Global Privacy Statement

Hilton Honors · agreement dated August 31, 2026 · Official agreement

197 of 450 cards in Legal Rights & Agreement Rules

Legal Rights & Agreement Rules · Context

Stated version of the Global Privacy Statement: last updated August 31, 2026

The document states its own version date: last updated August 31, 2026. The Statement is one global text, not a United States-only notice: it names a United Kingdom and Canada address, EEA and UK transfer rules, and California, Nevada, France, Hong Kong, Türkiye, China, Brazil, Monaco, Nigeria, Korea, Mexico and Albania provisions, so this date versions the whole global statement.

Supporting quotations

Last updated: August 31, 2026

Qualifications & exceptions

This is the statement's own stated date; it is not a check of the publisher's live page.
The date versions the global statement, whose regional appendices carry their own terms.

Legal Rights & Agreement Rules · Company commitment

Hilton's mission, its privacy pledge, and what the Statement explains

Hilton states its mission to be the most hospitable company in the world and pledges to deliver the highest level of customer service, which includes respecting privacy and protecting personal information. It then explains the document's purpose: to give details of how Hilton collects, uses and discloses personal information. The document names itself the privacy statement and defines 'Statement' as the short form used for it throughout.

Supporting quotations

Hilton’s mission is to be the most hospitable company in the world.

We pledge to deliver the highest level of customer service, which includes respecting your privacy and protecting your personal information.

In this privacy statement (“Statement”), we provide you with details about how we collect, use, and disclose your personal information.

Qualifications & exceptions

The commitment is framed as part of a high level of customer service, not as a guarantee of absolute privacy or security.
The Statement is a global document; nothing in this passage limits it to United States users.

Legal Rights & Agreement Rules · Context

Entities the Statement applies to: Hilton Worldwide Holdings, its subsidiaries and all Portfolio brands

The Statement applies to Hilton Worldwide Holdings Inc., its subsidiaries, and all hotels within the Hilton Portfolio of Brands, which it then lists brand by brand, from Waldorf Astoria Hotels & Resorts and LXR Hotels & Resorts through Hampton by Hilton, Tru by Hilton, Spark by Hilton, Homewood Suites by Hilton, LivSmart Studios by Hilton, Graduate by Hilton, NoMad, Outset Collection by Hilton, Apartment Collection by Hilton, Select by Hilton and Undergraduate by Hilton. The covered population is therefore the whole global hotel group, not only Hilton's United States properties, and the scope follows the group rather than a single brand's United States terms.

Supporting quotations

This Statement applies to Hilton Worldwide Holdings Inc., its subsidiaries, and all of the hotels within the Hilton Portfolio of Brands

Our Portfolio of Brands includes Waldorf Astoria Hotels & Resorts, LXR Hotels & Resorts, Conrad Hotels & Resorts, Canopy by Hilton

Spark by Hilton, Homewood Suites by Hilton, Home2 Suites by Hilton, LivSmart Studios by Hilton, Graduate by Hilton, NoMad, Outset Collection by Hilton, Apartment Collection by Hilton, Select by Hilton, and Undergraduate by Hilton.

Qualifications & exceptions

Coverage follows the corporate group and the Portfolio of Brands worldwide, not a single country.
Franchised and joint-venture hotels in the Portfolio are covered by the Statement, though they may act as their own controllers.

Legal Rights & Agreement Rules · Permission or license

Using Hilton products or agreeing to the Statement acknowledges collection and use

Hilton says that by using any of its products or services, and/or by agreeing to this Statement — for example when registering for a product or service — the person understands and acknowledges that Hilton will collect and use personal information as described in the Statement. The acknowledgement is of collection and use on the terms described; where consent is required for other processing, the Statement separately says explicit, informed consent is obtained.

Supporting quotations

By using any of our products or services and/or by agreeing to this Statement, e.g., in the context of registering for any of our products or services, you understand and acknowledge that we will collect and use personal information as described in this Statement.

Qualifications & exceptions

The acknowledgement covers collection and use as described in the Statement, not every processing activity.
The Statement separately requires explicit, informed consent where consent is the applicable basis, including before selling or sharing.

Legal Rights & Agreement Rules · Company practice

Hilton Domestic Operating Company Inc. is the data controller for guest data

The Statement names Hilton Domestic Operating Company Inc., a United States corporation organized under Delaware law, as the Hilton entity that is the data controller for all guest data and that operates, among other things, Hilton's marketing activities. It is a subsidiary of Hilton Worldwide Holdings Inc. The controller named here is a United States entity, but the data it controls is guest data worldwide under this global statement.

Supporting quotations

Hilton Domestic Operating Company Inc., a corporation in the United States duly organized and existing under the laws of the State of Delaware, is the Hilton entity that is the data controller for all guest data

and operates, among other things, Hilton’s marketing activities

Hilton Domestic Operating Company Inc. is a subsidiary of Hilton Worldwide Holdings Inc.

Qualifications & exceptions

The controller is named for guest data as a whole; other group entities, and franchised or joint-venture hotels, may be controllers for their own data.
Marketing activities are operated by this entity but remain subject to the choices the Statement describes.

Legal Rights & Agreement Rules · Restriction or exception

Franchised and joint-venture hotels are separate entities and may be independent controllers

The Statement explains that the Portfolio of Brands includes managed, franchised and joint venture hotels; franchised hotels are operated by entities separate from Hilton, and joint venture hotels are operated by entities that are only partially owned or controlled by Hilton. Those entities, in addition to Hilton Domestic Operating Company Inc., may be independent data controllers for guest data, so the Statement's commitments are made by Hilton for Hilton's own processing rather than for every hotel's processing.

Supporting quotations

The Hilton Portfolio of Brands includes managed, franchised, and joint venture hotels.

Franchised hotels are operated by entities that are separate from Hilton.

In addition to Hilton Domestic Operating Company Inc., those entities may be independent data controllers for guest data.

Qualifications & exceptions

Only franchised and joint-venture hotels are described as possibly separate; managed hotels are not described here.
Separate control follows from the operating model, not from the guest's choice of hotel.

Legal Rights & Agreement Rules · User right or choice

Your Rights and Choices: reviewing and updating the information you gave at enrollment

Hilton states that a Hilton Honors member may review and update the information provided at the time of enrollment at any time by signing in to the Hilton Honors account, and may also make changes by contacting Hilton Reservations and Customer Care at +1 888-4HONORS (888-446-6677) for the US and Canada; customers located outside the US and Canada can review global phone numbers, and a support form may also be completed. The right is stated for members, and the routes are Hilton's own channels rather than a regulator's process.

Supporting quotations

4. Your Rights and Choices

you may review and update the information you provided to us at the time of enrollment at any time

contacting Hilton Reservations and Customer Care at +1 888-4HONORS (888-446-6677) (US and Canada)

Customers located outside of the US and Canada can review our

You may also

Qualifications & exceptions

The review-and-update right is stated for Hilton Honors members.
The published telephone route is given for the US and Canada; other locations are directed to global phone numbers.

Legal Rights & Agreement Rules · User right or choice

Your Rights and Choices: the rights depend on where you live

Hilton states that depending on where you live, you may be able to request that it: informs you about the personal information it maintains about you; withdraws your consent for certain data processing activity; and/or updates, corrects, deletes and/or stops processing your personal information. The right to request is therefore stated as dependent on residence, and the statement describes the categories of request rather than a single universal entitlement.

Supporting quotations

Depending on where you live, you may be able to request that we:

inform you about the personal information we maintain about you,

withdraw your consent for certain data processing activity, and/or

update, correct, delete, and/or stop processing your personal information.

Qualifications & exceptions

Each of the three rights is qualified by 'depending on where you live'.
The right to withdraw consent is limited to processing that relies on consent.

Legal Rights & Agreement Rules · Procedure

Your Rights and Choices: how to submit a request, timing and fees

Hilton says that to see the rights based on residency or to submit a request, a person can visit the Data Subject Rights Requests Portal, email the Data Protection Office, or send a letter to the Hilton Data Protection Office in McLean, Virginia. It says it will process a request within the time specified by applicable law and as required by law, and that where the law permits, Hilton may charge an appropriate fee to cover the costs of responding. The rights available are shown by residency at the portal, and the timing is set by the applicable law rather than by a fixed period in this Statement.

Supporting quotations

To see your rights based on residency or submit a request:

visit the Data Subject Rights Requests Portal at

email DataProtectionOffice@hilton.com

send a letter to Hilton Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102, USA

We will process your request within the time specified by applicable law and as required by law.

When permitted by law, we may charge an appropriate fee to cover the costs of responding to the request.

Qualifications & exceptions

The processing time is the time specified by applicable law, and the fee is charged only where the law permits.
The portal shows the rights available based on the requester's residency.

Legal Rights & Agreement Rules · User right or choice

Submitting a rights request on behalf of someone else

Hilton states that in some circumstances a person may have the option to submit a request on behalf of someone else as their legal representative, and that if they do so, they may be asked to provide proof of authorization. The requester's own authority therefore has to be evidenced before the request is acted on.

Supporting quotations

In some circumstances you may have the option to submit a request on behalf of someone else as their legal representative.

If you submit a request on behalf of someone else, then you may be asked to provide proof of authorization.

Qualifications & exceptions

The option applies only 'in some circumstances'.
Proof of authorization may be requested.

Legal Rights & Agreement Rules · Context

Contact information for questions or concerns: the Data Protection Office

Hilton directs any questions or concerns to its Data Protection Office, giving the contact routes: email DataProtectionOffice@hilton.com; postal address Hilton Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102; telephone (800) 413-7470; and the Data Subject Rights Requests Portal at datarights.hilton.com. The stated contact point is a United States address and a United States toll-free number.

Supporting quotations

10. Contact Information for Questions or Concerns

If you have any questions or concerns, please contact Hilton’s Data Protection Office.

Email: DataProtectionOffice@hilton.com

Address: Attn: Hilton Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102

Phone number: (800) 413-7470

Data Subject Rights Requests Portal: datarights.hilton.com

Qualifications & exceptions

The contact point is a United States address and a United States toll-free number, although the Statement applies globally.
The portal is stated as the route for data subject rights requests.

Legal Rights & Agreement Rules · Company practice

Changes to this Statement: changes take effect on posting, and continued use means acceptance

Hilton says it may modify the Statement from time to time, and that the date at the top of the Statement shows when it was last updated. It says any changes become effective upon posting of the revised Statement on the site, and that using the site, any of its products and services, consenting to and/or having the opportunity to review the updated Statement after a change constitutes acceptance of the revised Statement then in effect.

Supporting quotations

11. Changes to this Statement

We may modify this Statement from time to time.

Any changes to our Statement will become effective upon posting of the revised Statement on the site.

Use of the site, any of our products and services, consenting to and/or having the opportunity to review the updated Statement following such changes constitutes your acceptance of the revised Statement then in effect.

Qualifications & exceptions

Changes take effect by posting, without a separate notice period stated here.
Acceptance is stated to follow from use, from consenting, or even from having had the opportunity to review the updated Statement.

Legal Rights & Agreement Rules · Context

Summary of material changes: August 2026

The Statement carries a summary of material changes, with the last update shown as August 2026. The August 2026 entries are: the Marketing Communications Choices section was updated to include additional details on SMS messaging and short code, and Appendix A-6 China Residents was updated to include updated information on collection and entrusted processing of personal information.

Supporting quotations

Summary of Material Changes to this Statement

Last update: August 2026

August 2026 Updates

Updated the Marketing Communications Choices section to include additional details on SMS messaging and short code.

Updated Appendix A-6: China Residents to include updated information on collection and entrusted processing of personal information.

Qualifications & exceptions

The summary covers the changes Hilton calls material; the Statement does not define the test.
The August 2026 entries concern SMS and short-code detail and the China appendix.

Legal Rights & Agreement Rules · Context

Summary of material changes: May and April 2026

The May 2026 entry records that the Appendix A-11 Mexico Residents and A-12 Albania Residents sections were added. The April 2026 entries record that the Introduction was updated to reflect two further Portfolio of Brands, Apartment Collection by Hilton and Select by Hilton; that the Reservations with Hilton's Third-Party Partner section was updated to include Placemakr; that the How We Disclose Personal Information section was updated to include information on the e-Folio Program and Reservations with Select by Hilton; that Appendix A-10 was updated to align with the Personal Information Protection Act; and that the Changes to this Statement section was updated to include a summary of material changes.

Supporting quotations

May 2026 Updates

Added the Appendix A-11: Mexico Residents and A-12: Albania Residents sections.

April 2026 Updates

Updated the Introduction section to reflect additional Hilton Portfolio of Brands: Apartment Collection by Hilton and Select by Hilton.

Updated the Reservations with Hilton’s Third-Party Partner section to include Placemakr.

Updated the How We Disclose Personal Information section to include information on the e-Folio Program and Reservations with Select by Hilton.

Updated Appendix A-10 to align with the Personal Information Protection Act.

Updated the Changes to this Statement section to include a summary of material changes.

Qualifications & exceptions

The summary lists changes Hilton identifies as material; it is not a complete list of edits.

Legal Rights & Agreement Rules · Context

Appendix A: additional provisions for residents of certain countries and US states, which override the main body on

Appendix A provides additional information for individuals residing in countries and US states that have enacted privacy laws giving residents of those jurisdictions additional rights. The US states listed include Alabama, California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Nevada, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont and Virginia, and the countries include the EEA, the United Kingdom, Switzerland, Australia, Bermuda, Brazil, Canada, China, Korea, Hong Kong, Monaco, Israel, Japan, Nigeria and Türkiye. The Appendix outlines the additional information Hilton must give and the rights the person has under applicable local laws, and it states that it controls to the extent it conflicts with any provision in the main body of the Statement.

Supporting quotations

Appendix A: Additional Provisions Applicable to Residents of Certain Countries and US States

This Appendix provides additional information for individuals residing in countries and U.S. states that have enacted privacy laws giving certain additional rights to residents of those jurisdictions.

Once effective, the U.S. states include, but are not limited to, Alabama, California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Nevada, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont, and Virginia.

These countries include, but are not limited to, those in the European Economic Area (EEA), the United Kingdom and Switzerland, as well as Australia, Bermuda, Brazil, Canada, China, Korea, Hong Kong, Monaco, Israel, Japan, Nigeria, and Türkiye.

This Appendix will control to the extent it conflicts with any provision in the main body of this Statement.

Qualifications & exceptions

Both lists are given as examples: 'include, but are not limited to'.
The Appendix controls over the main body where they conflict, so the regional terms are the operative ones for those residents.
The rights described are the rights the person has under applicable local laws, not a single global standard.

Legal Rights & Agreement Rules · Context

Appendix A: how to reach the controller and the Data Protection Office

Within Appendix A, the controller entry says to refer to the Data Protection Office for the contact information of other entities that may receive the personal data, and the Data Protection Office entry gives the email address DataProtectionOffice@Hilton.com and the postal address Attn: Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102, USA.

Supporting quotations

Controller: Please refer to the Data Protection Office at

Data Protection Office: Hilton’s Data Protection Office may be contacted by email at DataProtectionOffice@Hilton.com

Attn: Data Protection Office 7930 Jones Branch Drive McLean, VA 22102 USA

Qualifications & exceptions

The controller entry points to the Data Protection Office for the identity of other recipients, rather than naming them here.
The stated address is in the United States.

Legal Rights & Agreement Rules · Company practice

Purposes and legal basis: the five stated bases, and the basis follows the purpose

Appendix A states that Hilton processes personal information for the purposes set out in the Personal Information We Collect section of the main body, and that the legal bases for its processing activities include processing necessary to comply with contractual obligations, compliance with legal obligations, protecting the safety of employees, guests and others, pursuing legitimate business interests, and processing pursuant to the person's consent. It adds that the particular legal basis for processing a piece of personal information is based on the purpose for which that information was provided or collected. This is the European-style basis-and-purpose structure in Appendix A, which controls over the main body for the residents it covers.

Supporting quotations

Purposes and Legal Basis for Processing

Hilton processes your personal information for the purposes set forth in the section titled Personal Information We Collect

The legal bases for Hilton’s processing activities include processing such information as necessary to comply with our contractual obligations, compliance with our legal obligations, protecting the safety of our employees, guests and others, for our legitimate business interests, and pursuant to your consent.

The particular legal basis for the processing of your personal information is based on the purpose for which such information was provided or collected.

Qualifications & exceptions

The legal basis is stated to follow the purpose, so the basis for a given item depends on why it was collected.
This text sits in Appendix A, which applies to the residents of the listed jurisdictions and overrides the main body on conflict.

Legal Rights & Agreement Rules · Company practice

Legal basis for Hilton Honors participation: contract, consent where required, legitimate interests

For the personal information obtained in connection with participation in the Hilton Honors program, Hilton states that it processes the information on the basis of its contractual relationship with the person, consent if legally required, and for pursuing legitimate business interests, including personalising the person's use of its services and applications, communicating news and promotional items, and delivering personalised advertising and content.

Supporting quotations

Hilton Honors Participation: We process the personal information obtained in connection with your participation in the Hilton Honors program on the basis of our contractual relationship with you, consent if legally required, and for pursuing our legitimate business interests

including to personalize your use of our services and applications, to communicate news and promotional items, and to deliver personalized advertising and content

Qualifications & exceptions

Consent is one of three bases and applies only where legally required.
Personalisation and personalised advertising are stated as legitimate-interest purposes.

Legal Rights & Agreement Rules · Company practice

Legal basis for post-stay surveys: voluntary, consent plus business interests

Hilton says it may send post-stay surveys by SMS or email, that completion of the surveys is voluntary, and that it processes the information obtained from surveys on the basis of consent and in furtherance of its business interests, including marketing, service improvements and analytics.

Supporting quotations

Surveys: We may send post-stay surveys via SMS or email.

Completion of surveys is voluntary – we process the information obtained from surveys on the basis of your consent and in furtherance of our business interests, including marketing, service improvements, and analytics.

Qualifications & exceptions

Completion of the surveys is voluntary.
Marketing is a stated business interest for survey data.

Legal Rights & Agreement Rules · Company practice

Legal basis for on-property collection: contract, legitimate interests, and legal obligations at registration

Hilton says that when a guest makes a reservation and stays at one of its hotel properties, it processes the guest's name, address, contact information and the details of the stay — arrival and departure day and time, vehicle information and information about others travelling or staying with the guest — on the basis of its contractual relationship with the guest. It says it also processes that data for legitimate business interests, with consent where legally required, including marketing, service improvements, administration of the e-Folio programme, and analytics and service personalisation. It separately collects additional personal information at registration and check-in, such as national ID or passport information, as necessary to comply with its legal obligations.

Supporting quotations

On-Property Collection: When you make a reservation and when you stay at one of our hotel properties, we process your name, address, contact information, along with the details of your stay (arrival and departure day and time, vehicle information and information regarding others traveling or staying with you), on the basis of our contractual relationship with you.

We also process such data for pursuing our legitimate business interests, with your consent if legally required, including for marketing, service improvements, administration of our e-Folio program, and analytics and service personalization

We collect certain additional personal information during registration/check-in at our properties (such as national ID or passport information), as necessary to comply with our legal obligations.

Qualifications & exceptions

The stay details include information about other people travelling or staying with the guest.
Consent is required for the legitimate-interest processing only where legally required.
National ID or passport information at registration or check-in is collected to meet legal obligations, not for service delivery.

Legal Rights & Agreement Rules · Company practice

Legal basis for on-property CCTV and location monitoring: protection of staff, guests and visitors

Hilton states that it uses closed-circuit television and other security measures at its properties, which may capture or record images of guests and visitors in public areas, and information related to the guest's location while on its properties, via keycards and other technologies, for the protection of Hilton's staff, guests and visitors. The stated purpose is protection of people on the property; keycard and similar location tracking is named alongside CCTV.

Supporting quotations

We use closed circuit television and other security measures at our properties that may capture or record images of guests and visitors in public areas, as well as information related to your location while on our properties (via keycards and other technologies) for the protection of our staff, guests and visitors to our properties.

Qualifications & exceptions

CCTV is stated to capture images of guests and visitors in public areas.
Location information is collected through keycards and other technologies while the guest is on the property.

Legal Rights & Agreement Rules · Company practice

Legal basis for on-property services: concierge, spas, childcare, equipment rental and Digital Key

Hilton states that it processes personal information in connection with on-property services — concierge services, health clubs, spas, activities, child care services, equipment rental and the Digital Key functionality — in order to provide those services and for its business interests, including marketing, service improvements, administration of the e-Folio programme, and analytics and service personalisation.

Supporting quotations

We process personal information in connection with on-property services (such as concierge services, health clubs, spas, activities, child care services, equipment rental, and our Digital Key functionality), in order to provide the services to you and for our business interests including for marketing, service improvements, administration of our e-Folio program, and analytics and service personalization

Qualifications & exceptions

The stated purposes include the business-interest purposes, not only service delivery.
The categories named include child care services and the Digital Key functionality.

Legal Rights & Agreement Rules · Company practice

Legal basis for event profiles: contract plus legitimate interests, with consent where required

For event profiles, Hilton states that it processes the personal information obtained in connection with the person's event on the basis of its contractual relationship with the person and for pursuing legitimate business interests, with consent where legally required, including for marketing, service improvements, and analytics and service personalisation.

Supporting quotations

Event Profiles: We process the personal information obtained in connection with your event on the basis of our contractual relationship with you and for pursuing our legitimate business interests, with your consent if legally required, including for marketing, service improvements, and analytics and service personalization

Qualifications & exceptions

Consent is required for the legitimate-interest processing only where legally required.

Legal Rights & Agreement Rules · Company practice

Legal basis for promotions and sweepstakes: voluntary, consent and administration of the offering

Hilton states that participation in sweepstakes, contests and other promotional offerings is voluntary, and that it processes the information obtained from such participation based on consent and as necessary to administer the offering. It also says it uses certain data for its business purposes, including marketing, service improvements, administration of the e-Folio programme, and analytics and service personalisation.

Supporting quotations

Promotions and Sweepstakes: Participation in sweepstakes, contests and other promotional offerings is voluntary – we process the information obtained from such participation based on your consent and as necessary to administer the offering.

We also use certain data for our business purposes, including for marketing, service improvements, administration of our e-Folio program, and analytics and service personalization

Qualifications & exceptions

Participation is voluntary.
The business-purpose uses apply to certain data from the participation, on top of administering the offering.

Legal Rights & Agreement Rules · User right or choice

Direct marketing: sent on consent, withdrawable by email, unsubscribe or account preferences

Hilton states that it uses personal information to send marketing messages on the basis of consent, and that consent for direct marketing communications may be withdrawn at any time by contacting the Data Protection Office, by following the unsubscribe instructions in the marketing message received, or by logging in to the Hilton Honors account and updating communication preferences. The three routes for withdrawal are given side by side.

Supporting quotations

Direct Marketing: We use your personal information to send you marketing messages on the basis of your consent.

You may withdraw your consent for direct marketing communications at any time by contacting us at DataProtectionOffice@hilton.com

following the unsubscribe instructions in the marketing message you received, or by logging in to your Hilton Honors account and updating your communication preferences

Qualifications & exceptions

Marketing messages are stated to be sent on the basis of consent, and consent may be withdrawn at any time.
The account route applies to Hilton Honors members who can update their communication preferences.

Legal Rights & Agreement Rules · Company practice

Legal bases for franchise and ownership opportunities and for the supplier diversity programme

For franchise and ownership opportunities, Hilton states that it processes the information on the basis of its contractual relationship with the person and for its related legitimate business interests, including maintaining and promoting the Hilton brand and facilitating direct communication between properties within the Portfolio of Brands. For its Supplier Diversity Programme, it states that participation is voluntary and that it processes the information based on consent and for its related legitimate business interests, including maintaining and enhancing the diversity programme.

Supporting quotations

Franchise and Ownership Opportunities: We process this information on the basis of our contractual relationship with you and for our related legitimate business interests, including maintaining and promoting the Hilton brand and facilitating direct communication between properties within the Hilton Portfolio of Brands.

WMBE Suppliers: Participation in Hilton's Supplier Diversity Program is voluntary – we process this information based on your consent and for our related legitimate business interests, including maintaining and enhancing our diversity program.

Qualifications & exceptions

Participation in the supplier diversity programme is voluntary.
The franchise and ownership processing covers brand promotion and communication between properties in the Portfolio.

Legal Rights & Agreement Rules · Context

Data Subject Rights: some regional, national and state laws confer rights, shown in the portal

Appendix A states that some regional, national and state laws confer rights relating to personal data, as indicated in the Personal Data Requests Portal, and that residents of certain jurisdictions may have the rights it then lists. The scope of the rights is therefore stated to depend on the jurisdiction of the person, and the portal is said to indicate which rights apply.

Supporting quotations

Data Subject Rights

Some regional, national, and state laws confer rights relating to personal data as indicated in the Personal Data Requests Portal.

Residents of certain jurisdictions may have the following rights.

Access, Correction and Erasure Requests: You have the right to:

Qualifications & exceptions

The rights are stated as those that residents of certain jurisdictions may have.
The portal is said to indicate which rights apply.

Legal Rights & Agreement Rules · User right or choice

Access, correction and erasure requests

Within the Appendix A rights, the person has the right to ask Hilton to confirm whether it is processing their personal information and to receive information on how their data is processed; to obtain a copy of their personal information; to request that Hilton update or correct it; and to request that Hilton delete personal information in certain circumstances. The deletion right is qualified by 'in certain circumstances'.

Supporting quotations

ask us to confirm whether we are processing your personal information and receive information on how your data is processed

obtain a copy of your personal information

request that we update or correct your personal information

request that we delete personal information in certain circumstances

Qualifications & exceptions

The right to deletion applies only in certain circumstances.
The confirmation right includes receiving information on how the data is processed.

Legal Rights & Agreement Rules · User right or choice

Right to object to processing, including marketing, profiling and legitimate-interest processing

The person has the right to request that Hilton cease processing their personal information for marketing activities, including profiling; for statistical purposes; and where the processing is based on Hilton's legitimate business interests, unless Hilton can demonstrate a compelling legitimate basis for the processing or needs the information for the establishment, exercise or defence of a legal claim.

Supporting quotations

Right to Object to Processing: You have the right to request that Hilton cease processing of your personal information:

for marketing activities, including profiling

for statistical purposes

where such processing is based on our legitimate business interests, unless we are able to demonstrate a compelling legitimate basis for such processing or we need to process your personal information for the establishment, exercise or defense of a legal claim

Qualifications & exceptions

The objection to legitimate-interest processing is subject to a compelling legitimate basis or a legal-claims exception.
Profiling is included within the marketing ground.

Legal Rights & Agreement Rules · User right or choice

Right to restrict processing, and notice before processing resumes

The person may request that Hilton limit the processing of their personal information while Hilton is evaluating or responding to a request to update or correct the information where the processing is unlawful and the person does not want the data deleted; where Hilton no longer requires the data but the person wants it retained for the establishment, exercise or defence of a legal claim; and where the person has objected to processing based on legitimate business interests and Hilton's response is pending. Hilton says that where it limits processing at the person's request, it will inform the person before re-engaging in that processing.

Supporting quotations

Right to Restrict Processing: You have the right to request that Hilton limit the processing of your personal information:

while Hilton is evaluating or in the process of responding to a request by you to update or correct your personal information where such processing is unlawful and you do not want Hilton to delete your data

where Hilton no longer requires such data, but you want us to retain the data for the establishment, exercise or defense of a legal claim

where you have submitted an objection to processing based on our legitimate business interests, pending our response to such request

Where we limit the processing of your personal information pursuant to your request, we will inform you prior to re-engaging in such processing.

Qualifications & exceptions

Each ground is a specific situation; the right is not a general pause on processing.
Hilton says it will inform the person before re-engaging in the limited processing.

Legal Rights & Agreement Rules · User right or choice

Data portability: a copy in a machine-readable format, limited to directly obtained data and consent or contract

The person may request that Hilton provide them, or a third party they designate, with certain of their personal information in a commonly used, machine-readable format. Hilton states two limits: data portability rights apply only to personal information obtained directly from the person, and only where the processing is based on consent or on the performance of a contract.

Supporting quotations

Data Portability Requests: You have the right to request that we provide you or a third party that you designate with certain of your personal information in a commonly used, machine readable format.

data portability rights apply only to personal information that we have obtained directly from you and only where our processing is based on consent or the performance of a contract

Qualifications & exceptions

Portability is limited to personal information obtained directly from the person.
Portability applies only where processing is based on consent or on the performance of a contract.
The person may designate a third party recipient.

Legal Rights & Agreement Rules · Procedure

Submitting requests in Appendix A, identity verification, and the effect of a deletion request on services

Requests under the Appendix A rights may be submitted through the Data Subject Rights Request Portal, in writing to the Data Protection Office by email or post, and the person may also update their information as described in the main body's Your Rights and Choices section. Hilton says it will take reasonable steps to verify the identity and the request, including by checking account information, residency or the email address provided, that an authorized agent may have to produce written authorization, and that it will not respond unless it can appropriately verify the requester's identity. It says it will respond within the period permitted by law, that applicable law may give a right not to be discriminated against for exercising rights, that some information may be exempt — for example information retained for legal compliance and to secure the services — and that if the person asks for information Hilton needs to provide the services to be deleted, the person may no longer be able to use the services. It may also charge a reasonable fee for subsequent copies of data.

Supporting quotations

Submitting Requests: Your requests may be submitted by accessing the Data Subject Rights Request Portal at

or in writing to DataProtectionOffice@hilton.com

We will take reasonable steps to verify your identity and requests, including by verifying your account information, residency or the email address you provide.

We will not respond to any request unless we are able to appropriately verify the requester’s identity.

We will respond to all such requests within the time period permitted by law.

certain personal information may be exempt from such rights pursuant to applicable data protection laws, such as information we retain for legal compliance and to secure our services.

We may need certain information in order to provide the services to you; if you ask us to delete it, you may no longer be able to use the services.

In addition, we may charge you a reasonable fee for subsequent copies of data that you request.

Qualifications & exceptions

Hilton will not respond unless it can appropriately verify the requester's identity.
Some information may be exempt from the rights, including information retained for legal compliance and to secure the services.
Deleting information Hilton needs to provide the services may end the person's use of them.
A fee may be charged for subsequent copies of data requested.

Legal Rights & Agreement Rules · User right or choice

Complaining about data practices or the exercise of rights: Hilton or the supervisory authority

Hilton states that a person who wants to present a complaint or has concerns about its data practices, or about the exercise of their rights, may either contact Hilton at the Data Protection Office email address or the supervisory authority in the Member State of the person's residence. It says that for the EEA the supervisory authorities are listed on the European Data Protection Board page, and that for the UK the supervisory authority is the Information Commissioner's Office, linked from the Statement.

Supporting quotations

If you want to present a complaint or have concerns about our data practices or the exercise of your rights, you may either contact Hilton at DataProtectionOffice@Hilton.com

or the supervisory authority in the Member State of your residence.

For the EEA, the supervisory authorities are available

For the UK, the supervisory authority is available

Qualifications & exceptions

The complaint route depends on residence: the supervisory authority of the Member State of residence.
The Statement links to the EEA list of authorities and to the UK authority; their content is outside this document.

Legal Rights & Agreement Rules · User right or choice

Appeal rights in thirteen US states

Hilton states that residents of Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas and Virginia may appeal the denial of a request by emailing the Data Protection Office or mailing the Hilton Data Protection Office in McLean, Virginia. The appeal right is stated for those thirteen states only, and by those two routes.

Supporting quotations

Additionally, Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, and Virginia residents may appeal the denial of a request by emailing us at DataProtectionOffice@hilton.com

or mailing us at Hilton Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102, USA.

Qualifications & exceptions

The appeal right is listed for thirteen named US states.
The appeal is made by email or post to the Data Protection Office, not through the portal.

Legal Rights & Agreement Rules · User right or choice

Right to object to profiling and automated decision making

Hilton states that the person has the right to object to profiling and automated decision making, and explains that it uses personal information to divide large groups of consumers into sub-groups, known as segments, based on shared characteristics such as geography, behaviour or demographics. It adds that with the person's consent it makes automated decisions, meaning decisions without human interference, to offer certain benefits based on the person's characteristics — such as discounted room rates or other special offers based on geography, behaviour or demographics — with the example that frequent weekday travel to hotels in France may bring special offers for Hilton hotels in France.

Supporting quotations

Right to Object to Profiling and Automated Decision Making: You have the right to object to profiling and automated decision making.

We use personal information to divide large groups of consumers into sub-groups of consumers (known as segments) based on some type of shared characteristics such as geography, behavior, or demographics.

With your consent, we make automated decisions, meaning without human interference, to offer you certain benefits based on your characteristics (such as discounted room rates or other special offers based on your geography, behavior, or demographics).

if you travel frequently during the week to hotels in France, we may send you special offers for Hilton hotels in France

Qualifications & exceptions

Automated decisions are made with the person's consent.
The benefit examples are 'such as' items, and the France travel example is an illustration.
Profiling is described as grouping consumers into segments on shared characteristics.

Legal Rights & Agreement Rules · Context

Appendix A-1: California residents — CCPA information and the sections it cross-refers to

The California appendix says that California law requires Hilton to give additional information about how it collects, uses and discloses 'personal information' as defined in the California Consumer Privacy Act, and that Hilton describes the categories of information collected, the business purposes for collection, the sources and uses, and the entities with which it discloses information in the 'Collection of Personal Information – Generally', 'Collection of Personal Information – Notice at Point of Collection', 'Cookies and Other Technologies' and 'How We Disclose Personal Information' sections of the Statement. The California appendix therefore works by cross-reference to the main body rather than repeating it.

Supporting quotations

Appendix A-1: California Residents

The law in California requires us to provide you with some additional information regarding how we collect, use, and disclose your “personal information” as defined in the California Consumer Privacy Act (“CCPA”).

We describe the categories of information we collect, our business purposes for collecting such information, the sources and uses of such information and the entities with which we disclose such information in the

"Cookies and Other Technologies," and "How We Disclose Personal Information" sections of this Statement.

Qualifications & exceptions

The appendix cross-refers to four sections of the main body instead of restating them.
'Personal information' is stated to carry the meaning given in the California Consumer Privacy Act.

Legal Rights & Agreement Rules · Restriction or exception

California: no sale or sharing of a consumer's information where Hilton knows they are under 16

Hilton states that it does not 'sell' or 'share' personal information, as those terms are defined under the CCPA, if it has actual knowledge that the consumer is less than 16 years of age. The rule is a prohibition tied to actual knowledge of the consumer's age, and it applies to the sale and sharing definitions in the CCPA rather than to collection generally.

Supporting quotations

We do not “sell” or “share” personal information (as those terms are defined under the CCPA) if we have actual knowledge that the consumer is less than 16 years of age.

Qualifications & exceptions

The prohibition applies only where Hilton has actual knowledge that the consumer is under 16.
The terms 'sell' and 'share' are the CCPA definitions.

Legal Rights & Agreement Rules · Company practice

Appendix A rights: response time, exemptions from the rights, service limits and copy fees

Hilton says it will respond to all such requests within the time period permitted by law, and that applicable law may give the person a right not to be discriminated against for exercising their rights. It adds three qualifications: certain personal information may be exempt from the rights under applicable data protection laws, such as information Hilton retains for legal compliance and to secure its services; Hilton may need certain information in order to provide the services, so a request to delete it may mean the person can no longer use those services; and Hilton may charge a reasonable fee for subsequent copies of data requested.

Supporting quotations

We will respond to all such requests within the time period permitted by law.

Applicable law may further provide you with the right to not be discriminated against for exercising your rights.

certain personal information may be exempt from such rights pursuant to applicable data protection laws, such as information we retain for legal compliance and to secure our services.

We may need certain information in order to provide the services to you; if you ask us to delete it, you may no longer be able to use the services.

In addition, we may charge you a reasonable fee for subsequent copies of data that you request.

Qualifications & exceptions

The response period is the one permitted by law.
Exempt information includes what Hilton retains for legal compliance and to secure its services.
Deleting information needed to provide the services may end the person's use of them.
The fee applies to subsequent copies of data requested.

Legal Rights & Agreement Rules · User right or choice

California: the three CCPA rights, in addition to the Appendix A rights

Hilton states that, in addition to certain rights described in Appendix A for residents of certain countries and US states, the California Consumer Privacy Act affords California consumers three rights: the right to know what personal information Hilton collects, uses, discloses and/or sells; the right to request that it delete their personal information; and the right to request that it no longer sell or share their personal information. The California rights are stated as additional to the Appendix A rights, not as a substitute for them.

Supporting quotations

The Right to Know, The Right to Delete, and the Right to Opt-Out of the Sale or Sharing of Personal Information

the California Consumer Privacy Act (“CCPA”) affords California consumers (1) the right to know what personal information we collect, use, disclose, and/or sell; (2) the right to request that we delete their personal information; and (3) the right to request that we no longer sell or share their personal information.

Qualifications & exceptions

The three CCPA rights are stated as additional to the Appendix A rights.
The right to know covers collection, use, disclosure and sale.

Legal Rights & Agreement Rules · Procedure

California: where to send a request for information, correction or deletion

Hilton directs a person who wants information about the personal information it collects, or who wants to request correction or deletion, to the Data Subject Rights Portal, and also gives a toll-free telephone number, the Data Protection Office email address and a postal address in McLean, Virginia. The same DPO contact point serves the California and Appendix A routes.

Supporting quotations

If you would like information about the personal information that we collect, or if you would like to make a request for us to correct or delete your personal information, please visit Data Subject Rights Portal at

You also may call our toll-free telephone number: (800) 413-7470, email the Data Protection Office (“DPO”) at DataProtectionOffice@hilton.com

send a letter to the Data Protection Office at 7930 Jones Branch Drive, McLean, Virginia, USA 22102.

Qualifications & exceptions

The stated telephone number and postal address are in the United States.
The portal is the first route given.

Legal Rights & Agreement Rules · Procedure

California: identity verification before a request is fulfilled, and how to appoint an agent

Hilton states that when the DPO receives a request it first verifies the person's identity: for a Hilton Honors member, by asking for the name, the Honors account number and the email address and phone number associated with the account; for someone who is not a member, by asking for the name, the email address and/or phone number associated with a past stay and potentially a confirmation number from a stay. Once identity is verified, the DPO says it will promptly fulfil the request. A person may designate an authorized agent, and to do so must submit a court order, a document submitted by a barred attorney, or a formal certified document issued by an official governmental agency.

Supporting quotations

When the DPO receives your request, the DPO will first verify your identity.

If you are a Hilton Honors member, the DPO will verify your identity by asking you to provide your name, Hilton Honors account number, and the email address and phone number associated with your Hilton Honors account.

If you are not a Hilton Honors member, the DPO will verify your identity by asking you to provide your name, the email address and/or phone number associated with a past stay, and potentially a confirmation number from one of your stays at a Hilton property.

Once the DPO has verified your identity, the DPO will promptly fulfill your request.

If you would like, you may designate an authorized agent to make a request on your behalf.

please submit an order issued by a court, a document submitted by a barred attorney, or a formal certified document issued by an official governmental agency.

Qualifications & exceptions

Identity verification comes before the request is fulfilled.
The authorized-agent appointment requires one of three kinds of formal document.
The confirmation number is described as something the DPO 'potentially' asks for.

Legal Rights & Agreement Rules · User right or choice

California: opting out of sale or sharing, and the Global Privacy Control

Hilton states that a person who wants to opt out of the sale or sharing of their personal information may submit the request through the 'Your Privacy Choices | Cookie Information' link at the bottom of the Hilton.com website, shown when the site is accessed from an IP address indicating presence in a state that has enacted a privacy law. A cookie, tag and pixel opt-out applies only to the device and browser used, so the person must opt out again on each other device or browser. California residents can also turn on the Global Privacy Control to opt out of the browser-based 'sale' or 'sharing' for each participating browser system. The Statement notes that a cookie blocker such as Ghostery may hide the Your Privacy Choices tool or link, including in the web footer, and that California consumers may separately request that Hilton no longer sell or share non-cookie based personal information by making a Hilton Opt-out request.

Supporting quotations

If you would like to opt out of the sale or sharing of your personal information, you may submit a request by clicking the “ Your Privacy Choices| Cookie Information” link at the bottom of the Hilton.com website

when you opt out of cookies, tags, and pixels, that opt out only pertains to the device and the browser that you are using when you opt out.

California residents can also turn on the Global Privacy Control (GPC) to opt out of the “sale” or “sharing” of your personal information that is browser based for each participating browser system that you use.

If you use a cookie blocker such as Ghostery, it may block visibility of the Your Privacy Choices tool or link, including in your web footer.

California consumers may request that we no longer sell or share non-cookie based personal information by making a Hilton Opt-out request

Qualifications & exceptions

A cookie-based opt-out is device- and browser-specific and must be repeated on each device.
The Global Privacy Control covers browser-based sale or sharing for each participating browser system.
A cookie blocker may hide the opt-out tool, which is why a separate non-cookie opt-out request exists.
The 'Your Privacy Choices' link appears only when the IP address indicates a state with a privacy law.

Legal Rights & Agreement Rules · Restriction or exception

California: use of sensitive personal information is limited to what the services or the law require

Hilton states that it limits the use of a California consumer's sensitive personal information to the use necessary to perform reasonably expected services or as required by law, and that California's right to limit the use and disclosure of sensitive personal information therefore does not apply to it. The statement is framed as a limitation on Hilton's own use, with the statutory right said not to apply on that basis.

Supporting quotations

Sensitive Personal Information

We limit the use of your sensitive personal information to that use which is necessary to perform reasonably expected services or as required by law, to which California’s right to limit the use and disclosure of sensitive personal information does not apply.

Qualifications & exceptions

The limitation is to use necessary for reasonably expected services or as required by law.
The right to limit use and disclosure is stated not to apply because of that limitation.

Legal Rights & Agreement Rules · User right or choice

California: requesting information about disclosures for direct marketing, once a year

Hilton states that California consumers may request information about its disclosures of certain categories of personal information to third parties for their direct marketing purposes, and that such requests must be sent to the California privacy or Data Protection Office email addresses, or by post to the Data Protection Office in McLean, Virginia. Within thirty days of receiving such a request, Hilton says it will provide the list of categories of personal information disclosed to third parties for third-party direct marketing purposes during the immediately preceding calendar year, together with the names and addresses of those third parties. The request may be made no more than once per calendar year, and Hilton reserves the right not to respond to requests sent to addresses other than the ones specified.

Supporting quotations

Direct Marketing/Shine the Light Disclosure

California consumers also may request information about our disclosures of certain categories of personal information to third parties for their direct marketing purposes.

Within thirty days of receiving such a request, we will provide a list of the categories of personal information disclosed to third parties for third-party direct marketing purposes during the immediately preceding calendar year, along with the names and addresses of these third parties.

This request may be made no more than once per calendar year.

We reserve our right not to respond to requests submitted to addresses other than the addresses specified in this paragraph.

Qualifications & exceptions

The response is due within thirty days and covers the immediately preceding calendar year.
The request may be made no more than once per calendar year.
Hilton reserves the right not to respond to requests sent to other addresses.
The disclosure covered is for third-party direct marketing purposes.

Legal Rights & Agreement Rules · Company commitment

California: no discrimination for exercising CCPA rights

Hilton states that the CCPA prohibits a business from treating a consumer differently because the consumer exercised a right conferred by the CCPA, that it welcomes people to exercise their rights under the CCPA, and that it will not discriminate against them for doing so. The commitment is framed as non-discrimination, not as an extension of the rights themselves.

Supporting quotations

The Right to Non-Discrimination

The CCPA prohibits a business from treating a consumer differently because the consumer exercised a right conferred on him/her by the CCPA.

we will not discriminate against you for doing so.

Qualifications & exceptions

The commitment is to non-discrimination, not to a wider set of rights.

Legal Rights & Agreement Rules · Company practice

California: no financial incentive for collecting, selling or deleting personal information

Hilton states that it does not offer a financial incentive for the collection, sale or deletion of personal information, and explains that it primarily collects personal data from guests in order to fulfil guest reservations and from Honors members in order to operate the Hilton Honors loyalty programme, while also collecting personal data for marketing and other purposes as permitted by applicable law. The statement is the notice required where a business offers a financial incentive, and Hilton says it offers none.

Supporting quotations

Financial Incentive Notice

Hilton does not offer a financial incentive for the collection, sale, or deletion of personal information.

Hilton primarily collects personal data from guests in order to fulfill guest reservations and from Honors members in order to operate the Hilton Honors loyalty program.

Hilton also collects personal data for marketing and other purposes as permitted by applicable law.

Qualifications & exceptions

The main collection purposes are given as reservation fulfilment and operating the loyalty programme, with marketing and other purposes as permitted by law.
The notice covers collection, sale and deletion.

Legal Rights & Agreement Rules · Company practice

California: accumulating Honors points and discounted rates are not a financial incentive

Hilton states, referring to the Hilton Honors Terms and Conditions, that Hilton Honors members can accumulate points and access discounted rates, and that the ability to accumulate points and access discounted rates is not directly related to the value provided to the business of members' data. The Terms and Conditions are a separate document whose text this source does not supply, so the Statement's own explanation is what can be read here.

Supporting quotations

As set forth in the Hilton Honors Terms and Conditions

Hilton Honors members have the ability to accumulate points and access discounted rates.

The ability to accumulate points and to access discounted rates is not directly related to the value provided to the business of members’ data.

Qualifications & exceptions

The statement is that the points and discounted rates are 'not directly related' to the value of members' data.
The underlying terms are in the Hilton Honors Terms and Conditions, which this source does not contain.

Not stated here

The linked Hilton Honors Terms and Conditions are not supplied in this source, so this card cannot say what those terms provide beyond the reference the Statement itself makes.

Legal Rights & Agreement Rules · User right or choice

California: request to remove publicly posted content if you are under 18

Hilton states that if a person is a California resident under the age of 18 and a registered user of any site where the policy is posted, California Business and Professions Code Section 22581 permits them to request and obtain removal of content or information they have publicly posted, and the request is made by emailing a detailed description of the specific content to CA_Privacy@Hilton.com. It warns that such a request does not ensure complete or comprehensive removal, and that there may be circumstances in which the law does not require or allow removal even if requested.

Supporting quotations

Removal of Content

If you are a California resident under the age of 18, and a registered user of any site where this policy is posted, California Business and Professions Code Section 22581 permits you to request and obtain removal of content or information you have publicly posted.

Please be aware that such a request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested.

Qualifications & exceptions

The right is stated for California residents under 18 who are registered users of a site where the policy is posted.
The request is made by email with a detailed description of the specific content.
Removal is not guaranteed and the law may not require or allow it even when requested.

Legal Rights & Agreement Rules · Company practice

California: Do Not Track signals are not responded to

Hilton states that California law requires it to tell people how it responds to web browser Do Not Track signals, and that because there is currently no industry or legal standard for recognising or honouring DNT signals, it does not respond to them at this time. The main body's advertising section says the same, and separately says that legally recognised global opt-out signals are honoured.

Supporting quotations

Do Not Track (“DNT”)

California law requires us to let you know how we respond to web browser Do Not Track (“DNT”) signals.

Because there currently isn’t an industry or legal standard for recognizing or honoring DNT signals, we don’t respond to them at this time.

Qualifications & exceptions

The reason given is the absence of an industry or legal standard for recognising or honouring DNT signals.
The commitment is expressed as 'at this time', so it is not a permanent statement.

Legal Rights & Agreement Rules · User right or choice

Nevada residents: requesting that Hilton stop selling certain categories of personal information

The Nevada appendix states that a Nevada resident may request that Hilton stop selling certain categories of personal information that it collects, and gives the routes: the opt-out request page on Hilton's website, the toll-free telephone number, the Data Protection Office email address, or a letter to the Data Protection Office in McLean, Virginia. It then repeats the identity verification: for a Hilton Honors member the DPO asks for the name, account number and account email and phone number, for a non-member for the name, contact details associated with a past stay and potentially a stay confirmation number, and once identity is verified the DPO says it will promptly fulfil the request.

Supporting quotations

Appendix A-2: Nevada Residents

If you are a Nevada resident, you may request that we stop selling certain categories of personal information that we collect.

To submit a request, please visit our website at https://www.hilton.com/en/hilton-honors/opt-out-request

When the DPO receives your request, the DPO will first verify your identity.

If you are a Hilton Honors member, the DPO will verify your identity by asking you to provide your name, Hilton Honors account number, and the email address and phone number associated with your Hilton Honors account.

Once the DPO has verified your identity, the DPO will promptly fulfill your request.

Qualifications & exceptions

The right covers 'certain categories' of personal information that Hilton collects, not all of it.
Identity verification precedes fulfilment, with different evidence for members and non-members.

Legal Rights & Agreement Rules · Restriction or exception

French residents: phone number collection, no telemarketing, and the telephone canvassing opposition list

The French appendix states that, as disclosed in the Statement, Hilton may collect a French resident's phone number to fulfil guest reservations, send reservation communications, provide customer service and support, verify identity, send marketing communications by SMS, process transactions with partners, share data with Hilton's Third-Party Partner, authenticate mobile accounts, send service-related SMS communications, detect and prevent fraud, and engage in sales activity for group bookings. It adds that Hilton will not use the phone number for telemarketing, and that a person who wishes to register on the list of opposition to telephone canvassing may do so on the French Bloctel site. This is a France-specific statement; it is not the rule stated in the main body of the global Statement.

Supporting quotations

Appendix A-3: French Residents

This Appendix provides additional information for individuals residing in France.

French residents, as disclosed in this Statement, we may collect your phone number to fulfill guest reservations, send guests communications relating to their reservations, provide customer service and support, verify identity, send marketing communications via SMS, process transactions with partners, share data with Hilton’s Third-Party Partner, authenticate mobile accounts, send service-related SMS communications, detect and prevent fraud, and engage in sales activities for group bookings.

We will not use your phone number for telemarketing.

if you would like to register on the list of opposition to telephone canvassing, you may do so at www.bloctel.gouv.fr

Qualifications & exceptions

The no-telemarketing statement and the Bloctel reference are specific to French residents.
The purposes listed are those the Statement already discloses for the phone number, restated for France.
The Bloctel registration is an external route Hilton points to rather than a process it runs.

Legal Rights & Agreement Rules · User right or choice

Hong Kong: access or correction requests, further information for verification, and refusal

The Hong Kong appendix says that a person who wants to access or correct their personal information should contact the Data Protection Office or visit the Data Subject Rights Requests Portal. It states that Hilton may require further information from the requester in order to verify identity before processing the request, and that in certain circumstances where permitted under applicable law, Hilton may refuse to fulfil the request.

Supporting quotations

If you would like to access or correct your personal information, please contact the Data Protection Office (“DPO”) at DataProtectionOffice@hilton.com

We may require further information from you in order to verify your identity before processing your request.

In certain circumstances where permitted to do so under applicable law, we may refuse to fulfil your request.

Qualifications & exceptions

Further information may be required for identity verification before the request is processed.
Refusal is possible in certain circumstances where applicable law permits it.

Legal Rights & Agreement Rules · Context

Türkiye appendix: additional information and rights under local law, controlling over the main body

The Türkiye appendix states that for data subjects in Türkiye it outlines certain additional information Hilton is obliged to provide and certain rights they have with respect to the processing of their personal information, pursuant to applicable local laws, and that the appendix controls to the extent it conflicts with any provision in the main body of the Statement or in Appendix A. It is therefore a jurisdictional override within the global statement.

Supporting quotations

Appendix A-5: Türkiye Residents

For data subjects in Türkiye, this Appendix outlines certain additional information that Hilton is obligated to provide to you, as well as certain rights you have with respect to the processing of your personal information, pursuant to applicable local laws.

This Appendix will control to the extent it conflicts with any provision in the main body of this Statement, or Appendix A, as applicable.

Qualifications & exceptions

The appendix controls over both the main body and Appendix A where they conflict.
The information and rights are stated as those owed and available under applicable local laws.

Legal Rights & Agreement Rules · Company practice

Türkiye: the data controller for guest data, and local entities that may also be controllers

The Türkiye appendix names Hilton Domestic Operating Company Inc. as the Hilton entity for all guest data and for Hilton's marketing activities. It adds that a person's personal data may also be processed by other Hilton entities in Türkiye that act as a data controller based on the Hilton property they stay at, and that in such cases the relevant Hilton entity will act as the data controller and will provide a separate privacy notice where necessary. The controller for a given stay therefore depends on which property the person stays at.

Supporting quotations

Data Controller. Hilton Domestic Operating Company Inc. is the Hilton entity for all guest data and Hilton's marketing activities.

Your personal data may be processed by other Hilton entities in Türkiye who act as a data controller based on the Hilton property you stay at.

the relevant Hilton entity will act as the data controller for your personal data, who will provide you with a separate privacy notice, where necessary.

Qualifications & exceptions

The local entity's separate privacy notice is provided 'where necessary'.
The controller for a stay follows the property at which the person stays.

Legal Rights & Agreement Rules · Context

Türkiye: the data controller representative for questions and complaints

The Türkiye appendix says a person in Türkiye may contact Hilton's data controller representative in Türkiye by email or mail to handle questions and complaints about the processing of their personal data, and gives the representative as Esin Attorney Partnership, with the email address info@esin.av.tr and the postal address Akatlar Mah. Ebulula Mardin Cad. Gül Sok. No. 2. This is a local representative contact, separate from the Data Protection Office in Virginia.

Supporting quotations

Data Controller Representative. You may contact our data controller representative in Türkiye by email or mail to handle questions and complaints in connection with the processing of your personal data if you are in Türkiye.

Esin Attorney Partnership

info@esin.av.tr

Akatlar Mah. Ebulula Mardin Cad. Gül Sok. No. 2

Qualifications & exceptions

The representative handles questions and complaints about the processing of personal data in Türkiye.
The representative is a law firm named in the appendix.

Legal Rights & Agreement Rules · Company practice

Türkiye: the four legal bases relied on for the purposes in the Statement

The Türkiye appendix states that Hilton relies on the following legal bases when processing personal data for the purposes indicated in the Global Privacy Statement, in accordance with Article 5 of Law No. 6698 on Protection of Personal Data, referred to as the Data Protection Law: processing necessary because it is directly related to the conclusion or fulfilment of the contract between the person and Hilton; processing mandatory for Hilton to comply with its legal obligations; processing mandatory for Hilton's legitimate interests, provided it does not violate the person's fundamental rights and freedoms; or the person's explicit consent. It adds that it relies on explicit consent only when it requires consent for the processing, and does not rely on that ground when it relies on one of the others. The appendix cites the legal basis without setting out the law's terms.

Supporting quotations

Legal bases for the processing of your personal data. Hilton relies on the following legal bases while processing your personal data for the purposes indicated in the Global Privacy Statement in accordance with Article 5 of the Law No. 6698 on Protection of Personal Data (“Data Protection Law”):

processing of your personal data is necessary provided that it is directly related to the conclusion or fulfillment of the contract between you and Hilton;

processing is mandatory for Hilton to be able to comply with our legal obligations;

processing is mandatory for Hilton’s legitimate interests, provided that it does not violate your fundamental rights and freedoms; or

your explicit consent. (Please note that we rely on your explicit consent only when we require your consent for the processing and we do not rely on this legal basis if and when we rely on one of the other legal grounds above.)

Qualifications & exceptions

The legitimate-interest basis is qualified by the condition that it does not violate the person's fundamental rights and freedoms.
Explicit consent is relied on only where consent is required, and not as a substitute for the other grounds.
The citation names Article 5 of Law No. 6698; the appendix does not reproduce the law.

Legal Rights & Agreement Rules · Company practice

Türkiye: fulfilling guest reservations — data categories and legal basis

For the purpose of fulfilling guest reservations, the Türkiye appendix states that Hilton collected the following categories of personal data: name, telephone and fax numbers, email address, home address and Hilton Honors number, and that it relies on the contract as the legal basis for processing them. Only the contract basis is listed for this purpose.

Supporting quotations

We have collected personal data for the following purposes:

Fulfill guest reservations

We collected the following categories of personal data for this purpose:

Name

Telephone and fax numbers

Email address

Home address

Hilton Honors number

We rely on the following legal bases to process personal data:

Contract

Qualifications & exceptions

Only the contract legal basis is listed for this purpose.
The data categories are the ones the appendix states were collected for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: reservation communications — data categories and legal bases

For the purpose of sending guests communications about reservations, the Türkiye appendix states that Hilton collected name, telephone and fax numbers, email address and Hilton Honors number, and that it relies on the contract and legitimate interests as the legal bases for processing them. The home address collected for reservations is not listed for this purpose.

Supporting quotations

Send guests communications about reservations

We collected the following categories of personal data for this purpose:

Name

Telephone and fax numbers

Email address

Hilton Honors number

We rely on the following legal bases to process personal data:

Contract

Legitimate interests

Qualifications & exceptions

Two legal bases are listed for this purpose: contract and legitimate interests.
The home address is not among the categories listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: administering Hilton Honors membership — data categories and legal bases

For the purpose of administering Hilton Honors membership and activity, the Türkiye appendix states that Hilton collected name, email address, home address and Hilton Honors number, and that it relies on the contract and legitimate interests as the legal bases. Unlike the reservation purpose, telephone and fax numbers are not listed for this purpose.

Supporting quotations

Administer Hilton Honors membership and activity

We collected the following categories of personal data for this purpose:

Name

Email address

Home address

Hilton Honors number

We rely on the following legal bases to process personal data:

Contract

Legitimate interests

Qualifications & exceptions

Two legal bases are listed: contract and legitimate interests.
Telephone and fax numbers are not among the categories listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: customer service and support — data categories and legal bases

For the purpose of providing customer service and support, the Türkiye appendix states that Hilton collected name, telephone and fax numbers, email address, home address, Hilton Honors number, WeChat name and profile photo, arrival time, corporate travel planner contact information, booking engine data, and whether the person holds a Hilton and American Express co-branded credit card and whether their Hilton and Amazon and Hilton and Lyft accounts are linked. It relies on the contract and legitimate interests as the legal bases. This is the widest list of data categories in the Türkiye purposes shown so far.

Supporting quotations

Provide customer service and support

We collected the following categories of personal data for this purpose:

Name

Telephone and fax numbers

Email address

Home address

Hilton Honors number

WeChat name and profile photo

Arrival time

Corporate travel planner contact information (name, title, company, business phone, email and address)

Qualifications & exceptions

Two legal bases are listed: contract and legitimate interests.
The list includes inferences about linked partner accounts, not only contact details.

Legal Rights & Agreement Rules · Company practice

Türkiye: customer service — partner account indicators and the legal bases

The remainder of the customer service and support list in the Türkiye appendix records booking engine data, whether the person has a Hilton and American Express co-branded credit card, whether their Hilton and Amazon accounts are linked and whether their Hilton and Lyft accounts are linked, and states that the legal bases for this purpose are the contract and legitimate interests.

Supporting quotations

Booking engine

Whether you have a Hilton and American Express Co-Branded Credit Card

Whether your Hilton and Amazon accounts are linked

Whether your Hilton and Lyft accounts are linked

We rely on the following legal bases to process personal data:

Contract

Legitimate interests

Qualifications & exceptions

The legal bases listed for this purpose are the contract and legitimate interests.
The three partner items are recorded as whether statements rather than as content.

Legal Rights & Agreement Rules · Company practice

Türkiye: verifying identity — data categories collected

For the purpose of verifying identity, the Türkiye appendix states that Hilton collected name, telephone and fax numbers, email address and home address. The legal bases listed for this purpose follow in the next part of the appendix.

Supporting quotations

Verify identity

We collected the following categories of personal data for this purpose:

Name

Telephone and fax numbers

Email address

Home address

Qualifications & exceptions

Only the collected data categories are stated in this part; the legal bases are listed in the following part of the appendix.

Legal Rights & Agreement Rules · Company practice

Türkiye: legal basis for verifying identity is legitimate interests

The Türkiye appendix lists one legal basis for processing the identity data it collected to verify identity: legitimate interests. The data categories for this purpose were name, telephone and fax numbers, email address and home address, as stated in the preceding part of the appendix.

Supporting quotations

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: sending marketing communications — data categories and legal basis

For the purpose of sending email, direct mail and social media marketing communications, the Türkiye appendix states that Hilton collected name, Hilton Honors number and corporate travel planner contact information, and that consent is the legal basis relied on. This is the only purpose in the Türkiye list whose sole stated legal basis is consent.

Supporting quotations

Send email, direct mail, and social media marketing communications

We collected the following categories of personal data for this purpose:

Name

Hilton Honors number

Corporate travel planner contact information (name, title, company, business phone, email and address)

We rely on the following legal bases to process personal data:

Consent

Qualifications & exceptions

Consent is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: analytics for personalised offers and content — data categories

For the purpose of performing analytics for personalised offers and content, the Türkiye appendix states that Hilton collected name, Hilton Honors number, home address, preferred language, room preference, internet or other electronic network activity information including interaction with Hilton websites, applications or advertisements, IP addresses, session IDs, geolocation information, device information including MAC addresses, and social media information and publicly available online information including through social media platforms. The legal bases for this purpose are set out in the following part of the appendix.

Supporting quotations

Perform analytics for personalized offers and content

We collected the following categories of personal data for this purpose:

Name

Hilton Honors number

Home address

Preferred language

Room preference

Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements

IP addresses

Session IDs

Geolocation information

Device information (including MAC addresses)

Social media information; publicly available online information (including through social media platforms)

Qualifications & exceptions

The legal bases for this purpose follow in the next part of the appendix.
The data categories include online activity, device identifiers and location information.

Legal Rights & Agreement Rules · Company practice

Türkiye: legal bases for personalization analytics are legitimate interests and consent

The Türkiye appendix lists demographic data among the data collected for the personalization analytics purpose, and gives the legal bases for that purpose as legitimate interests and consent. The appendix's own note elsewhere states that explicit consent is relied on only where consent is required, and not where one of the other grounds applies.

Supporting quotations

Demographic data

We rely on the following legal bases to process personal data:

Legitimate interests

Consent

Qualifications & exceptions

Two legal bases are listed for this purpose: legitimate interests and consent.
Demographic data is added to the categories for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: analytics to improve business operations — data categories and legal basis

For the purpose of performing analytics to improve business operations, the Türkiye appendix states that Hilton collected name, home address, Hilton Honors number, room preference, internet or other electronic network activity information including interaction with Hilton websites, applications or advertisements, IP addresses, session IDs, booking engine data, whether the person has a Hilton and American Express co-branded credit card, whether their Hilton and Amazon and Hilton and Lyft accounts are linked, and spending amount, and that the legal basis is legitimate interests.

Supporting quotations

Perform analytics to improve business operations

We collected the following categories of personal data for this purpose:

Name

Home address

Hilton Honors number

Room preference

Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements

IP addresses

Session IDs

Booking engine

Whether you have a Hilton and American Express Co-branded Credit Card

Whether your Hilton and Amazon accounts are linked

Whether your Hilton and Lyft accounts are linked

Spending amount

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.
The categories include spending amount and the linked partner account indicators.

Legal Rights & Agreement Rules · Company practice

Türkiye: eligibility for special or promotional rates — data categories and legal basis

For the purpose of determining guests' eligibility for special or promotional rates, the Türkiye appendix states that Hilton collected name, Hilton Honors number, corporate number and name, and travel agent number and name, and that the legal basis is legitimate interests.

Supporting quotations

Determine guests' eligibility for special or promotional rates

We collected the following categories of personal data for this purpose:

Name

Hilton Honors number

Corporate number and name

Travel agent number and name

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: processing payments and strong customer authentication — data categories and legal bases

For the purpose of processing payments, including strong customer authentication where required by law, the Türkiye appendix states that Hilton collected name, home address, payment card information and IP addresses, and that the legal bases are the contract and legal obligations. The purpose itself is qualified by 'when required by law' as to strong customer authentication.

Supporting quotations

Process payments, including strong customer authentication when required by law

We collected the following categories of personal data for this purpose:

Name

Home address

Payment card information

IP addresses

We rely on the following legal bases to process personal data:

Contract

Legal obligations

Qualifications & exceptions

Strong customer authentication is stated to apply only when required by law.
Two legal bases are listed: contract and legal obligations.

Legal Rights & Agreement Rules · Company practice

Türkiye: transactions with partners — data categories and legal basis

For the purpose of processing transactions with partners, the Türkiye appendix states that Hilton collected name, telephone and fax numbers, email address, home address and Hilton Honors number, and that the legal basis is the contract.

Supporting quotations

Process transactions with partners

We collected the following categories of personal data for this purpose:

Name

Telephone and fax numbers

Email address

Home address

Hilton Honors number

We rely on the following legal bases to process personal data:

Contract

Qualifications & exceptions

The contract is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: administering contests and sweepstakes — data categories and legal bases

For the purpose of administering contests and sweepstakes, the Türkiye appendix states that Hilton collected name, email address, home address and Hilton Honors number, and that the legal bases are consent and legitimate interests.

Supporting quotations

Administer contests and sweepstakes

We collected the following categories of personal data for this purpose:

Name

Email address

Home address

Hilton Honors number

We rely on the following legal bases to process personal data:

Consent

Legitimate interests

Qualifications & exceptions

Two legal bases are listed: consent and legitimate interests.

Legal Rights & Agreement Rules · Company practice

Türkiye: optimizing websites and mobile apps — data categories and legal bases

For the purpose of optimizing Hilton's websites and mobile apps, the Türkiye appendix states that Hilton collected name, internet or other electronic network activity information including interaction with Hilton websites, applications or advertisements, and IP addresses, and that the legal bases are consent and legitimate interests.

Supporting quotations

Optimize our websites and mobile apps

We collected the following categories of personal data for this purpose:

Name

Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements

IP addresses

We rely on the following legal bases to process personal data:

Consent

Legitimate interests

Qualifications & exceptions

Two legal bases are listed: consent and legitimate interests.

Legal Rights & Agreement Rules · Company practice

Türkiye: detecting and preventing fraud — data categories and legal basis

For the purpose of detecting and preventing fraud, the Türkiye appendix states that Hilton collected name, telephone and fax numbers, email address, home address, payment card information, Hilton Honors number, internet or other electronic network activity information including interaction with Hilton websites, applications or advertisements, IP addresses, session IDs, geolocation information, and device information including MAC addresses, and that the legal basis is legitimate interests.

Supporting quotations

Detect and prevent fraud

We collected the following categories of personal data for this purpose:

Name

Telephone and fax numbers

Email address

Home address

Payment card information

Hilton Honors number

Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements

IP addresses

Session IDs

Geolocation information

Device information (including MAC addresses)

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.
The categories combine identity, payment, device and online activity data.

Legal Rights & Agreement Rules · Company practice

Türkiye: SMS marketing communications — the data category collected

For the purpose of sending marketing communications via SMS, the Türkiye appendix states that Hilton collected telephone and fax numbers. The legal basis for this purpose is set out in the following part of the appendix.

Supporting quotations

Send marketing communications via SMS

We collected the following categories of personal data for this purpose:

Telephone and fax numbers

Qualifications & exceptions

Only the data category is stated in this part; the legal bases are listed in the next part of the appendix.

Legal Rights & Agreement Rules · Company practice

Türkiye: legal basis for SMS marketing is consent

The Türkiye appendix lists consent as the legal basis for processing the telephone and fax numbers collected for sending marketing communications by SMS. Consent is the only basis listed for that purpose.

Supporting quotations

We rely on the following legal bases to process personal data:

Consent

Qualifications & exceptions

Consent is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: authenticating a mobile account — data categories and legal basis

For the purpose of authenticating a mobile account, the Türkiye appendix states that Hilton collected telephone and fax numbers and email address, and that the legal basis is legitimate interests.

Supporting quotations

Authenticate mobile account

We collected the following categories of personal data for this purpose:

Telephone and fax numbers

Email address

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: service-related SMS communications — data category and legal basis

For the purpose of sending service-related SMS communications, the Türkiye appendix states that Hilton collected telephone and fax numbers, and that the legal basis is legitimate interests. The data category is the same as for marketing SMS, but the legal basis differs.

Supporting quotations

Send service-related SMS communications

We collected the following categories of personal data for this purpose:

Telephone and fax numbers

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose, in contrast to consent for marketing SMS.

Legal Rights & Agreement Rules · Company practice

Türkiye: group bookings, meetings and events — data categories and legal bases

For the purpose of engaging in sales activity for group bookings, meetings and events, the Türkiye appendix states that Hilton collected telephone and fax numbers, email address and home address, and that the legal bases are legitimate interests and consent.

Supporting quotations

Engage in sales activity for group booking, meetings, and events

We collected the following categories of personal data for this purpose:

Telephone and fax numbers

Email address

Home address

We rely on the following legal bases to process personal data:

Legitimate interests

Consent

Qualifications & exceptions

Two legal bases are listed: legitimate interests and consent.

Legal Rights & Agreement Rules · Company practice

Türkiye: email marketing — data category and legal basis

For the purpose of sending marketing communications via email, the Türkiye appendix states that Hilton collected the email address, and that consent is the legal basis relied on.

Supporting quotations

Send marketing communications via email

We collected the following categories of personal data for this purpose:

Email address

We rely on the following legal bases to process personal data:

Consent

Qualifications & exceptions

Consent is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: direct mail marketing — data category and legal basis

For the purpose of sending marketing communications via direct mail, the Türkiye appendix states that Hilton collected the home address, and that consent is the legal basis relied on.

Supporting quotations

Send marketing communications via direct mail

We collected the following categories of personal data for this purpose:

Home address

We rely on the following legal bases to process personal data:

Consent

Qualifications & exceptions

Consent is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: compliance with laws requiring information in some jurisdictions — data categories and legal basis

For the purpose of complying with applicable laws requiring this information in some jurisdictions, the Türkiye appendix states that Hilton collected nationality, date of birth, gender, and images of footage captured by closed circuit television, and that the legal basis is legal obligations. The purpose is qualified by 'some jurisdictions'.

Supporting quotations

Comply with applicable laws requiring this information in some jurisdictions

We collected the following categories of personal data for this purpose:

Nationality

Date of birth

Gender

Images of footage captured by closed circuit television (CCTV)

We rely on the following legal bases to process personal data:

Legal obligations

Qualifications & exceptions

The legal requirement is qualified by 'some jurisdictions'.
Legal obligations is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: books and records for reporting, auditing, tax and income reconciliation

For the purpose of maintaining books and records for business reporting, auditing, tax and income reconciliation, the Türkiye appendix states that Hilton collected payment card information and spending amount, and that the legal basis is legal obligations.

Supporting quotations

Maintain books and records for business reporting, auditing, tax, and income reconciliation

We collected the following categories of personal data for this purpose:

Payment card information

Spending amount

We rely on the following legal bases to process personal data:

Legal obligations

Qualifications & exceptions

Legal obligations is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: logging in to the Hilton Honors account — data category and legal basis

For the purpose of enabling login to the Hilton Honors account, the Türkiye appendix states that Hilton collected the WeChat ID, and that consent is the legal basis relied on.

Supporting quotations

Enable login to Hilton Honors account

We collected the following categories of personal data for this purpose:

WeChat ID

We rely on the following legal bases to process personal data:

Consent

Qualifications & exceptions

Consent is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: superior guest experience — data category and legal basis

For the purpose of providing a superior guest experience, the Türkiye appendix states that Hilton collected the preferred language, and that the legal basis is legitimate interests.

Supporting quotations

Provide superior guest experience

We collected the following categories of personal data for this purpose:

Preferred language

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: Hilton Honors communications — data category and legal basis

For the purpose of sending Hilton Honors communications, the Türkiye appendix states that Hilton collected the preferred language, and that consent is the legal basis relied on. The same data category is listed for the superior guest experience purpose, but on a different legal basis.

Supporting quotations

Send Hilton Honors communications

We collected the following categories of personal data for this purpose:

Preferred language

We rely on the following legal bases to process personal data:

Consent

Qualifications & exceptions

Consent is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: marketing communications — preferred language and consent

For the separate purpose of 'Send marketing communications' in the Türkiye appendix, Hilton states that it collected the preferred language and relies on consent. This is listed as its own purpose, distinct from the email, direct mail and SMS marketing purposes, each of which names a different data category.

Supporting quotations

Send marketing communications

We collected the following categories of personal data for this purpose:

Preferred language

We rely on the following legal bases to process personal data:

Consent

Qualifications & exceptions

This is a separate entry from the email, direct mail and SMS marketing purposes.
Consent is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: better serving guests — the widest list of data categories

For the purpose of better serving guests, the Türkiye appendix states that Hilton collected preferred language, room preference, room selection and assignment, arrival time, departure date, MyWay preferences, email and consent preferences such as opt-out or opt-in, descriptions of incidents at a Hilton property or involving a Hilton employee including safety, security, violation of law, policy or contractual obligation, descriptions of complaints including free form textual feedback from Honors members, spa and wellness service or treatment details, and spending amount, and that the legal basis is legitimate interests. This is the broadest data list in the Türkiye purposes.

Supporting quotations

Better serve guests

We collected the following categories of personal data for this purpose:

Preferred language

Room preference

Room selection and assignment

Arrival time

Departure date

MyWay preferences

Email and consent preferences (such as opt-out or opt-in as applicable)

Description of an incident that occurs at a Hilton property or involves a Hilton employee, including incidents related to safety and security, and violation of law, applicable policy, or contractual obligation

Description of a complaint that you make to us, including your free form textual feedback if you are a Hilton Honors member

Spa and wellness service or treatment details (such as date, time, and type of service)

Spending amount

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.
The categories include incident and complaint descriptions and spa or treatment details.
The complaint description is included only where the person is a Hilton Honors member.

Legal Rights & Agreement Rules · Company practice

Türkiye: personalizing the guest experience — data categories and legal basis

For the purpose of personalizing the guest experience, the Türkiye appendix states that Hilton collected arrival time and departure date, and that the legal basis is legitimate interests.

Supporting quotations

Personalize guest experience

We collected the following categories of personal data for this purpose:

Arrival time

Departure date

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: fulfilling corporate travel reservations — data category and legal basis

For the purpose of fulfilling corporate travel reservations, the Türkiye appendix states that Hilton collected corporate travel planner contact information — name, title, company, business phone, email and address — and that the legal basis is the contract.

Supporting quotations

Fulfill corporate travel reservations

We collected the following categories of personal data for this purpose:

Corporate travel planner contact information (name, title, company, business phone, email and address)

We rely on the following legal bases to process personal data:

Contract

Qualifications & exceptions

The contract is the only legal basis listed for this purpose.
The collected data is that of the corporate travel planner, not of the traveller.

Legal Rights & Agreement Rules · Company practice

Türkiye: contacting media and social influencers — data category and legal basis

For the purpose of contacting the media and social influencers, the Türkiye appendix states that Hilton collected business contact data for members of the media and social media influencers, and that consent is the legal basis relied on.

Supporting quotations

Contact the media and social influencers

We collected the following categories of personal data for this purpose:

Business contact data for members of the media and social media influencers

We rely on the following legal bases to process personal data:

Consent

Qualifications & exceptions

Consent is the only legal basis listed for this purpose.
The data is business contact data about media members and social media influencers.

Legal Rights & Agreement Rules · Company practice

Türkiye: attributing reservations to travel agents — data category and legal basis

For the purpose of attributing reservations to travel agents, the Türkiye appendix states that Hilton collected the travel agent number and name, and that the legal basis is the contract.

Supporting quotations

Attribute reservations to travel agents

We collected the following categories of personal data for this purpose:

Travel agent number and name

We rely on the following legal bases to process personal data:

Contract

Qualifications & exceptions

The contract is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: attributing Points to airline loyalty participants — data category and legal basis

For the purpose of attributing Points to airline loyalty participants, the Türkiye appendix states that Hilton collected the airline partner number and name, and that the legal basis is the contract.

Supporting quotations

Attribute Points to airline loyalty participants

We collected the following categories of personal data for this purpose:

Airline partner number and name

We rely on the following legal bases to process personal data:

Contract

Qualifications & exceptions

The contract is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: enabling parking at properties — data category and legal basis

For the purpose of enabling parking at Hilton properties, the Türkiye appendix states that Hilton collected vehicle information, and that the legal basis is legitimate interests. The same data category is listed for the safety and security purpose.

Supporting quotations

Enable parking at properties

We collected the following categories of personal data for this purpose:

Vehicle information

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: enabling safety and security — data category and legal basis

For the purpose of enabling safety and security, the Türkiye appendix states that Hilton collected vehicle information, and that the legal basis is legitimate interests.

Supporting quotations

Enable safety and security

We collected the following categories of personal data for this purpose:

Vehicle information

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: protecting people on property — data category and legal basis

For the purpose of protecting people on property, the Türkiye appendix states that Hilton collected images or footage captured by closed circuit television, and that the legal basis is legitimate interests.

Supporting quotations

Protect people on property

We collected the following categories of personal data for this purpose:

Images or footage captured by closed circuit television

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: supporting internal and external promotions — data category and legal basis

For the purpose of supporting internal and external promotions, the Türkiye appendix states that Hilton collected promotional images or footage captured by on-property photographers, and that consent is the legal basis relied on. This is the only listed purpose whose data is captured by photographers and whose sole basis is consent.

Supporting quotations

Support internal and external promotions

We collected the following categories of personal data for this purpose:

Promotional images or footage captured by on-property photographers

We rely on the following legal bases to process personal data:

Consent

Qualifications & exceptions

Consent is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: supporting marketing efforts — data categories and legal bases

For the purpose of supporting marketing efforts, the Türkiye appendix states that Hilton collected booking engine data, whether the person has a Hilton and American Express co-branded credit card, whether their Hilton and Amazon and Hilton and Lyft accounts are linked, and spending amount, and that the legal bases are legitimate interests and consent.

Supporting quotations

Support marketing efforts

We collected the following categories of personal data for this purpose:

Booking engine

Whether you have a Hilton and American Express Co-Branded Credit Card

Whether your Hilton and Amazon accounts are linked

Whether your Hilton and Lyft accounts are linked

Spending amount

We rely on the following legal bases to process personal data:

Legitimate interests

Consent

Qualifications & exceptions

Two legal bases are listed: legitimate interests and consent.

Legal Rights & Agreement Rules · Company practice

Türkiye: solving website issues — data categories and legal basis

For the purpose of solving website issues, the Türkiye appendix states that Hilton collected IP addresses, customer ratings and survey responses, and free form textual feedback, and that the legal basis is legitimate interests.

Supporting quotations

Solve website issues

We collected the following categories of personal data for this purpose:

IP addresses

Customer ratings and survey responses

Free form textual feedback

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: showing targeted advertisements on media — data categories and legal bases

For the purpose of showing targeted advertisements on media, the Türkiye appendix states that Hilton collected booking engine data, whether the person has a Hilton and American Express co-branded credit card, and whether their Hilton and Amazon and Hilton and Lyft accounts are linked, and that the legal bases are legitimate interests and consent.

Supporting quotations

Show targeted advertisements on media

We collected the following categories of personal data for this purpose:

Booking engine

Whether you have a Hilton and American Express Co-Branded Credit Card

Whether your Hilton and Amazon accounts are linked

Whether your Hilton and Lyft accounts are linked

We rely on the following legal bases to process personal data:

Legitimate interests

Consent

Qualifications & exceptions

Two legal bases are listed: legitimate interests and consent.

Legal Rights & Agreement Rules · Company practice

Türkiye: evaluating streaming service use — data category and legal basis

For the purpose of evaluating streaming service use, the Türkiye appendix states that Hilton collected streaming service usages, including the service used, hours of use, launch method and logout method, and that the legal basis is legitimate interests.

Supporting quotations

Evaluate streaming services use

We collected the following categories of personal data for this purpose:

Streaming service usages (including service used, hours of use, launch method, and logout method)

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: co-branded card benefits — data category and legal basis

For the purpose of providing co-branded card benefits, the Türkiye appendix states that Hilton collected whether the person has a Hilton and American Express co-branded credit card, and that the legal basis is the contract. The data collected is the fact of holding the card, not the card details.

Supporting quotations

Provide co-branded card benefits

We collected the following categories of personal data for this purpose:

Whether you have a Hilton and American Express Co-Branded Credit Card

We rely on the following legal bases to process personal data:

Contract

Qualifications & exceptions

The contract is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: Amazon's Shop with Points — data category and legal basis

For the purpose of facilitating Amazon's Shop with Points, the Türkiye appendix states that Hilton collected whether the person's Hilton and Amazon accounts are linked, and that the legal basis is the contract.

Supporting quotations

Facilitate Amazon's Shop with Points

We collected the following categories of personal data for this purpose:

Whether your Hilton and Amazon accounts are linked

We rely on the following legal bases to process personal data:

Contract

Qualifications & exceptions

The contract is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: access to hotel room and facilities — data category and legal basis

For the purpose of enabling access to the hotel room and facilities, the Türkiye appendix states that Hilton collected geolocation information, and that the legal basis is legitimate interests.

Supporting quotations

Enable access to hotel room and facilities

We collected the following categories of personal data for this purpose:

Geolocation information

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: responding to service concerns — the data category collected

For the purpose of responding to service concerns, the Türkiye appendix states that Hilton collected social media information and publicly available online information, including through social media platforms. The legal bases for this purpose are set out in the following part of the appendix.

Supporting quotations

Respond to service concerns

We collected the following categories of personal data for this purpose:

Social media information; publicly available online information (including through social media platforms)

Qualifications & exceptions

Only the data category is stated in this part; the legal bases are listed in the next part of the appendix.

Legal Rights & Agreement Rules · Company practice

Türkiye: legal bases for responding to service concerns are legitimate interests and consent

The Türkiye appendix gives two legal bases for processing the social media information and publicly available online information collected to respond to service concerns: legitimate interests and consent.

Supporting quotations

We rely on the following legal bases to process personal data:

Legitimate interests

Consent

Qualifications & exceptions

Two legal bases are listed: legitimate interests and consent.

Legal Rights & Agreement Rules · Company practice

Türkiye: providing a personalized experience — data category and legal basis

For the purpose of providing a personalized experience, the Türkiye appendix states that Hilton collected social media information and publicly available online information, including through social media platforms, and that the legal basis is legitimate interests. The same data category is listed for responding to service concerns, where the bases are legitimate interests and consent.

Supporting quotations

Provide personalized experience

We collected the following categories of personal data for this purpose:

Social media information; publicly available online information (including through social media platforms)

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: sending requested communications — data category and legal basis

For the purpose of sending requested communications, the Türkiye appendix states that Hilton collected MyWay preferences, and that consent is the legal basis relied on. The data is the member's recorded communication preferences rather than contact details.

Supporting quotations

Send requested communications

We collected the following categories of personal data for this purpose:

MyWay preferences

We rely on the following legal bases to process personal data:

Consent

Qualifications & exceptions

Consent is the only legal basis listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Türkiye: responding to safety and security concerns — data categories and legal basis

For the purpose of responding to safety and security concerns, the Türkiye appendix states that Hilton collected descriptions of incidents at a Hilton property or involving a Hilton employee, including safety and security incidents and violations of law, applicable policy or contractual obligation, descriptions of complaints including free form textual feedback from Hilton Honors members, and spa and wellness service or treatment details, and that the legal basis is legitimate interests. The same three categories are listed for the separate compliance purpose, on the basis of legal obligations.

Supporting quotations

Respond to safety and security concerns

We collected the following categories of personal data for this purpose:

Description of an incident that occurs at a Hilton property or involves a Hilton employee, including incidents related to safety and security, and violation of law, applicable policy, or contractual obligation

Description of a complaint that you make to us, including your free form textual feedback if you are a Hilton Honors member

Spa and wellness service or treatment details (such as date, time, and type of service)

We rely on the following legal bases to process personal data:

Legitimate interests

Qualifications & exceptions

Legitimate interests is the only legal basis listed for this purpose.
The complaint description is included only where the person is a Hilton Honors member.

Legal Rights & Agreement Rules · Company practice

Türkiye: complying with legal or contractual obligations — data categories and legal basis

For the purpose of complying with legal or contractual obligations, the Türkiye appendix states that Hilton collected descriptions of incidents at a Hilton property or involving a Hilton employee, descriptions of complaints including free form textual feedback from Hilton Honors members, and spa and wellness service or treatment details, and that the legal basis is legal obligations. The same three categories are listed for the safety and security purpose, on the basis of legitimate interests.

Supporting quotations

Comply with legal or contractual obligations

We collected the following categories of personal data for this purpose:

Description of an incident that occurs at a Hilton property or involves a Hilton employee, including incidents related to safety and security, and violation of law, applicable policy, or contractual obligation

Description of a complaint that you make to us, including your free form textual feedback if you are a Hilton Honors member

Spa and wellness service or treatment details (such as date, time, and type of service)

We rely on the following legal bases to process personal data:

Legal obligations

Qualifications & exceptions

Legal obligations is the only legal basis listed for this purpose.
The complaint description is included only where the person is a Hilton Honors member.

Legal Rights & Agreement Rules · User right or choice

Türkiye: rights under Article 11, and the thirty-day response with a possible fee

The Türkiye appendix states that the person has rights under Article 11 of the Data Protection Law and may exercise them by contacting the Data Protection Office by email or post. It says requests found in the application will be resolved as soon as possible according to the nature of the request and within thirty days at the latest and free of charge, but that if a request incurs additional cost to Hilton, the person may be charged over the tariff fee determined by the Turkish Personal Data Protection Board. The appendix cites Article 11 without reproducing the law.

Supporting quotations

Your rights. You have the rights under Article 11 of the Data Protection Law and may exercise your rights by contacting us at: DataProtectionOffice@hilton.com

The requests found in your application will be resolved as soon as possible according to the nature of your request and within thirty days at the latest free of charge.

if your request incurs additional cost to our company, then you may be charged over the tariff fee determined by the Turkish Personal Data Protection Board.

Qualifications & exceptions

The response is due within thirty days at the latest and free of charge, unless the request incurs additional cost.
The possible charge is at the tariff fee set by the Turkish Personal Data Protection Board.
The article number is cited; the appendix does not set out the law's terms.

Legal Rights & Agreement Rules · Restriction or exception

Türkiye: two sentences of the main Statement do not apply in Türkiye

The Türkiye appendix lists two passages of the Global Privacy Statement that do not apply to individuals in Türkiye. The first is the sentence in the second paragraph of the Introduction, under which a person acknowledges that Hilton will collect and use personal information as described in the Statement by using its products or services or agreeing to the Statement. The second is the sentence in the International Personal Data Transfers section, under which a person acknowledges that Hilton may share personal information among Portfolio members, service providers and other third parties which may be located outside their own country. In Türkiye, the cross-border position is instead handled by the separate consent practice described later in the appendix.

Supporting quotations

Amendments. The following sections of the Global Privacy Statement do not apply to individuals in Türkiye:

The following sentence at the second paragraph: By using any of our products or services and/or by agreeing to this Statement, e.g., in the context of registering for any of our products or services, you understand and acknowledge that we will collect and use personal information as described in this Statement.

The following sentence in the International Personal Data Transfers section: To provide this service, you acknowledge that we may share your personal information among members of the Hilton Portfolio of Brands, our service providers, and other third parties, which may be located in countries outside of your own.

Qualifications & exceptions

The exclusions are limited to the two quoted sentences.
The International Data Transfers acknowledgement sentence is replaced by the appendix's own consent practice.

Legal Rights & Agreement Rules · Context

Türkiye: the Turkish version prevails over the English version

The Türkiye appendix states that the Statement is available in English and Turkish, and that if there is any inconsistency or different interpretation between the two versions, the Turkish text shall prevail. The analysed source is the English text, so the English wording may differ from the governing Turkish wording.

Supporting quotations

Language. This Statement is available in English and Turkish. If there is any inconsistency or different interpretation between the English and Turkish versions, the Turkish text shall prevail.

Qualifications & exceptions

The Turkish text prevails over the English text in case of inconsistency or different interpretation.
The source analysed here is the English version.

Legal Rights & Agreement Rules · Context

China appendix: who it covers, and that it prevails over the main body on conflict

The China appendix says it applies to individuals who reside in the People's Republic of China — for the purposes of the Statement excluding Hong Kong SAR, Macau SAR and Taiwan, referred to as China — and to citizens of the People's Republic of China, and that it introduces how Hilton collects, uses, discloses and otherwise processes their personal information, including sensitive personal information where applicable. It states that the appendix does not replace the main body but supplements it and should be read with the main body and Appendix A as applicable, and that in the event of any conflict or inconsistency the China appendix prevails.

Supporting quotations

Appendix A-6: China Residents

1. Introduction

For individuals who reside in the People's Republic of China (for the purposes of this Privacy Statement, excluding Hong Kong Special Administrative Region, Macau Special Administrative Region and Taiwan) ("China") or citizens of the People's Republic of China

in this Appendix, we provide you with an introduction to how Hilton collects, uses, discloses, and otherwise processes your personal information (including sensitive personal information, where applicable) that we receive or collect from you.

This Appendix does not replace the main body of this Statement, but supplements the main body of this Statement, and should be read together with the main body and Appendix A, as applicable.

In the event of any conflict or inconsistency between this Appendix and the main body of this statement, this Appendix shall prevail.

Qualifications & exceptions

Hong Kong SAR, Macau SAR and Taiwan are excluded from the definition of China used in the appendix.
The appendix prevails over the main body in case of conflict or inconsistency.
It supplements rather than replaces the main body.

Legal Rights & Agreement Rules · Context

China: the meaning of personal information and sensitive personal information, and the strict-necessity limit

The China appendix states that 'Personal Information' and 'Sensitive personal information' have the same meaning as defined in the Personal Information Protection Law of the People's Republic of China, as revised from time to time, and that personal information can be recorded electronically or otherwise and can identify the identity or reflect the activity of a specific natural person alone or in combination with other information. It says the sensitive personal information involved in the Statement may include passport or ID card information, payment card information, spending amount, accommodation information such as arrival and departure time, interaction with Hilton websites, and precise positioning information, and that Hilton processes it only where strictly necessary for the relevant purposes identified in the collection section of the main body, adhering to the safeguards mandated by applicable laws and regulations. It warns that such processing may have impacts including potential harm to reputation, property or personal safety in the event of a data breach, and records the person's agreement that the sensitive personal information will be processed in accordance with the purposes and methods set out in the Statement.

Supporting quotations

“Personal Information” shall have the same meaning as defined in the Personal Information Protection Law of the People's Republic of China (as revised from time to time).

The sensitive personal information involved in this Statement may include passport or ID card information, payment card information, spending amount, accommodation information (such as arrival and departure time), interaction with Hilton websites, and precise positioning information.

We only process your sensitive personal information where such processing is strictly necessary for the relevant purposes identified in the Personal Information We Collect

such processing may result in various impacts, including potential harm to your reputation, property, or personal safety in the event of a data breach.

You agree that the sensitive personal information will be processed in accordance with the purposes and methods set forth in this Statement.

Qualifications & exceptions

The definitions are those of the Chinese Personal Information Protection Law, which the appendix does not reproduce.
Sensitive personal information is processed only where strictly necessary for the relevant purposes.
The data-breach impact is stated as a possible outcome, including harm to reputation, property or personal safety.
The person's agreement is recorded for processing the sensitive personal information on the Statement's purposes and methods.

Legal Rights & Agreement Rules · Restriction or exception

China: no knowing collection or disclosure from children under 14

The China appendix states that Hilton will not knowingly collect or disclose personal information from minors under the age of 14, and that when it collects personal information from an individual under the age of 14 it needs to obtain consent from their parent or guardian and will process that information in accordance with the safeguards set out in applicable laws and regulations. This is a China-specific threshold; the main body of the Statement uses the age of majority in the person's own jurisdiction instead.

Supporting quotations

Hilton will not knowingly collect or disclose personal information from minors under the age of 14.

When we collect personal information from an individual under the age of 14, we need to obtain consent from their parent or guardian, and we will process such information in accordance with the safeguards set out in applicable laws and regulations.

Qualifications & exceptions

The threshold is 14 and applies to knowing collection or disclosure.
Parent or guardian consent is required, and the safeguards of applicable laws and regulations apply.

Legal Rights & Agreement Rules · User right or choice

China: rights over personal information and the 15-day deregistration response

The China appendix states that the person has the right to access, correct and, in certain circumstances, delete their personal information, to withdraw consent to Hilton's processing, to deregister their membership account if any, to object to the use of their personal information in automated decision making, and to make complaints about how Hilton processes their personal information, and that they may have other rights under other applicable laws. It says Hilton seeks to handle these requests within the legally required period, and in particular will respond to a deregistration request within 15 days of receipt, unless there are extenuating circumstances, in which case it will inform the person of the anticipated timeline. It notes that after deregistration the person can no longer enjoy membership benefits, and that the personal information will be deleted or anonymized unless the applicable laws require retention.

Supporting quotations

6. Changing and Accessing Your Personal Information, and Deregistration of Accounts

You have the right to access, correct and/or (in certain circumstances) delete your personal information, withdraw consent to our processing of your personal information, deregister your membership account (if any), object to the use of your personal information in automated decision making and make complaints about how we process your personal information.

we will respond to your request to deregister within 15 days of our receipt of the request, unless there are extenuating circumstances, in which we will inform you of the anticipated timeline if we expect our response to take longer than 15 days.

if you request to deregister your membership account, you will no longer be able to enjoy any membership benefits from the date of deregistration.

After you deregistered your membership account, your personal information will be deleted or anonymized unless the applicable laws require us to retain this information.

Qualifications & exceptions

Deletion is available only 'in certain circumstances'.
The 15-day response applies to deregistration requests and may be extended in extenuating circumstances.
Membership benefits end from the date of deregistration, and information is deleted or anonymized unless retention is required.

Legal Rights & Agreement Rules · Company practice

China: publication of material changes, and notice or consent where local law requires

The China appendix says that if Hilton makes material changes to the Statement it will publish them, referring to the main body's Changes to Statement section for more information, and that if required by local laws it will notify the person and/or seek their consent.

Supporting quotations

10. Changes to This Statement

If we make material changes to this Statement, we will publish these changes.

If required by the local laws, we will notify you and/or seek your consent.

Qualifications & exceptions

Notification and consent are conditional on what local law requires.
The publication commitment is stated for material changes.

Legal Rights & Agreement Rules · Context

China: contact the Data Protection Office or the China privacy contact

Section 11 of the China appendix states that a person can contact Hilton for questions, requests or complaints regarding the protection of personal information, giving the Data Protection Office email address and, for contact in China, a separate China privacy email address. This is the section 11 that the China appendix's own rights passage points to.

Supporting quotations

11. Contact Information for Questions or Concerns

You can contact us if you have any questions, requests, or complaints regarding the protection of personal information.

or, if you would like to get in touch with the contact in China, please contact: China_Privacy@hilton.com

Qualifications & exceptions

A China-specific contact address is given in addition to the Data Protection Office.

Legal Rights & Agreement Rules · Context

Brazil: the LGPD appendix applies to people in Brazil, and leaves the rest of the Statement in force

The Brazil appendix says that to the extent a person is located in Brazil or is in any form subject to the Brazilian General Data Protection Law, Federal Law nº 13709/18, referred to as the LGPD, the provisions it indicates should be read and applied to the processing of the person's personal data accordingly. Unless stated otherwise in that appendix, the remainder of the Policy, including Appendix A as applicable, does not vary and remains in full force and effect.

Supporting quotations

Appendix A-7: Brazil Residents

To the extent you are located within Brazil or are in any form subject to the Brazilian General Data Protection Law – Federal Law nº 13709/18 (“LGPD”), the provisions indicated below should be read and applied to the processing of your personal data accordingly.

Unless stated otherwise in this Appendix, the remainder of the Policy, including Appendix A as applicable, shall not vary and shall remain in full force and effect.

Qualifications & exceptions

The appendix applies to people located in Brazil and to anyone subject to the LGPD in any form.
Unless the appendix says otherwise, the rest of the Statement is unchanged.

Legal Rights & Agreement Rules · User right or choice

Brazil: the data subject rights under the LGPD

The Brazil appendix says that under certain circumstances a person has the following rights under the LGPD in relation to their personal data: the right to information, meaning clear, transparent and understandable information on how Hilton uses the data; the right of confirmation and access; the right of rectification, where the data is outdated, inaccurate or incorrect or needs completing; the right of anonymization, blocking or deletion of any unnecessary or excessive data or data processed in non-compliance with applicable law; the right to withdraw consent at any time for consent-based processing; the right to data portability, to copy or transfer the data to another database in accordance with further regulation of the local authority; the right to receive information about the public and private entities with which the data is shared; the right to object to processing based on a legal basis other than consent where the LGPD is violated; the right to review decisions based solely on automated processing, reviewed by a natural person, where they affect the person's interests; and the right to file a complaint with the local data protection authority or consumer protection entities. The rights are stated to apply 'under certain circumstances'.

Supporting quotations

1. Data Subjects Rights

Under certain circumstances, you have the following rights under the LGPD in relation to your personal data:

Right to Information: right to obtain clear, transparent and understandable information on how we use your personal data;

Right of confirmation and access: right to receive confirmation and access your personal data held by us about you;

Right of rectification: right to have your personal data corrected if they are outdated, inaccurate or incorrect and/or to complete them;

Right of anonymization, blocking or deletion: Anonymize, block or eliminate any unnecessary or excessive data or data processed in noncompliance with the applicable law;

Right to withdraw consent at any time for consent-based data processing: right to withdraw your consent to the processing of your personal data when such processing is based on consent;

Right to data portability: right to request copying, transferring your personal data to another database in accordance with further regulation of the local authority;

Right to receive information about public and privacy entities: right to receive information about public and private entities with which your personal data is shared;

Right to object: right to oppose any processing activity based on a legal basis other than consent in case there is violation of the LGPD;

Right to review automated decisions: right to review of decisions, whenever they are based only on automated processing of personal data, by a natural person, whenever it affects your interests;

Right to file a complaint with your local Data Protection Authority or consumer protection entities.

Qualifications & exceptions

The rights are stated to apply only under certain circumstances.
Data portability is subject to further regulation of the local authority.
The right to review automated decisions requires review by a natural person and applies where the decision affects the person's interests.

Legal Rights & Agreement Rules · Company practice

Brazil: the legal bases relied on under Article 7 of the LGPD

The Brazil appendix says Hilton usually relies on one of the following legal bases when processing personal data for the purposes indicated in the Statement, in accordance with Article 7 of the LGPD: the data subject's consent; compliance with a legal or regulatory obligation; performance of a contract or preliminary procedures relating to a contract to which the data subject is a party; and the legitimate interests of the controller or of third parties, except where the fundamental rights of the data subject prevail. It adds that other legal bases set out in the LGPD may apply depending on the concrete situation. The article numbers are cited; the appendix does not reproduce the law.

Supporting quotations

2. Legal Bases

Hilton usually relies on one of the following legal bases when processing your personal data for the purposes indicated in the Global Privacy Statement in accordance with Article 7 of the LGPD:

Data subject’s consent (art. 7, I);

For compliance of a legal or regulatory obligation (Article 7, II);

Whenever necessary for the performance of a contract or preliminary procedures relating to contracts in which the data subject is a party (Article 7, V);

Whenever necessary for the legitimate interests of the controller or of third parties, except in the prevalence of fundamental rights of the data subject (Article 7, IX).

However, depending on the concrete situation, other legal bases set forth in the LGPD may apply.

Qualifications & exceptions

The bases are those Hilton 'usually' relies on; other LGPD bases may apply in a particular situation.
The legitimate-interest basis is qualified by the fundamental rights of the data subject prevailing.

Legal Rights & Agreement Rules · Context

Monaco: the appendix for data subjects in the Principality, controlling over the main body on conflict

The Monaco appendix says that for data subjects in the Principality of Monaco it outlines certain additional information Hilton is obliged to provide and certain rights they have with respect to the processing of their personal data, pursuant to applicable local laws, and that it controls to the extent it conflicts with any provision in the main body of the Statement or in Appendix A.

Supporting quotations

Appendix A-8: Monaco Residents

For data subjects in the Principality of Monaco, this Appendix outlines certain additional information that Hilton is obligated to provide to you, as well as certain rights you have with respect to the processing of your personal data, pursuant to applicable local laws.

This Appendix will control to the extent it conflicts with any provision in the main body of this Statement or Appendix A, as applicable.

Qualifications & exceptions

The appendix controls over the main body and Appendix A where they conflict.

Legal Rights & Agreement Rules · Company practice

Monaco: legal bases under Act No. 1.054

The Monaco appendix states that Hilton relies on legal bases while processing personal data for the purposes indicated in the main body of the Global Privacy Statement, in accordance with Act No. 1.054 on the Protection of Personal Data. The appendix names the act and does not set out its terms or the specific bases relied on.

Supporting quotations

1. Legal Bases for the Processing Of Your Personal Data

Hilton relies on legal bases while processing your personal data for the purposes indicated in the main body of the Global Privacy Statement in accordance with Act No. 1.054 on the Protection of Personal Data ("Act No. 1.054").

Qualifications & exceptions

The act is cited but the specific bases are not listed in this section.

Legal Rights & Agreement Rules · User right or choice

Monaco: rights under Act No. 1.054 and the route to the Personal Data Protection Authority

The Monaco appendix states that, in accordance with Act No. 1.054, the person has rights of access to, and of rectification, erasure and portability of, their personal data, as well as rights to object to and restrict its processing, and that with proof of identity they may exercise these rights by contacting the Data Protection Office by email. It adds that if, after contacting the DPO, the person does not feel their rights have been observed, they may make a claim with the Personal Data Protection Authority.

Supporting quotations

2. Personal Data Access and Customer Rights

you have a right of access to and a right to the rectification, erasure and portability of your personal data as well as a right to object and restrict the processing of this personal data.

With proof of your identity, you may exercise your rights by contacting the Data Protection Office ("DPO") by email at DataProtectionOffice@hilton.com

If, after contacting the DPO, you do not feel that your rights have been observed, you may make a claim with the Personal Data Protection Authority ("APDP")

Qualifications & exceptions

Proof of identity is required to exercise the rights.
The authority complaint is the step after contacting the Data Protection Office.

Legal Rights & Agreement Rules · Context

Monaco: the English text prevails over the French text

The Monaco appendix states that the statement is available in English and French, and that if there is any inconsistency or different interpretation between the English and French versions, the English text prevails. The source analysed here is that English text.

Supporting quotations

5. Language

This statement is available in English and French. If there is any inconsistency or different interpretation between the English and French versions, the English text shall prevail.

Qualifications & exceptions

The English text prevails over the French text in case of inconsistency or different interpretation.

Legal Rights & Agreement Rules · Context

Nigeria: the NDPA appendix applies to people in Nigeria and controls over the main body

The Nigeria appendix says that to the extent a person is located in Nigeria or is in any form subject to the Nigeria Data Protection Act 2023, referred to as the NDPA, the provisions it indicates should be read and applied to the processing of their personal information accordingly, and that the appendix controls to the extent it conflicts with any provision in the main body of the Statement or in Appendix A.

Supporting quotations

Appendix A-9: Nigeria Residents

To the extent you are located within Nigeria or are in any form subject to the Nigeria Data Protection Act 2023 (NDPA), the provisions indicated below should be read and applied to the processing or your personal information accordingly.

This Appendix will control to the extent it conflicts with any provision in the main body of this Statement or Appendix A, as applicable.

Qualifications & exceptions

The appendix applies to people located in Nigeria and to anyone subject to the NDPA in any form.
The appendix controls over the main body and Appendix A where they conflict.

Legal Rights & Agreement Rules · Company practice

Nigeria: the legal grounds relied on under the NDPA

The Nigeria appendix says that in accordance with the NDPA, Hilton processes personal information for the purposes indicated in the Global Privacy Statement on the following legal grounds: consent, where the person has given explicit consent for specific processing activities; contractual necessity, to fulfil obligations under a contract with the person such as processing reservations and providing requested services; legal obligation, to comply with applicable Nigerian laws and regulatory requirements; and legitimate interests, to pursue Hilton's legitimate business interests, provided that such processing does not override the person's fundamental rights and freedoms.

Supporting quotations

1. Legal Basis for Processing

In accordance with the NDPA, we process your personal information for the purposes indicated in the Global Privacy Statement based on the following legal grounds:

Consent: Where you have provided explicit consent for specific processing activities.

Contractual Necessity: To fulfill our obligations under a contract with you, such as processing reservations and providing requested services.

Legal Obligation: To comply with applicable Nigerian laws and regulatory requirements.

Legitimate Interests: To pursue our legitimate business interests, provided that such processing does not override your fundamental rights and freedoms.

Qualifications & exceptions

The legitimate-interest ground is qualified by the person's fundamental rights and freedoms.
The contractual ground is illustrated with reservations and requested services.

Legal Rights & Agreement Rules · User right or choice

Nigeria: the rights of Nigerian data subjects

The Nigeria appendix says that as a resident of Nigeria the person is entitled to the following rights under the NDPA: to access, meaning confirmation of whether their personal information is being processed and access to it; to rectification of inaccurate or incomplete information; to erasure, which may be requested in certain circumstances such as when the data is no longer necessary for the purposes collected; to restrict processing in specific situations; to data portability, meaning receiving the information in a structured, commonly used and machine-readable format and transmitting it to another data controller; to object to processing based on legitimate interests or for direct marketing; to withdraw consent at any time without affecting the lawfulness of processing before withdrawal; and to lodge complaints with the Nigeria Data Protection Commission.

Supporting quotations

2. Rights of Nigerian Data Subjects

As a resident of Nigeria, you are entitled to the following rights under the NDPA:

Right to Access: You may request confirmation as to whether your personal information is being processed and, if so, access to that information.

Right to Rectification: You have the right to request the correction of inaccurate or incomplete personal information.

Right to Erasure: You can request the deletion of your personal information under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.

Right to Restrict Processing: You may request that we limit the processing of your personal information in specific situations.

Right to Data Portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit that data to another data controller.

Right to Object: You can object to the processing of your personal information based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent: If processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Right to Lodge Complaint: You have a right to lodge complaints with the Nigeria Data Protection Commission (NDPC).

Qualifications & exceptions

Erasure is available only in certain circumstances, with an example given.
Restriction is available in specific situations.
Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Legal Rights & Agreement Rules · Context

Nigeria: contact the Data Protection Office for questions under Nigerian law

The Nigeria appendix says that a person with questions, concerns or requests regarding the processing of their personal information under Nigerian law should contact Hilton's Data Protection Office, giving the email address DataProtectionOffice@hilton.com, and adds that Hilton is committed to addressing inquiries promptly and in accordance with the NDPA. The appendix does not give a Nigerian postal address or telephone number for the office.

Supporting quotations

7. Contact Information

If you have any questions, concerns, or requests regarding the processing of your personal information under Nigerian law, please contact our Data Protection Office at:

Email: DataProtectionOffice@hilton.com

We are committed to addressing your inquiries promptly and in accordance with the NDPA.

Qualifications & exceptions

Only an email address is given in this appendix.
The commitment is to addressing inquiries promptly and in accordance with the NDPA.

Legal Rights & Agreement Rules · Company practice

Nigeria: how changes to the Statement are published and take effect

The Nigeria appendix says Hilton may modify the Statement from time to time, that when it makes material changes it will post a link to the revised Statement on the homepage of its site, that the date at the top of the Statement shows when it was last updated, and that any changes become effective upon posting of the revised Statement on the site. Unlike the Türkiye and China appendices, this section states no consent or notification requirement.

Supporting quotations

8. Changes to this Statement

We may modify this Statement from time to time.

When we make material changes to this Statement we will post a link to the revised Statement on the homepage of our site.

Any changes to our Statement will become effective upon posting of the revised Statement on the site.

Qualifications & exceptions

Material changes are signalled by a link on the site homepage.
Changes take effect on posting.

Legal Rights & Agreement Rules · Context

Korea: PIPA compliance, the published processing policy, and the appendix's priority

The Korea appendix says Hilton complies with the Personal Information Protection Act (PIPA) and other applicable laws to protect the freedom and rights of data subjects, handles personal information lawfully and manages it safely, and — in accordance with Article 30 of the PIPA — establishes and discloses the personal information processing policy set out in the appendix to guide data subjects on the procedures and standards for processing and protection and to ensure grievances are promptly and accurately resolved. The appendix controls to the extent it conflicts with the main body or Appendix A, and it applies to the extent the person is located in South Korea or is in any form subject to the PIPA.

Supporting quotations

Appendix A-10: Korea Privacy Policy

Hilton complies with the Personal Information Protection Act (PIPA) and other applicable laws to protect the freedom and the rights of data subjects, and handles personal information in a lawful manner and manages it safely.

In accordance with Article 30 of the PIPA, we establish and disclose the following personal information processing policy to guide data subjects on the procedures and standards for the processing and protection of personal information, and to ensure that grievances are promptly and accurately resolved.

This Appendix will control to the extent it conflicts with any provision in the main body of this Statement or Appendix A, as applicable.

To the extent you are located in South Korea or is any form subject to the PIPA, the provisions below should be read and applied to the processing of personal information accordingly.

Qualifications & exceptions

The processing policy is stated to be published under Article 30 of the PIPA.
The appendix controls over the main body and Appendix A where they conflict.
The Korea rules are stated to apply to people located in South Korea and those subject to the PIPA in any form.

Legal Rights & Agreement Rules · Context

Korea: the domestic local representative for information and communication services

The Korea appendix states that, in accordance with Article 32-5 of the Information and Communications Network Act, a domestic representative — a local person in charge of information and communication services — is designated, and that a person in Korea may contact the local agent by phone, email or mail to handle questions and complaints about the processing of their personal data. The local agent given is Jung Byung-hyuk (Brad Jeong), Managing Director of Conrad Seoul, with a telephone number in Seoul, a email address and a Seoul address.

Supporting quotations

Contact Information: In accordance with Article 32-5 of the Information and Communications Network Act, A domestic representative (local person) in charge of information and communication services is designated as follows:

Local Representative Agent: You may contact our Local Agent below by phone, email or mail to handle questions and complaints in connection with the processing of your personal data if you are in Korea.

Local Agent: Jung Byung-hyuk (Brad Jeong), Managing Director, Conrad Seoul

Telephone: 02-6137-7600

Email: Brad.jeong@conradhotels.com

Address: 10 Gukjegeumyuong-ro Yeouido, Seoul, 07326, South Korea

Qualifications & exceptions

The designation is made under Article 32-5 of the Information and Communications Network Act.
The local agent handles questions and complaints for people in Korea.

Legal Rights & Agreement Rules · Context

Korea: the Data Protection Office contact details and the rights portal

The Korea appendix says a person may also contact Hilton's Data Protection Office, giving a telephone number, the email address DataProtectionOffice@hilton.com, the address 7930 Jones Branch Drive, McLean, VA 22102 USA, and the Data Subject Rights Requests Portal at datarights.hilton.com. These are the same United States contact details given in the main body of the Statement.

Supporting quotations

Data Protection Office: You may also contact Hilton’s Data Protection Office.

Telephone: 070-4732-6767

Email: DataProtectionOffice@hilton.com

Address: 7930 Jones Branch Drive, McLean, VA 22102 USA

Data Subject Rights Portal at datarights.hilton.com

Qualifications & exceptions

The contact point is a United States office, with a South Korean local agent given separately.

Legal Rights & Agreement Rules · Company practice

Korea: processing on consent or as the PIPA permits, and no knowing collection from under-14s

The Korea appendix says Hilton will use personal information with the person's consent or as permitted by the PIPA, and that if it wants to use it for other purposes it will obtain consent unless the new use is permitted by applicable law. It also states that Hilton does not knowingly collect, disclose or sell personal information of minors under the age of 14.

Supporting quotations

1. Processing and Retention of Personal Information

We will use your personal information with your consent or as permitted by the PIPA.

If we want to use your personal information for other purposes, we will obtain your consent unless the new use is permitted by applicable law.

Hilton does not knowingly collect, disclose, or sell personal information of minors under the age of 14.

Qualifications & exceptions

Further use needs consent only where the new use is not permitted by applicable law.
The under-14 rule is stated as a knowledge-qualified prohibition on collection, disclosure and sale.

Legal Rights & Agreement Rules · Company practice

Korea: personalization analytics — legal basis, sources and first items processed

For the processing purpose of performing analytics in order to provide guests with personalized offers and content, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the items of personal information processed as name, Hilton Honors number, home address, preferred language and room preference.

Supporting quotations

Perform analytics in order to provide guests with personalized offers and content

Legal Basis

Article 15(1)(1) (Consent) of the PIPA)

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

From demographics companies

Items of Personal Information Processed

Name

Hilton Honors number

Home address

Preferred language

Room preference

Qualifications & exceptions

The legal basis is consent under Article 15(1)(1) of the PIPA.
Three sources are named, two of them indirect.

Legal Rights & Agreement Rules · Company practice

Korea: personalization analytics — online activity, device and demographic items processed

The remainder of the items processed for the personalization analytics purpose in the Korea appendix are internet or other electronic network activity information, including information on the customer's interaction with Hilton websites, applications or advertisements, IP addresses, session IDs, device information including MAC addresses, social media information and publicly available online information including through social media platforms, and demographic data.

Supporting quotations

Internet or other electronic network activity information, including information regarding a customer’s interaction with Hilton websites, applications, or advertisements

IP addresses

Session IDs

Device information (including MAC addresses)

Social media information; publicly available online information (including through social media platforms)

Demographic data

Qualifications & exceptions

The items include online activity, device identifiers and data from publicly available online sources.

Legal Rights & Agreement Rules · Company practice

Korea: administering contests and sweepstakes — legal basis, sources and items processed

For the processing purpose of administering contests and sweepstakes, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers themselves, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the items of personal information processed as name, email address, home address and Hilton Honors number.

Supporting quotations

Administer contests and sweepstakes

Legal Basis

Article 15(1)(1) (Consent) of the PIPA)

Source

Directly from consumers themselves

From third parties such as travel booking platforms and credit card providers

From demographics companies

Items of Personal Information Processed

Name

Email address

Home address

Hilton Honors number

Qualifications & exceptions

The legal basis is consent under Article 15(1)(1) of the PIPA.
Telephone numbers are not among the items listed for this purpose.

Legal Rights & Agreement Rules · Company practice

Korea: business analytics — legal basis, sources and first items processed

For the processing purpose of performing analytics to improve business operations, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the items of personal information processed as name, home address, Hilton Honors number, room preference and internet or other electronic network activity information.

Supporting quotations

Perform analytics to improve business operations

Legal Basis

Article 15(1)(6) Legitimate Interest

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

From demographics companies

Items of Personal Information Processed

Name

Home address

Hilton Honors number

Room preference

Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements

Qualifications & exceptions

The legal basis is legitimate interest under Article 15(1)(6) of the PIPA, in contrast to consent for the personalization analytics purpose.

Legal Rights & Agreement Rules · Company practice

Korea: business analytics — remaining items processed

The remaining items of personal information processed for the business analytics purpose in the Korea appendix are IP addresses, session IDs, booking engine data, whether the person has a Hilton and American Express co-branded credit card, whether their Hilton and Amazon accounts are linked, whether their Hilton and Lyft accounts are linked, and spending amount.

Supporting quotations

IP addresses

Session IDs

Booking engine

Whether you have a Hilton and American Express Co-Branded Credit Card

Whether your Hilton and Amazon accounts are linked

Whether your Hilton and Lyft accounts are linked

Spending amount

Qualifications & exceptions

The items include spending amount and the partner account indicators.

Legal Rights & Agreement Rules · Company practice

Korea: eligibility for special or promotional rates — legal basis, sources and items processed

For the processing purpose of determining guests' eligibility for special or promotional rates, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the items of personal information processed as name, Hilton Honors number, corporate number and name, and travel agent number and name.

Supporting quotations

Determine guests' eligibility for special or promotional rates

Legal Basis

Article 15(1)(6) Legitimate Interest

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

From demographics companies

Items of Personal Information Processed

Name

Hilton Honors number

Corporate number and name

Travel agent number and name

Qualifications & exceptions

The legal basis is legitimate interest under Article 15(1)(6) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: authenticating a mobile account — legal basis and source

For the processing purpose of authenticating a mobile account, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest and the source as directly from consumers. The remaining sources and the items processed are set out in the following part of the appendix.

Supporting quotations

Authenticate mobile account

Legal Basis

Article 15(1)(6) Legitimate Interest

Source

Directly from consumers

Qualifications & exceptions

Only the legal basis and the first source are stated in this part.

Legal Rights & Agreement Rules · Company practice

Korea: authenticating a mobile account — sources and items processed

The Korea appendix completes the entry for authenticating a mobile account: besides the source stated earlier — directly from consumers — a further source is third parties such as travel booking platforms and credit card providers, and the items of personal information processed are telephone and fax numbers and email address.

Supporting quotations

From third parties such as travel booking platforms and credit card providers

Items of Personal Information Processed

Telephone and fax numbers

Email address

Qualifications & exceptions

The legal basis for this purpose is legitimate interest under Article 15(1)(6) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: processing payments and strong customer authentication

For the processing purpose of processing payments, including conducting strong customer authentication where required by law, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers; and the items of personal information processed as name, home address, payment card information and IP addresses.

Supporting quotations

Process payments, including conducting strong customer authentication (SCA) when required by law

Legal Basis

Article 15(1)4 of the PIPA (Execution and Performance of a Contract)

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

Items of Personal Information Processed

Name

Home address

Payment card information

IP addresses

Qualifications & exceptions

Strong customer authentication applies only where required by law.
The legal basis is contract performance under Article 15(1)4 of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: processing transactions with partners

For the processing purpose of processing transactions with partners, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers; and the items of personal information processed as name, telephone and fax numbers, email address, home address and Hilton Honors number.

Supporting quotations

Process transactions with partners

Legal Basis

Article 15(1)4 of the PIPA (Execution and Performance of a Contract)

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

Items of Personal Information Processed

Name

Telephone and fax numbers

Email address

Home address

Hilton Honors number

Qualifications & exceptions

The legal basis is contract performance under Article 15(1)4 of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: optimizing the websites and mobile apps

For the processing purpose of optimizing Hilton's websites and mobile apps, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the items of personal information processed as name, internet or other electronic network activity information, and IP addresses.

Supporting quotations

Optimize our websites and mobile apps

Legal Basis

Article 15(1)(6) Legitimate Interest

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

From demographics companies

Items of Personal Information Processed

Name

Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements

IP addresses

Qualifications & exceptions

The legal basis is legitimate interest under Article 15(1)(6) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: detecting and preventing fraud — legal basis, sources and first items

For the processing purpose of detecting and preventing fraud, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers, and the items of personal information processed as name, telephone and fax numbers, email address, home address and payment card information. The remaining items for this purpose are listed in the following part of the appendix.

Supporting quotations

Detect and prevent fraud

Legal Basis

Article 15(1)(6) Legitimate Interest

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

Items of Personal Information Processed

Name

Telephone and fax numbers

Email address

Qualifications & exceptions

The legal basis is legitimate interest under Article 15(1)(6) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: detecting and preventing fraud — remaining items processed

The remaining items of personal information processed for the fraud prevention purpose in the Korea appendix are home address, payment card information, Hilton Honors number, internet or other electronic network activity information, IP addresses, session IDs, geolocation information, and device information including MAC address.

Supporting quotations

Home address

Payment card information

Hilton Honors number

Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements

IP addresses

Session IDs

Geolocation information

Device information (including MAC address)

Qualifications & exceptions

The items combine identity, payment, device, location and online activity data.

Legal Rights & Agreement Rules · Company practice

Korea: SMS, service-related SMS and Hilton Honors communications

For the processing purpose of sending marketing communications via SMS, service-related SMS communications and communications relating to Hilton Honors — a single combined entry — the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the items of personal information processed as telephone and fax numbers and preferred language.

Supporting quotations

Send marketing communications via SMS, service-related SMS communications, and communications relating to Hilton Honors

Legal Basis

Article 15(1)(1) (Consent) of the PIPA)

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

From demographics companies

Items of Personal Information Processed

Telephone and fax numbers

Preferred language

Qualifications & exceptions

Marketing, service-related and Honors communications are combined into one entry with a single legal basis.
The legal basis is consent under Article 15(1)(1) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: sales activity for group bookings, meetings and events

For the processing purpose of engaging in sales activity for group bookings, meetings and events, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers, and the items of personal information processed as telephone and fax numbers, email address and home address.

Supporting quotations

Engage in sales activity for group bookings, meetings and events

Legal Basis

Article 15(1)(1) (Consent) of the PIPA)

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

Items of Personal Information Processed

Telephone and fax numbers

Email address

Home address

Qualifications & exceptions

The legal basis is consent under Article 15(1)(1) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: marketing communications via email

For the processing purpose of sending marketing communications via email, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the item of personal information processed as email address.

Supporting quotations

Send marketing communications via email

Legal Basis

Article 15(1)(1) (Consent) of the PIPA)

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

From demographics companies

Items of Personal Information Processed

Email address

Qualifications & exceptions

The legal basis is consent under Article 15(1)(1) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: marketing communications via direct mail

For the processing purpose of sending marketing communications via direct mail, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the item of personal information processed as home address.

Supporting quotations

Send marketing communications via direct mail

Legal Basis

Article 15(1)(1) (Consent) of the PIPA)

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

From demographics companies

Items of Personal Information Processed

Home address

Qualifications & exceptions

The legal basis is consent under Article 15(1)(1) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: books and records for legal obligations — legal basis and sources

For the processing purpose of maintaining books and records to comply with legal obligations for business reporting, auditing, tax and income reconciliation, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest and the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers. The items of personal information processed are set out in the following part of the appendix.

Supporting quotations

Maintain books and records to comply with legal obligations for business reporting, auditing, tax, and income reconciliation

Legal Basis

Article 15(1)(6) Legitimate Interest

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

Qualifications & exceptions

Only the legal basis and the sources are stated in this part.

Legal Rights & Agreement Rules · Company practice

Korea: books and records for legal obligations — items processed

The Korea appendix lists the items of personal information processed for the purpose of maintaining books and records to comply with legal obligations for business reporting, auditing, tax and income reconciliation as payment card information and spending amount, on the legal basis of legitimate interest under Article 15(1)(6) of the PIPA.

Supporting quotations

Items of Personal Information Processed

Payment card information

Spending amount

Qualifications & exceptions

The legal basis for this purpose is legitimate interest under Article 15(1)(6) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: enabling guests to log into the Hilton Honors account

For the processing purpose of enabling guests to log into their Hilton Honors account, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the item of personal information processed as preferred language.

Supporting quotations

Enable guests to log into Hilton Honors Account

Legal Basis

Article 15(1)(1) (Consent) of the PIPA)

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

From demographics companies

Items of Personal Information Processed

Preferred language

Qualifications & exceptions

The legal basis is consent under Article 15(1)(1) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: items processed for Hilton Honors account login

The Korea appendix's entry for enabling guests to log into their Hilton Honors account lists the items of personal information processed as preferred language, room preference, room selection and assignment, arrival time, departure date, MyWay preferences, email and consent preferences such as opt-out or opt-in, descriptions of incidents at a Hilton property or involving a Hilton employee including safety, security and violations of law, policy or contractual obligation, descriptions of complaints including free form textual feedback from Hilton Honors members, spa and wellness service or treatment details, and spending amount. The entry's legal basis is consent under Article 15(1)(1) of the PIPA and its sources are the consumer directly, booking platforms and card providers, and demographics companies.

Supporting quotations

Room preference

Room selection and assignment

Arrival time

Departure date

Your MyWay preferences

Your email and consent preferences (such as opt-out or opt-in, as applicable)

Description of an incident that occurs at a Hilton property or involves a Hilton employee, including incidents related to safety, security, violation of law, violation of applicable policy, or violation of contractual obligation

Description of a complaint that you make to us, including your free form textual feedback if you are a Hilton Honors member

Spa and wellness service or treatment details (such as date, time, and type of service)

Spending amount

Qualifications & exceptions

The item list is long and includes incident, complaint and spa or treatment details as well as preferences and spending amount.
The complaint description is included only where the person is a Hilton Honors member.

Legal Rights & Agreement Rules · Company practice

Korea: fulfilling and managing corporate travel reservations

For the processing purpose of fulfilling and managing corporate travel reservations, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers; and the item of personal information processed as corporate travel planner contact information, being the name, title, company, business phone, email and address.

Supporting quotations

Fulfill and manage corporate travel reservations

Legal Basis

Article 15(1)4 of the PIPA (Execution and Performance of a Contract)

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

Items of Personal Information Processed

Corporate travel planner contact information (name, title, company, business phone, email and address)

Qualifications & exceptions

The legal basis is contract performance under Article 15(1)4 of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: contacting members of the media and social media influencers

For the processing purpose of contacting members of the media and social media influencers in their business capacity, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers, and the item of personal information processed as travel agent number and name.

Supporting quotations

Contact members of the media and social media influencers in their business capacity

Legal Basis

Article 15(1)(1) (Consent) of the PIPA)

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

Items of Personal Information Processed

Travel agent number and name

Qualifications & exceptions

The legal basis is consent under Article 15(1)(1) of the PIPA.
The item listed for this purpose is the travel agent number and name.

Legal Rights & Agreement Rules · Company practice

Korea: attributing points to airline loyalty participants

For the processing purpose of properly attributing points to consumers who participate in airline loyalty programs, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers; and the item of personal information processed as airline partner number and name.

Supporting quotations

Properly attribute points to consumers who participate in airline loyalty programs

Legal Basis

Article 15(1)4 of the PIPA (Execution and Performance of a Contract)

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

Items of Personal Information Processed

Airline partner number and name

Qualifications & exceptions

The legal basis is contract performance under Article 15(1)4 of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: enabling safety and security and guest parking

For the processing purpose of ensuring safety and security and enabling guests to park at Hilton's properties — a single combined entry — the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the sources as directly from consumers and directly from cameras located on and around the property, and the item of personal information processed as vehicle information.

Supporting quotations

Ensure safety and security, and enable guests to park at our properties

Legal Basis

Article 15(1)(6) Legitimate Interest

Source

Directly from consumers

Directly from cameras located on and around the property

Items of Personal Information Processed

Vehicle information

Qualifications & exceptions

The entry combines two purposes, and one of its sources is on-property cameras.
The legal basis is legitimate interest under Article 15(1)(6) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: protecting guests, employees and visitors to properties

For the processing purpose of protecting guests, employees and visitors to Hilton's properties, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the source as directly from cameras located on and around the property, and the item of personal information processed as images or footage captured by closed circuit television.

Supporting quotations

Protect guests, employees and visitors to properties

Legal Basis

Article 15(1)(6) Legitimate Interest

Source

Directly from cameras located on and around the property

Items of Personal Information Processed

Images or footage captured by closed circuit television (CCTV)

Qualifications & exceptions

The only stated source is on-property cameras.
The legal basis is legitimate interest under Article 15(1)(6) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: internal and external promotions and communications

For the processing purpose of internal and external promotions and communications, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the source as directly from cameras utilized on the property, and the item of personal information processed as promotional images or footage captured by on-property photographers.

Supporting quotations

Internal and external promotions and communications

Legal Basis

Article 15(1)(1) (Consent) of the PIPA)

Source

Directly from cameras utilized on the property

Items of Personal Information Processed

Promotional images or footage captured by on-property photographers

Qualifications & exceptions

The source is cameras used on the property, and the legal basis is consent.
The legal basis is consent under Article 15(1)(1) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: supporting marketing efforts

For the processing purpose of supporting marketing efforts, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, indirectly from consumers by reviewing publicly available information on their social media channels, and from publicly available online sources, and the items of personal information processed as booking engine data, whether the person has a Hilton and American Express co-branded credit card, whether their Hilton and Amazon accounts are linked, whether their Hilton and Lyft accounts are linked, and spending amount.

Supporting quotations

Support marketing efforts

Legal Basis

Article 15(1)(1) (Consent) of the PIPA)

Source

Directly from consumers

Indirectly from consumers by reviewing publicly available information on their social media channels

From publicly available online sources

Items of Personal Information Processed

Booking engine

Whether you have a Hilton and American Express Co-Branded Credit Card

Whether your Hilton and Amazon accounts are linked

Whether your Hilton and Lyft accounts are linked

Spending amount

Qualifications & exceptions

Two of the three sources are public information, including the person's own social media channels.
The legal basis is consent under Article 15(1)(1) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: troubleshooting and resolving website issues

For the processing purpose of troubleshooting and resolving website issues, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the source as directly from consumers, and the items of personal information processed as IP addresses, customer ratings and survey responses, and free form textual feedback.

Supporting quotations

Troubleshoot and resolve website issues

Legal Basis

Article 15(1)(6) Legitimate Interest

Source

Directly from consumers

Items of Personal Information Processed

IP addresses

Customer ratings and survey responses

Free form textual feedback

Qualifications & exceptions

The legal basis is legitimate interest under Article 15(1)(6) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: showing targeted advertisements on media

For the processing purpose of showing targeted advertisements on media, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, indirectly from consumers by reviewing publicly available information on their social media channels, and from publicly available online sources, and the item of personal information processed as booking engine data.

Supporting quotations

Show you targeted advertisements on media

Legal Basis

Article 15(1)(1) (Consent) of the PIPA)

Source

Directly from consumers

Indirectly from consumers by reviewing publicly available information on their social media channels

From publicly available online sources

Items of Personal Information Processed

Booking engine

Qualifications & exceptions

Two of the three sources are public information, including the person's own social media channels.
The legal basis is consent under Article 15(1)(1) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: items processed for showing targeted advertisements on media

The items of personal information processed for the purpose of showing targeted advertisements on media in the Korea appendix are booking engine data, whether the person has a Hilton and American Express co-branded credit card, whether their Hilton and Amazon accounts are linked, and whether their Hilton and Lyft accounts are linked. The legal basis for this purpose is consent under Article 15(1)(1) of the PIPA.

Supporting quotations

Whether you have a Hilton and American Express Co-Branded Credit Card

Whether your Hilton and Amazon accounts are linked

Whether your Hilton and Lyft accounts are linked

Qualifications & exceptions

The legal basis is consent under Article 15(1)(1) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: evaluating the usage of different streaming services

For the processing purpose of evaluating the usage of different streaming services, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the source as directly from the consumer as a result of logging into a streaming service through the Connected Room functionality, and the item of personal information processed as streaming service usage, including the service used, hours of use, launch method and log-out method.

Supporting quotations

Evaluate the usage of different streaming services

Legal Basis

Article 15(1)(6) Legitimate Interest

Source

Directly from consumer as a result of their logging into a streaming service through Connected Room functionality

Items of Personal Information Processed

Streaming service usage (including service used, hours of use, launch method, and log-out method)

Qualifications & exceptions

The data arises from logging into a streaming service through Connected Room.
The legal basis is legitimate interest under Article 15(1)(6) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: benefits associated with the co-branded card

For the processing purpose of providing benefits associated with the co-branded card, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the source as American Express; and the item of personal information processed as whether the person has a Hilton and American Express co-branded credit card.

Supporting quotations

Provide you with benefits associated with your co-branded card

Legal Basis

Article 15(1)4 of the PIPA (Execution and Performance of a Contract)

Source

From American Express

Items of Personal Information Processed

Whether you have a Hilton and American Express Co-Branded Credit Card

Qualifications & exceptions

The source is the co-branded partner rather than the guest directly.
The legal basis is contract performance under Article 15(1)4 of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: facilitating Honors points in Amazon's Shop with Points programme

For the processing purpose of facilitating the use of Honors points as part of Amazon's Shop with Points program, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the source as Amazon; and the item of personal information processed as whether the person's Hilton and Amazon accounts are linked.

Supporting quotations

Facilitate use of Honors points as part of Amazon's Shop with Points program

Legal Basis

Article 15(1)4 of the PIPA (Execution and Performance of a Contract)

Source

From Amazon

Items of Personal Information Processed

Whether your Hilton and Amazon accounts are linked

Qualifications & exceptions

The source is the partner platform.
The legal basis is contract performance under Article 15(1)4 of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: Digital Key sharing and guest access to room and facilities

For the processing purpose of fulfilling Digital Key sharing requests and enabling guest access to the guest room and hotel facilities — a single combined entry — the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the source as directly from consumers, and the item of personal information processed as geolocation information.

Supporting quotations

Fulfill Digital Key sharing requests, enable guest access to guest room and hotel facilities

Legal Basis

Article 15(1)(1) (Consent) of the PIPA)

Source

Directly from consumers

Items of Personal Information Processed

Geolocation information

Qualifications & exceptions

The legal basis is consent under Article 15(1)(1) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: a more personalized welcome and stay experience, and responding to service concerns

For the processing purpose of providing a more personalized welcome and stay experience and responding to service concerns in order to better serve guests — a single combined entry — the Korea appendix states two legal bases, Article 15(1)(6) Legitimate Interest and Article 15(1)(1) (Consent) of the PIPA; the sources as directly from consumers, indirectly from consumers by reviewing publicly available information on their social media channels, and from publicly available online sources; and the item of personal information processed as social media information and publicly available online information, including through social media platforms.

Supporting quotations

Provide a more personalized welcome and stay experience, respond to service concerns in order to better serve our guests

Legal Basis

Article 15(1)(6) Legitimate Interest

Article 15(1)(1) (Consent) of the PIPA)

Source

Directly from consumers

Indirectly from consumers by reviewing publicly available information on their social media channels

From publicly available online sources

Items of Personal Information Processed

Social media information; publicly available online information (including through social media platforms)

Qualifications & exceptions

This entry lists two legal bases, legitimate interest and consent.
Two of the three sources are public information, including the person's own social media channels.

Legal Rights & Agreement Rules · Company practice

Korea: sending the communications the guest would like to receive

For the processing purpose of sending the communications the guest would like to receive, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the source as directly from consumers, and the item of personal information processed as the guest's MyWay preferences.

Supporting quotations

Send you the communications you would like to receive

Legal Basis

Article 15(1)(1) (Consent) of the PIPA)

Source

Directly from consumers

Items of Personal Information Processed

Your MyWay preferences

Qualifications & exceptions

The legal basis is consent under Article 15(1)(1) of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: responding to safety and security concerns and complying with obligations

For the processing purpose of responding to safety and security concerns and complying with legal or contractual obligations — a single combined entry — the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the source as directly from consumers, and the items of personal information processed as descriptions of incidents at a Hilton property or involving a Hilton employee, including safety, security, violation of law, violation of applicable policy or violation of contractual obligation, descriptions of complaints including free form textual feedback from Hilton Honors members, and spa and wellness service or treatment details.

Supporting quotations

Respond to safety and security concerns Comply with legal or contractual obligations

Legal Basis

Article 15(1)(6) Legitimate Interest

Source

Directly from consumers

Items of Personal Information Processed

Description of an incident that occurs at a Hilton property or involves a Hilton employee, including incidents related to safety, security, violation of law, violation of applicable policy, or violation of contractual obligation

Description of a complaint that you make to us, including your free form textual feedback if you are a Hilton Honors member

Spa and wellness service or treatment details (such as date, time, and type of service)

Qualifications & exceptions

The entry combines two purposes, and the complaint description is included only for Hilton Honors members.

Legal Rights & Agreement Rules · Company practice

Korea: fulfilling guest reservations and verifying identity

For the processing purpose of fulfilling guest reservations and verifying identity — a single combined entry in the list processed without consent — the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers; and the items of personal information processed as name, telephone and fax number, email address, home address and Hilton Honors number.

Supporting quotations

Fulfill guest reservations and verify identity

Legal Basis

Article 15(1)4 of the PIPA (Execution and Performance of a Contract)

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

Items of Personal Information Processed

Name

Telephone and fax number

Email address

Home address

Hilton Honors number

Qualifications & exceptions

This entry appears in the list of processing carried out without consent, on the basis of contract performance.
The legal basis is contract performance under Article 15(1)4 of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea: sending guests communications relating to the reservation

For the processing purpose of sending guests communications relating to their reservation, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract, and the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies. The items of personal information processed for this purpose are listed in the following part of the appendix.

Supporting quotations

Send guests communications relating to their reservation

Legal Basis

Article 15(1)4 of the PIPA (Execution and Performance of a Contract)

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

From demographics companies

Qualifications & exceptions

Only the legal basis and the sources are stated in this part.
The legal basis is contract performance under Article 15(1)4 of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea without consent: items processed for reservation communications

The items of personal information processed for the purpose of sending guests communications relating to their reservation, in the list of processing carried out without consent, are name, email address, home address and Hilton Honors number. The legal basis for that purpose is Article 15(1)4 of the PIPA, execution and performance of a contract.

Supporting quotations

Items of Personal Information Processed

Name

Email address

Home address

Hilton Honors number

Qualifications & exceptions

This entry is in the list processed without the data subject's consent, on the basis of contract performance.

Legal Rights & Agreement Rules · Company practice

Korea without consent: customer service and support — legal basis, sources and first items

For the processing purpose of providing customer service and support, in the list processed without consent, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers; and the items of personal information processed as name, telephone and fax numbers, email address, home address and Hilton Honors number.

Supporting quotations

Provide customer service and support

Legal Basis

Article 15(1)4 of the PIPA (Execution and Performance of a Contract)

Source

Directly from consumers

From third parties such as travel booking platforms and credit card providers

Items of Personal Information Processed

Name

Telephone and fax numbers

Email address

Home address

Qualifications & exceptions

The legal basis is contract performance under Article 15(1)4 of the PIPA.

Legal Rights & Agreement Rules · Company practice

Korea without consent: customer service — remaining items processed

The remaining items of personal information processed for the customer service and support purpose in the Korea appendix are Hilton Honors number, WeChat name and profile photo, arrival time, corporate travel planner contact information, booking engine data, whether the person has a Hilton and American Express co-branded credit card, whether their Hilton and Amazon accounts are linked, and whether their Hilton and Lyft accounts are linked.

Supporting quotations

Hilton Honors number

WeChat name and profile photo

Arrival time

Corporate travel planner contact information (name, title, company, business phone, email and address)

Booking engine

Whether you have a Hilton and American Express Co-Branded Credit Card

Whether your Hilton and Amazon accounts are linked

Whether your Hilton and Lyft accounts are linked

Qualifications & exceptions

The items include partner account indicators and corporate travel planner contact information.

Legal Rights & Agreement Rules · User right or choice

Korea: the rights of data subjects under the PIPA

The Korea appendix states that as residents of Korea, people are entitled to the following rights under the PIPA: the right to be informed, the right to access, the right to rectification, the right to erasure, the right to object, opt out of or suspend processing, the right to data portability, and the right to contest automated decision-making. The appendix lists the rights by name; the routes for exercising them follow in the next part.

Supporting quotations

2. Rights and Obligations of Data Subjects

As residents of Korea, you are entitled to the following rights under PIPA:

Right to be Informed

Right to Access

Right to Rectification

Right to Erasure

Right to Object/Opt-out or Suspend Processing

Right to Data Portability

Right to Contest Automated Decision-making

Qualifications & exceptions

The rights are listed by name; the detail of how to exercise them follows separately.

Legal Rights & Agreement Rules · Procedure

Korea: how to exercise the rights, and the Data Protection Office contacts

The Korea appendix says data subjects may at any time exercise their rights and should direct their requests to the named department using the contact information given, and that the Data Protection Office will respond promptly within the time period permitted by law. The department given is the Data Protection Office, with telephone number 070-4732-6767, the email address DataProtectionOffice@hilton.com, the address Attn: Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102, USA, and the Data Subject Rights Portal at datarights.hilton.com.

Supporting quotations

Exercise Your Rights: Data subjects may, at any time, exercise their rights and should direct their requests to the following department using the below contact information.

The Data Protection Office will respond promptly within the time period permitted by law.

Department: Data Protection Office

Telephone: 070-4732-6767

Email: DataProtectionOffice@hilton.com

Address: Attn: Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102, USA

Data Subject Rights Portal at datarights.hilton.com

Qualifications & exceptions

The response is stated to be prompt and within the period permitted by law.
The stated department is the Data Protection Office, with a United States address.

Legal Rights & Agreement Rules · User right or choice

Korea: submitting a request on behalf of someone else

The Korea appendix states that in some circumstances a person may have the option to submit a request on behalf of someone else, and that if they do so they may be asked to provide proof of authorization.

Supporting quotations

In some circumstances you may have the option to submit a request on behalf of someone else.

If you submit a request on behalf of someone else, then you may be asked to provide proof of authorization.

Qualifications & exceptions

The option applies only 'in some circumstances'.
Proof of authorization may be requested.

Legal Rights & Agreement Rules · Procedure

Korea: remedies for infringement — dispute resolution and the reporting institutions

The Korea appendix says that to seek a remedy for personal information infringements, a person may apply for dispute resolution or consultation with institutions such as the Korea Internet & Security Agency's Personal Information Infringement Report Center, the Privacy Infringement Reporting Center, and gives the contact numbers for the Personal Information Dispute Mediation Committee, 1833-6972, the KISA Personal Information Infringement Report Center, 118, and the National Police Agency, 182.

Supporting quotations

Remedies for Infringement of Rights and Interests: To seek a remedy for personal information infringements, you may apply for dispute resolution or consultation with institutions such as the Korea Internet & Security Agency's (KISA) Personal Information Infringement Report Center, the Privacy Infringement Reporting Center.

Personal Information Dispute Mediation Committee: (without area code) 1833-6972

KISA Personal Information Infringement Report Center: (without area code) 118

National Police Agency: (without area code) 182

Qualifications & exceptions

Three Korean institutions are named with their own contact numbers.
The remedy route is offered in addition to the rights process.

Legal Rights & Agreement Rules · Company practice

Korea: when the policy takes effect and how to get the previous version

The Korea appendix says the Privacy Policy is effective from the last updated date shown at the top of the Statement, and that a person wanting the previous version should email privacy@hilton.com. It adds that for a summary of the material changes the reader should refer to the Changes to this Statement section.

Supporting quotations

6. Changes to the Privacy Policy

This Privacy Policy is effective from the last updated date noted at the top of this Statement.

For the previous version of this Statement, please email privacy@hilton.com

For a summary of the material changes, please refer to the Changes to this Statement section.

Qualifications & exceptions

Effectiveness is tied to the last updated date at the top of the Statement.
The previous version is available on request by email.

Legal Rights & Agreement Rules · Context

Albania: additional information for residents, with an Albanian translation of the Statement

The Albania appendix states that it provides additional information for individuals residing in Albania, and that the Albanian translation of the Global Privacy Statement is available through the link in the appendix. The Albanian text itself is a separate document that this source does not contain.

Supporting quotations

Appendix A-12: Albania Residents

This Appendix provides additional information for individuals residing in Albania.

The Albanian translation of the Global Privacy Statement is available

Qualifications & exceptions

The Albanian translation is a separate document, linked from the appendix and not supplied here.

Not stated here

The linked Albanian translation of the Global Privacy Statement is not supplied in this source, so this card cannot say what the Albanian text provides.

Global Privacy Statement

Stated version of the Global Privacy Statement: last updated August 31, 2026

Supporting quotations

Qualifications & exceptions

Hilton's mission, its privacy pledge, and what the Statement explains

Supporting quotations

Qualifications & exceptions

Entities the Statement applies to: Hilton Worldwide Holdings, its subsidiaries and all Portfolio brands

Supporting quotations

Qualifications & exceptions

Using Hilton products or agreeing to the Statement acknowledges collection and use

Supporting quotations

Qualifications & exceptions

Hilton Domestic Operating Company Inc. is the data controller for guest data

Supporting quotations

Qualifications & exceptions

Franchised and joint-venture hotels are separate entities and may be independent controllers

Supporting quotations

Qualifications & exceptions

Your Rights and Choices: reviewing and updating the information you gave at enrollment

Supporting quotations

Qualifications & exceptions

Your Rights and Choices: the rights depend on where you live

Supporting quotations

Qualifications & exceptions

Your Rights and Choices: how to submit a request, timing and fees

Supporting quotations

Qualifications & exceptions

Your Rights and Choices: asking Hilton to stop sharing with business partners or to stop using your information

Supporting quotations

Qualifications & exceptions

Opting out of the sale of personal information or its sharing for targeted advertising

Supporting quotations

Qualifications & exceptions

Submitting a rights request on behalf of someone else

Supporting quotations

Qualifications & exceptions

Contact information for questions or concerns: the Data Protection Office

Supporting quotations

Qualifications & exceptions

Changes to this Statement: changes take effect on posting, and continued use means acceptance

Supporting quotations

Qualifications & exceptions

Summary of material changes: August 2026

Supporting quotations

Qualifications & exceptions

Summary of material changes: May and April 2026

Supporting quotations

Qualifications & exceptions

Appendix A: additional provisions for residents of certain countries and US states, which override the main body on

Supporting quotations

Qualifications & exceptions

Appendix A: how to reach the controller and the Data Protection Office

Supporting quotations

Qualifications & exceptions

Purposes and legal basis: the five stated bases, and the basis follows the purpose

Supporting quotations

Qualifications & exceptions

Legal basis for Hilton Honors participation: contract, consent where required, legitimate interests

Supporting quotations

Qualifications & exceptions

Legal basis for post-stay surveys: voluntary, consent plus business interests

Supporting quotations

Qualifications & exceptions

Legal basis for on-property collection: contract, legitimate interests, and legal obligations at registration

Supporting quotations

Qualifications & exceptions

Legal basis for on-property CCTV and location monitoring: protection of staff, guests and visitors

Supporting quotations

Qualifications & exceptions

Legal basis for on-property services: concierge, spas, childcare, equipment rental and Digital Key

Supporting quotations

Qualifications & exceptions

Legal basis for event profiles: contract plus legitimate interests, with consent where required

Supporting quotations

Qualifications & exceptions

Legal basis for social media participation: voluntary, consent where required plus legitimate interests

Supporting quotations

Qualifications & exceptions

Legal basis for promotions and sweepstakes: voluntary, consent and administration of the offering