Name: third parties the name was shared with, and the sale statement
Hilton states that it shared the name with service providers who perform tasks on its behalf, which may include providers that send marketing communications on its behalf; with Hilton's Third-Party Partner; with payment card issuers and payment processors; with employers under corporate agreements, employee consent and as permitted by law; with entities that arranged a special rate plan, an event or a room block with Hilton; with the third-party travel booking platform or travel agent through which the guest made the reservation; with government agencies pursuant to legal requirements in some countries; with third-party advertisers, for optimization and personalization on their platforms; with Hilton's Third-Party Operator; and with Hilton Principal. The same line answers the sale question for this category: the information was sold to a third party within the past 12 months — Yes.
Supporting quotations
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on our behalf
Hilton’s Third-Party Partner
Payment card issuers and payment processors
Employers pursuant to corporate agreements, employee consent, and as permitted by law
Entities that have arranged a special rate plan with Hilton and/or organized an event and/or room block with Hilton
The third-party travel booking platform or travel agent through which a guest made a reservation
Government agencies pursuant to legal requirements in some countries
Third-party advertisers, for optimization and personalization on their platforms
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months Yes
Qualifications & exceptions
The sale answer covers the 12 months before the statement's August 31, 2026 date.
Recipients are named as categories of third party, not as named companies, apart from the Hilton-related roles the Statement defines later.
The service-provider category expressly includes providers that send marketing communications on Hilton's behalf.
Government sharing is qualified to 'some countries' and to legal requirements.
Sharing & Disclosure · Company practice
Telephone and fax numbers: post-stay surveys, third-party sharing and the sale statement
The last stated purpose for telephone and fax numbers is sending post-stay surveys by SMS. Hilton then says it shared the number with service providers who perform tasks on its behalf, including providers that send marketing communications on its behalf; with Hilton's Third-Party Partner; with employers under corporate agreements, employee consent and as permitted by law; with the third-party travel booking platform or travel agent through which the guest booked; with third-party advertisers, for optimization and personalization on their platforms; with Hilton's Third-Party Operator; and with Hilton Principal. The sale answer for this category is Yes: the information was sold to a third party within the past 12 months.
Supporting quotations
Sending post-stay surveys via SMS
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on our behalf
Hilton's Third-Party Partner
Employers pursuant to corporate agreements, employee consent, and as permitted by law
The third-party travel booking platform or travel agent through which a guest made a reservation
Third-party advertisers, for optimization and personalization on their platforms
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Recipients are categories of third party, not named companies.
No government-agency recipient is listed for this category, unlike the name and nationality categories.
Sharing & Disclosure · Company practice
Email address: group sales purpose, third-party sharing and the sale statement
The remaining stated purpose for email addresses is engaging in sales activity for group bookings, meetings and events. Hilton says it shared the email address with service providers performing tasks on its behalf, including providers that send marketing communications on its behalf; with Hilton's Third-Party Partner; with employers under corporate agreements, employee consent and as permitted by law; with the third-party travel booking platform or travel agent through which the guest booked; with third-party advertisers, for optimization and personalization on their platforms; with Hilton's Third-Party Operator; and with Hilton Principal. The sale answer for this category is Yes: the information was sold to a third party within the past 12 months.
Supporting quotations
Engage in sales activity for group bookings, meetings and events
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on our behalf
Hilton's Third-Party Partner
Employers pursuant to corporate agreements, employee consent, and as permitted by law
The third-party travel booking platform or travel agent through which a guest made a reservation
Third-party advertisers, for optimization and personalization on their platforms
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Recipients are categories of third party, not named companies.
The third-party advertisers entry is qualified to optimization and personalization on their own platforms.
Sharing & Disclosure · Company practice
Home address: third parties the address was shared with, and the sale statement
Hilton states that it shared the home address with service providers who perform tasks on its behalf; with Hilton's Third-Party Partner; with payment card issuers and payment processors; with employers under corporate agreements, employee consent and as permitted by law; with the third-party travel booking platform or travel agent through which the guest booked; with third-party advertisers, for optimization and personalization on their platforms; with Hilton's Third-Party Operator; and with Hilton Principal. The sale answer for this category is Yes: the information was sold to a third party within the past 12 months.
Supporting quotations
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton
Hilton's Third-Party Partner
Payment card issuers and payment processors
Employers pursuant to corporate agreements, employee consent, and as permitted by law
The third-party travel booking platform or travel agent through which a guest made a reservation
Third-party advertisers, for optimization and personalization on their platforms
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Recipients are categories of third party rather than named companies.
Employer sharing is conditional on corporate agreements, employee consent and the law.
Sharing & Disclosure · Company practice
Arrival time: purposes, third-party sharing and the sale statement
Hilton lists the business or commercial purposes for arrival time as better serving guests, fulfilling reservations, personalizing the guest experience and providing customer service and support. It says it shared arrival time with Hilton Partner Accommodations, with Hilton's Third-Party Operator and with Hilton Principal, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
We collected this personal information for the following business or commercial purposes:
Better serve our guests
Fulfill reservations
Personalize guest experience
Provide customer service and support
We have shared this personal information with the following categories of third parties
Hilton Partner Accommodations
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Recipients are categories of third party rather than named companies.
Sharing & Disclosure · Company practice
Hilton Honors number: remaining purposes, third-party sharing and the sale statement
The remaining purposes Hilton lists for the Hilton Honors number are determining guests' eligibility for special or promotional rates, processing payments, processing transactions with partners, administering contests and sweepstakes, and detecting and preventing fraud. It says it shared the number with service providers who perform tasks on its behalf, including providers that send marketing communications on its behalf; with Hilton's Third-Party Partner; with employers under corporate agreements, employee consent and as permitted by law; with third-party advertisers, for optimization and personalization on their platforms; with Hilton's Third-Party Operator; and with Hilton Principal. The sale answer for this category is Yes: the information was sold to a third party within the past 12 months.
Supporting quotations
Determine guests’ eligibility for special or promotional rates
Process payments
Process transactions with partners
Administer contests and sweepstakes
Detect and prevent fraud
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on our behalf
Hilton's Third-Party Partner
Employers pursuant to corporate agreements, employee consent, and as permitted by law
Third-party advertisers, for optimization and personalization on their platforms
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Recipients are categories of third party rather than named companies.
Employer sharing requires corporate agreements, employee consent and the law.
Sharing & Disclosure · Company practice
IP addresses: sharing with advertising networks, analytics providers, service providers and card issuers, not sold
Hilton says it shared IP addresses with advertising networks, with analytics providers for its websites and mobile applications, with service providers who perform tasks on its behalf — which may include those who send marketing communications on its behalf — and with payment card issuers and payment processors, but only when conducting strong customer authentication. It says the information was not sold to a third party within the past 12 months.
Supporting quotations
We have shared this personal information with the following categories of third parties
Advertising networks
Analytics providers for our websites and mobile applications
Service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on our behalf
Payment card issuers and payment processors (only when conducting SCA)
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The payment-card recipient is limited to the strong customer authentication case.
The sale answer covers the 12 months before August 31, 2026.
Sharing & Disclosure · Company practice
Session IDs: remaining purposes, sharing with advertising networks, and the sale statement
The remaining purposes for session IDs are performing analytics that improve business operations, sharing the data with advertising networks that serve personalized advertisements, and detecting and preventing fraud. Hilton says it shared session IDs with advertising networks and with analytics providers for its websites and mobile applications, and that the information was sold to a third party within the past 12 months.
Supporting quotations
Perform analytics to improve business operations
Share that data with advertising networks who serve personalized advertisements
Detect and prevent fraud
We have shared this personal information with the following categories of third parties
Advertising networks
Analytics providers for our websites and mobile applications
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Recipients are categories of third party rather than named companies.
Sharing & Disclosure · Company practice
Hilton and American Express co-branded card data: sharing and the sale statement
Hilton says it shared the co-branded card data with advertising networks, with analytics providers for its websites and mobile applications, with Hilton Honors affiliated partners, with Hilton Partner Accommodations and with Hilton's Third-Party Operator, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
We have shared this personal information with the following categories of third parties
Advertising networks
Analytics providers for our websites and mobile applications
Hilton Honors affiliated partners
Hilton Partner Accommodations
Hilton's Third-Party Operator
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Recipients are categories of third party rather than named companies.
The sale answer covers the 12 months before August 31, 2026.
Sharing & Disclosure · Company practice
Geolocation information: not sold to a third party in the past 12 months
The sale status for geolocation information completes the category: Hilton states the information was not sold to a third party within the past 12 months. Read with the earlier statement that it does not share geolocation information with any third parties, the category is described as neither shared nor sold.
Supporting quotations
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Sharing & Disclosure · Company practice
On-site incidents: sharing with franchise property owners and others required by law
The sharing list for on-site incidents continues: Hilton says it shared the information with the management and/or owners of a franchise property if the incident relates to that property, and with others as required by law. It says the information was not sold to a third party within the past 12 months. The franchise-property disclosure is conditional on the incident relating to that property, and the second ground is limited to what the law requires.
Supporting quotations
The management and/or owners of a franchise property if the incident relates to that property
Others as required by law
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Franchise owners receive the information only where the incident relates to their property.
'Others as required by law' is limited to legal requirement.
The sale answer covers the 12 months before August 31, 2026.
Sharing & Disclosure · Company practice
Interest-based advertising: third parties combine activity across sites, apps and devices
Hilton says it partners with third parties to provide advertising services targeted at a person's online activities across websites, mobile apps and devices over time, commonly called interest-based advertising. Its advertising partners may collect information about the person's activities on Hilton's services on their current device and combine it with information about their activities on other websites, mobile apps and devices, using server logs, cookies, web beacons, tags, pixels, mobile advertising identifiers such as Facebook cookies or Google's Advertising ID, cross-device linking and similar technologies. Advertising partners may use a site visit to target advertising on other websites and mobile apps, and may match browsers or devices if the person logs into the same online service on multiple devices or if the devices share attributes supporting an inference that they are used by the same person or household. The Statement adds that the person can opt out of interest-based advertising in web browsers and mobile apps on the current browser or device by following the instructions below.
Supporting quotations
We partner with third parties to provide advertising services that are targeted based on your online activities across websites, mobile apps, and devices over time (commonly referred to as “interest-based advertising”).
Our advertising partners may collect information about your activities on our Services on your current device and combine it with information about your activities on other websites, mobile apps, and devices.
They may collect such information using server logs, cookies, web beacons, tags, pixels, mobile advertising IDs (such as Facebook cookies or Google’s Advertising ID), cross-device linking, and similar technologies.
They may match your browsers or devices if you log into the same online service on multiple devices or if your devices share similar attributes that support an inference that they are used by the same person or household.
You can opt out of interest-based advertising in web browsers and mobile apps on your current browser or device by following the instructions below.
Qualifications & exceptions
The cross-device combination is described as something advertising partners may do, and the person-matching is described as an inference from logins or device attributes.
The opt-out described here is limited to the browser or device on which it is made.
Sharing & Disclosure · Context
How We Disclose Personal Information: what this section adds to the collection section
Hilton introduces its disclosure section by saying that, in addition to the information given in the Personal Information We Collect section, the following summarises how it may disclose personal information. The section therefore adds a summary of disclosure to the earlier collection disclosures rather than replacing them.
Supporting quotations
7. How We Disclose Personal Information
In addition to the information provided in the Personal Information We Collect section, the following summarizes how we may disclose personal information.
Qualifications & exceptions
The disclosure summary is additional to the collection section, not a restatement of it.
Sharing & Disclosure · Company practice
Disclosure to protect safety and security, and disclosure required by law
Hilton says it will disclose personal information as required by law, giving as examples the case where countries require it to collect personal data about visitors to properties in that country, where a law enforcement agency serves a valid subpoena, and where a civil litigant serves a lawful discovery request. It also says it may elect to share personal information with law enforcement, employers, those who host events with Hilton or others as necessary to protect the safety and security of people and property, to pursue available remedies or limit the damages it may sustain, and to respond to an emergency. The disclosure to law enforcement and employers is therefore stated as something Hilton may elect to do, not only something it must do.
Supporting quotations
Protection of Safety and Security
Hilton will disclose personal information as required by law.
Examples of such disclosures include when countries require Hilton to collect personal data about visitors to properties in that country, when a law enforcement agency serves a valid subpoena on Hilton, and when a civil litigant serves a lawful discovery request on Hilton.
Hilton may elect to share personal information with law enforcement, employers, those who host events with Hilton, or others as necessary to protect the safety and security of people and property, to pursue available remedies or limit the damages that we may sustain, and to respond to an emergency.
Qualifications & exceptions
The mandatory disclosures are qualified by 'required by law' and by the validity of the subpoena or discovery request.
The safety and security disclosures are framed as a Hilton election ('may elect to share') for the purposes listed, including limiting Hilton's own damages.
Sharing & Disclosure · Company practice
e-Folio Program: a folio extract may go to the employer and the credit card company
Hilton says that if a person is an employee of a company participating in the Hilton e-Folio Program, and books a room using a company corporate code or pays expenses with a corporate credit card, Hilton may send the employer and the credit card company an extract of the folio detailing the goods and services provided. The disclosure is to two recipients and is limited to an extract of the folio.
Supporting quotations
E-Folio Program
If you are an employee of a company that participates in the Hilton e-Folio Program and you book your room using a company corporate code or pay for your expenses using a corporate credit card, we may send your employer and the credit card company an extract of your folio detailing the goods and services provided to you.
Qualifications & exceptions
The disclosure applies only to employees of companies in the e-Folio Program who book with a corporate code or corporate credit card.
What is sent is an extract of the folio, not the whole folio.
Sharing & Disclosure · Company practice
Reservations with partner accommodations: AutoCamp, SLH and Evermore Resort receive guest information
Hilton says that when a guest makes a reservation with AutoCamp, Small Luxury Hotels of the World (SLH) or Evermore Resort – Orlando through a Hilton channel, it will provide certain guest information for the exclusive purpose of fulfilling the reservation and providing customer support, as identified in the collection section of this Statement. The Hilton channels named are its website, the Hilton Honors application and Mini Programs, and the guest information will be processed and retained in accordance with the partner's own privacy policies and as permitted by applicable law. The Statement then points to each partner's privacy policy, documents that are not supplied in this source.
Supporting quotations
Reservations with Hilton Partner Accommodations
Hilton will provide certain guest information for the exclusive purpose of fulfilling the reservation and providing customer support
The guest information will be processed and retained in accordance with their privacy policies and as permitted by applicable law.
AutoCamp: You can access AutoCamp’s privacy policy
SLH: You can access SLH’s privacy policy
Evermore Resort – Orlando: You can access Evermore Resort’s privacy policy
Qualifications & exceptions
The purpose is stated as the exclusive one of fulfilling the reservation and providing customer support.
The partner processes and retains the data under its own privacy policies, which this source does not reproduce.
Not stated here
The linked AutoCamp privacy policy is not supplied in this source, so this card cannot say what it requires.
The linked SLH privacy policy is not supplied in this source, so this card cannot say what it requires.
The linked Evermore Resort privacy policy is not supplied in this source, so this card cannot say what it requires.
Sharing & Disclosure · Company practice
Reservations with Hilton's third-party partners: HGV and Placemakr receive booking information
Hilton says that when a guest makes a reservation with Hilton Grand Vacations (HGV) through a Hilton channel, it provides the information given for the booking to HGV to fulfil the reservation; the channels named are its website, the Hilton Honors application and the Hilton Honors Mini Programs. HGV may also process the personal information in accordance with HGV's privacy policies and as permitted by applicable law, and Hilton may also share personal data with HGV if the guest is a Hilton Honors member; depending on the jurisdiction, prior consent to share may be required, and in that case Hilton says it will obtain consent during the Hilton Honors enrolment journey. The same structure applies to Placemakr, whose data may also be processed under its own privacy policies and with prior consent where required. The Statement points to each partner's privacy policy, documents that are not supplied in this source.
Supporting quotations
Reservations with Hilton’s Third-Party Partners
Hilton Grand Vacations: When making a reservation with Hilton Grand Vacations (HGV) through a Hilton channel, Hilton will provide the information you provided for your booking to HGV to fulfill your reservation.
HGV may also process your personal information in accordance with HGV’s privacy policies and as permitted by applicable law.
Depending on your jurisdiction, prior consent to share your personal data with HGV may be required. If this is the case, we will obtain your consent to do so during the Hilton Honors enrollment journey.
Placemakr: When making a reservation with Placemakr through Hilton channel, Hilton will provide the information you provided for your booking to Placemakr to fulfill your reservation.
Depending on your jurisdiction, prior consent to share your personal data with Placemakr may be required. If this is the case, we will obtain your consent.
Qualifications & exceptions
Sharing with HGV for a Hilton Honors member is a separate ground from the booking itself.
Prior consent to share may be required depending on the jurisdiction, and is then obtained during enrolment.
The partners' own privacy policies govern their processing and are not reproduced here.
Not stated here
The linked Hilton Grand Vacations privacy notice is not supplied in this source, so this card cannot say what it requires.
The linked Placemakr privacy policy is not supplied in this source, so this card cannot say what it requires.
Sharing & Disclosure · Company practice
Reservations with Hilton's third-party operator: Genting receives booking information from US guests
Hilton says that if a guest who lives in the United States makes a reservation at Resorts World Las Vegas, Conrad Las Vegas or Crockfords Las Vegas through a Hilton channel, it will provide its Third-Party Operator, Genting, with the information provided for the booking to fulfil the reservation; the channels named are its website, the Hilton Honors application and Mini Programs. Genting may also process the personal information in accordance with Genting's privacy policies and as permitted by applicable law. The Statement points to Genting's privacy policy, a document that is not supplied in this source.
Supporting quotations
Reservations with Hilton’s Third-Party Operator
If you are a guest who lives in the United States, when you make a reservation with Resorts World Las Vegas, Conrad Las Vegas, or Crockfords Las Vegas through a Hilton channel, we will provide our Third-Party Operator, Genting with the information you provided for your booking to fulfill your reservation.
Genting may also process your personal information in accordance with Genting’s privacy policies and as permitted by applicable law.
Qualifications & exceptions
The disclosure is stated for guests who live in the United States.
Genting's own processing is governed by its privacy policies, which are not reproduced here.
Not stated here
The linked Genting privacy policy is not supplied in this source, so this card cannot say what it requires.
Sharing & Disclosure · Company practice
Reservations with Hilton Principal: BRE Hotels & Resorts receives booking information from US guests
Hilton says that if a guest who lives in the United States makes a reservation at the Waldorf Astoria Grand Wailea, it will provide BRE Hotels & Resorts, the hotel's owner, described as 'Hilton Principal', with the booking information. BRE may process the personal information in accordance with its privacy policy and as permitted by applicable law. The Statement points to BRE's privacy policy, a document that is not supplied in this source.
Supporting quotations
Reservations with Hilton Principal
If you are a guest who lives in the United States, when you make a reservation at the Waldorf Astoria Grand Wailea, Hilton will provide BRE Hotels & Resorts (or “Hilton Principal”), the hotel’s owner, with your booking information.
BRE may process your personal information in accordance with its privacy policy and as permitted by applicable law.
Qualifications & exceptions
The disclosure is stated for guests who live in the United States.
BRE's own processing is governed by its privacy policy, which is not reproduced here.
Not stated here
The linked BRE Hotels & Resorts privacy policy is not supplied in this source, so this card cannot say what it requires.
Sharing & Disclosure · Company practice
Reservations with Select by Hilton: YOTEL receives booking information
Hilton says that when a guest makes a reservation with YOTEL through a Hilton channel, it will provide YOTEL with the booking information, and that YOTEL may process the personal information in accordance with its privacy policy and as permitted by applicable law. The Statement points to YOTEL's privacy policy, a document that is not supplied in this source.
Supporting quotations
Reservations with Select by Hilton
YOTEL: When you make a reservation with YOTEL through a Hilton channel, Hilton will provide YOTEL with your booking information.
YOTEL may process your personal information in accordance with its privacy policy and as permitted by applicable law.
Qualifications & exceptions
YOTEL's own processing is governed by its privacy policy, which is not reproduced here.
Not stated here
The linked YOTEL privacy policy is not supplied in this source, so this card cannot say what it requires.
Sharing & Disclosure · Company practice
International transfers: sharing across the Portfolio, and transfer of reservation data to the United States
Hilton describes itself as a global company that seeks to provide the same level of service whether the guest is in San Francisco, London or Tokyo, and says the guest acknowledges that personal information may be shared among members of the Hilton Portfolio of Brands, its service providers and other third parties, which may be located in countries outside the guest's own. It says that when a guest stays at a Hilton property outside the United States, the data controller for that property transfers the personal information relating to the reservation to Hilton in the United States pursuant to data transfer agreements where applicable laws or regulations require them; that controller may also keep a local copy of the personal information, which in some cases the applicable law requires; and that although data protection laws differ between countries, Hilton will take appropriate steps to ensure the information is handled as described in this Statement and in accordance with the law.
Supporting quotations
8. International Transfers
As a global company, we endeavor to provide you with the same level of service that you have come to expect at Hilton whether you are in San Francisco, London or Tokyo.
you acknowledge that we may share your personal information among members of the Hilton Portfolio of Brands, our service providers, and other third parties, which may be located in countries outside of your own.
When you stay at a Hilton property outside the United States, the data controller for that property transfers the personal information relating to your reservation to Hilton in the United States pursuant to data transfer agreements when required by applicable laws or regulations.
The data controller may also maintain a local copy of your personal information, and in some cases this is required by applicable laws or regulations.
we will take appropriate steps to ensure that your personal information is handled as described in this Statement and in accordance with the law.
Qualifications & exceptions
Recipients may be located outside the guest's own country, and the sharing is acknowledged rather than presented as a unilateral choice.
The transfer to the United States is stated to be pursuant to data transfer agreements only where applicable law or regulation requires them.
A local copy of the personal information may be kept by the property's controller, in some cases because the law requires it.
The safeguard is stated as 'appropriate steps' to handle the information as described and in accordance with the law.
Sharing & Disclosure · Company practice
Appendix A: international transfers of personal information, to the United States, with safeguards
In the Appendix A rights, Hilton states that it may transfer the personal information it collects to countries that have not been found to provide adequate protection of data under a country-specific law, and in particular that it transfers personal information to the United States. It says it uses appropriate safeguards for transfers among its affiliates in various jurisdictions and, where required, has implemented data transfer agreements, such as the European Commission standard contractual clauses or similar safeguards, and that a copy of the clauses or further information on transfers can be requested at privacy@hilton.com.
Supporting quotations
International Data Transfers: We may transfer the personal information we collect about you pursuant to the purposes described in this Statement to countries that have not been found to provide adequate protection of data pursuant to a country-specific law.
In particular, we transfer your personal information to the United States.
We use appropriate safeguards for the transfer of personal information among our affiliates in various jurisdictions, and where required, we have implemented data transfer agreements, such as the European Commission standard contractual clauses or other similar safeguards for such purposes.
To obtain a copy of theses clauses or additional information on transfers, you may send your request to privacy@hilton.com
Qualifications & exceptions
The transfer to the United States is stated as a fact, not as a possibility.
Data transfer agreements are stated to be implemented where required.
The safeguards are described as appropriate safeguards, and the clauses as the European Commission standard contractual clauses 'or other similar safeguards'.
Sharing & Disclosure · Company practice
California: the categories shared for targeted advertising, which may constitute a sale
Hilton states that it engages in targeted, or cross-context behavioural, advertising on its services or on other sites and when it advertises its services elsewhere, and that in connection with such advertising it may share categories of information with advertising networks and providers, advertisers and social media networks, which may be considered a sale under California law and is the processing of personal information for targeted advertising. The categories listed are device information and identifiers such as IP address, unique advertising identifiers and cookies; hashed identifiers such as contact information; usage information such as browsing history or app usage; location information such as city; and inference data.
Supporting quotations
Sale or Sharing of Personal Information
We engage in targeted (or cross context behavioral) advertising on our services or on other sites and when we advertise our services elsewhere.
we may share the following categories of information with advertising networks and providers, advertisers, and social media networks, which may be considered a sale under California law and is the processing of personal information for targeted advertising: device information and identifiers, such as IP address, and unique advertising identifiers and cookies; hashed identifiers such as contact information, usage information, such as browsing history or app usage; location information, such as city; and inference data.
Qualifications & exceptions
The sharing 'may be considered a sale under California law' and is the processing for targeted advertising.
The category list includes hashed contact information, not contact information itself.
Sharing & Disclosure · Company practice
China: arrival time — sharing with service providers
The China appendix's arrival time entry states that the information was shared with service providers who perform tasks on behalf of Hilton. The sources and purposes for arrival time are set out in the preceding part of the appendix.
Supporting quotations
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton
Sharing & Disclosure · Company practice
China: who personal information may be shared with, with express consent where required
The China appendix says that with the person's express consent where required, Hilton may share their personal information for the purposes described in the Statement with members of the Hilton worldwide brand portfolio, its service providers and other third parties as follows: Hilton Worldwide Holdings Inc. and its subsidiaries and members of the Hilton brand portfolio, including franchised and managed hotels; service providers providing services on Hilton's behalf; payment card providers and processors; employers specified in the company agreements; and advertising networks and analytics providers for Hilton's website and mobile applications. The sharing is framed as conditioned on express consent where required.
Supporting quotations
3. Entrusted Processing, Sharing, Transfer, and Disclosure of Personal Information
With your express consent, where required, we may share your personal information for the purposes described in this Statement with members of the Hilton worldwide brand portfolio, our service providers, and other third parties as follows:
Hilton Worldwide Holdings Inc. and its subsidiaries, and members of the Hilton brand portfolio, including franchised and managed hotels,
Service providers providing services on Hilton’s behalf,
Payment card providers and processors
Employers specified in the company agreements,
Advertising networks and analytics providers for Hilton’s website and mobile applications.
Qualifications & exceptions
The express consent requirement applies 'where required'.
The listed recipients are categories, including franchised and managed hotels.
Sharing & Disclosure · Company practice
China: Portfolio brands' own processing is governed by the Statement, and third-party controllers apply their own
The China appendix states that the processing of personal information by members of the Hilton Portfolio of Brands, including purposes and means of processing and the categories of personal information processed, is governed by the Statement, and points to the Data Protection Office for the contact information of other entities that may receive the personal data. It adds that some of the third parties listed may also process the personal information for their own purposes as data controllers, in which case their own privacy policies apply, including as to purposes, means of processing and categories processed.
Supporting quotations
The processing of your personal information by members of the Hilton Portfolio of Brands, including purposes and means of processing and categories of personal information processed, is governed by this Statement.
Please refer to the Data Protection Office at dataprotectionoffice@hilton.com
Some of the third parties listed above may also process your personal information for their own purposes as data controllers, in which case their own privacy policies will apply, including as to the purposes and means of processing and categories of personal information processed.
Qualifications & exceptions
Where a listed third party acts as a controller for its own purposes, that party's own privacy policies apply instead.
The contact route for the other recipients is the Data Protection Office.
Sharing & Disclosure · Company practice
China: sharing with third parties for media campaigns, with their own privacy policies
The China appendix says that to optimize media campaigns Hilton may share personal information with partners and other third parties, and that it then lists the third parties with whom it currently cooperates, their names, the types of personal information collected and the purposes of collection and use. It directs readers to those third parties' own privacy policies for details of their collection and processing.
Supporting quotations
3.2 Sharing Your Personal Information with Third-Parties
To optimize media campaigns, we may share your personal information with partners and other third parties.
For details regarding the collection and processing of your personal information by the following third parties, please refer to the privacy policies of such third parties.
Qualifications & exceptions
The stated purpose of the sharing is to optimize media campaigns.
The list covers third parties with whom Hilton currently cooperates.
The third parties' own privacy policies govern their collection and processing.
Sharing & Disclosure · Company practice
China: Shenzhen Tencent — media campaign sharing of hashed phone numbers and WeChat Union ID
The China appendix names Shenzhen Tencent Computer Systems Company Limited as a third party with which Hilton cooperates. The purpose of the personal information processing is to optimize media campaigns, and the method is sharing personal information with third-party advertising platforms through backend API integrations — such as hashed or encrypted mobile phone numbers and the WeChat Union ID — to recommend or display content, products or services that may be relevant to users based on their personal information and preferences. The types shared are the hashed mobile phone number and the WeChat Union ID, and the contact given for the third party is ads_service@tencent.com.
Supporting quotations
Shenzhen Tencent Computer Systems Company Limited
Purpose of personal information processing
Optimize media campaigns
Method of personal information processing
Share personal information with third-party advertising platforms through backend API integrations (such as hashed/encrypted mobile phone numbers, WeChat Union ID) to recommend or display content, products, or services that may be relevant to users based on their personal information and preferences.
Types of personal information shared with third party
Hashed mobile phone number
WeChat Union ID
Contact of third party
ads_service@tencent.com
Qualifications & exceptions
The phone number is described as hashed or encrypted when shared.
The stated purpose of the sharing is to recommend or display content, products or services relevant to the user.
Sharing & Disclosure · Company practice
China: co-branded membership programmes and the sharing of the Honors number
The China appendix states that Hilton may also collaborate with certain third-party partners to offer co-branded membership programmes, and that where the person chooses to take part, Hilton and the relevant partner may independently process their personal information. It says Hilton may share the person's Hilton Honors number with the relevant partner to link the membership accounts and to provide, operate and administer the applicable co-branded membership programme and related benefits.
Supporting quotations
We may also collaborate with certain third-party partners to offer co-branded membership programs.
Where you choose to participate in such programs, we and the relevant partner may independently process your personal information.
We may share your Hilton Honors number with the relevant partner to link your membership accounts and to provide, operate, and administer the applicable co-branded membership program and related benefits.
Qualifications & exceptions
Participation is voluntary: the sharing happens where the person chooses to participate.
The partner may process the person's information independently, as its own controller.
What is shared is the Hilton Honors number.
Sharing & Disclosure · Company practice
China: transfer of personal information to third parties with consent and safeguards
Section 3.4 of the China appendix says that with the person's consent, Hilton may transfer their personal information to third parties for the purposes described in the Statement, and that before any such transfer it will ensure that appropriate notice and safeguards are in place. The transfer is thus stated as consent-based and as preceded by notice and safeguards.
Supporting quotations
3.4 Transfer of Personal Information
With your consent, we may transfer your personal information to third parties for the purposes as described in this Statement.
Prior to the transfer of your personal information, we will ensure that appropriate notice and safeguards are in place.
Qualifications & exceptions
The transfer is stated to be on the basis of consent.
Appropriate notice and safeguards are stated to be in place before the transfer.
Sharing & Disclosure · Company practice
China: disclosure of personal information to third parties for five stated reasons
Section 3.5 of the China appendix says that despite the other situations described, Hilton may disclose personal information to third parties in order to: comply with applicable laws or effective legal procedures; respond to enquiries of governments or to requests of public or government authorities; protect the rights, privacy, security or property of Hilton, site visitors, guests, employees or the public; pursue or exercise Hilton's own rights; or respond to emergencies. The grounds include protecting Hilton's own rights and property, not only others'.
Supporting quotations
3.5 Disclosure of Personal Information
Despite the above situations, we may disclose personal information to third parties to: comply with applicable laws or effective legal procedures; respond to enquiries of the governments or requests of the public and/or the government authorities; protect rights, privacy, security or property of Hilton, site visitors, guests, employees or the public; pursue or exercise our rights; or respond to emergencies.
Qualifications & exceptions
The disclosure is stated to apply despite the other situations described in the appendix.
One ground is pursuing or exercising Hilton's own rights.
Sharing & Disclosure · User right or choice
China: targeted advertising with third parties, and the opt-out
The China appendix says Hilton cooperates with third parties to serve targeted advertising based on a person's online activities across different websites, mobile applications and devices over time, and that the advertising partners may collect information about the person's activities related to Hilton's services on their current device and combine it with information about their activities on other websites, mobile applications and devices, using server logs, cookies, web beacons, tags, pixels, mobile advertising IDs, cross-device linking and similar technologies, and that this may include the person's personal information. It says the person can opt out of interest-based advertising and cross-device linking in the current browser or the mobile apps on the device, and that Hilton does not currently respond to 'do not track' signals, referring to the main body of the Statement for more information.
Supporting quotations
5. Analytics and Interest-Based Advertisements
We also cooperate with third parties to serve targeted advertising based on your online activities across different websites, mobile applications, and devices over time.
They may collect this information using server logs, cookies, web beacons, tags, pixels, mobile advertising IDs, cross-device linking and similar technologies. This may include your personal information.
You can opt out of interest-based advertising and cross-device linking in the current browser or the web browsers and mobile apps on your device.
We do not currently respond to "do not track" signals.
Qualifications & exceptions
The cross-device combination 'may include your personal information'.
The opt-out is available in the current browser or the mobile apps on the device.
Do Not Track signals are not responded to, consistently with the main body.
Sharing & Disclosure · Restriction or exception
China: Hilton is not responsible for third-party websites and applications
The China appendix states that Hilton is not responsible for the collection, use, disclosure or other processing of personal information by third-party websites or applications, and asks readers to read those sites' privacy policies and terms of use. It says this applies to three situations: in-hotel internet services it may offer; third-party websites and applications to which links in its own sites and mobile applications may lead; and third-party digital messaging applications or platforms it uses to communicate with the person.
Supporting quotations
We are not responsible for the collection, use, disclosure, or otherwise processing of personal information by our third-party websites or applications.
This applies to: (1) in-hotel internet services we may offer; (2) third-party websites and applications to which the links in our websites and mobile applications may direct; and (3) third-party digital messaging applications or platforms which we use to communicate with you.
Qualifications & exceptions
The exclusion covers three named situations, including in-hotel internet services.
The reader is directed to the third party's own policies for that processing.
Sharing & Disclosure · Company practice
China: transfers outside China, to the global reservation system in the United States
The China appendix says that as Hilton operates globally, with the person's express consent where required, it may transfer personal information — including sensitive personal information where applicable — to jurisdictions outside China, including the United States, Europe and other jurisdictions where Hilton, its service providers and other third parties conduct business. It says the information may in particular be transferred to Hilton Domestic Operating Company Inc. for storage and processing in accordance with the Statement via Hilton's global centralized reservation system, which is deployed in the United States, and that information in that system may be further transferred to properties in different countries according to the person's reservations, with the Data Protection Office named as the contact for the other entities that may receive the information. It adds that Hilton will take appropriate steps to protect the integrity and confidentiality of the information and ensure it is processed in accordance with the main body of the Statement and applicable law.
Supporting quotations
8. International Transfers of Personal Information
As Hilton operates globally, with your express consent where required, we may transfer your personal information (including your sensitive personal information, if applicable) to jurisdictions outside of China, including United States, Europe, and other jurisdictions where we, our service providers, and other relevant third parties conduct business.
your personal information may be transferred to Hilton Domestic Operating Company Inc. for storage and processing in accordance with this Statement via Hilton's global centralized reservation system, which is deployed in the United States.
The personal information stored in Hilton's global centralized reservation system may be further transferred to properties in different countries based on your reservations in accordance with this Statement.
We will take appropriate steps to protect the integrity and confidentiality of your information and to ensure that your personal information is processed in accordance with the main body of this Statement and in accordance with the applicable laws.
Qualifications & exceptions
The transfer is stated as conditional on express consent where required.
The central destination is the global centralized reservation system deployed in the United States, and information may then move to properties in other countries.
The safeguard is stated as appropriate steps protecting integrity and confidentiality.
Sharing & Disclosure · Company practice
Brazil: how transfers out of Brazil are managed
The Brazil appendix says that where information originating in Brazil is transferred to a country outside Brazil, it will take steps to make sure the transfer is carefully managed to protect privacy rights. It describes three routes: transfers within the Hilton Group of Companies may be covered by an intra-group agreement that contractually obliges each member to ensure an adequate and consistent level of protection wherever the information is transferred within Hilton in accordance with the LGPD; transfers outside the group, including to service providers, are covered by contractual commitments and assurances such as standard contractual clauses or binding corporate rules, and in the absence of instructions from the local supervisory authority Hilton may follow the standard models adopted under European Union or other competent authorities' models; and Hilton may also transfer to countries recognised as providing an adequate level of legal protection, or where it is satisfied alternative arrangements are in place. It invites requests for the specific mechanism used.
Supporting quotations
3. International Transfers
Where we transfer information that originates in Brazil to a country outside of Brazil, we will take steps to make sure such transfer is carefully managed to protect your privacy rights:
transfers within the Hilton Group of Companies may be covered by an agreement entered into by members of Hilton (an intra-group agreement) which contractually obliges each member to ensure that your information receives an adequate and consistent level of protection wherever it is transferred within Hilton in accordance with the LGPD;
where we transfer your data outside of the Hilton Group of Companies, including to other companies providing us with a service, we will obtain contractual commitments and assurances from them to protect your information, such as standard contractual clauses or binding corporate rules.
In the lack of instructions from the local supervisory authority, we may follow the standard models adopted under the European Union or by other competent authorities until then;
we are also able to transfer personal information to countries which are recognized as providing an adequate level of legal protection or where we can be satisfied that alternative arrangements are in place to protect your privacy rights; and
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of Brazil.
Qualifications & exceptions
Intra-group transfers rest on an intra-group agreement; transfers outside the group rest on contractual commitments and assurances.
The standard models used pending local supervisory authority instructions are the European Union's or other competent authorities' models.
Transfer to adequacy-recognised countries is also stated as available.
Sharing & Disclosure · Company practice
Monaco: transfers to affiliates outside Monaco and the transfer authorization form
The Monaco appendix states that Hilton is required to transfer personal data to its affiliates outside the Principality of Monaco, which includes Hilton Domestic Operating Company Inc. and its in-country suppliers, all resident in the United States, in order to complete reservations, process Hilton Honors memberships and conduct promotion activities through a website whose servers are located abroad. It adds that where a subcontractor or partner is located in a country not recognised as offering an adequate level of protection under Act No. 1.054 — which it says is the case for the United States — Hilton must fulfil a transfer authorization form to comply with the act's requirements, and the subcontractors should ensure satisfactory protection of the personal data.
Supporting quotations
4. International Transfers of Personal Data
Hilton is required to transfer your personal data to its affiliates outside of the Principality of Monaco which includes Hilton Domestic Operating Company Inc., all resident in the United States, as well as their in-country suppliers, in order to complete reservations, process Hilton Honors memberships and conduct promotion activities through its website, whose servers are located abroad.
When a subcontractor or partner is located in a country that has not been recognized as having an adequate level of protection as the one offered by Act No. 1.054 (which is the case for the United States), Hilton must fulfill a transfer authorization form in order to comply with Act No. 1.054’s own requirements on the security and privacy of personal data and the subcontractors should ensure a satisfactory protection of your personal data.
Qualifications & exceptions
The United States is stated not to be recognised as offering an adequate level of protection under Act No. 1.054.
The transfer authorization form is Hilton's own compliance step; protection is also stated as something subcontractors should ensure.
Sharing & Disclosure · Company practice
Nigeria: transfers to third parties and safeguards on transfer outside Nigeria
The Nigeria appendix says Hilton may transfer personal information to third parties, including entities within the Hilton group and external service providers, for the purposes described in the Statement, and that when transferring personal information outside Nigeria it ensures appropriate safeguards are in place in accordance with the NDPA.
Supporting quotations
3. Data Transfer and Sharing
We may transfer your personal information to third parties, including entities within the Hilton group and external service providers, for the purposes described in this Privacy Statement.
When transferring personal information outside Nigeria, we ensure that appropriate safeguards are in place to protect your data in accordance with the NDPA.
Qualifications & exceptions
Recipients include entities within the Hilton group as well as external service providers.
Safeguards are stated for transfers outside Nigeria.
Sharing & Disclosure · Company practice
Korea: transfer of personal information outside Korea to the United States with consent
The Korea appendix states that with the person's consent, Hilton will collect, process and transfer their personal information outside Korea to the United States, as necessary to fulfil their bookings and enable them to participate in the Hilton Honors programme. The transfer is stated as the destination being the United States and as requiring consent.
Supporting quotations
4. International Transfers of Personal Information
With your consent, we will collect, process, and transfer your personal information outside of Korea to the United States, as necessary to fulfill your bookings and enable you to participate in the Hilton Honors program.
Qualifications & exceptions
The transfer is stated to require the person's consent.
The stated purpose is fulfilling bookings and enabling participation in the loyalty programme.
Sharing & Disclosure · Company practice
Mexico: personal information shared with Invex for telemarketing on the co-brand card
The Mexico appendix says that a person based in Mexico may have the following personal information shared with Invex, a third party that provides telemarketing services on behalf of the Hilton/Invex co-brand card: the Honors number, Honors loyalty tier, first name, last name, email address, phone number, co-brand card participation yes or no, last stay date and next stay date. It says a person may opt out of receiving telemarketing calls at any time by following the instructions in Invex's privacy statement, which is linked from the appendix and is not supplied in this source.
Supporting quotations
Appendix A-11: Mexico Residents
If you are based in Mexico, we may share the following personal information with Invex, a third party that provides telemarketing services on behalf of the Hilton/Invex co-brand credit card:
Honors Number
Honors Loyalty Tier
First Name
Last Name
Email Address
Phone Number
Co-Brand Card Participation (Y/N)
Last Stay Date
Next Stay Date
You may opt out of receiving telemarketing calls at any time by following the instructions provided in Invex’s privacy statement
Qualifications & exceptions
The sharing is to Invex, on behalf of the Hilton/Invex co-brand card, for telemarketing services.
The opt-out runs through Invex's own instructions, not through Hilton's Data Protection Office.
The co-brand card participation item is recorded as a yes or no.
Not stated here
The linked Invex privacy statement is not supplied in this source, so this card cannot say what it provides or requires.
Sharing & Disclosure · Company practice
HPCJ: member number — additional third parties shared with
The Appendix B states that the HPCJ member number is shared with the following additional categories of third parties: payment card issuers and payment processors; Hilton's Third-Party Partner; service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on Hilton's behalf; employers pursuant to corporate agreements, employee consent and as permitted by law; entities that have arranged a special rate plan with Hilton and/or organized an event or room block with Hilton; government agencies pursuant to legal requirements in some countries; third-party advertisers, for optimization and personalization on their platforms; and Hilton's Third-Party Operator.
Supporting quotations
We have shared this personal information with the following additional categories of third parties
Payment card issuers and payment processors
Hilton's Third-Party Partner
Service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on our behalf
Employers pursuant to corporate agreements, employee consent, and as permitted by law
Entities that have arranged a special rate plan with Hilton and/or organized an event and/or room block with Hilton
Government agencies pursuant to legal requirements in some countries
Third-party advertisers, for optimization and personalization on their platforms
Hilton’s Third-Party Operator
Qualifications & exceptions
The sharing is stated as additional to the sharing described in the rest of the Statement.
Employer and government sharing are qualified by corporate agreements, employee consent, the law and 'some countries'.