY mobile application, and other websites and applications operated by or on behalf of NH DISCOVERY.  

3. HOW WE COLLECT AND PROCESS YOUR PERSONAL INFORMATION 

We only Process your Personal Information if there is a legal basis. The legal bases we rely on to process Personal Information may depend on the specific purposes we are trying to achieve, all detailed in the Privacy Policy. We typically rely on one or more of the following legal bases: 

• the individual's consent; 
• the processing is necessary for the conclusion or performance of a contract in which the individual is a party, or necessary for human resources management in accordance with the labour rules and regulations established in accordance with the law and the collective contracts signed in accordance with the law;  

Categories of personal information  

Minor Hotels Europe & Americas will process the following categories of data:  

• Data provided for registration in Minor DISCOVERY.  
  • Identification data: Name, surname, telephone number, nationality.   
  • Contact details: Address, email address.   
  • Professional data: Company where you provide services. 
• Data provided for the creation of an account associated with the registration.
  • Identification data: Name, surname, telephone number.
  • Contact details: Address, e-mail address.
• Data provided for the sending of communications related to your account. 
  • Identification data: Name, surname, first name. 
  • Contact details: e-mail address.
• Data provided for the sending of commercial communications
  • Identification data: Name, surname. 
  • Contact details: e-mail address. 
• Data provided to measure your degree of satisfaction with the service provided. 
  • Identification data: Name, surname and first name. 
  • Contact details: e-mail address.
  • Data on services provided: Stays at Minor Hotels Europe & Americas Hotels and other companies members of its business group.
• Data provided for personalisation of the services offered to members of the Programme
  • Identification data: Name, surname(s)
  • Contact details: e-mail address
  • Data on services provided: Stays at Minor Hotels Europe & Americas Hotels and other companies members of its business group.
• Data collected through cookies that are accepted. 

We do not collect Personal Information from minors under the age of 14. Please ensure that minors in your care do not send us their Personal Information without your consent. If we have received the Personal Information of any minor under the age of 14 in your care, you can get in touch with us using the information in the "HOW TO CONTACT US" section below to have such Personal Information deleted. 

Purposes of the processing 

We inform you that the data provided in the Minor DISCOVERY Programme registration process are processed by Minor Hotels Europe & Americas for the following purposes:  

• Proceed to the registration to the Minor DISCOVERY Programme. This data will be kept until the termination of the programme, and if applicable, until the end of the responsibilities that may arise for the parties. 
• Sending commercial communications via email or equivalent electronic means of communication about offers and services related to the Programme. The legal basis of this purpose is the consent of the data subject. These data will be kept until the revocation of the consent of the data subject for those commercial communications.
• Creation of an account associated with the registration that allows access within the Minor Hotels Europe & Americas website and other web pages of the loyalty programs member of GHA DISCOVERY, to enable the management of the user's account, to communicate with the person in charge, as well as to manage the account. These data will be kept until the termination of the programme, and if applicable, until the end of the responsibilities that may arise for the parties.
• Sending communications related to your account, including, among others, registration, notifications, failures and/or problems with the account and any other communication that keeps you informed of the status of your account. These data will be kept until the termination of the programme, and if applicable, until the end of the responsibilities that may arise for the parties. 
• To measure your degree of satisfaction with the service provided, in those cases in which you have stayed at one of the Participating Hotels operated by Minor Hotels Europe & Americas or any of its subsidiaries under a Minor Hotels Europe & Americas Brand, as well as other companies members of its business group. This purpose may include sending quality surveys and adapting and personalising the services provided by Minor Hotels Europe & Americas and other companies members of its business group and/or GHA. This data will be kept for three years from the moment of their obtention. Once the previous is expired, your data will be blocked in order to fulfil obligations related to responsibilities and/or claims filed by the data subject. 
• Personalisation of the services offered to members of the Programme, by means of the study of their profile and tastes. These data will be kept until the termination of the programme, and if applicable, until the end of the responsibilities that may arise for the parties. 

In order to improve the receptiveness to the products offered, Minor Hotels Europe & Americas will proceed to the elaboration of a profile based on your personal characteristics (such as stays made) and the information obtained from your actions as a user. 

This purpose responds to the need to make personalised offers to each of the members of the Programme (including by electronic means, when authorised), to facilitate the acquisition by them of their preferred products and similar alternatives, as well as to offer them products that may be of interest to them based on their profile (for this purpose, automated decisions may be taken). Therefore, the user will benefit from offers tailored to his preferences and tastes, expressed through his activity or deduced according to the characteristics of his profile. The information relating to your profile will be treated securely and confidentially, being processed only in systems that analyse the information obtained in an automated manner. Moreover, the User may, at any time, express his/her wish not to be subject to this processing by exercising his/her right to object to it. 

4. TRANSFERS OF PERSONAL INFORMATION 

Entrusted Processing 

In order to provide certain services to you, we may need to engage an Entrusted Processor to Process some of your Personal Information. We will enter into strict confidentiality agreements and include Personal Information protection clauses in other agreements with Entrusted Processors that require them to process and protect your Personal Information in accordance with our own high standards, this Addendum and Relevant Laws and Regulations. 

Typical examples of Entrusted Processors that we engage with include:

• Professional advisors, such as lawyers, accountants, tax consultants, etc.;
• Technical experts, such as IT security specialists, etc.; and
• Others, such as marketing experts, surveyors, etc. 

Domestic transfers 

In order to provide you with the best guest experience possible, we need to share your Personal Information with third parties within China. Please see the list below for more information about the third parties within China that may receive your Personal Information. Before we transfer your Personal Information, we will seek your separate consent in accordance with Relevant Laws and Regulations. 

Transfers outside China  

Corporate Transactions 

If we need to transfer your Personal Information due to a merger, division, dissolution, bankruptcy or any other reason, we will notify you of the organisational or personal name and contact information of the receiving party. 

Foreign Governments 

We do not share Personal Information with foreign governments except as Relevant Laws and Regulations permit.  

Other Transfers 
Because unforeseen situations can occur, we may need to transfer Personal Information in other circumstances not described above. Where this occurs, we will obtain any consent required from you, as required by Relevant Laws and Regulations. 

5. SECURITY 

We will take reasonable steps to secure your Personal Information against Security Incidents in accordance with Relevant Laws and Regulations and as described in the Privacy Policy. If you have any concerns about the security of your Personal Information or believe that you have experienced a Security Incident, please get in touch with us using the information in the "HOW TO CONTACT US" section below. 

6. YOUR RIGHTS 

You may exercise, by writing to the address of the data controller indicated in the heading of this document, with the Reference "Data Protection", enclosing a photocopy of your identity document, at any time and free of charge, the following rights:   

• Request access to your personal data 
• Request correction of your personal data 
• Request erasure of your personal data 
• Object to processing of your personal data 
• Request restriction of processing your personal data 
• Request portability of your personal data
• Right to withdraw consent 

Please note that if you decide to withdraw your consent, such withdrawal will not affect the validity of any Personal Information Processing already carried out before the withdrawal based on your consent. 

If you would like to exercise the rights described above, please get in touch with us using the information in the "HOW TO CONTACT US" section below. We try to respond to all legitimate requests within one month, or within the timeframe as specified by the applicable data protection legislation. Occasionally, it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. 

Additionally, if you use our mobile application, you can also correct, complete or delete some of your Personal Information by clicking on Account/Profile in the app. 

7. HOW TO CONTACT US 

If you have any questions about anything described in the Privacy Policy or this Addendum, or you wish to exercise your rights under Relevant Laws and Regulations, you may get in touch with us using any of the contact details listed below: 

Identity: Minor Hotels Europe & Americas  
TAX IDENTIFICATION NUMBER: A-28027944.  
Address: Calle Santa Engracia 120, 7ª, 28003, Madrid.  
Data Protection Officer (DPO): you can contact our DPO through the following means:  
E-mail: dpo@minor-hotels.com , indicating in the reference "Data Protection Officer". 

Last update: March 2025